£3 million fine for healthcare MSP with sloppy security after it was hit by ransomware attack.
Sensitive data related to almost 80,000 people exposed, and NHS services disrupted.
Read more in my article on the Exponential-e blog: https://www.exponential-e.com/blog/3-million-fine-for-healthcare-msp-with-sloppy-security-after-it-was-hit-by-ransomware-attack
A little ray of sunshine:
The Journal Times, part of Lee Enterprises, had been seriously impacted by the #ransomware attack by Qilin in February. Today, they announced that they are back to full strength: https://journaltimes.com/opinion/column/article_856d2fed-473b-4683-bbf4-61e8fd157830.html
Sincere congrats to them after what was almost two months of intensive and dedicated efforts to fully recover.
Hackers breached Oracle's Cerner servers after January 22, stealing patient data to extort US medical providers. The FBI is now investigating. 
#Oracle #Cerner #CyberSecurity #DataBreach #FBI #HealthcareSecurity #MedicalData #TechNews #Ransomware
it should be obvious by now that anything created by the #techbros behind this coup needs to be considered #malware
https://www.wired.com/story/doge-rebuild-social-security-administration-cobol-benefits/
and that includes the 2-3 years of #Palantir having free reign hacking everything related to not just #immigration but #passports
DOGE IS MORE THAN #MALWARE IT’S #RANSOMWARE
so who is putting up contingencies to use all the #OpenGOV tools we have had developed the last 20 years, to audit the White House’s acts of digital terrorism?
@aral :
I don't want to pay a cent. Neither donate, nor via taxes.
@aral : most Let's Encrypt (and other Domain Validated) certificates are issued to junk- or plain criminal websites.
They're the ultimate manifestation of evil big tech.
They were introduced to encrypt the "last mile" because Internet Service Providers were replacing ads in webpages and, in the other direction, inserting fake clicks.
DV has destroyed the internet. People loose their ebank savings and companies get ransomwared; phishing is dead simple. EDIW/EUDIW will become an identity fraud disaster (because of AitM phishing atracks).
Even the name "Let's Encrypt" is wrong for a CSP: nobody needs a certificate to encrypt a connection. The primary purpose of a certificate is AUTHENTICATION (of the owner of the private key, in this case the website).
However, for human beings, just a domain name simply does not provide reliable identification information. It renders impersonation a peace of cake.
Decent online authentication is HARD. Get used to it instead of denying it.
REASONS/EXAMPLES
Troy Hunt fell in the DV trap: https://infosec.exchange/@ErikvanStraten/114222237036021070
Google (and Troy Hunt!) killed non-DV certs (for profit) because of the stripe.com PoC. Now Chrome does not give you any more info than what Google argumented: https://infosec.exchange/@ErikvanStraten/114224682101772569
https:⧸⧸cancel-google.com/captcha was live yesterday: https://infosec.exchange/@ErikvanStraten/114224264440704546
Stop phishing proposal: https://infosec.exchange/@ErikvanStraten/113079966331873386
Lots of reasons why LE sucks:
https://infosec.exchange/@ErikvanStraten/112914047006977222 (corrected link 09:20 UTC)
This website stopped registering junk .bond domain names, probably because there were too many every day (the last page I found): https://newly-registered-domains.abtdomain.com/2024-08-15-bond-newly-registered-domains-part-1/. However, this gang is still active, open the RELATIONS tab in https://www.virustotal.com/gui/ip-address/13.248.197.209/relations. You have to multiply the number of LE certs by approx. 5 because they also register subdomains and don't use wildcard certs. Source: https://www.bleepingcomputer.com/news/security/revolver-rabbit-gang-registers-500-000-domains-for-malware-campaigns/
New ransom group blog post!
Group name: ransomhub
Post title: cisd.org
Info: https://cti.fyi/groups/ransomhub.html
New post from #Crazyhunter Team : Johnson Fitness
More at : https://www.ransomlook.io/group/Crazyhunter%20Team #Ransomware
@cryptadamist Also
Virginia OAG #ransomware attack: The Cloak ransomware gang has taken credit for breaching the Virginia Attorney General's Office last week. The agency took down its computer network and told staff to return to paper court filings while they dealt with the attack. The Cloak gang has dumped all the agency's data, suggesting officials declined to pay the ransom.
#Cybersecurity
https://www.securityweek.com/ransomware-group-claims-attack-on-virginia-attorney-generals-office/
December 2023: US District Attorney Jessica Aber indicts 4 Russians for war crimes in #Ukraine
September 2024: US District Attorney Jessica Aber indicts Russian cryptocurrency money launderer / cybercriminal #SergeyIvanov
November 2024: US District Attorney Jessica Aber accuses Virginia based companies of running "three different schemes to illegally transship sensitive American technology to Russia," including sending equipment to a Russian telecommunications company linked to the #Kremlin and Russia's notorious #FSB security agency.
March 2025: Former US District Attorney Jessica Aber found dead at age 43
Just a friendly reminder to be careful when installing VSCode extensions: they can be - and sometimes are - malicious.
It is worth noting these extensions did not seem to be very successful.
Dealing with something ridiculous at the moment that is a great example of just how 'easy' it really is to close down exposed data:
Found a server recently with no access controls at all that was hit by ransomware in May 2024 and most of the data is encrypted. (It got hit by an automated script, it wasn't targeted by a ransom group)
Found a non encrypted directory:
The company is STILL uploading, monthly, hundreds of millions of records of logs with their clients data.
Tried to reach out to the company, nothing. Company is from AUS so I tried ASD, nothing.
I sent an email to AUSCERT, they validated with me the issue and forwarded the information and my contact to ASD, they also tried to reach out to the company themselves.
Not a word from anyone and the server is still exposed a month after my initial alerts.
Logs are still being uploaded to the server so it's obvious no one did anything.
So what am I supposed to do here?
#Ransomware attacks are costing #Government offices a month of downtime on average
Pennsylvania Schools Union Breach Affects Over Half a Million Members - https://www.redpacketsecurity.com/over-half-a-million-hit-by-pennsylvania-schools-union-breach/
CERT.at investigates ransomware attacks via critical Fortinet vulnerabilities (FortiOS, FortiProxy) and recommends urgent forensic investigations of all devices that didn't have FortiOS 7.0.16 installed before 2025-01-27, when the PoC for CVE-2024-55591 was published. Those devices may be compromised despite having been patched later.
Check (German) warning by @CERT_at
https://www.cert.at/de/warnungen/2025/3/ransomware-gruppen-nutzen-weiterhin-kritische-fortinet-schwachstellen-warnung-vor-gepatchten-aber-bereits-kompromittierten-geraten
Long story with Forescout:
https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/
‘People Are Scared’: Inside #CISA as It Reels From #TrumpPurge
Employees at the #Cybersecurity & #Infrastructure #Security Agency…are struggling to protect the #US while the #Trump admin dismisses their colleagues & poisons…partnerships.
#MassLayoffs & weak leadership are taking a severe toll on the US govt’s #cyber #defense agency, undermining its ability to protect America from…adversaries bent on crippling infrastructure & #ransomware gangs…bleeding #SmallBusiness dry.
https://archive.is/2025.03.13-143433/https://www.wired.com/story/inside-cisa-under-trump/
Black Basta ransomware group is indeed dead, post hack and dump of their chats. #threatintel #ransomware
A massive leak of internal chat logs from the notorious Black Basta ransomware-as-a-service (RaaS) group has exposed potential ties to Russian authorities, extensive use of artificial intelligence in its operations and plans for a complete rebranding.
Hackers are exploiting #Fortinet firewall bugs to plant #ransomware
https://techcrunch.com/2025/03/17/hackers-are-exploiting-fortinet-firewall-bugs-to-plant-ransomware/
