The IT Nerd

Remember when I told you that the infamous ransomware group LockBit claimed to have pwned The Federal Reserve? Well that turns out to be incorrect because yesterday, Evolve Bank & Trust confirmed in an online statement that hackers stole retail bank and financial technology partners’ customers’ information and posted it on the dark web. Here’s the connection to the Federal Reserve. The documents that were posted in relation to the alleged Federal Reserve hack actually belonged to Evolve.

“33 terabytes of juicy banking information containing Americans’ banking secrets,” claimed LockBit on its leak site.

The bank said it is investigating the incident and it appears the hackers have released data including Personal Identification Information that varies by individual but may include:

• Name
• Social Security Number
• Date of birth
• Account information
• Other personal information

Earlier this month, Evolve was subject to a Federal Reserve enforcement action and Tuesday LockBit’s dark web post linked a press release about the enforcement action alongside a collection of information apparently taken from the institution’s systems. 

Stephen Gates, Principal Security SME, Horizon3.ai had this to say:

   “Once an organization experiences a breach, and the smoke begins to clear after a deep investigation into what happened, the biggest question they need to ask is, “What do we do next?” Everything in the networking environment is now suspect, possibly riddled with other exploitable vulnerabilities and weaknesses that likely remain hidden. Teams must find the attack path that allowed the breach to happen, and they must uncover other attack paths that could enable it to happen again.

   “Now is the time to thoroughly assess the entire networking environment, both on-premises and cloud, but that could take months if not longer. And as one area gets assessed, and human assessors move on to the next, changes have already taken place in areas that were previously marked as secure. This is the time when autonomous assessment solutions meet a critical need.

   “These technologies are designed to find the original attack path (if it still remains a mystery) and other attack paths that remain unknown. Acting as force multipliers for human assessors, autonomous assessment solutions never tire as they scan the entire environment looking for other weaknesses such as easily compromised credentials, additional exposed data, unidentified software misconfigurations, inadequately implemented security controls, and unenforced security policies.

   “Some of these issues were probably uncovered by attackers when defenses were breached the first time. If they are not resolved now, the inescapable will likely happen again.”

At this point, Evolve has some explaining to do given the fact that it was subject to an enforcement action from the Federal Reserve. And Evolve’s customers will be waiting to hear those answers.

Yesterday, South Africa’s National Health Laboratory Service (NHLS) confirmed it is experiencing a ransomware attack that is affecting the dissemination of lab results amidst a monkeypox outbreak.

Saturday morning, hackers deleted sections of NHLS’s systems and backup servers, “rendering them inaccessible and blocking communication” from databases to and from users. 

All the 265 laboratories the NHLS runs are still functional and continue to receive and process clinical samples, but lab reports are not automatically generated and sent to clinicians forcing more urgent test results to be communicated to doctors over the phone or printed and mailed. 

The ransomware attack has caused concern in South Africa given the outbreak of monkeypox. As of Tuesday, three deaths and 16 laboratory-confirmed cases have been found. 

Officials do not know when the systems will be restored. 

Cigent CGO Brett Hansen had this to say:

   “No one is immune from attack. The days of healthcare and children being off limits to attacks are over. Organizations need to be proactively protecting their data vs detect and respond. This requires embracing zero-trust access controls that assume device or credential compromise. Utilizing step-up authentication, a low-friction requirement that controls endpoint data access can prevent ransomware or other malware from accessing files even when the device has been compromised. Protected endpoint data can still be accessed during an attack, allowing continued operation through the crisis.”

This is yet another example of heathcare being a target of threat actors. While I never try to blame the victim so to speak, healthcare needs to do a better job of protecting themselves from threat actors. Some of that comes from better funding, and some of that comes from just putting in the work. Otherwise this will keep repeating itself.