Latest cybersecurity reporting from selected sources.

Also, Envoy Air Confirms Data Compromise Following Clop Extortion CampaignThis week, Qilin didn't hack a Spanish tax agency, Nexperia standoff, Envoy Air confirmed a data compromise, Experian Netherlands fined 2.7M euros, ToolShell used to breach global networks, flaws in TP-Link Omada and Festa VPN routers and a New York firm settled a cybersecurity investigation.

Settlement Includes Corrective Action Plan Focused on Improving Risk AnalysisAn investigation into a ransomware breach reported in 2020 as affecting the protected personal information of 170,000 people led to a $175,000 fine against a certified public accounting and consulting firm. Regulators also required the company to implement a corrective action plan in the settlement.

2021 Pysa Hack Compromised PHI of Nearly 25,000 PatientsA HIPAA breach investigation into a 2021 attack involving a variant of Pysa ransomware resulted in a $250,000 fine for an upstate New York specialty surgery practice, which also agreed to a corrective action plan that will be monitored by federal regulators for the next two years.

2021 Pysa Hack Compromised PHI of Nearly 25,000 PatientsA HIPAA breach investigation into a 2021 attack involving a variant of Pysa ransomware resulted in a $250,000 fine for an upstate New York specialty surgery practice, which also agreed to a corrective action plan that will be monitored by federal regulators for the next two years.

Settlement Follows Federal Investigation Into Data Leak and Ransomware AttackA Texas mental healthcare provider's failure to conduct a comprehensive risk analysis resulted in a $225,000 federal fine after regulators investigated a data leak followed by a ransomware attack in 2023. Deer Oaks Behavioral Health also must implement a corrective action plan.

Enforcement Action Is Latest Under Agency's Ransomware, Risk Analysis InitiativesFederal regulators fined a New York neurology practice $25,000 following an investigation into a 2020 ransomware breach affecting nearly 7,000 individuals. Comprehensive Neurology failed to conduct an accurate and thorough risk analysis, regulators said.

Cases are Latest in a Spate of HIPAA Settlements As Biden Administration Wraps UpA medical supply firm will pay $3 million to settle issues found by a HIPAA investigation into a breach. Also, a public health system will pay $60,000 to resolve a right-of-access dispute. The cases are among the latest in a spate of HIPAA enforcement actions as the Biden administration wraps up.

NY AG Action and $1M Fine Follow Back-to-Back Hacks That Affected 224,500 in 2023An upstate New York-based medical practice must spend $2.25 million to improve its data security practices over the next five years, plus pay state regulators up to a $1 million fine following an investigation into two ransomware attacks days apart in 2023 that affected nearly 224,500 people.

Nonprofit Group Hit 3 Times in 3 Weeks in 2018, Affecting PHI of 85,000 PatientsFederal regulators have hit a California physician services organization with a $240,000 HIPAA civil penalty following an investigation into three ransomware attacks that occurred within a three-week span in early 2018, compromising the sensitive information of 85,000 patients.

Fine Is For 2019 Disclosure That Meta Stored User Passwords In PlaintextThe Irish data regulator fined social media giant Meta 91 million euros after an investigation found the company insecurely stored passwords of millions of European Facebook and Instagram users. A Meta spokesperson said the company identified the problem in 2019 and took "immediate action."

Telecom Company Also Faces OAIC Investigation and Potentially Millions in FinesThe Australian Communications and Media Authority says it has filed proceedings against Optus in a federal court as the company failed to protect sensitive customer data during a data breach in September 2022. The Office of the Australian Information Commissioner is also investigating the incident.

HHS OCR Says a Malicious Worker Stole and Sold Patient Information in 2013HHS has fined a New York City medical center $4.75 million to settle potential HIPAA violations discovered during an investigation into a hospital insider who sold patient data to identity thieves in 2013. The hospital said it has beefed up its security and privacy since the incident occurred.

World's Largest Cryptocurrency Exchange Will Pay $4.3 BillionBinance Chief Executive Changpeng Zhao will plead guilty to violating anti-money laundering statutes in U.S. federal court in a settlement ending an investigation into illicit transactions at the world's largest cryptocurrency exchange. The company will pay $4.3 billion in fines and forfeiture.