Top Stories
Companies and Governments Disclose Data Theft From Attack on File-Sharing Tool - WSJ
The attack on the MoveIt tool underscores the risk to companies from third-party suppliers, even if they aren’t customers but work with others who are. Cyberattacks on other little-known, yet ubiquitous, software have had similar ripple effects in the U.S. and Europe. These include the hacks on software providers SolarWinds in 2020, and Kaseya in 2021. A vulnerability in Log4j, also discovered in 2021, has been used by hackers in a similar fashion. This incident is different in that the gang doesn’t appear to have deployed ransomware on systems, analysts said, choosing instead to steal data and attempt to extort its owners.
Millions of Oregon, Louisiana state IDs stolen in MOVEit breach
Louisiana and Oregon warn that millions of driver's licenses were exposed in a data breach after a ransomware gang hacked their MOVEit Transfer security file transfer systems to steal stored data.
These attacks were conducted by the Clop ransomware operation, which began worldwide hacks of MOVEit Transfer servers on May 27th using a previously unknown, zero-day vulnerability tracked as CVE-2023-34362.
MOVEit Transfer customers warned of new flaw as PoC info surfaces
Progress warned MOVEit Transfer customers to restrict all HTTP access to their environments after info on a new SQL injection (SQLi) flaw (tracked as CVE-2023-35708) was shared online today.
Breaches
SEC delays final rule on proposed four-day breach notification for public companies until October | SC Media
The new rule has provoked numerous concerns over the short time of the four-day reporting requirement, the need for a national security exemption, and conflicts with proposed reporting laws around critical infrastructure.
Real Estate Firm Hack Affects 319,500 Patients, Employees
A commercial real estate company that operates more than a dozen addiction recovery centers and other medical facilities in several states is notifying 319,500 patients and employees of a recent ransomware incident that compromised their personal and health information.
Yakima Valley Memorial Hospital Resolution Agreement and Corrective Action Plan | HHS.gov
In May 2018, OCR initiated an investigation of Yakima Valley Memorial Hospital following the receipt of a breach notification report, stating that 23 security guards working in the hospital’s emergency department used their login credentials to access patient medical records maintained in Yakima Valley Memorial Hospital’s electronic medical record system without a job-related purpose. The information accessed included names, dates of birth, medical record numbers, addresses, certain notes related to treatment, and insurance information.
Security
Microsoft: Windows 10 21H2 has reached end of servicing
Multiple editions of Windows 10 21H2 have reached their end of service (EOS) in this month's Patch Tuesday, as Microsoft reminded customers today.
CISA Order Highlights Persistent Risk at Network Edge – Krebs on Security
Under a new order from the Cybersecurity and Infrastructure Security Agency (CISA), federal agencies will have 14 days to respond to any reports from CISA about misconfigured or Internet-exposed networking equipment. The directive applies to any networking devices — such as firewalls, routers and load balancers — that allow remote authentication or administration.
Bill for Rural Hospital Cyber Skills Passes Senate Committee
Bipartisan legislation proposing to help rural hospitals better address cybersecurity personnel shortages cleared a Senate committee Wednesday amid signs of a deepening ransomware crisis affecting hospitals serving areas with low population density.
Misc
49ers agree to settle data breach class action lawsuit, must create new IT positions - The Athletic
The football team will be required to create a new position to oversee IT operations and hire a dedicated cybersecurity professional. The proposed settlement covers 20,930 who would be entitled to up to $2,000 for expenses related to addressing the data breach.