Latest cybersecurity reporting from selected sources.

An On Demand video from ID DatawebScattered Spider continues to evolve, and organizations across financial services, healthcare, insurance, telecommunications, and other sectors are strengthening defenses against increasingly sophisticated identity-driven threats.

Also, Eurail Breach, ChipSoft Hospital Disruptions, W3LL Phishing TakedownThis week, a "Raccoon"-linked actor hit help desks, Eurail exposed 308K users, Fortinet patched critical flaws, Pushpaganda scams, major data leaks hit healthcare and China, ransomware and phishing ops surged, and multiple breaches impacted firms and hospitals.

Market Pressures Are Rewarding Storytelling More Than Validation, Operational ValueThe fall of health tech company Theranos exposed how hype can outpace reality. In cybersecurity, similar pressures are emerging as vendors compete with bold claims and buyers struggle to verify outcomes. The result: a market where narrative can overshadow measurable operational value.

Mapping Platform Exposed Addresses and Medical Assistance PlansThe Illinois Department of Human Services is notifying more than 700,000 individuals of a breach involving "incorrect privacy settings" left in place for several year that exposed online data pertaining to Medicare, Medicaid and rehabilitation services recipients.

Healthcare sector mergers and acquisitions dramatically amplify cybersecurity and data privacy exposure for potential buyers and sellers, said attorney Jonian Rafti of law firm Proskauer. But there are critical steps entities can take to reduce those risks, he said.

National Accident Health Says Breach Exposed Medical Info of 181,000 PeopleA Maine-based third-party administrator that handles healthcare claims involving day care centers, youth sports and NCAA athlete accidents is notifying more than 181,000 individuals that their medical information and personal identifiers may have been accessed or stolen in a hacking incident.

Data of Nearly 470,000 Patients and Employees May Have Been Leaked on Dark WebOmni Family Health, a California nonprofit network of community health centers, has agreed to pay $6.5 million to settle proposed class action lawsuits related to a 2024 hack that may have exposed the personal information of nearly 470,000 current and former patients and employees on the dark web.

Default credentials, weak passwords, misconfigurations and a variety of other security shortcomings are exposing millions of medical devices and their data on the internet, said Soufian El Yadmani, CEO and co-founder of Modat, who shared recent research findings.

Researcher Finds Database of Sensitive Patient Info With No Password ProtectionAn unencrypted database containing nearly 150,000 patient records of a California provider of home health and palliative care services was left exposed on the internet, said a cybersecurity researcher who discovered the unsecured data cache. Why does this keep happening in the healthcare sector?

Default credentials, weak passwords, misconfigurations and a variety of other security shortcomings are exposing millions of medical devices and their data on the internet, said Soufian El Yadmani, CEO and co-founder of Modat, who shared recent research findings.

Suits Filed After Researcher Found 1 Million Patient Records With No Password SetupAn Ohio firm that assists individuals in obtaining physician-certified medical marijuana cards is facing at least six proposed federal class action lawsuits so far involving the recent discovery by a security researcher of a database exposing nearly one million sensitive patient records on the web.

Personal Data Stolen in Ransomware Hit, Says Dutch Owner of Stop & Shop, Giant FoodFood retail giant Ahold Delhaize USA is notifying 2.2 million current and former employees, as well as an unspecified number of employees in the Netherlands, that a November 2024 data breach exposed their personally identifiable information, including Social Security numbers and medical details.

Australian Human Rights Commission Detected Leak of 670 Online Forms After a MonthThe Australian Human Rights Commission said unprotected online complaint forms exposed the personal, healthcare and demographic information of Australians to the public internet for over a month. The data leak exposed 670 complaints and nominations online.

Serviceaide Incident Exposed Patient Data of Catholic Health, a NY-Based ClientServiceaide, a provider of agentic AI-based IT management and workflow software, reported to regulators that an inadvertent exposure of data on the web has affected more than 483,000 patients of client Catholic Health, a network of six hospitals and dozens of other facilities in western New York.

SolarWinds CISO Tim Brown's Case Shows Personal, Legal and Health Risks for CISOsCISOs face tremendous stress in dealing with regulatory scrutiny and legal exposure in the wake of a data breach. SolarWinds CISO Tim Brown shares the personal and professional impact of Securities and Exchange Commission charges against him after the 2020 SolarWinds supply chain attack.

UK ICO Says Advanced's Security Measures 'Fell Seriously Short'A British IT service company must pay a 3.07 million pound fine for a 2022 ransomware hack that exposed medical records of tens of thousands of National Health Service patients. Hackers breached the Advanced system through a user account that did not have multifactor authentication in place.

Researcher Found Unsecured Database Server Containing 1,864 GB of OrthoMinds' DataAn orthodontic practice software vendor is notifying an undisclosed number of patients that their data was exposed to the internet for 10 days last November. The security researcher who discovered the data leak said the incident appears to have lasted longer and affected more than 200,000 patients.

Researcher Says Firm Failed to Secure Sensitive Health Data From Survey FormsAn unsecured database containing 2 terabytes of data allegedly exposed more than 1.6 million clinical research records to the internet, including sensitive personal and medical information of patients, said the security researcher who discovered the lapse. Why does this keep happening?

American Addiction Centers Says 422,424 Individuals' Private Details ExposedSubstance abuse treatment company American Addiction Centers is warning nearly half a million patients that ransomware-wielding attackers stole their personal details, including names and Social Security numbers. The Rhysida ransomware operation claimed to perpetrate the attack.

Inmediata Health Group Has Paid $2.7M in Fines, Civil Claims for 2019 HIPAA BreachA breach that exposed the personal information of nearly 1.6 million patients of a Puerto Rico-based clearinghouse has led to a $250,000 financial settlement with federal regulations for multiple HIPAA violations. The 2019 leak has cost Inmediata Health $2.7 million in fines and civil settlements.