Latest

Fraud Management & Cybercrime

Hacker in UPMC Data Theft, Fraud Case Gets Maximum Sentences

Marianne Kolbasuk McGee  •  October 20, 2021

A federal judge has imposed the maximum sentences - a total of seven years in prison - on a hacker who earlier pleaded guilty in a conspiracy case involving the hacking of University of Pittsburgh Medical Center human resources databases and the theft of personal information of 65,000 employees - some which was sold...

3rd Party Risk Management

Ransomware Soap Opera Continues With REvil’s Latest Outage

Mathew J. Schwartz  •  October 20, 2021

Is there any bigger cybercrime soap opera than the life and times of ransomware operators? Take the REvil, aka Sodinokibi, ransomware-as-a-service operation, which feels like it's disappeared and reappeared more times than the secret, identical twin of the protagonist in your favorite melodrama.

Blockchain & Cryptocurrency

New York Tells 2 Cryptocurrency Firms to Cease and Desist

Dan Gunderman  •  October 19, 2021

New York State AG Letitia James served cease and desist letters to two cryptocurrency lending platforms that her office says engage in "unregistered and unlawful activities." Three other platforms were told by the OAG to "immediately provide information about their activities and products."

Endpoint Detection & Response (EDR)

More Attempted Cyberattacks on Israeli Healthcare Entities

Marianne Kolbasuk McGee  •  October 19, 2021

Israeli officials say they have fended off a wave of attempted cyberattacks on several hospitals and healthcare entities in recent days, as Hillel Yaffe Medical Center continues to recover from a ransomware attack last week that authorities reportedly suspect was carried out by Chinese hackers.

►

Cybercrime

Preparing for Ransomware Attacks in the Education Sector

Anna Delaney  •  October 19, 2021

A spate of ransomware incidents affecting the education sector has led to the loss of student coursework, financial records and data relating to COVID-19 testing. Matthew Trump, senior IT security officer for the University of London, U.K., outlines incident response strategies.

Fraud Management & Cybercrime

Analysis: Top Ransomware Gangs Targeting Healthcare Sector

Marianne Kolbasuk McGee  •  October 18, 2021

Ransomware attacks are continuing to threaten the U.S. and global healthcare sectors, in part due to many organizations' high dependency on legacy systems and lack of security resources, says new analysis by federal officials, which also identified the top ransomware gangs hitting the sector.

Breach Notification

Thingiverse Breach: 50,000 3D Printers Faced Hijacking Risk

Jeremy Kirk  •  October 18, 2021

A data breach affecting MakerBot's Thingiverse 3D printing repository website is far bigger than what the company has acknowledged, a former employee claims. Upwards of 2 million users may have been affected by the breach, which left their 3D printers at risk of being hijacked.

Anti-Money Laundering (AML)

Treasury Dept. to Crypto Companies: Comply with Sanctions

Dan Gunderman  •  October 16, 2021

The U.S. Department of the Treasury unveiled additional steps to curb the illicit use of cryptocurrencies on Friday, warning enterprises not to engage with sanctioned entities exploiting the financial system - particularly to launder ransomware proceeds.

►

3rd Party Risk Management

ISMG Editors' Panel: Are Our Systems Too Complex to Secure?

Anna Delaney  •  October 15, 2021

In this update, four editors discuss key cybersecurity issues, including addressing the complexity of security, the rising number of victims targeted by double extortion ransomware and the Information Commissioner's Office's recent consultation on creating an international data transfer agreement.

Access Management

Missouri Refers Coordinated Bug Disclosure to Prosecutors

Jeremy Kirk  •  October 15, 2021

A newspaper reporter in Missouri who responsibly reported the exposure of Social Security numbers on a state government website has been accused of malicious hacking by the state's governor. The governor alleged the publication of the vulnerability after it was fixed was part of a "political vendetta."

Account Takeover Fraud

Teenage Cybercrime: Giving Young Hackers A Second Chance

Anna Delaney  •  October 15, 2021

The latest edition of the ISMG Security Report features an analysis of attempts made by European law enforcement to encourage young cybercriminals to channel their skills in more ethical ways. Also featured: Fraud detection and response; inspiring behavioral change.

3rd Party Risk Management

Profiles in Leadership: John O'Driscoll, State of Victoria

Jeremy Kirk  •  October 14, 2021

John O'Driscoll is the first CISO for the Australian state of Victoria, a job that has purview over 1,900 entities with 340,000 public servants. He's an expert in risk and audit, and that has subsequently lead to interesting conversations about who is accountable for risk and how to manage risk.