Cyberattacks & Security

[phkrause]

A cyberattack has disrupted hospitals and health care in several states

MANCHESTER, Conn. (AP) — Hospitals and clinics in several states on Friday began the time-consuming process of recovering from a cyberattack that disrupted their computer systems, forcing some emergency rooms to shut down and ambulances to be diverted.

https://apnews.com/article/cyberattack-hospital-emergency-outage-4c808c1dad8686458ecbeababd08fecf?

[phkrause]

FBI investigating ransomware attack crippling hospitals across 4 states

A major hospital network with arms in multiple states is dealing with widespread network outages due to a cyberattack, which the FBI confirms is ransomware.

https://therecord.media/hospital-network-facing-cyberattack?

[phkrause]

Casino giant Caesars Entertainment reports cyberattack; MGM Resorts says some systems still down

LAS VEGAS (AP) — Casino company Caesars Entertainment on Thursday joined Las Vegas gambling rival MGM Resorts International in reporting that it was hit by a cyberattack, but added in a report to federal regulators that its casino and online operations were not disrupted.

https://apnews.com/article/vegas-casinos-mgm-resorts-caesars-cyberattack-shutdown-3f7f80d0d200e9f26a2efa88bc5a6862?

[phkrause]

? Vegas outage stretches to a week

Five days into an apparent cyberattack on MGM Resorts International, slot machines are still out of order, digital room keys are offline and resort guests are slamming the company on social media, Axios' Sam Sabin reports.

• Why it matters: Casinos and hospitality firms have become a rising target for cyberattacks.

It's not just Vegas: Sam visited MGM National Harbor outside D.C. yesterday and found a handful of slot machines on the second floor were still offline.

• MGM Rewards kiosks — where members can print rewards cards so they can use their points to play games — were down, forcing people to cash out their winnings in person.

What's happening: A member of the hacking group Scattered Spider has claimed responsibility for the MGM hack, the Financial Times reports. The hackers are believed to be young adults, possibly based in the U.S. and U.K.

• Bloomberg reported the same group targeted Caesars last week.

[phkrause]

? Charted: Clorox wipeout

Data: S&P Global Market Intelligence. Chart: Axios Visuals Clorox revenue plummeted to a nearly eight-year low in the last quarter after a devastating cyberattack, Axios' Nathan Bomey writes. Why it matters: The horrific drop — sales fell 31% from the previous quarter — illustrates the steep consequences of cybersecurity breakdowns. What's happening: Revenue plunged as the company was hit with product shortages, including disinfecting wipes and bleach, stemming from its inability to process orders efficiently. ? Between the lines: The earlier movements on this chart capture consumers' pandemic behavior in one slide.

[phkrause]

States and Congress wrestle with cybersecurity after Iran attacks small town water utilities

HARRISBURG, Pa. (AP) — The tiny Aliquippa water authority in western Pennsylvania was perhaps the least-suspecting victim of an international cyberattack.

https://apnews.com/article/water-utilities-hackers-cybersecurity-1c475f5d2ef3b5d52410c93bdeab3aad?

[phkrause]

Russia May Be Behind Hack of Texas Water Facility

Google's cybersecurity firm Mandiant uncovers evidence linking the water facility incident to an infamous Russian state-sponsored hacking group called Sandworm.

https://www.pcmag.com/news/russia-may-be-behind-hack-of-texas-water-facility?

[phkrause]

UnitedHealth says wide swath of patient files may have been taken in Change cyberattack

UnitedHealth says files with personal information that could cover a “substantial portion of people in America” may have been taken in the cyberattack earlier this year on its Change Healthcare business.

https://apnews.com/article/unitedhealth-change-cyberattack-50e7e86ace92e95711dfbf8914d27db1?

[phkrause]

? Fending off political cyberattacks

Illustration: Annelise Capossela/Axios

A bipartisan group of Texas lawmakers is pledging to boost campaign protections, hoping to safeguard elections against deepfakes and other forms of AI manipulation. Why it matters: Against the backdrop of a loud national conversation about election fraud and the baseless claim of a "stolen" 2020 election, the Texas Innovation and Technology caucus is quietly focused on addressing how artificial intelligence could warp get-out-the-vote efforts by either party. Flashback: Robocalls in New Hampshire in January used a manipulated version of President Joe Biden's voice, telling listeners their votes would be better used in November and to skip the primary. What they're saying: Rep. Giovanni Capriglione, a Southlake Republican who chairs the caucus, said at an event last week that efforts to manipulate voter turnout "will be a factor" in closely contested, down-ballot races. Zoom in: Next year's legislative proposals could include requirements that campaigns add disclaimers when using artificial intelligence. There could also be higher penalties for violating a state law that bars making a deepfake video with the intent to influence the outcome of an election, Capriglione said. Reality check: It's not clear how much lawmakers can do. "I'm skeptical that they can stop malicious actors from using some of these technologies," Francesca Lockhart, who heads a cybersecurity clinic at the University of Texas at Austin, tells Axios. What's next

[phkrause]

A cyberattack forces a big US health system to divert ambulances and take records offline

TOPEKA, Kan. (AP) — A cyberattack on the Ascension health system operating in 19 states across the U.S. forced some of its 140 hospitals to divert ambulances, caused patients to postpone medical tests and blocked online access to patient records.

https://apnews.com/article/cyberattack-hospital-system-ambulances-diverted-ascension-728ab2a0e5afaf7c344e46a5ce5ca42c?

[phkrause]

? Dealer outage could last into July

Illustration: Sarah Grillo/Axios

Cyberattacks on software widely used by dealerships are throttling auto sales, Axios' Nathan Bomey writes. Why it matters: Some 15,000 dealerships were rendered helpless this month when hackers attacked CDK Global software that the dealerships rely on to sell cars and manage inventory. Between the lines: U.S. auto sales are expected to fall anywhere from 2.6% to 7.2% in June compared with a year earlier, J.D. Power projected today. The attacks could cost dealers up to 140,000 vehicle sales in June, ? What's next: CDK told dealers that the outage could last past June 30. Go deeper.

[phkrause]

Auto dealer outage

 

CDK Global, a software firm serving car dealerships across the US that was roiled by a cyberattack last month, appears to have paid a $25 million ransom to the hackers to get their systems back online, multiple sources told CNN. The ransomware attack that hit CDK in June disrupted thousands of auto dealerships that use the company's software to manage everything from scheduling to sales and orders. The ransom was likely paid in bitcoin and sent to a cryptocurrency account controlled by the hackers, sources say. Federal officials discourage paying a ransom to cybercriminals because it can fuel future attacks, but some companies feel they have no choice but to pay to recover customer data or regain control of their operations. 

[phkrause]

Cybersecurity

 

Russian cybersecurity company Kaspersky Lab will "gradually wind down" its US operations and lay off its US-based employees after the Department of Commerce announced a ban on the firm selling its products in the US, citing national security concerns. US officials have claimed that the Russian government could use Kaspersky's popular antivirus software to surveil Americans through hacking or data collection. Kaspersky has strenuously denied those claims. US government agencies were already banned from using Kaspersky Lab's software but the Commerce Department's move to prevent the sale of the software across the country is unprecedented.

[phkrause]

Social Security numbers stolen from Dallas County employees, their dependents in data breach

Social security numbers for employees and their dependents may have been stolen last October when cyber hackers attacked Dallas County.

https://www.keranews.org/news/2024-07-18/social-security-numbers-stolen-from-dallas-county-employees-their-dependents-in-data-breach?

[phkrause]

Cyber attack on OneBlood donation center could leave Florida hospitals short of blood

The non-profit blood donation center that serves much of the southeast said Wednesday it fell victim to a cyber attack, leaving hundreds of hospitals potentially facing shortages.

https://www.orlandosentinel.com/2024/07/31/cyber-attack-on-oneblood-donation-center-could-leave-florida-hospitals-short-of-blood/?

[phkrause]

Cyberattacks

 

The US government has concluded the Iranian government is behind the hack and leak operation that targeted Donald Trump's presidential campaign and also attempted to target the Biden-Harris campaign. The FBI in recent days briefed the former president on its preliminary findings after news organizations reported receiving documents believed to have come from an account belonging to a senior Trump campaign official. Vice President Kamala Harris' campaign has said the hackers were unsuccessful in their attempts against the Biden-Harris campaign. The investigation marks the clearest sign of the efforts by Iran — and other countries — to try to influence the 2024 election, US officials believe. Iran rejected what it called "unsubstantiated" claims that its government was behind the hacking operation.

[phkrause]

Cybersecurity head says there’s no chance a foreign adversary can change US election results

WASHINGTON (AP) — Nearly a month out from Election Day, the head of the nation’s cybersecurity agency is forcefully reassuring Americans who have been swept into the chaotic churn of election disinformation and distrust that they will be able to feel confident in the outcome.

https://apnews.com/article/election-2024-security-misinformation-russia-iran-b93d6bbbf08c5046b4cee70ba7676a52?

[phkrause]

The US and Microsoft disrupt a Russian hacking group targeting American officials and nonprofits

WASHINGTON (AP) — A hacking group tied to Russian intelligence tried to worm its way into the systems of dozens of Western think tanks, journalists and former military and intelligence officials, Microsoft and U.S. authorities said Thursday.

https://apnews.com/article/russia-hacking-microsoft-star-blizzard-fb41bfccbbe7aaecd10a0a93905d4c8a?

[phkrause]

Cyberattack

American Water, the largest regulated water and wastewater utility company in the US, announced Monday that it was the victim of a cyberattack, prompting the firm to pause billing to customers. The New Jersey-based company — which provides services to more than 14 million people in 14 states and on 18 military installations — said it became aware of the unauthorized activity on Thursday and immediately took protective steps, including shutting down certain systems. American Water said staffers were working "around the clock" to investigate the nature and scope of the attack. The company also said customers will not face late charges while its systems are unavailable.

 

American Water, the largest water utility in US, is targeted by a cyberattack

The largest regulated water and wastewater utility company in the United States announced Monday that it was the victim of a cyberattack, prompting the firm to pause billing to customers.

https://apnews.com/article/american-water-cyberattack-36423062dbce05c9aa70ef8aa07810cb?

[phkrause]

FBI issues urgent 'scam' warning to Black Friday shoppers using Safari, Chrome and Edge as report reveals 'telltale' sign of cyber attack

The FBI has issued an urgent 'scam' warning to Black Friday shoppers after a report revealed 'telltale' signs of a cyber attack.

https://www.newsbreak.com/news/3696298737601-fbi-issues-urgent-scam-warning-to-black-friday-shoppers-using-safari-chrome-and-edge-as-report-reveals-telltale-sign-of-cyber-attack?

[phkrause]

One Tech Tip: How to protect your communications through encryption

LONDON (AP) — After a sprawling hacking campaign exposed the communications of an unknown number of Americans, U.S. cybersecurity officials are advising people to use encryption in their communications.

https://apnews.com/article/privacy-encryption-signal-whatsapp-9faf31ed3411bc5b7cab0647b4ab224d?

[phkrause]

Treasury says Chinese hackers remotely accessed workstations and documents in ‘major’ cyber incident Chinese hackers remotely accessed several U.S. Treasury Department workstations and unclassified documents after compromising a third-party software service provider, the agency said Monday. Read more.

Key points: The department did not provide details on how many workstations had been accessed or what sort of documents the hackers may have obtained, but it said in a letter to lawmakers revealing the breach that “at this time there is no evidence indicating the threat actor has continued access to Treasury information.” It said the hack was being investigated as a “major cybersecurity incident.”   The revelation comes as U.S. officials are continuing to grapple with the fallout of a massive Chinese cyberespionage campaign known as Salt Typhoon that gave officials in Beijing access to private texts and phone conversations of an unknown number of Americans. A top White House official said Friday that the number of telecommunications companies confirmed to have been affected by the hack has now risen to nine.

RELATED COVERAGE ➤ Rhode Islanders’ data was leaked from a cyberattack on state health benefits website   FBI issues warning to leagues about organized crime groups targeting pro athletes   A caucus of military veterans seeks to bridge the political divide in a polarized Congress   Another Democratic state lawmaker in Florida is joining the Republican party   Border arrests are little changed in December, ending Biden’s term at lowest level   How American presidents have planned their own funerals

[phkrause]

Hack attack

The US Treasury says China-backed hackers recently breached its workstations in what officials are describing as a "major incident." In a letter reviewed by CNN, a Treasury official said the department was informed by a third-party software service provider on December 8 that a threat actor used a stolen key to remotely access certain Treasury workstations and unclassified documents. It's not clear exactly how many workstations were infiltrated or if the department has fully determined the extent of the damage caused by the breach. Treasury officials plan to hold a classified briefing about the hack next week with staffers from the House Financial Services Committee.

[phkrause]

? America's altered cyber playbook

Illustration: Shoshana Gordon/Axios

Under Trump 2.0, everything the cybersecurity industry knew about D.C. is up for debate, Sam Sabin writes in Axios Future of Cybersecurity — our new weekly newsletter launching today, succeeding Axios Codebook. Why it matters: For decades, U.S. presidents of both parties have viewed China, Russia, Iran and North Korea as the biggest cyber threats. But that list is now in question. President Trump's push to reset diplomatic ties with Russia — including U.S. Cyber Command's reported pause on new offensive operations against the country — is likely to upend long-standing cybersecurity norms, with consequences that could play out for years. A pause in offensive operations — even briefly — could take months to recover from, Jake Williams, a former NSA hacker and faculty member at IANS Research, told Axios. Planning a cyber offense requires months of lurking and learning about a target's networks to understand their weak points. Keep reading ...

[phkrause]

UN researchers warn that Asian scam operations are spreading across the rest of the world

BANGKOK (AP) — Transnational organized crime groups in East and Southeast Asia are spreading their lucrative scam operations across the globe in response to increased crackdowns by authorities, according to a U.N. report issued on Monday.

https://apnews.com/article/asian-scam-operations-cybercime-fraud-united-nations-494b1832f330d6a9690b083411809f93?