Content by Marianne Kolbasuk McGee

US Senator Quizzes 23andMe Over Credential-Stuffing Hack

Marianne Kolbasuk McGee  •  October 26, 2023

Genetics testing firm 23andme is facing intensifying scrutiny in the wake of a credential-stuffing hack that leaked genetic ancestry information of potentially millions of customers. That includes at least 16 proposed federal class action lawsuits and an inquiry by a high-ranking U.S. senator.

12M Patient Medical Records, Other Data Found Exposed on Web

Marianne Kolbasuk McGee  •  October 25, 2023

An unsecured database of an India-based medical laboratory recently exposed more than 12 million test results, other patient records and development files for the company's mobile health app, according to the security researcher who found the vulnerability. Redcliffe Labs has fixed the problem.

Attack on Shared IT Supplier Affects 5 Hospitals in Ontario

Marianne Kolbasuk McGee  •  October 24, 2023

A cyberattack on a shared IT services organization is forcing five member hospitals in Ontario to cancel or reschedule patient appointments and steer nonemergency patients to other facilities. Attacks against third-party vendors are rising, and many regional hospitals are unprepared.

Feds Issue HIPAA Guidance on Employee Sanctions, Telehealth

Marianne Kolbasuk McGee  •  October 23, 2023

Federal regulators issued new guidance materials for HIPAA-regulated entities, including a document stressing the importance of sanction policies for workforce members who violate HIPAA, plus two new resources for healthcare providers and patients regarding telehealth privacy and security risks.

33 State AGs Settle 3 Health Data Breach Cases

Marianne Kolbasuk McGee  •  October 20, 2023

Attorneys general across 33 states have reached settlements for three health data breaches that affected nearly 2 million people, including a $1.4 million settlement for a clearinghouse that left patient data exposed for three years. The AGs accused the firms of violating state laws and HIPAA rules.

Plastic Surgeons Warned About New Face of Cyber Extortion

Marianne Kolbasuk McGee  •  October 19, 2023

The FBI is warning plastic surgery practices and their patients of cybercriminals targeting their sensitive health information and medical photos for extortion schemes. The alert followed recent hacking incidents at several plastic surgery practices involving data theft.

US House Panel: AI Regulation Begins With Privacy

Marianne Kolbasuk McGee  •  October 18, 2023

The U.S. needs to pass federal legislation to establish a national framework of standards and a rules of the road for AI, but first passing federal data privacy legislation is an essential foundational part of that, some witnesses told members of Congress.

IBM Says 631K Affected in Johnson & Johnson Database Breach

Marianne Kolbasuk McGee  •  October 17, 2023

IBM says the personal information of 631,000 people was compromised by a "technical method" that allowed unauthorized access to a third-party database used by a Johnson & Johnson patient medication support platform. IBM said the problem has been fixed, but two lawsuits have already been filed.

Victim Count Doubles in Heart Institute Data Theft Hack

Marianne Kolbasuk McGee  •  October 16, 2023

The number of people affected by a Tennessee cardiac care clinic hack has more than doubled to 411,000 since the healthcare group first reported the incident to regulators in July. Cybercriminal group Karakurt claimed responsibility for the attack, which has so far triggered five class action suits.

Feds Warn Healthcare Sector of 'NoEscape' RaaS Gang Threats

Marianne Kolbasuk McGee  •  October 13, 2023

Federal authorities are warning healthcare organizations and the public health sector of threats involving NoEscape, a relatively new multi-extortion ransomware-as-a-service group believed to be a successor to the defunct Russian-speaking Avaddon gang.

Could Middle Eastern Cyberwarfare Spill Into Health Sector?

Marianne Kolbasuk McGee  •  October 12, 2023

The violent surprise attack on Israel by Hamas and the region's escalating war spotlights the critical importance of situational awareness, and especially for healthcare organizations that rely on medical or tech products from Israeli technology firms, said Denise Anderson, president of the H-ISAC.

Supply Chain, Cloud Compromise Worries Growing in Healthcare

Marianne Kolbasuk McGee  •  October 11, 2023

Cloud compromises and supply chain attacks are overshadowing ransomware as the top cyberthreats worrying healthcare sector organizations - but all such incidents are still viewed as significant risks to patient outcomes and safety, said Ryan Witt of Proofpoint, citing new research findings.

McLaren Health Care Facing 3 Lawsuits in Ransomware Hack

Marianne Kolbasuk McGee  •  October 10, 2023

A recent attack by a Russian ransomware-as-a-service group that stole the personal information of 2.5 million patients of McLaren Health Care has triggered at least three proposed federal class action lawsuits in recent days, claiming the healthcare company failed to protect patient privacy.

23andMe Investigating Apparent Credential Stuffing Hack

Marianne Kolbasuk McGee  •  October 9, 2023

Genetics testing firm 23andMe is investigating a data leak of ancestry DNA information for certain customers whose usernames and passwords were previously hacked on other websites. The company suspects a massive credential stuffing attack on individual accounts using recycled passwords and no MFA.

Why AI in Healthcare is Promising, But 'Not Magic'

Marianne Kolbasuk McGee  •  October 7, 2023

The use of generative AI is being "highly explored" in healthcare and has great promise for a variety of applications, but it needs to be scrutinized closely, said Erik Decker, vice president and CISO of Intermountain Health and a cybersecurity adviser to the federal government.