UnitedHealth’s Change Healthcare Hack Exposes Millions, Marking Largest Data Breach in U.S. Healthcare History and more Deepfake Scandals

We have now reached MORE than 23,745 subscribers! Thanks for your support. Help us with our mission of helping 100,000 organizations become cyber-resilient by sharing this newsletter with your network.

Be sure to read the "My thoughts" section to learn strategies for navigating and combating cyber attacks. I'm here to assist you in avoiding and battling these threats should they ever affect you.

Contact me if you have any questions regarding your enterprise's cybersecurity strategy --> Luigi Tiano.

P.S. We often do giveaways on our company page -->

Deepfake attack that used the CEO’s voice to steal credentials?

At the TechCrunch Disrupt conference in San Francisco, Assaf Rappaport, CEO and co-founder of Wiz, revealed that his employees recently fell victim to a deepfake attack where hackers impersonated his voice to steal credentials. The attackers used audio from a past conference to create the deepfake but failed because Rappaport's voice in the recording sounded different from how his employees knew him in daily interactions. This incident highlights the low risk of detection for cybercriminals, as the company could identify the source of the voice but not the attacker. Rappaport also discussed why Wiz declined a $23 billion acquisition offer from Google, emphasizing the significant opportunities in the cloud security market, which they estimate to be worth $100 billion. ( techcrunch.com ) ?

?

??My Thoughts: This attack on Wiz's employees illustrates a significant threat that we can't ignore. If even a cybersecurity company can fall victim to this type of sophisticated impersonation, it raises important questions about our defenses.?

Hackers using publicly available information to create convincing fakes is a tactic we all need to watch out for. The fact that the risk of getting caught is so low makes these attacks even more concerning.?

As we move into 2025, it’s crucial that we enhance our training around deepfake technology and its implications. The traditional cybersecurity awareness training we are accustomed to, just won’t cut it! Our teams must be equipped to recognize the subtle signs that indicate something is off. We need to proactively bolster our defenses to protect sensitive information and stay ahead of these evolving threats. Let’s ensure we’re not just reacting, but actively preparing for what’s next. ?

?

?

?

UnitedHealth Reports Change Healthcare Hack Impacts Over 100 Million, Marking Largest Data Breach in U.S. Healthcare History?

?

UnitedHealth has announced that a recent cyberattack on its Change Healthcare business may have compromised files containing personal information that could impact a substantial portion of Americans. The attack raises significant concerns about data security within the healthcare sector, highlighting vulnerabilities that can affect sensitive patient information. The scale of the breach is alarming, and UnitedHealth is working to assess the extent of the data exposed and implement necessary security measures to protect against future incidents. This incident underscores the critical importance of robust cybersecurity practices in healthcare organizations, where personal data is not only sensitive but also crucial for patient trust. ( techcrunch.com ) ?

?

My Thoughts: If files containing personal information for a substantial portion of Americans were compromised, we’re looking at a serious breach of trust and privacy.?

This incident highlights the pressing need for stronger cybersecurity measures in the healthcare sector. Protecting sensitive personal data should be a top priority, not just for compliance, but to maintain the trust of patients and consumers alike.?

Again, as we head into 2025, we must advocate for enhanced security protocols and better incident response plans. It's not enough to react to breaches; we need to proactively strengthen our defenses to safeguard against these evolving threats. ?

Canadian Library still not up back and running after ransomware attack??

?

The Calgary Public Library (CPL) recently fell victim to a ransomware attack on October 11, 2024, which forced all 22 branches to close temporarily. While services have since been restored with some modifications, the incident highlights the increasing vulnerability of public institutions to cyber threats. Experts point out that cultural organizations like libraries often lack robust cybersecurity infrastructure, making them attractive targets for hackers. This attack reflects a troubling trend, as libraries and other cultural institutions are being targeted more frequently, emphasizing the need for enhanced security measures to protect sensitive information and maintain public trust. ( globalnews.ca ) ?

?

My Thoughts: The ransomware attack on the Calgary Public Library underscores the need for robust defenses in public institutions. Here are six essential steps to reduce the risks of such attacks:?

1. Regular Data Backups?

1. Security Awareness and Training?

1. Network Segmentation and Access Controls?

1. Endpoint Detection and Response (EDR)?

1. Incident Response Planning?

1. Regular System Updates and Vulnerability Management?

By implementing these strategies, institutions like libraries can greatly enhance their resilience against cyber threats and maintain public trust.?

?

We only partner with the best on the market. We have a variety of options, tailored to your needs and organization size.??

?

Have questions about your cybersecurity posture? Let’s chat.?

?

Calendar Link ?

?

Is the CRA in big trouble? ?

?

The Canada Revenue Agency (CRA) has reported a series of significant cyberattacks that have led to unauthorized access to taxpayer accounts, resulting in the fraudulent disbursement of over $6 million in refunds. Hackers exploited confidential data from major tax preparation firms like H&R Block Canada to access personal CRA accounts, change direct deposit information, and file false returns. The agency acknowledged a surge in privacy breaches, with more than 31,000 incidents recorded between March 2020 and December 2023, affecting approximately 62,000 taxpayers. Criticism has been directed at the CRA for underreporting the scale of these breaches to Parliament, raising concerns about public trust in the agency’s ability to protect sensitive financial information. Experts are now calling for a comprehensive parliamentary inquiry to assess the situation and hold the CRA accountable for its cybersecurity shortcomings. ( cbc.ca ) ?

?

My Thoughts: The cyberattacks on the Canada Revenue Agency (CRA) reveal how crucial cybersecurity is for government agencies responsible for handling citizens' sensitive financial data. Protecting taxpayer information requires a multi-layered approach to cybersecurity, especially as attacks on government agencies become more sophisticated. Here are six key measures that could help mitigate the risks of such breaches:?

1. Multi-Factor Authentication (MFA)?

1. Third-Party Security Assessments?

1. Data Encryption and Access Control?

1. Continuous Monitoring and Incident Response?

1. Employee Security Awareness and Training?

1. Transparency and Accountability Practices?

By reinforcing these areas, organizations like the CRA can better safeguard taxpayer information, maintain public trust, and minimize the impact of future cyber incidents.?

?

Assurance IT can help. We know how it’s done.??

?