CySecurity News - Latest Information Security and Hacking Incidents: Healthcare

Authentication DEBULL Government Healthcare Identity Attacks Microsoft 365 Phishing

Microsoft 365 Users Targeted in New Device Code Phishing Campaign

Cybersecurity researchers have revealed a phishing campaign that is exploiting Microsoft's legitimate device authentication process to seize control of Microsoft 365 accounts, reflecting a broader shift in how cybercriminals are conducting identity-focused attacks. Rather than stealing passwords through counterfeit login pages, the operation manipulates victims into completing a genuine Microsoft authentication process, allowing attackers to obtain valid authentication tokens that grant direct access to compromised accounts.

The campaign, tracked by email security firm ZeroBEC, was observed between the final week of June and early July 2026. Investigators found that the attackers relied on collaboration-themed phishing lures that directed recipients to Microsoft's authentic device login experience instead of fraudulent credential harvesting websites. Behind the scenes, a backend broker generated Microsoft device authentication codes and continuously polled the authentication process until victims completed the sign-in sequence, enabling the attackers to capture valid authentication tokens without ever collecting passwords.

Researchers noted that the activity closely resembles techniques previously documented by Microsoft in its investigation of the threat cluster known as Storm-2372. That campaign, first disclosed in February 2025, used fake Microsoft Teams invitations and messaging-themed social engineering to persuade victims to enter attacker-generated device codes. Once authentication was completed, the attackers received valid access tokens that allowed them to take over Microsoft 365 accounts. Microsoft said Storm-2372 had targeted organizations across government, defense, healthcare, telecommunications, higher education, information technology, energy, and non-governmental sectors spanning Europe, North America, Africa, and the Middle East. The company also stated that the attacks abused legitimate authentication functionality rather than exploiting vulnerabilities in Microsoft products.

Although the latest campaign mirrors many of Storm-2372's tactics, ZeroBEC believes the operation is powered by a reusable phishing framework called DEBULL rather than the original threat actor itself. The researchers concluded that techniques once associated with advanced threat groups are now being packaged into reusable infrastructure that enables multiple operators to launch similar attacks with far less effort. This evolution reflects the continuing commercialization of identity-focused phishing operations, where sophisticated attack methods are increasingly offered through phishing-as-a-service platforms instead of being developed independently by individual threat actors.

At the center of the campaign is device code phishing, an attack technique that abuses the OAuth 2.0 Device Authorization Grant, a legitimate authentication mechanism designed for devices that cannot easily support traditional browser-based sign-ins. The workflow is commonly used by devices such as smart televisions, printers, conference room equipment, and other systems with limited input capabilities. Instead of entering credentials directly on those devices, users receive a short verification code that must be entered on another device through Microsoft's official authentication portal to complete the login process.

Threat actors exploit the separation between the device requesting authentication and the browser used to authorize it. Rather than creating counterfeit Microsoft login pages, attackers initiate their own device authentication session, obtain a legitimate verification code from Microsoft, and deliver that code to victims through convincing phishing emails. When recipients unknowingly enter the supplied code into Microsoft's authentic login page and complete the sign-in process, they authorize the attackers' session instead of their own, handing over valid authentication tokens that can be used to access Microsoft 365 resources. Because the victim is interacting with a genuine Microsoft service, traditional indicators of phishing, such as suspicious URLs or fake login portals, are largely absent.

Security researchers have increasingly warned that device code phishing represents a natural evolution of identity attacks. As organizations strengthened defenses against conventional credential phishing and adversary-in-the-middle attacks, threat actors shifted toward abusing trusted authentication workflows that require no password theft and can effectively circumvent multi-factor authentication protections by obtaining legitimate session tokens directly from users. Proofpoint recently reported a sharp increase in device code phishing activity during 2026, attributing the growth to publicly available criminal toolkits and the rapid expansion of phishing-as-a-service platforms that have made these techniques accessible to a wider range of cybercriminals.

Romania’s Hospital Cyberattack Highlights Growing Ransomware Threats to Healthcare Systems



 

Healthcare cybersecurity

Anonymous Romania Cyber Attacks cyber resilience CyberSecurity Ransomware Attacks Healthcare Healthcare Cyberattacks Healthcare cybersecurity

Romania’s Hospital Cyberattack Highlights Growing Ransomware Threats to Healthcare Systems

A large-scale ransomware attack that took place in the healthcare system of Romania in February 2024 makes for textbook material on how to respond to such incidents, as well as the challenges they present. The ransomware attack scenario started when criminals got hold of a hospital management system called Hippocrates and, using it as a vector, distributed BackMyData ransomware to encrypt data.

One of the software’s main functions is processing and storing information on laboratory results, pharmacy claims, payroll, admission and discharge of patients, doctors, and other medical staff. After being locked, the hospitals had to pay nearly 160 thousand euros to decrypt the data, which is in Bitcoin. When some hospitals reported the ransomware attack, the National Computer Security Center (DNSC) took an extraordinary measure to order over a hundred facilities to disconnect from the internet to prevent the virus from spreading to other institutions.

Consequently, the hospitals’ systems became unable to provide access to email, the Internet, and interconnected medical devices. To manage patients and keep the critical functions running, doctors and nurses used paper-based solutions to write down and manually input lab results, physician orders, and treatment plans. In parallel, hospital staff worked on taking down the ransomware and securing the system.

Authorities eventually found out that the ransomware infection was confirmed in 26 hospitals, where the ransomware attack response team with the help of the system supplier isolated the contaminated systems from the network. After decrypting files and securing the system, the technicians returned the hospitals to the network and ensured there were no other problems.

Throughout the ransomware incident, authorities provided the public with updates on the ransomware situation, telling the people to avoid visiting the facilities if possible and advising the hospitals not to give in to the attackers’ demands. Nevertheless, the response to the challenge was far from perfect, as Romania continues to face challenges with cybercrime. The patients complained about the inconvenience of standing in queues and having their tests processed manually, but the government did not go through with paying off the ransom.

At the same time, it is worth noting that having up-to-date data backups allowed the hospitals to quickly restore their vital functions without having to wait for decrypting tools from hackers. Five days after the ransomware attack, most of the affected facilities had already returned to normal operations. At the same time, there were no reports of patient deaths or damage to health caused by the ransomware attack. Still, doctors and nurses had to manually enter a lot of the patient’s personal data, which took them several more weeks to finish, while some of the relevant information was lost altogether.

So far, the ones behind the ransomware attack have not been revealed. Still, it has been reported that some of the suspects’ resources in Russia have been shut down by the police, while others are currently detained abroad. It is not yet known whether they will be brought to justice in Romania. The ransomware attack on the healthcare system of Romania serves as a reminder of how fragile our systems are and the importance of protecting them.

In many ways, hospitals are a critical infrastructure component, meaning that potential attackers will always attempt to take advantage of them by holding vital functions hostage until they get a hefty ransom. Even though the ransomware response team handled the situation in Romania efficiently, the ransomware incidents in the UK and the US show that problems of that sort are far from being exclusive to Romania.

Healthcare Cyber Breach Raises Concerns After 33,000 Patients Affected



 

Healthcare

affected patients Breach Cyber Breach Cyber Security Healthcare

Healthcare Cyber Breach Raises Concerns After 33,000 Patients Affected

Initially perceived as a supply-chain disruption within the UK healthcare ecosystem, the ransomware attack has now revealed an even more severe and long-lasting impact on patient privacy. A cybercriminal attack on pathology services provider Synnovis two years ago has caused Bedfordshire Hospitals NHS Foundation Trust to confirm that sensitive data related to over 33,000 individuals has been stolen and published.

The exposed records come from administrative pathology files associated with laboratory and diagnostic testing conducted between 2011 and 2020, and may contain personal information and clinical test results.

Despite the fact that ransomware incidents have long been associated with operational disruption, they present long-term data protection challenges for healthcare organizations. Moreover, attacks on critical third-party suppliers supporting essential NHS services pose cascading risks. Following the June 2024 ransomware incident, Synnovis and relevant healthcare organizations conducted an extensive forensic review to determine the extent of the exposure.

Bedfordshire Hospitals Foundation Trust informed the affected individuals after receiving confirmation that data associated with approximately 32,927 patients had been identified in material exfiltrated by the attackers and distributed on dark web sites. According to the trust, delayed disclosure was primarily driven by the complexity of the investigation rather than a newly discovered breach. This compromised dataset consisted of fragmented administrative records dispersed across several sources, as opposed to conventional datasets stored in structured repositories. For the contents and organizational ownership of these files to be determined, more than a year of specialist analysis was required.

According to the review, historical pathology-related information spanning nearly a decade predating November 2020 may have been exposed, including patient names, dates of birth, NHS and patient identification numbers, postcodes, and diagnostic test results. Researchers find it difficult to assess cyber incidents involving unstructured healthcare data due to the difficulty of accurately mapping stolen information before the full impact can be understood on affected individuals. After notifications had been sent to the affected individuals, the focus shifted from forensic reconstruction to risk mitigation.

Bedfordshire Hospitals Foundation Trust urged patients to remain vigilant for suspicious communications, advising them not to respond to unexpected requests for personal information, to avoid opening attachments or links from sources that are unfamiliar, and to be cautious when receiving unsolicited phone calls, emails, or text messages that reference healthcare information.

It is acknowledged that disclosures of such information may cause concern, however the trust emphasised that the compromise was a result of an external pathology supplier's systems rather than its own network infrastructure, reiterating that it is committed to supplier oversight and data protection governance. However, cybersecurity professionals have expressed criticism regarding the delay of the disclosure.

It has been argued by Saif Abed, founding partner of the AbedGraham Group, that a two-year gap between the incident and patient notification raises serious questions regarding the accountability of all organizations involved in the attack. Furthermore, he challenged suggestions that the fragmented nature of the stolen records significantly reduces risk. In his view, modern threat actors are equipped to aggregate, analyse, and correlate disparate datasets with greater ease.

In Abed's opinion, once healthcare data enters criminal ecosystems, they are more likely to be misused than when the original breach occurred. This leaves affected individuals with limited recourse and raises concerns as to whether systemic lessons from the Synnovis incident have been adequately addressed. Several of his concerns are echoed by those he expressed last year for a formal public inquiry into the ransomware attack, as they relate to broader concerns regarding third-party cyber risk, breach transparency, and the resilience of critical healthcare supply chains. Despite the restoration of disrupted systems and the fading of headlines, the consequences of cyberattacks often persist.

It is critical for healthcare organizations to maintain cyber resilience in the face of complex networks of third-party providers as visibility into supply chain security, timely breach assessment, and transparent communication remain critical. As a result of the case, patients need to remain vigilant against phishing attempts and identity-based fraud, while healthcare leaders need to reinforce the importance of continuously monitoring external partners whose information is sensitive.

This incident demonstrates that maintaining patient trust throughout the healthcare ecosystem involves much more than simply adhering to technical requirements.

West Pharmaceutical Services Reports Data Breach and Encrypted Systems



 

pharmaceutical services

Data Breach financial data exposure Healthcare pharmaceutical services

West Pharmaceutical Services Reports Data Breach and Encrypted Systems

West Pharmaceutical Services has confirmed that it suffered a cybersecurity incident that resulted in both data theft and the encryption of parts of its internal network, making it the latest major manufacturing and healthcare-related company to face operational disruption from a cyberattack.

In a filing submitted to the U.S. Securities and Exchange Commission (SEC), the company stated that it identified suspicious activity on May 4, 2026, and later determined on May 7 that an unauthorized actor had exfiltrated certain data and encrypted multiple systems within its environment. The company described the breach as a “material cybersecurity attack,” indicating that the incident was serious enough to potentially affect operations or business continuity.

Following the initial detection of the intrusion, West Pharmaceutical said it immediately activated its incident response procedures. As part of its containment efforts, the company proactively shut down and isolated affected systems across its global infrastructure, restricted access to enterprise resources, informed law enforcement authorities, and brought in external cyber-forensic specialists to assist with the investigation and recovery process.

The investigation into the incident is still ongoing, and the company says it is currently working to determine the full scope and nature of the breach, including exactly what type of information may have been stolen during the attack.

West Pharmaceutical Services is a publicly traded American pharmaceutical manufacturing company and a member of the S&P 500 index. The firm generates more than $3 billion in annual revenue and employs over 10,800 people worldwide. Its business focuses heavily on injectable drug packaging systems, syringe and vial components, containment technologies, and medical drug delivery devices used throughout the healthcare and pharmaceutical sectors.

The cyberattack disrupted several parts of the company’s global operations, particularly systems tied to manufacturing, shipping, and other enterprise functions. West Pharmaceutical stated that some of its core systems supporting production and distribution activities have now been restored, while manufacturing operations have partially resumed in certain areas. However, the company acknowledged that the full restoration process has not yet been completed and did not provide a timeline for when all systems are expected to return to normal operation.

At this stage, the company has also not estimated the financial impact the incident may have on its business.

West Pharmaceutical further stated that it has taken measures intended to reduce the risk of the stolen information being distributed or exposed publicly, although it did not disclose what those mitigation steps involve.

In a statement shared after media inquiries, a company spokesperson said the organization initiated both incident response and crisis management procedures immediately after discovering the intrusion. The company added that containment actions included shutting down and isolating affected on-premises infrastructure, limiting access to enterprise systems, and implementing additional technical and organizational security measures.

West Pharmaceutical also confirmed that it engaged Palo Alto Networks’ Unit 42 incident response team to assist with containment, forensic analysis, and system recovery efforts alongside outside legal counsel and other external experts.

As of now, no ransomware group has publicly claimed responsibility for the attack. However, cybersecurity analysts note that incidents involving both data exfiltration and system encryption often resemble modern double-extortion ransomware operations, where attackers not only lock systems but also threaten to leak stolen information to pressure victims into negotiations.

The incident also reflects a broader trend affecting manufacturing and healthcare supply chains, sectors that have increasingly become targets for cybercriminal groups because operational downtime can quickly disrupt production, logistics, and critical services. Security experts continue to warn that attacks against pharmaceutical and healthcare-related manufacturers can have consequences extending beyond financial losses, particularly when production environments and supply chain systems are affected.

ChipSoft Ransomware Incident Disrupts Dutch Healthcare Systems And Hospital Operations



 

Healthcare Cyber Attack

ChipSoft ransomware attack Cyber Attacks Cyber Security Ransomware Attacks cybersecurity in healthcare Healthcare Healthcare Cyber Attack

ChipSoft Ransomware Incident Disrupts Dutch Healthcare Systems And Hospital Operations

Early in April, a ransomware incident struck ChipSoft, a Dutch firm supplying healthcare software. Hospitals relying on its systems faced major interruptions. Some had to go offline - cutting access to essential tools. Instead of regular operations, backup plans took over. When providers like ChipSoft fall victim, ripple effects hit care delivery hard. This event highlights how vulnerable medical networks can be through supplier weak points.

After the event, Z-CERT - the Dutch agency for health sector cyber safety - has coordinated alongside ChipSoft and impacted facilities to evaluate risks, share actionable insights, meanwhile aiding restoration steps. Updates are still being tracked while medical services adapt to disruptions unfolding across systems. To prevent further risk, ChipSoft blocked entry to major platforms like Zorgportaal, HiX Mobile, and Zorgplatform.

Because hospitals rely on these tools for handling medical records and daily operations, the outage caused serious disruptions. Service recovery is now unfolding step by step, with fresh login details being sent out alongside updates. Among affected sites, 11 hospitals cut access to ChipSoft tools mid-operation - network disconnection became a fast response. Connections through protected vendor-linked tunnels faced shutdowns on guidance from cybersecurity teams.

Though halting some digital pathways slowed danger spread, care routines stumbled briefly at various locations. Outages hit multiple medical centers - Sint Jans Gasthuis, Laurentius Hospital, VieCuri Medical Center, and Flevo Hospital among them. Even so, treatment did not break down. Extra staff appeared at support stations because digital tools failed. Phone lines opened wider under pressure. When systems went quiet, people stepped in, swapping screens for spoken updates. Care moved forward, hand over hand.

So far, officials report uninterrupted critical healthcare operations, thanks to workable backup strategies reducing disruption. While probes continue, nothing yet points to leaked personal health records. Still, monitoring remains active across systems. Still unknown is who launched the attack, yet no known ransomware collective has stepped forward. At times throughout recovery efforts, access to ChipSoft’s internal platforms - including its public site - was blocked, showing how deep the impact ran.

From within the supplier’s infrastructure the compromise likely began, which triggered protective steps among client organizations. Security worries after the breach have slowed things down elsewhere too. Though planned earlier, rolling out the updated patient records software at Leiden University Medical Center now faces postponement - ChipSoft’s system caught in the ripple effects.

This occurrence underscores an ongoing pattern in digital security: hospitals continue facing heightened risks because disruptions to care carry serious consequences, demanding swift fixes. When core technology suppliers suffer breaches, ripple effects spread through interconnected systems, worsening damage far beyond one location.

Still working through recovery, teams from Z-CERT alongside medical facilities aim to bring systems back online without harming patient services. Because of the ChipSoft ransomware event, attention has shifted toward building tougher defenses, spotting threats earlier, with more reliable safeguards woven into health sector networks.

Student Founders Establish Backed Program to Help Peers Build Startups



 

Students

AI Cyber Security entrepreneurs founders Healthcare new startup Stanford University Students

Student Founders Establish Backed Program to Help Peers Build Startups

Two students affiliated with Stanford University have raised $2 million to expand an accelerator program designed for entrepreneurs who are still in college or who have recently graduated. The initiative, called Breakthrough Ventures, focuses on helping early-stage founders move from rough ideas to viable businesses by providing capital, guidance, and access to professional networks.

The program was created by Roman Scott, a recent graduate, and Itbaan Nafi, a current master’s student. Their work began with small-scale demo days held at Stanford in 2024, where student teams presented early concepts and received feedback. Interest from participants and observers revealed a clear gap. Many students had promising ideas but lacked practical support, legal guidance, and introductions to investors. The founders then formalized the effort into a structured accelerator and raised funding to scale it.

Breakthrough Ventures aims to address two common obstacles faced by student founders. First, early funding is difficult to access before a product or revenue exists. Second, students often do not have reliable access to mentors and industry networks. The program responds to both challenges through a combination of financial support and hands-on assistance.

Selected teams receive grant funding of up to $10,000 without giving up ownership in their companies. Participants also gain access to legal support and structured mentorship from experienced professionals. The program includes technical resources such as compute credits from technology partners, which can lower early development costs for startups building software or data-driven products. At the end of the program, founders who demonstrate progress may be considered for additional investment of up to $50,000.

The accelerator operates through a hybrid format. Founders participate in a mix of online sessions and in-person meetups, and the program concludes with a demo day at Stanford, where teams present their progress to potential investors and collaborators. This structure is intended to keep participation accessible while still offering in-person exposure to the startup ecosystem.

Over the next three years, the organizers plan to deploy the $2 million fund to support at least 100 student-led companies across areas such as artificial intelligence, healthcare, consumer products, sustainability, and deep technology. By targeting founders at an early stage, the program aims to reduce the friction between having an idea and building a credible company, while promoting responsible, well-supported innovation within the student community.

Tribal Health Clinics in California Report Patient Data Exposure



 

Rhysida

California Databreach Exposed Patient Records Healthcare Privacy ransomware attacks Rhysida

Tribal Health Clinics in California Report Patient Data Exposure

Patients receiving care at several tribal healthcare clinics in California have been warned that a cyber incident led to the exposure of both personal identification details and private medical information. The clinics are operated by a regional health organization that runs multiple facilities across the Sierra Foothills and primarily serves American Indian communities in that area.

A ransomware group known as Rhysida has publicly claimed responsibility for a cyberattack that took place in November 2025 and affected the MACT Health Board. The organization manages several clinics in the Sierra Foothills region of California that provide healthcare services to Indigenous populations living in nearby communities.

In January, the MACT Health Board informed an unspecified number of patients that their information had been involved in a data breach. The organization stated that the compromised data included several categories of sensitive personal information. This exposed data may include patients’ full names and government-issued Social Security numbers. In addition to identity information, highly confidential medical details were affected. These medical records can include information about treating doctors, medical diagnoses, insurance coverage details, prescribed medications, laboratory and diagnostic test results, stored medical images, and documentation related to ongoing care and treatment.

The cyber incident caused operational disruptions across MACT clinic systems starting on November 20, 2025. During this period, essential digital services became unavailable, including phone communication systems, platforms used to process prescription requests, and scheduling tools used to manage patient appointments. Telephone services were brought back online by December 1. However, as of January 22, some specialized imaging-related services were still not functioning normally, indicating that certain technical systems had not yet fully recovered.

Rhysida later added the MACT Health Board to its online data leak platform and demanded payment in cryptocurrency. The amount requested was eight units of digital currency, which was valued at approximately six hundred sixty-two thousand dollars at the time the demand was reported. To support its claim of responsibility, the group released sample files online, stating that the materials were taken from MACT’s systems. The files shared publicly reportedly included scans of passports and other internal documents.

The MACT Health Board has not confirmed that Rhysida’s claims are accurate. There is also no independent verification that the files published by the group genuinely originated from MACT’s internal systems. At this time, it remains unclear how many individuals received breach notifications, what method was used by the attackers to access MACT’s network, or whether any ransom payment was made. The organization declined to provide further information when questioned.

In its written notification to affected individuals, MACT stated that it experienced an incident that disrupted its information technology operations. The organization reported that an internal investigation found that unauthorized access occurred to certain files stored on its systems during a defined time window between November 12 and November 20, 2025.

The health organization is offering eligible individuals complimentary identity monitoring services. These services are intended to help patients detect possible misuse of personal or financial information following the exposure of sensitive records.

Rhysida is a cybercriminal group that first became active in public reporting in May 2023. The group deploys ransomware designed to both extract sensitive data from victim organizations and prevent access to internal systems by encrypting files. After carrying out an attack, the group demands payment in exchange for deleting stolen data and providing decryption tools that allow victims to regain access to locked systems. Rhysida operates under a ransomware-as-a-service model, in which external partners pay to use its malware and technical infrastructure to carry out attacks and collect ransom payments.

The group has claimed responsibility for more than one hundred confirmed ransomware incidents, along with additional claims that have not been publicly acknowledged by affected organizations. On average, the group’s ransom demands amount to several hundred thousand dollars per incident.

A significant portion of Rhysida’s confirmed attacks have targeted hospitals, clinics, and other healthcare providers. These healthcare-related incidents have resulted in the exposure of millions of sensitive records. Past cases linked to the group include attacks on healthcare organizations in multiple U.S. states, with ransom demands ranging from over one million dollars to several million dollars. In at least one case, the group claimed to have sold stolen data after a breach.

Researchers tracking cybersecurity incidents have recorded more than one hundred confirmed ransomware attacks on hospitals, clinics, and other healthcare providers across the United States in 2025 alone. These attacks collectively led to the exposure of nearly nine million patient records. In a separate incident reported during the same week, another healthcare organization confirmed a 2025 breach that was claimed by a different ransomware group, which demanded a six-figure ransom payment.

Ransomware attacks against healthcare organizations often involve both data theft and system disruption. Such incidents can disable critical medical systems, interfere with patient care, and create risks to patient safety and privacy. When hospitals and clinics lose access to digital systems, staff may be forced to rely on manual processes, delay or cancel appointments, and redirect patients to other facilities until systems are restored. These disruptions can increase operational strain and place patients and healthcare workers at heightened risk.

The MACT Health Board is named after the five California counties it serves: Mariposa, Amador, Alpine, Calaveras, and Tuolumne. The organization operates approximately a dozen healthcare facilities that primarily serve American Indian communities in the region. These clinics provide a range of services, including general medical care, dental treatment, behavioral health support, vision and eye care, and chiropractic services.

Conduent Healthcare Data Breach Exposes 10.5 Million Patient Records in Massive 2025 Cyber Incident



 

healthcare data breach

Data Breach Data Exfilteration Data protection data security Healthcare Healthcare Breach Healthcare Data healthcare data breach

Conduent Healthcare Data Breach Exposes 10.5 Million Patient Records in Massive 2025 Cyber Incident

In what may become the largest healthcare breach of 2025, Conduent Business Solutions LLC disclosed a cyberattack that compromised the data of over 10.5 million patients. The breach, first discovered in January, affected major clients including Blue Cross Blue Shield of Montana and Humana, among others. Although the incident has not yet appeared on the U.S. Department of Health and Human Services’ HIPAA breach reporting website, Conduent confirmed the scale of the exposure in filings with federal regulators.

The company reported to the U.S. Securities and Exchange Commission in April that a “threat actor” gained unauthorized access to a portion of its network on January 13. The breach caused operational disruptions for several days, though systems were reportedly restored quickly. Conduent said the attack led to data exfiltration involving files connected to a limited number of its clients. Upon further forensic analysis, cybersecurity experts confirmed that these files contained sensitive personal and health information of millions of individuals.

Affected data included patient names, treatment details, insurance information, and billing records. The company’s notification letters sent to Humana and Blue Cross customers revealed that the breach stemmed from Conduent’s third-party mailroom and printing services unit. Despite the massive scale, Conduent maintains that there is no evidence the stolen data has appeared on the dark web.

Montana regulators recently launched an investigation into the breach, questioning why Blue Cross Blue Shield of Montana took nearly ten months to notify affected individuals. Conduent, which provides business and government support services across 22 countries, reported approximately $25 million in direct response costs related to the incident during the second quarter of 2024. The company also confirmed that it holds cyber insurance coverage and has notified federal law enforcement.

The Conduent breach underscores the growing risk of third-party vendor incidents in the healthcare sector. Experts note that even ancillary service providers like mailroom or billing vendors handle vast amounts of protected health information, making them prime targets for cybercriminals. Regulatory attorney Rachel Rose emphasized that all forms of protected health information (PHI)—digital or paper—fall under HIPAA’s privacy and security rules, requiring strict administrative and technical safeguards.

Security consultant Wendell Bobst noted that healthcare organizations must improve vendor risk management programs by implementing continuous monitoring and stronger contractual protections. He recommended requiring certifications like HITRUST or FedRAMP for high-risk vendors and enforcing audit rights and breach response obligations.

The incident follows last year’s record-breaking Change Healthcare ransomware attack, which exposed data from 193 million patients. While smaller in comparison, Conduent’s 10.5 million affected individuals highlight how interconnected the healthcare ecosystem has become—and how each vendor link in that chain poses a potential cybersecurity risk. As experts warn, healthcare organizations must tighten vendor oversight, ensure data minimization practices, and develop robust incident response playbooks to prevent the next large-scale PHI breach.

Healthcare, Banking and Industry in India Struggle Amid Rising Cyber Attacks



 

Industrial Cybersecurity Risks

AI-Driven Ransomware Banking Cyber Threats Cybercrime In India Cybersecurity In India Data Breach Digital Security Challenges Healthcare Industrial Cybersecurity Risks

Healthcare, Banking and Industry in India Struggle Amid Rising Cyber Attacks

The Indian economy today stands at a crossroads of a profound digital transformation, in which technology has seamlessly woven its way into the fabric of everyday life, in both cities and remote villages. Smartphones and internet connectivity are transforming the way people live, work and transact around the country.

UPI powered digital banking, e-commerce, and the widespread shift toward remote work have all contributed to the rapid evolution of the country into a digital first economy. However, behind the impressive progress made in the past few years, there is a darker reality: cyberattacks that threaten to undermine the very foundations of this transformation. In the healthcare, banking, and industrial sectors, as digital tools become increasingly commonplace, they are also facing unprecedented security challenges.

As a consequence, the healthcare industry, as well as its associated industries, has emerged as one of the most vulnerable frontlines in the world, with numerous high-profile cyber incidents demonstrating how a cyber incident can threaten the safety of patients, disrupt crucial services, and undermine public trust.

A chief information security officer (CISO) is responsible for safeguarding critical systems and sensitive data, even though they must deal with legacy infrastructure, shortages of workforce, and rapidly evolving threats all while struggling to protect their critical systems and sensitive data.

Despite the benefits of artificial intelligence as a means of alleviating operational burdens, it also brings with it complex security demands, which makes cyber leaders a priority to ensure resilience in the future. In a rapidly emerging world filled with increasing risks, cybersecurity is no longer an optional skill but rather a necessity—a crucial tool for professionals, organisations, and citizens alike as India advances in its digital revolution.

India's critical sectors are experiencing a surge in cyberattacks, with an average of 4.1 million attacks occurring in the financial services industry, insurance industry, banking industry, and healthcare industry between January and June 2025. In spite of the fact that India remained the primary target, countries such as the United States, France, Singapore and Germany all contributed to this wave of malicious activities.

A wide range of vulnerabilities, ranging from system flaws to employee accounts, were exploited, testing the resilience of digital infrastructure. Insurers, which depend heavily on consumer data, have experienced threefold increases in the number of vulnerabilities exploited, as well as 350 per cent increases in distributed denial-of-service (DDoS) attacks.

It has emerged that Application Programming Interfaces (APIs), often overlooked yet central to digital ecosystems, have become a major weak point, with targeted attacks soaring by 126 per cent and DDoS attacks soaring by 3per cent. Even though supply chains and production systems are increasingly vulnerable, the manufacturing and industrial sectors have been hit hard.

Overall breaches increased by 31 per cent, including a staggering increase of 427 per cent in DDoS attacks, highlighting the need to protect these systems. There was also an increase of 46 per cent in employee-focused attacks and 17 per cent in politically motivated disruptions, and that resulted in increased DDoS activity of 1 per cent during peak operations during the financial year.

Even though smaller businesses often have limited resources, they have not been spared—attacks against their websites have gone up by 202 per cent, while cloud-based intrusions have increased seventy-fourfold during this period. There has been a surge in attacks on the healthcare sector, which have risen by 247 per cent, posing a grave threat to patient data and life-critical hospital services.

Despite being viewed as low-hanging fruit for cybercriminals, retail and e-commerce platforms experienced 42 per cent higher DDoS attacks, along with an increase in credential theft and fraudulent card transactions. Cybercrime has the potential to significantly impact national security as well as economic stability in the near future as a result of this massive increase in attacks.

The cybercrime specialist Professor Triveni Singh, who is also a former IPS officer, said that artificial intelligence and advanced detection systems have prevented more than 4.26 billion attempted breaches worldwide by preventing them from being attempted.

As India's digital economy accelerates, it requires stronger technologies, skilled professionals, continuous monitoring, and robust policies strengthened by international cooperation as well as stronger technology.

A major component of the Indian cyber landscape has emerged as a complex and vulnerable healthcare sector. Hospitals and medical groups operate in high-stakes environments, which can be very difficult for anyone to deal with.

Even a few minutes of system downtime could mean the difference between life and death for the patient. In light of this, ransomware groups have targeted them as prime targets, exploiting the urgency of care to extract money from patients.

A growing number of medical Internet of Things (MIoT) devices, including heart monitors, infusion pumps, and many other devices that interact with the internet, has led to a widening of attack surfaces in recent years. In spite of the promises of these technologies, their historically weak security makes them more appealing to threat actors that are powered by artificial intelligence, raising the possibility of patient data being stolen or even being interfered with directly.

As telehealth has increased in popularity, the risks have increased further, as both patients and providers are at risk of being attacked via the internet, which can harvest sensitive information from patients. It is important to note that India's healthcare sector continues to struggle with legacy systems, financial constraints, and a shortage of cybersecurity experts, which leaves small and mid-sized institutions particularly vulnerable, despite the country's progress in digitisation.

Despite the fragmentation of national regulations, frameworks like the Information Technology Act, SPDI Rules, and the Digital Personal Data Protection Act have only limited coverage, and there are still many gaps to fill in systemic coverage, according to industry bodies such as the Data Security Council of India and the Healthcare Information and Management Systems Society (HIMSS).

One real-world example of this problem can be found in August last year, when an artificial intelligence-driven ransomware attack crippled a healthcare provider specialising in artificial intelligence, making the urgency of the issue clear. The malware was triggered by a phishing email, and after a few minutes, it had encrypted electronic patient records, billing systems, and admissions, forcing surgeries to be delayed and critical procedures rerouted.

However, even though the organisation did not pay the ransom and instead cooperated with law enforcement, there was a severe fallout from the incident: patient trust was shattered, data was compromised, and the incident highlighted India's healthcare cybersecurity posture as being extremely fragile.

It is becoming increasingly apparent that cyber threats are evolving at an alarming rate, posing an increasing threat to individuals as well as organisations. In the era where millions of devices are connected to the internet, attackers have access to a larger pool of entry points, so they can exploit weaknesses across both personal and corporate networks more easily.

A report from Seqrite, which tracked over eight million endpoints, revealed that millions of malware infections were detected in just a matter of seconds, demonstrating how large the problem is. It has become increasingly common for cybercriminals to take advantage of the surge in digital services, whether it is small businesses' adoption of online platforms or individuals sharing their personal information on social media.

For instance, a newly established organisation without adequate security can become a target for ransomware or phishing attacks, while an individual who shares too much information online may be unwittingly vulnerable to identity theft because of it. It has been warned that as technology adoption grows, so will the sophistication of threats, requiring stronger security strategies across every sector.

The digital expansion of India is undeniably one of the world’s largest markets, but it is also accompanied by many vulnerabilities, making awareness and resilience crucial for long-term growth. India is speeding ahead on the digital journey, but it must maintain a balance between innovation and resiliency to achieve long-term growth.

No sector is immune to the impact of cyberattacks, as evidenced by the increasingly widespread attacks affecting industries such as healthcare, banking, and small businesses, all of which are rising at an alarming rate.

The price of inaction will only increase over time. It is still important to keep in mind that technology is only one factor of cybersecurity - creating a culture of cyber awareness, strengthening digital hygiene, and hiring skilled talent will prove to be just as important as deploying advanced firewalls and artificial intelligence services.

For organisations with limited resources, policymakers, regulators, and industry leaders must work in tandem in order to develop a comprehensive framework aimed at enforcing data protection as well as incentivising proactive security measures. In order to effectively combat cybercrime, it is vital that we foster international collaboration. Cybercrime transcends national boundaries, which requires collective intelligence to combat.

Individuals are advised to protect their personal information, to exercise caution online, and to update their digital practices in order to combat the threat at the grassroots level. In addition to protecting India's critical infrastructure, India will also inspire global confidence that it can lead a secure, technology-driven future as long as it combines security with the very foundations of its digital revolution.

2 Doctors in Hong Kong Arrested for Leaking Patient Data



 

Privacy

Data Leak Doctor Healthcare Hong Kong Hospital Privacy

2 Doctors in Hong Kong Arrested for Leaking Patient Data

Two doctors at a Hong Kong public hospital were arrested on charges of accessing computers with dishonest or criminal intent, allegedly involved in a data leak. According to police superintendent Wong Yick-lung, a 57-year-old consultant and a 35-year-old associate consultant from Tseung Kwan O Hospital were arrested in Ho Man Tin and Fo Tan, respectively.

Officers seized computers and other records; the pair is in police custody. On Sunday, the hospital stated the alleged leak, but the exact details were not disclosed at that time. The hospital’s chief executive, Dr. Kenny Yuen Ka-ye, said that the data of a few patients had been given to a third party. An internal complaint a month ago prompted the investigation.

According to Dr Ka-ye, the hospital found at least one doctor who accessed the patient’s personal data without permission. The hospital believes the documents containing information about other patients might have also been exposed to the third party. Police said experts are working to find out more details concerning the number of patients impacted by the incident.

While the investigation is ongoing, the consultant Dr has given his resignation, while the associate consultant has been suspended. At the time of writing this story, the motivation behind the attack is not known. According to Yuen, every doctor has access to the clinical management system that has patient information, but the use is only permitted under a strict “need-to-know” for research purposes or as part of the medical team taking care of a patient.

The investigation revealed that the two doctors didn’t fit into either category, which was a violation. According to SCMP’s conversation with a source, the portal reported that the two doctors (both members of the surgery department) sent details of a female pancreatic cancer patient who died after a surgical operation.

The pair illegally accessed the info and sent it to the family, asking them to file a complaint against the doctor who did the operation. This was done to show the doctor’s alleged incompetence.

The hospital has sent the case to the Office of the Privacy Commissioner for Personal Data, and has also reported the incident to the police and the Medical Council.

Hospital Notifies victims of a one-year old data breach, personal details stolen



 

Technology

Conti Healthcare Hospital Monti Ransomware Technology

Hospital Notifies victims of a one-year old data breach, personal details stolen

Hospital informs victims about data breach after a year

Wayne Memorial Hospital in the US has informed its 163,440 people about a year old data breach in May 2024 that exposed details such as: names, social security numbers, user IDs, and passwords, financial account numbers, credit and debit card numbers, expiration dates, and CVV codes, medical history, diagnoses, treatments, prescriptions, lab test results and images, health insurance, Medicare, and Medicaid numbers, healthcare provider numbers, state-issued ID numbers, and dates of birth.

Initially, the hospital informed only 2,500 people about the attack in August 2024. Ransomware group Monti took responsibility for the attack and warned that it would leak the data by July 8, 2024.

Ransom and payment

Wayne Memorial Hospital, however, has not confirmed Monti’s claim. As of now, it is not known if the hospital paid a ransom, what amount Monti demanded, or why the hospital took more than a year to inform victims, or how the threat actors compromised the hospital infrastructure.

According to the notice sent to victims, “On June 3, 2024, WMH detected a ransomware event, whereby an unauthorized third party gained access to WMH’s network, encrypted some of WMH’s data, and left a ransom note on WMH’s network.” The forensic investigation by WMH found evidence of unauthorized access to a few WMH systems between “May 30, 2024, and June 3, 2024.”

The hospital has offered victims a one-year free credit monitoring and fraud assistance via CyberScout. The deadline to apply is three months from the date of the notice letter.

What is the Monti group?

Monti is a ransomware gang that shares similarities with the Conti group. It was responsible for the first breach in February 2023. The group, however, has been working since June 2022. Monti is infamous for abusing software bugs like Log4Shell. Monti encrypts target systems and steals data as well. This pushes victims to pay ransom money in exchange for deleting stolen data and restoring the systems.

To date, Monti has claimed responsibility for 16 attacks. Out of these, two attacks hit healthcare providers.

Monti attacks on health care providers

In April 2023, Avezzano Sulmona L’Aquila (Italy) reported a ransomware attack that resulted in large-scale disruption for a month. Monti asked for $3 million ransom for the 500 GB of stolen data. ASL denies payment of the ransom.

Excelsior Othopedics informed 394,752 people about a June 2024 data compromise

Over 624,000 Impacted in Major Healthcare Data Breach: SSNs, Financial Data, and Identity Theft Risks



 

SSN leak

Data Breach Experian credit monitoring financial data exposure Healthcare HSGI cyberattack identity theft protection SSN leak

Over 624,000 Impacted in Major Healthcare Data Breach: SSNs, Financial Data, and Identity Theft Risks

A massive healthcare data breach has exposed the sensitive information of more than 624,000 individuals, putting Social Security numbers, financial details, and account credentials at risk.

The breach targeted Healthcare Services Group Inc. (HSGI), a Pennsylvania-based company that manages dining, housekeeping, and laundry services for hospitals across 48 U.S. states. According to BleepingComputer, HSGI has begun notifying impacted individuals through official letters.

Hackers infiltrated HSGI’s network in late September 2024, but the intrusion wasn’t discovered until October 7, 2024. An investigation revealed that a wide range of personal data may have been compromised, including:

Full names
Social Security numbers
Driver’s license and state ID numbers
Financial account details
Login credentials

The type of data exposed varies for each victim. Some may only have had their names leaked, while others also had SSNs and financial data exposed.

If you receive a data breach notification letter from HSGI, it will outline exactly what information of yours was exposed. The company is offering affected individuals free identity theft protection services from Experian, though the coverage period (12 months vs. 24 months) has not been confirmed.

Even though there’s no evidence yet of misuse of stolen data, experts warn that hackers could use the information for phishing attacks, fraud, or identity theft. Victims are urged to:

Monitor bank and credit card accounts closely
Watch for suspicious emails or texts
Avoid clicking unknown links or downloading attachments
Use trusted antivirus software on all devices

The healthcare industry has become a prime target for cybercriminals due to the high value of medical and financial records. Analysts believe this will not be the last attack of its kind, as similar breaches have been reported throughout the past year.

While individuals cannot control a company’s cybersecurity, they can take proactive measures once a breach occurs. As experts warn: You may not stop the breach, but you can protect yourself from becoming the next victim of identity fraud.

Cyberattack on New York Business Council Exposes Thousands to Risk



 

New York

BCNYS Data Breach Financial Data Healthcare New York

Cyberattack on New York Business Council Exposes Thousands to Risk

The Business Council of New York State (BCNYS), an influential body representing businesses and professional groups, has confirmed that a recent cyberattack compromised the personal information of more than 47,000 people.

In a report submitted to the Office of the Maine Attorney General, the Council disclosed that attackers accessed a wide range of sensitive data. The files included basic identifiers such as names and dates of birth, along with highly confidential records like Social Security numbers, state-issued IDs, and taxpayer identification numbers. Financial data was also exposed, including bank account details, payment card numbers, PINs, expiration dates, and even electronic signatures.

What makes this breach particularly concerning is the theft of medical records. The stolen information included healthcare providers’ names, diagnostic details, treatment histories, prescription data, and insurance documents, material that is often harder to replace or protect than financial information.

Investigators believe the attack took place in late February 2025, but the Council only uncovered it months later in August. The delay meant that for several months, criminals could have had access to the stolen records without detection. So far, officials have not confirmed any cases of identity theft linked to this incident. However, security experts note that breaches of this scale often have long-term consequences, as stolen data may circulate for years before being used.

Why it matters

The mix of financial, medical, and personal details gives criminals a powerful toolkit. With such data, they can open fraudulent credit lines, make unauthorized purchases, or submit false tax returns. Medical information raises another layer of danger — allowing fraudsters to access health services or prescriptions under someone else’s identity, potentially leaving victims to untangle costly disputes with insurers and providers.

Protective steps for those affected

1. Secure credit and banking accounts: Victims are advised to place fraud alerts or credit freezes with major credit bureaus, closely watch account activity, and notify banks of potential exposure.

2. Strengthen account security: Change passwords, use multifactor authentication wherever possible, and avoid reusing old login details.

3. Guard against tax fraud: Apply for an IRS Identity Protection PIN, which blocks others from filing tax returns in your name.

4. Monitor medical use: Review insurance and healthcare statements for unfamiliar claims or treatments, and flag suspicious activity immediately.

While BCNYS has offered free credit monitoring to those affected, the larger lesson extends far beyond this single breach. For organizations, it is a reminder that delayed detection amplifies the damage of any cyberattack. For individuals, it shows how deeply personal data, financial and medical can be intertwined in ways that make recovery especially difficult.

Cybersecurity experts warn that these breaches are no longer isolated events but part of a larger pattern where institutions become targets precisely because they store such valuable data. The question is no longer if data will be stolen, but how quickly victims can respond and how effectively organizations can limit the fallout.

Don’t Wait for a Cyberattack to Find Out You’re Not Ready



 

Software

Businesses Cyber Attacks Finance Healthcare Online Safety organisations Software

Don’t Wait for a Cyberattack to Find Out You’re Not Ready

In today’s digital age, any company that uses the internet is at risk of being targeted by cybercriminals. While outdated software and unpatched systems are often blamed for these risks, a less obvious but equally serious problem is the false belief that buying security tools automatically means a company is well-protected.

Many businesses think they’re cyber resilient simply because they’ve invested in security tools or passed an audit. But overconfidence without real testing can create blind spots leaving companies exposed to attacks that could lead to data loss, financial damage, or reputational harm.

Confidence vs. Reality

Recent years have seen a rise in cyberattacks, especially in sectors like finance, healthcare, and manufacturing. These industries are prime targets because they handle valuable and sensitive information. A report by Bain & Company found that while 43% of business leaders felt confident in their cybersecurity efforts, only 24% were actually following industry best practices.

Why this mismatch? It often comes down to outdated evaluation methods, overreliance on tools, poor communication between technical teams and leadership, and a natural human tendency to feel “safe” once something has been checked off a list.

Warning Signs of Overconfidence

Here are five red flags that a company may be overestimating its cybersecurity readiness:

1. No Real-World Testing - If an organization has never run a simulated attack, like a red team exercise or breach test, it may not know where its weaknesses are.

2. Rare or Outdated Risk Reviews - Cyber risks change constantly. Companies that rely on yearly or outdated assessments may be missing new threats.

3. Mistaking Compliance for Security - Following regulations is important, but it doesn’t mean a system is secure. Compliance is only a baseline.

4. No Stress Test for Recovery Plans - Businesses need to test their recovery strategies under pressure. If these plans haven’t been tested, they may fail when it matters most.

5. Thinking Cybersecurity Is Only an IT Job - True resilience requires coordination across departments. If only IT is involved, the response to an incident will likely be incomplete.

Building Stronger Defenses

To improve cyber resilience, companies should:

• Test and monitor security systems regularly, not just once.

• Train employees to recognize threats like phishing, which remains a common cause of breaches.

• Link cybersecurity to overall business planning, so that recovery strategies are realistic and fast.

• Work with outside experts when needed to identify hidden vulnerabilities and improve defenses.

If a company hasn’t tested its cybersecurity defenses in the past six months, it likely isn’t as prepared as it thinks. Confidence alone won’t stop a cyberattack but real testing and ongoing improvement can.

CISA, FBI Issue Alert Over Rising Interlock Ransomware Attacks on Critical Infrastructure



 

Interlock ransomware

Ascension Cyber Attacks critical infrastructure attack cybersecurity threat Double extortion FBI CISA advisory Healthcare Interlock ransomware

CISA, FBI Issue Alert Over Rising Interlock Ransomware Attacks on Critical Infrastructure

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have raised an alarm over an increase in ransomware activity linked to the Interlock gang. The advisory, released on Tuesday in collaboration with the Department of Health and Human Services (HHS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), warns that the group is actively targeting businesses and critical infrastructure in double extortion attacks.

The alert includes indicators of compromise (IOCs) gathered from recent investigations—some as recent as June 2025—and outlines protective measures for network defenders.

Emerging in September 2024, Interlock is a relatively new but rapidly growing ransomware operation. It has launched attacks across various global sectors, with a particular focus on healthcare. The gang has previously been connected to ClickFix intrusions, where they impersonated IT utilities to breach networks, and to malware campaigns using a remote access trojan (RAT) known as NodeSnake, particularly affecting U.K. universities.

The group recently claimed responsibility for cyberattacks on DaVita, a Fortune 500 kidney care company, leaking 1.5 terabytes of stolen data, and Kettering Health, a major healthcare provider with over 120 outpatient locations and more than 15,000 employees.

According to the FBI, the Interlock gang has been observed using unusual methods to infiltrate systems.

"FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups," the advisory notes.

The gang uses a double extortion model—first stealing and then encrypting victims’ data—forcing organizations to pay not just to restore systems but also to prevent public data leaks.

Episource Healthcare Data Breach Exposes Personal Data of 5.4 Million Americans



 

Patient Data

Data Analytics Agency Data Breach Data Leak Data Privacy data security Data Theft Healthcare Healthcare Data Healthcare Security Patient Data

Episource Healthcare Data Breach Exposes Personal Data of 5.4 Million Americans

In early 2025, a cyberattack targeting healthcare technology provider Episource compromised the personal and medical data of over 5.4 million individuals in the United States. Though not widely known to the public, Episource plays a critical role in the healthcare ecosystem by offering medical coding, risk adjustment, and data analytics services to major providers. This makes it a lucrative target for hackers seeking access to vast troves of sensitive information.

The breach took place between January 27 and February 6. During this time, attackers infiltrated the company’s systems and extracted confidential data, including names, addresses, contact details, Social Security numbers, insurance information, Medicaid IDs, and medical records. Fortunately, no banking or payment card information was exposed in the incident. The U.S. Department of Health and Human Services reported the breach’s impact affected over 5.4 million people.

What makes this breach particularly concerning is that many of those affected likely had no direct relationship with Episource, as the company operates in the background of the healthcare system. Its partnerships with insurers and providers mean it routinely processes massive volumes of personal data, leaving millions exposed when its security infrastructure fails.

Episource responded to the breach by notifying law enforcement, launching an internal investigation, and hiring third-party cybersecurity experts. In April, the company began sending out physical letters to affected individuals explaining what data may have been exposed and offering free credit monitoring and identity restoration services through IDX. These notifications are being issued by traditional mail rather than email, in keeping with standard procedures for health-related data breaches.

The long-term implications of this incident go beyond individual identity theft. The nature of the data stolen — particularly medical and insurance records combined with Social Security numbers — makes those affected highly vulnerable to fraud and phishing schemes. With full profiles of patients in hand, cybercriminals can carry out advanced impersonation attacks, file false insurance claims, or apply for loans in someone else’s name.

This breach underscores the growing need for stronger cybersecurity across the healthcare industry, especially among third-party service providers. While Episource is offering identity protection to affected users, individuals must remain cautious by monitoring accounts, being wary of unknown communications, and considering a credit freeze as a precaution. As attacks on healthcare entities become more frequent, robust data security is no longer optional — it’s essential for maintaining public trust and protecting sensitive personal information.

Kettering Health Ransomware Attack Linked to Interlock Group



 

Ransomwares

Cyberattack Data Breach Data Leak data security Employee Data Healthcare Interlock gang Interlock ransomware Kettering Health Ransomware attack Ransomware group Ransomwares

Kettering Health Ransomware Attack Linked to Interlock Group

Kettering Health, a prominent healthcare network based in Ohio, is still grappling with the aftermath of a disruptive ransomware attack that forced the organization to shut down its computer systems. The cyberattack, which occurred in mid-May 2025, affected operations across its hospitals, clinics, and medical centers. Now, two weeks later, the ransomware gang Interlock has officially taken responsibility for the breach, claiming to have exfiltrated more than 940 gigabytes of data.

Interlock, an emerging cybercriminal group active since September 2024, has increasingly focused on targeting U.S.-based healthcare providers. When CNN first reported on the incident on May 20, Interlock had not yet confirmed its role, suggesting that ransom negotiations may have been in progress. With the group now openly taking credit and releasing some of the stolen data on its dark web site, it appears those negotiations either failed or stalled.

Kettering Health has maintained a firm position that they are against paying ransoms. John Weimer, senior vice president of emergency operations, previously stated that no ransom had been paid. Despite this, the data breach appears extensive. Information shared by Interlock indicates that sensitive files were accessed, including private patient records and internal documents. Patient information such as names, identification numbers, medical histories, medications, and mental health notes were among the compromised data.

The breach also impacted employee data, with files from shared network drives also exposed. One particularly concerning element involves files tied to Kettering Health’s in-house police department. Some documents reportedly include background checks, polygraph results, and personally identifiable details of law enforcement staff—raising serious privacy and safety concerns. In a recent public update, Kettering Health announced a key development in its recovery process.

The organization confirmed it had restored core functionalities of its electronic health record (EHR) system, which is provided by healthcare technology firm Epic. Officials described this restoration as a significant step toward resuming normal operations, allowing teams to access patient records, coordinate care, and communicate effectively across departments once again. The full scope of the breach and the long-term consequences for affected individuals still remains uncertain.

Meanwhile, Kettering Health has yet to comment on whether Interlock’s claims are fully accurate. The healthcare system is working closely with cybersecurity professionals and law enforcement agencies to assess the extent of the intrusion and prevent further damage.

Unimed AI Chatbot Exposes Millions of Patient Messages in Major Data Leak



 

Unimed

AI Chatbot Cyber Security Dataleak Healthcare IdentityTheft Kafka phishing Privacy Unimed

Unimed AI Chatbot Exposes Millions of Patient Messages in Major Data Leak

iA significant data exposure involving Unimed, one of the world’s largest healthcare cooperatives, has come to light after cybersecurity researchers discovered an unsecured database containing millions of sensitive patient-doctor communications.

The discovery was made by cybersecurity experts at Cybernews, who traced the breach to an unprotected Kafka instance. According to their findings, the exposed logs were generated from patient interactions with “Sara,” Unimed’s AI-driven chatbot, as well as conversations with actual healthcare professionals.

Researchers revealed that they intercepted more than 140,000 messages, although logs suggest that over 14 million communications may have been exchanged through the chat system.

“The leak is very sensitive as it exposed confidential medical information. Attackers could exploit the leaked details for discrimination and targeted hate crimes, as well as more standard cybercrime such as identity theft, medical and financial fraud, phishing, and scams,” said Cybernews researchers.

The compromised data included uploaded images and documents, full names, contact details such as phone numbers and email addresses, message content, and Unimed card numbers.

Experts warn that this trove of personal data, when processed using advanced tools like Large Language Models (LLMs), could be weaponized to build in-depth patient profiles. These could then be used to orchestrate highly convincing phishing attacks and fraud schemes.

Fortunately, the exposed system was secured after Cybernews alerted Unimed. The organization issued a statement confirming it had resolved the issue:

“Unimed do Brasil informs that it has investigated an isolated incident, identified in March 2025, and promptly resolved, with no evidence, so far, of any leakage of sensitive data from clients, cooperative physicians, or healthcare professionals,” the notification email stated. “An in-depth investigation remains ongoing.”

Healthcare cooperatives like Unimed are nonprofit entities owned by their members, aimed at delivering accessible healthcare services. This incident raises fresh concerns over data security in an increasingly AI-integrated medical landscape.

AI is Accelerating India's Healthtech Revolution, but Data Privacy Concerns Loom Large



 

Technology

AI is Accelerating India's Healthtech Revolution, but Data Privacy Concerns Loom Large

India’s healthcare, infrastructure, is undergoing a remarkable digital transformation, driven by emerging technologies like artificialintelligence (AI), machinelearning, and bigdata. These advancements are not only enhancing accessibility and efficiency but also setting the foundation for a more equitable health system. According to the WorldEconomicForum (WEF), AI is poised to account for 30% of new drug discoveries by 2025 — a major leap for the pharmaceutical industry.

As outlined in the Global Outlook and Forecast 2025–2030, the market for AI in drugdiscovery is projected to grow from $1.72 billion in 2024 to $8.53 billion by 2030, clocking a CAGR of 30.59%. Major tech players like IBMWatson, NVIDIA, and GoogleDeepMind are partnering with pharmaceutical firms to fast-track AI-led breakthroughs.

Beyond R&D, AI is transforming clinical workflows by digitising patientrecords and decentralising models to improve diagnostic precision while protecting privacy.

During an interview with AnalyticsIndiaMagazine (AIM), Rajan Kashyap, Assistant Professor at the National Institute of Mental Health and Neuro Sciences (NIMHANS), shared insights into the government’s push toward innovation: “Increasing the number of seats in medical and paramedical courses, implementing mandatory rural health services, and developing Indigenous low-cost MRI machines are contributing significantly to hardware development in the AI innovation cycle.”

Tech-Driven Healthcare Innovation

Kashyap pointed to major initiatives like the GenomeIndia project, cVEDA, and the AyushmanBharatDigitalMission as critical steps toward advancing India’s clinical research capabilities. He added that initiatives in genomics, AI, and ML are already improving clinicaloutcomes and streamlining operations.

He also spotlighted BrainSightAI, a Bengaluru-based startup that raised $5 million in a Pre-Series A round to scale its diagnostic tools for neurological conditions. The company aims to expand across Tier 1 and 2 cities and pursue FDA certification to access global healthcaremarkets.

Another innovator, Niramai Health Analytics, offers an AI-based breast cancer screening solution. Their product, Thermalytix, is a portable, radiationfree, and cost-effective screening device that is compatible with all age groups and breast densities.

Meanwhile, biopharma giant Biocon is leveraging AI in biosimilar development. Their work in predictivemodelling is reducing formulation failures and expediting regulatory approvals. One of their standout contributions is Semglee, the world’s first interchangeablebiosimilar insulin, now made accessible through their tie-up with ErisLifesciences.

Rising R&D costs have pushed pharma companies to adopt AI solutions for innovation and costefficiency.

Data Security Still a Grey Zone

While innovation is flourishing, there are pressing concerns around dataprivacy. A report by Netskope Threat Labs highlighted that doctors are increasingly uploading sensitive patient information to unregulated platforms like ChatGPT and Gemini.

Kashyap expressed serious concerns about lax data practices:

“During my professional experience at AI labs abroad, I observed that organisations enforced strict data protection regulations and mandatory training programs…The use of public AI tools like ChatGPT or Gemini was strictly prohibited, with no exceptions or shortcuts allowed.”

He added that anonymised data is still vulnerable to hacking or reidentification. Studies show that even brainscans like MRIs could potentially reveal personal or financial information.

“I strongly advocate for strict adherence to protected data-sharing protocols when handling clinical information. In today’s landscape of data warfare, where numerous companies face legal action for breaching data privacy norms, protecting health data is no less critical than protecting national security,” he warned.

Policy Direction and Regulatory Needs

The Netskope report recommends implementing approved GenAI tools in healthcare to reduce “shadow AI” usage and enhance security. It also urges deploying datalossprevention (DLP) policies to regulate what kind of data can be shared on generative AI platforms.

Although the usage of personal GenAI tools has declined — from 87% to 71% in one year — risks remain.

Kashyap commented on the pace of India’s regulatory approach:

“India is still in the process of formulating a comprehensive data protection framework. While the pace may seem slow, India’s approach has traditionally been organic, carefully evolving with consideration for its unique context.”

He also pushed for developing interdisciplinary medtech programs that integrate AIeducation into medicaltraining.

“Misinformation and fake news pose a significant threat to progress. In a recent R&D project I was involved in, public participation was disrupted due to the spread of misleading information. It’s crucial that legal mechanisms are in place to counteract such disruptions, ensuring that innovation is not undermined by false narratives,” he concluded.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About