The IT Nerd

Earlier this week, the Singing River Health System issued a data breach notification stating that it is now estimating that 895,204 people were impacted by an August 2023 ransomware attack.

Singing River Health System is located in Mississippi and operates the 3 hospitals in the state totaling over 700 beds, as well as 2 hospices, 4 pharmacies, 6 imaging centers, 10 specialty centers, and 12 medical clinics all employing over 3,500 people.

The August 2023 ransomware attack resulted in operational disruptions at its hospitals and it was estimated that 501 individuals had personal data stolen. On September 13, the organization confirmed that data had been exfiltrated, and on December 18, it announced that the incident impacted 252,890 people.

According to the latest information in the notification and on the organization’s site, the exposed data includes:

• Full name
• DOBs
• Physical address
• SSNs
• Medical information
• Health information

The attack was claimed by the Rhysida ransomware gang which so far has leaked roughly 80% of the data they claim to hold, allegedly including 420,766 files totaling 754 GB.

BullWall Executive, Carol Volk had this comment:

   “The Singing River Health System’s ransomware attack is a stark reminder of the cybersecurity siege that healthcare organizations are under. This breach is not just a statistic but a severe blow to the trust and safety of nearly a million people. These victims had their most sensitive information—names, dates of birth, addresses, Social Security numbers, and medical records—exposed, placing them at significant risk of identity theft and fraud.
 
   “Hospitals and healthcare systems are prime targets for cybercriminals. The Rhysida ransomware gang’s claim to have leaked 80% of the data they stole highlights the immense challenges in protecting health information. Singing River Health System, with its extensive network of hospitals, clinics, and specialty centers, illustrates the vast attack surface and the inherent vulnerabilities within such a complex IT infrastructure.
 
   “The operational disruptions, coupled with the personal data theft of a staggering 252,890, reveal the deep and lasting scars these attacks inflict on healthcare services. The fallout from such breaches is catastrophic, not only in terms of financial loss but also in the erosion of patient trust and the potential delay or cancellation of critical medical treatments.
 
   “Healthcare organizations can assume they will be breached and must go beyond traditional defensive cybersecurity measures. It is imperative to implement robust ransomware containment defenses and maintain off-site backups to ensure continuity of care without succumbing to the demands of cyber extortionists. The Singing River Health System’s ordeal is a call to action for the entire healthcare sector to fortify its defenses and protect the sanctity of patient data and healthcare delivery.”

Once again I find myself in the position of having to say that healthcare needs more funding to protect themselves from attacks like these. The fact that I am constantly talking about this means that there’s a serious problem, which requires a real solution immediately.

On Monday via a press conference the City of Helsinki authorities shared details of their investigation of a data breach in its education division, which it discovered in late April of this year that is impacting 80,000 of students, guardians, and personnel.

According to the new details, an unauthorized actor gained access to a network drive after exploiting a vulnerability in a remote access server, a vulnerability that a patch was available for at the time of the attack but had not been installed.

The accessed drive contained tens of millions of files, most devoid of personally identifiable information with an “opportunity for abuse of which is not considered to be significant,” but still included usernames, email addresses, personal IDs, and physical addresses.

More concerning is the exposed drive containing information from the Educational Division:  

   “[…] fees (and the grounds thereof) for customers of early childhood education and care, sensitive information about the status of children, such as information requests by student welfare or information about the need of special support and medical certificates regarding the suspension of studies for upper secondary students, as well as the sick leave records of Education Division personnel.  We cannot rule out the possibility of the perpetrator gaining access to data of persons under a non-disclosure restriction,” read the City of Helsinki online update.

Currently, no ransomware groups have assumed responsibility for the attack and the perpetrators remain unknown.

Emily Phelps, Director, Cyware had this comment:

   “Data breaches that impact the education sector reinforce the importance of a proactive security posture that goes beyond security hygiene and traditional controls. To effectively get ahead of attackers, comprehensive threat intelligence sharing and the operationalization of this intelligence is critical.

   “Incorporating real-time threat intelligence can help organizations anticipate potential threats and take preemptive actions. By fostering a collaborative environment where information on threats is actively shared among trusted partners, entities can enhance their defensive mechanisms against sophisticated attacks.”

Dave Ratner, CEO, HYAS follows with this:

   “While patching systems in a timely manner is clearly best practices for any organization that cares about security, the reality is that it’s next to impossible to ensure that each and every patch is applied before a bad actor can take advantage of the vulnerability.  This is just one of the reasons that governments around the world are recommending Protective DNS and cyber resiliency solutions as a way of ensuring that bad actors inside the environment are stopped and shut down before damage ensues.”

This is pretty bad as the threat actor appears to have walked in through a metaphorical unlocked door to pwn the City of Helsinki. Let this be an object lesson to all that you need to make sure that you don’t make it that easy for a threat actor to pwn you.