The IT Nerd

Newspaper giant Lee Enterprises has reported that personal information belonging to 39,779 people was stolen in a February 2025 ransomware attack which you can read about here.

Jim Routh, Chief Trust Officer at Saviynt had this to say:

“Sophisticated threat actors continue to target enterprises with a high likelihood of making an extortion payment to resume critical operations. Often the threat actors will target an enterprise data replication and recovery infrastructure to create great disincentive to avoid a ransom payment. 

“The key for enterprises to avoid these types of attacks is to supplement their privileged access user monitoring system (PAM) with continuous validation based on user behavior analytics. Any significant deviation of pattern by a privileged user results in an automatic revocation of the entitlement operating in milliseconds. Continuous validation is not common for enterprises today, but it offers an essential control to reduce the risk of a ransomware attack causing significant business disruption.”

Roger Grimes, Data-Driven Defense Evangelist at KnowBe4 adds this:

“This seems like a standard, run-of-the-mill ransomware event. It is a little concerning that the breach happened in early February and impacted victims are just learning about the breach 4 months later. That isn’t timely.

“Second, this is the second data breach they suffered. What can they tell customers and employees to allay fears of another breach? Do they know how this breach happened, or the last? What steps are they taking to make sure that further breaches using the same methods or other hacking methods don’t happen again?

“Every company is given one breach forgiveness. But not two. When the second breach happens, customers and victims need to know how the breach happened (likely social engineering, unpatched software or firmware, or weak credentials), and what steps the company is taking to prevent it from happening again. Customers won’t likely give automatic forgiveness for the third breach.”

I will be interested in finding out what actually happened here and what Lee Enterprises will do to stop it from happening again. Hopefully those details actually see the light of day seeing as almost 40,000 people have been affected in this attack.

This morning, ransomware gang Interlock posted Kettering Health to its data leak site. It alleges to have stolen 941 GB of Kettering’s data, which includes 732,490 files across 20,418 folders and appears to contain ID cards, payment data, financial reports, and more.

In a blog post today, Rebecca Moody, Head of Data Research at Comparitech, commented:

“Interlock first began adding victims to its data leak site in October 2024. As with most ransomware gangs today, it seeks a ransom payment for the decryption of systems and the deletion of stolen data. Since October 2024, we’ve tracked 17 confirmed attacks via this group and a further 22 unconfirmed attacks that haven’t been acknowledged by the organizations in question. Interlock was also responsible for the April 2025 attack on kidney dialysis firm DaVita. This too caused widespread disruption to patient care and saw a large breach of 1.5 TB of data.”

“2025 has already seen 26 confirmed attacks on US healthcare companies, as well as a further 92 unconfirmed. Other recently confirmed attacks include Marlboro-Chesterfield Pathology, P.C. which was hit by SafePay in January 2025. This resulted in a data breach involving 235,911 people.”

“Over the last week, Bradford Health Services and Next Step Healthcare, LLC have started notifying patients of breaches stemming from older ransomware attacks. Bradford Health Services suffered an attack via Hunters International in December 2023 and has now confirmed 22,465 people were affected. Meanwhile, Next Step Healthcare, LLC has just started notifying 12,090 people of a breach following an attack via Qilin in June 2024.”

“As we are seeing with Kettering Health, ransomware attacks on healthcare companies have the potential to cause widespread disruption. Not only can they result in patient care being impacted after systems are encrypted, but the consequences are often felt months, and even years, afterward when data is stolen by hackers. In 2024 alone, nearly 27.3 million records were breached across 163 individual ransomware attacks on US healthcare companies.”

Once again, health care is the victim of a cyberattack. This isn’t a trivial event as any attack can cost lives potentially. More focus is needed to change this paradigm and that needs to happen fast.