According to the U.S. Department of Health and Human Services Breach Portal, a major cyberattack on ApolloMD, a large healthcare services provider, exposed the personal information of 626,540 people in a breach that occurred May 22-23, 2025. Attackers accessed the company’s IT systems before being detected, and viewed sensitive data tied to ApolloMD’s affiliated physicians and practices, including patient names, addresses, medical diagnoses, insurance info, dates of service, and some social security numbers.
The company first reported the breach in September 2025, and provided authorities with the full number of victims this week.
The ransomware gang Qilin has claimed responsibility for the attack, adding the company to its Tor-based leak site in early June 2025.
Here’s some commentary on this.
Vishal Agarwal, CTO Averlon:
“The ApolloMD breach is unlikely to stem from a single missed vulnerability. Maintaining access for two days and reaching sensitive patient records suggests attackers were able to assemble an attack chain that led to protected health information.
“In complex healthcare environments, applications and service identities often accumulate access over time. When systems are overprivileged, an attack chain does not stop at the initial compromise. It expands the blast radius and increases the volume of sensitive data that can be accessed.
“In such environments, an assume-breach mindset and strict enforcement of least privilege are essential. Eliminating unnecessary access paths reduces blast radius and prevents an initial foothold from expanding into material data exposure.”
Michael Bell, CEO, Suzu Labs:
“Dark web intelligence shows over 500 ApolloMD corporate credentials were already circulating on underground forums and Telegram channels before the breach. They came from third-party breaches going back years and were available to anyone who looked. When a healthcare organization holding data on 626,000 patients has that kind of credential exposure on the dark web unaddressed, the ransomware group doesn’t need a zero-day. They need a login.
“238 gigabytes exfiltrated in 48 hours is not subtle. That should trigger every exfiltration alarm in the stack. If it didn’t, the monitoring wasn’t tuned for it. If it did and nobody acted, that’s worse. Qilin had a documented playbook before they hit ApolloMD. The Synnovis attack in 2024 crippled London hospitals and contributed to patient deaths. Their targeting, tools, and techniques were public knowledge.
“Healthcare keeps treating vendor security like a regulatory exercise instead of an operational risk. ApolloMD touches patient data across dozens of physician groups. One vendor compromised, 626,000 patients exposed. And nine months between the breach and the HHS filing means those patients carried the exposure without knowing it. HIPAA requires notification within 60 days of discovery. The math doesn’t work.”
John Carberry, Solution Sleuth, Xcape, Inc.:
“The ApolloMD data breach, which compromised the sensitive medical information of over 626,000 patients, serves as a stark warning that the healthcare industry has become a prime target for sophisticated extortionists globally. The Qilin ransomware group has been identified as the same Russian-linked entity behind the 2024 Synnovis attack. That incident disrupted London hospitals and reportedly led to at least one patient fatality, and they have now extended its “industrialized” extortion tactics to the U.S. healthcare system. Qilin’s impressive efficiency is underscored by its ability to exfiltrate 238GB of data, containing diagnoses and Social Security numbers, in just 48 hours, a speed that overwhelms conventional reactive defense strategies. The delayed revelation of the breach’s full extent, only recently reported to federal regulators, exposes the significant “visibility gap” inherent in managing third-party physician groups.
“Security Operations Centers must understand that Qilin’s objective goes beyond mere financial gain; they leverage operational disruption and the considerable “shame value” associated with sensitive medical diagnoses to compel settlements. Qilin’s admitted involvement further emphasizes the persistent threat posed by ransomware groups to healthcare services and patient safety, echoing previous disruptive attacks on medical providers. The repercussions for patients can extend for years, even when services appear to be unaffected on the surface. Such patient information can be valuable to unscrupulous entities so further such misuses of the exfiltrated data are possible.
“When ransomware can weaponize 600,000 medical records in a single weekend, it underscores the fact that “compliance” is just paperwork but cybersecurity is the lifeblood.”
Groups like Qilin highlights the fact that it’s not optional for organizations to have a robust defence strategy. It’s mandatory or they will simply become another statistic.
Apple Patches Exploited Zero Day That Has Been Around For YEARS
Posted in Commentary with tags Apple on February 13, 2026 by itnerdApple has issued patches this week for an exploited zero-day that’s reported to have been in each version of iOS since v1.0. Which takes us back to the late 2000’s to the first iPhone in 2007.
Apple’s advisory notes: “An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.”
Mobile security expert Madhav Benoi, Head of Security Research, Approov had this to say:
“This attack is a powerful primitive that can be used to run arbitrary code. The good news is that it only affects iOS versions below 26.
“The immediate downside for a victim is complete device compromise. It makes sense that it was used for targeted individuals as for certain political/informational gain, this is a weapon that can be used to gain entryway into targets.
“Users and organizational security teams should patch Apple iPhones immediately, and if they’re still using iOS 18 and haven’t moved to 26, please do As soon As possible. If they’re continuing to run an iOS version below 26, they just be careful with what apps they install. Keep an eye out if any apps are popping up random things and are asking for permissions that they don’t need. This could be an indicator of compromise.”
Damon Small, Board Member, Xcape, Inc. adds this:
“Apple’s emergency patch for CVE-2026-20700 signifies a rare and concerning development, as the company explicitly warns of an “extremely sophisticated attack,” likely linked to nation-state espionage or commercial spyware. The significant drawback is that even highly controlled mobile ecosystems are vulnerable to advanced exploitation, and targeted individuals may have minimal indication that their devices have been compromised. Discovered by Google’s Threat Analysis Group, this zero-day vulnerability targets the Dynamic Link Editor (dyld), the essential “gatekeeper” responsible for how every application loads and is protected from each other on your device. By compromising this core component, attackers can completely bypass this iOS sandbox, enabling them to execute arbitrary code and silently install persistent surveillance tools.
“The true concern lies in the frightening precision of the exploit chain, which was used in conjunction with previously patched WebKit vulnerabilities to target high-value individuals with “zero-click” efficiency. For any team managing a fleet of Apple devices, this is not a standard update; it’s a critical emergency that necessitates immediate patching to iOS 26.3 or iOS 18.7.5. Individual users need to be concerned as well and should also update immediately.
“Patch fast or get pwned! If your iPhones aren’t on the latest build, assume someone’s already working on the next 0-day.”
If you haven’t updated to iOS 26.3, I’d be doing so ASAP. While you’re at it, you should update the rest of your Apple gear as well as there are updates for watchOS, macOS and others that were released at the same time. While Apple exploits tend to be used against high value targets such as human rights campaigners, journalists, and politicians, that could change at any time. Thus it’s time to patch all the things in order to be safe.
Leave a comment »