Latest cybersecurity reporting from selected sources.

State Insurance Officials Seeking Details About Service Firm's Mega Data BreachMissouri regulators are widening their investigation into the 204 hacking incident at Conduent Business Services, alleging that the company has stonewalled the state's attempts to obtain information about the data breach, which is estimated to affect more than 25 million people nationwide.

Will the Back-Office Services' Firm Incident Shatter US Data Breach Records?The Texas attorney general office has launched an investigation into the Conduent Business Services hacking incident, which affected about 15.5 million Texans, including about 4 million Blue Cross Blue Shield of Texas members. Will the nationwide victim tally shatter data breach records in the U.S.?

Seoul Accuses E-Commerce Giant of 'Self-Investigation,' Impeding Government ProbeSouth Korea's data protection watchdog told e-commerce giant Coupang to stop publishing its "self-investigation" findings into a massive data breach and demanded the interim CEO, a U.S. citizen, return to the country to meet with a police - drawing criticism from U.S. Republican lawmakers.

Also, Envoy Air Confirms Data Compromise Following Clop Extortion CampaignThis week, Qilin didn't hack a Spanish tax agency, Nexperia standoff, Envoy Air confirmed a data compromise, Experian Netherlands fined 2.7M euros, ToolShell used to breach global networks, flaws in TP-Link Omada and Festa VPN routers and a New York firm settled a cybersecurity investigation.

Settlement Includes Corrective Action Plan Focused on Improving Risk AnalysisAn investigation into a ransomware breach reported in 2020 as affecting the protected personal information of 170,000 people led to a $175,000 fine against a certified public accounting and consulting firm. Regulators also required the company to implement a corrective action plan in the settlement.

2021 Pysa Hack Compromised PHI of Nearly 25,000 PatientsA HIPAA breach investigation into a 2021 attack involving a variant of Pysa ransomware resulted in a $250,000 fine for an upstate New York specialty surgery practice, which also agreed to a corrective action plan that will be monitored by federal regulators for the next two years.

2021 Pysa Hack Compromised PHI of Nearly 25,000 PatientsA HIPAA breach investigation into a 2021 attack involving a variant of Pysa ransomware resulted in a $250,000 fine for an upstate New York specialty surgery practice, which also agreed to a corrective action plan that will be monitored by federal regulators for the next two years.

United Natural Foods, Inc. Launches Investigation, Confirms IT Systems BreachA cyberattack on United Natural Foods, the largest U.S. health food distributor and a key Whole Foods supplier, has disrupted the company's fulfillment operations, prompting a notification to law enforcement and a forensic investigation as it works to restore affected systems.

Also: Iberian Blackout, Delta Faces Lawsuit Linked to CrowdStrike OutageEvery week, ISMG rounds up cybersecurity incidents and breaches around the world. This week: Mirai Botnet Exploits Flaws in GeoVision, the Iberian blackout under investigation, dueling cybersecurity advisories from India and Pakistan, Delta must face a lawsuit linked to CrowdStrike outage.

Enforcement Action Is Latest Under Agency's Ransomware, Risk Analysis InitiativesFederal regulators fined a New York neurology practice $25,000 following an investigation into a 2020 ransomware breach affecting nearly 7,000 individuals. Comprehensive Neurology failed to conduct an accurate and thorough risk analysis, regulators said.

2019 Phishing Incident at California-Based PIH Health Affected Nearly 190,000A regional healthcare network with three California hospitals serving Los Angeles and Orange Counties has agreed to pay federal regulators $600,000 and implement a corrective action plan to resolve potential HIPAA violations identified during an investigation into a 2019 phishing breach.

Also, a 'Perfect Tool' for Cyberespionage and EU Stocks Up on Burner PhonesThis week, the cyber insurance market could double, Europe to use burner phones in the U.S., a BPFDoor campaign, "Alcasec" faces Spanish prison, a Thai harassment campaign and charges in Taiwan for a Chinese captain. China stonewalled a Swedish cable cutting investigation. 4Chan image board hacked.

Why MFA and Data Minimization Remain Key for Preventing Massive Data BreachesWhile PowerSchool's investigation into the massive theft of its customers' data is continuing, clear lessons have already emerged. Count among them the importance of using multi-factor authentication, which could have safeguarded access to PowerSchool's exploited customer support systems.

7 Texas Health and Human Services Workers Fired in Incident Affecting 61,000 peopleAuthorities in Texas are investigating an insider incident at the Texas Health and Human Services Commission that led to the firing of seven employees, an investigation into hundreds of thousands of dollars in stolen funds and notification of a breach of personal information affecting 61,000 people.

Cases are Latest in a Spate of HIPAA Settlements As Biden Administration Wraps UpA medical supply firm will pay $3 million to settle issues found by a HIPAA investigation into a breach. Also, a public health system will pay $60,000 to resolve a right-of-access dispute. The cases are among the latest in a spate of HIPAA enforcement actions as the Biden administration wraps up.

Company Probing Customers Affected After Attacker Claims 400 Gigabyte Data TheftFinancial technology firm Finastra is warning customers that it suffered a breach of a secure file transfer system that it uses to relay information to some customers, leading to an unknown quantity of data being exfiltrated by an attacker. The company is still identifying affected customers.

Top Tier Capital, HarbourVest Support Concentric's Path to Autonomous Data SecuritySupported by Top Tier Capital Partners and HarbourVest Partners, Concentric AI’s $45 million Series B funding round will drive product innovation in identity governance, risk monitoring and data breach investigation - critical areas for enterprises seeking resilient data security solutions.

Perry Johnson & Associates' 2023 Data Theft Breach Affected About 14 MillionThe 2023 hack at medical transcription firm Perry Johnson & Associates, which affected dozens of clients and about 14 million individuals, triggered the largest health data breach reported to regulators last year. Now the incident appears to be under federal criminal investigation.

6.9 Million Individuals' Genetic Details Stolen via 2023 Credential-Stuffing AttackPrivacy regulators in the U.K. and Canada have launched a joint investigation into 23andMe following the direct-to-consumer genetic testing service suffering a massive data breach in October 2023 that led to the theft of 6.9 million individuals' ancestry details.

Class Action Law Firms Seek Access to Commissioned Deloitte Report Into Mega-BreachThe Federal Court of Australia has rejected a request from telecommunications giant Optus to keep private a detailed digital forensic investigation report conducted by Deloitte into the massive data breach it suffered in 2022, exposing private information pertaining to nearly 10 million customers.