2023 Week 48
Summary
This week's news focused on the legal and water sectors. On the water side we saw two high profile attracts in the US but it is still unclear if they are related.
News
SLTT
The Kansas Judicial Branch has confirmed that hackers stole sensitive files in a breach last month. The October attack impacted the availability of several systems at the time. These systems included the eFiling system, electronic payment systems, and case management systems.
It appears that, like other attacks recently, the threat actors stole data prior to the ransomware phase of the attacks. Neither Kansas nor the threat actors have identified who is responsible.
The New York City Bar Association has disclosed in filings to the states of Main and Vermont that an investigation completed in October confirmed that hackers gained access to internal files last December. This corroborates the Clop ransomware gang claim in January. In that announcement, they threatened to leak 1.8 TB of data. The Bar Association is providing victims with 12 months of free credit monitoring, identity theft protection services, and up to 1 million dollars of insurance. This was a rare attack by Clop who in this case took the step of encrypting the data and stealing it, as is their normal mode of operation.
Water
A group calling themselves CyberAv3ngers has claimed attacks on several water systems worldwide that are using the Unitronics SCADA software. This now includes the municipal water system of Aliquippa, Pa. They detected the attack in one of their pumping stations and were able to take that station offline.
The North Texas Municipal Water District has announced it was the target of a ransomware attack. The district has said that no disruption of services has occurred. The ransomware group Daixin Team has claimed responsibility for the attack. They state that they have obtained PII to include Social Security numbers. They are threatening to release the 33,844 records if they do not get a payment. This follows a trend of late to start the attack by exfiltrating the data and holding it hostage. The district says it is working with law enforcement and a forensic specialist.
Healthcare
Ardent Health Services has fallen victim to a ransomware attack that has taken its entire network offline. This is affecting hospitals in 6 states to include emergency services. Ardent is working with law enforcement and is working with 3rd party experts.
Healthcare product and services provider, Henry Schein, reported being a victim of a second cyber attack this month. In both cases, it appears to be the BlackCat/ALPHV ransomware gange. The group encrypted systems for the 3rd time since October. In the second situation, the group performed the action after negotiations faltered from the first encryption.
Portneuf Medical Center in Portneuf Idaho is investigating a possible security breach. As a precaution, the emergency room is currently on divert, but other hospital operations are continuing. At the time of this writing, their website says that the ER is back open.
Capital Health, which operates several hospitals in New Jersey and Pennsylvania, is dealing with a cyber attack. They report they are still serving patients including Emergency Room visits. They are working with authorities, law enforcement, and 3rd parties to investigate the situation.
Comments
Post a Comment