Connect with us

Malware

Explosive 3AM Ransomware Attack Exposes Data of 464,000 Kootenai Health Patients

Cybercriminals have stolen the data of 464,000 Kootenai Health patients in a 3AM ransomware attack. The breach exposed personal and medical information, increasing the risk of identity theft. Kootenai Health is providing free credit monitoring to affected individuals while investigating the incident and bolstering their security measures.

Published

on

Imagine waking up at 3 AM, feeling restless and uneasy. You check your phone and discover that your personal information has been compromised in a massive data breach. This nightmare became a reality for over 464,000 Kootenai Health patients who had their sensitive data stolen and leaked by the 3AM ransomware operation.

Kootenai Health is a not-for-profit healthcare provider in Idaho, operating the region’s largest hospital and providing a variety of medical services, from emergency care to cancer treatment. Unfortunately, cybercriminals targeted their IT systems, causing disruption and gaining unauthorized access to sensitive patient data.

Timeline of the Cyberattack

In early March 2024, we became aware of unusual activity that disrupted access to certain IT systems at Kootenai Health. An ongoing investigation revealed that the cybercriminals gained unauthorized access to the systems on February 22, 2024, giving them ten days to roam the network and steal sensitive data. The examination of what data has been stolen as a result of this breach concluded on August 1, 2024, and confirmed the following information as exposed:

  • Full names
  • Dates of birth
  • Social Security numbers (SSNs)
  • Driver’s Licenses
  • Government ID numbers
  • Medical record numbers
  • Medical treatment and condition information
  • Medical diagnoses
  • Health insurance information

Kootenai Health states that it’s unaware of any misuse of the stolen information. Impacted individuals have been provided with instructions on how to enroll in 12-24 months of identity protection services, depending on what data was exposed.

For more information and support links, patients can visit the hospital’s announcement published on the Kootenai Health website.

3AM Ransomware: The Culprit Behind the Leak

The 3AM ransomware gang has claimed responsibility for the attack and leaked the stolen data on its darknet portal, indicating that a ransom was not paid. The stolen data consists of a 22GB archive, available for free, allowing any other cybercriminal to download the data and utilize it in further attacks.

First reported in September 2023, 3AM is a Rust-based ransomware strain that has seen limited deployment as a fallback option when more proven lockers failed. In January, Intrisec analysts reported notable links between 3AM, Conti, and the Royal ransomware gangs, suggesting some association between the three groups.

Protect Yourself and Stay Informed

It’s essential to keep up-to-date on cybersecurity news and threats, especially if you’ve been affected by a data breach like the one at Kootenai Health. We’re here to help you navigate the ever-changing landscape of cyber threats and provide you with the information you need to protect yourself and your data.

Stay vigilant and let us be your go-to resource for the latest cybersecurity updates and best practices.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Malware

Massive Cyberattack at French Hospital: Health Data of 750,000 Patients Compromised

A cyberattack on a French hospital exposed the health data of 750,000 patients. The incident highlights the growing risk of cyber threats targeting healthcare organizations, with sensitive patient information being increasingly sought by hackers. Ensure your organization’s data is protected with robust cybersecurity measures and stay informed on the latest threats.

Published

on

People walk in front of a brightly lit modern building adorned with a red cross sign, signaling it as a French hospital. Amidst whispers of a recent cyberattack targeting health data,

A data breach at a French hospital has led to the exposure of 750,000 patients’ medical records. The culprit, a threat actor going by the name ‘nears’, claims to have attacked multiple healthcare facilities in France, potentially gaining access to over 1.5 million patient records.

This attacker claims to have breached MediBoard, an Electronic Patient Record (EPR) solution by Softway Medical Group. The group has confirmed that a MediBoard account was indeed compromised, but it was not due to a software vulnerability or misconfiguration. Instead, the breach occurred through stolen hospital credentials.

How did this happen?

Softway Medical Group explained that the exposed data was not directly managed by them but was hosted by the hospital. They emphasized that their software was not responsible for the breach. Instead, a privileged account within the hospital’s infrastructure was compromised.

This situation highlights the importance of ensuring that all staff members, especially those with privileged access to sensitive systems, follow strict security protocols to prevent unauthorized access.

What’s at stake?

The threat actor began selling what they claimed was access to the MediBoard platform for multiple French hospitals. This access allegedly allowed the buyer to view sensitive healthcare and billing information, patient records, and even the ability to schedule and modify appointments or medical records.

To prove their claim, the hacker put the records of 758,912 patients from an unnamed French hospital up for sale. These records contain sensitive information, including full names, dates of birth, contact information, and even health card history.

The data was offered for purchase to three users, and currently, no buyers have been declared on the sale listing. However, even if the data isn’t sold, there’s always a risk of it being leaked online for free, making it accessible to the broader cybercrime community.

The dangers of exposed data

The type of data exposed in this incident raises the risk of phishing, scamming, and social engineering for impacted individuals. As a result, it’s crucial for healthcare providers to prioritize cybersecurity and invest in proper security measures to protect their patients’ sensitive information.

For patients, it’s essential to be vigilant and aware of potential scams and phishing attempts. Be cautious with any communication that seems suspicious or requests sensitive information, and never hesitate to verify the authenticity of a message.

What can you do to protect yourself?

With cyber threats constantly evolving, it’s essential to stay informed about cybersecurity best practices. As an IT Services company, we’re dedicated to helping people like you understand the risks and take appropriate action to protect your personal information and online security.

Don’t leave your cybersecurity to chance. Keep coming back to learn more about the latest threats, best practices, and how to keep yourself and your loved ones safe online. Together, we can build a more secure digital world for everyone.

Continue Reading

Malware

Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan

Fintech firm Finastra is probing a potential data breach following a hacking incident involving its SFTP server. The breach, which may have exposed sensitive user data, has prompted the company to bolster its security measures and notify affected customers.

Published

on

The Finastra logo, featuring a stylized ribbon design on a dark purple background, stands resilient even amid discussions of data breaches.

Did you know that even the largest and most successful financial software companies can fall victim to cyberattacks? Recently, Finastra, a company that serves over 8,000 institutions across 130 countries, experienced a cybersecurity incident that put their customers’ sensitive data at risk.

The Incident at Finastra

Finastra is a global financial software company that counts 45 of the world’s top 50 banks and credit unions among its clients. With over 12,000 employees and a revenue of $1.7 billion last year, it’s a major player in the finance sector. On November 7, 2024, a cyber attacker managed to access one of Finastra’s Secure File Transfer Platform (SFTP) systems using compromised credentials.

So far, the company’s investigation, supported by external cybersecurity experts, has not found evidence that the breach extended beyond the SFTP platform. But the attack has raised concerns about the security of the company’s software services, which include lending solutions, payment processing, cloud-enabled retail and banking platforms, and trading risk management tools.

How We Learned About the Breach

Brian Krebs first reported the security breach after seeing a data breach notification sent to an impacted person. The attack appears to be linked to a post on a hacking forum, where a threat actor named “abyss0” claimed to be selling 400GB of data stolen from Finastra.

When we asked Finastra about the forum post, they wouldn’t confirm or deny if the data belonged to them. However, they did acknowledge a limited-scope security breach and are currently evaluating its impact. They also stressed that the compromised SFTP platform was not used by all their customers and was not their default file exchange platform.

What’s Next for Finastra and Its Customers?

The exact impact and scope of the breach are still under investigation. It may take some time to determine who has been affected, but Finastra has assured that those who are deemed impacted will be contacted directly. As a result, public disclosures from the company are not expected.

Interestingly, the threat actor who published the data samples earlier this month has since deleted the post. It’s unclear whether the data was sold to a buyer or if “abyss0” became concerned about the sudden publicity.

A History of Cybersecurity Incidents

This isn’t the first time Finastra has experienced a cybersecurity incident. In March 2020, the company was hit by ransomware actors and forced to take parts of its IT infrastructure offline, causing service disruptions. At the time, reports highlighted Finastra’s lackluster vulnerability management strategy, as they were using older versions of Pulse Secure VPN and Citrix servers.

What Can We Learn From This?

The Finastra breach is a stark reminder that no organization is immune to cyber threats. As technology continues to evolve, so do the tactics and techniques used by cybercriminals. It’s crucial for companies, large and small, to prioritize cybersecurity and invest in the latest security measures to protect their customers’ data.

And for you, as a reader and potential customer, it’s important to stay informed about the latest cybersecurity news and best practices. That’s where we come in. We’re committed to providing you with the most up-to-date information on cybersecurity, so you can stay one step ahead of the bad guys. So why not reach out to us and keep coming back to learn more about how you can protect yourself and your business from cyber threats?

Continue Reading

Malware

Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure

Ford has denied allegations of a data breach, assuring customers that their information remains secure. The automaker responded to claims made by a security researcher who discovered a vulnerability in their systems, stating that no sensitive data was accessed or exposed. Ford is working closely with the researcher to investigate and resolve the issue.

Published

on

The Ford logo stands proudly against a geometric, blue and purple-patterned background with triangular shapes, embodying an attention to detail akin to safeguarding customer information.

As someone who cares about cybersecurity, I can’t help but feel concerned about the recent news that Ford is investigating allegations of a data breach. A threat actor going by the name ‘EnergyWeaponUser’ claimed on a hacking forum to have leaked 44,000 customer records. They also implicated another hacker, ‘IntelBroker,’ who supposedly took part in the breach back in November 2024.

What’s in the leaked data?

The leaked information includes Ford customer records containing personal details such as full names, physical locations, purchase details, dealer information, and record timestamps. While this data might not be extremely sensitive, it still contains personally identifiable information (PII) that could be used in phishing and social engineering attacks targeting the affected individuals.

What’s interesting is that the threat actors didn’t try to sell the dataset. Instead, they offered it to registered members of the hacker forum for eight credits, equivalent to just a little over $2.

Ford’s response and investigation

We reached out to Ford to validate the claims, and a spokesperson confirmed that they are actively investigating the allegations. They stated, “Ford is aware and is actively investigating the allegations that there has been a breach of Ford data. Our investigation is active and ongoing.”

Is there credibility to these allegations?

The involvement of IntelBroker in the breach lends some credibility to the threat actor’s allegations. This hacker has a track record of confirmed breaches, including recent ones at Cisco’s DevHub portal, Nokia (through a third party), Europol’s EPE web portal, and T-Mobile (via a vendor).

The data samples leaked by the threat actors include locations from around the world, with the United States being one of them.

How to protect yourself from potential risks

In light of this potential data exposure, it’s crucial to treat unsolicited communications with caution and reject requests for revealing more information under any pretense. Keep an eye out for any suspicious emails, messages, or phone calls that might use this leaked information to manipulate or deceive you.

An important update from Ford

After our initial report, Ford provided us with an additional statement based on new findings from their ongoing investigation. They said, “Ford’s investigation has determined that there was no breach of Ford’s systems or customer data. The matter involved a third-party supplier and a small batch of publicly available dealers’ business addresses. It is our understanding that the matter has now been resolved.” – A Ford spokesperson

Stay informed and stay safe

Keeping up to date with cybersecurity news and best practices is crucial in today’s digital world. Continue to check back with us for the latest information and advice on protecting yourself and your data. Remember, knowledge is power, and staying informed is the first step in defending against potential threats.

Continue Reading

Trending

Copyright © 2023 IT Services Network.