Homepage

The settlement with the 9.2 million individuals whose data was stolen during a longstanding undetected hack on the vendor included denial by liability by Accellion, which maintains that the company held no legal duty of care to individuals, and that customers were responsible for managing their own software instances – despite security flaws in the product.

The SolarWinds and Microsoft Exchange incidents improved coordination between the government and private industry, but also exposed worrying gaps in the government’s information sharing, auditors concluded in a new Government Accountability Office report released Thursday.

A ransomware attack struck the Maryland Department of Health on Dec. 4, driving the systems offline in an effort to contain the spread. The outage has spurred manual COVID-19 reporting.

Attacks using QakBot, the persistent "Swiss Army knife" of banking malware, increased by 65% in 2021, according to cybersecurity and anti-virus firm Kaspersky.

BioPlus notified 350,000 patients that their data was accessed during a systems hack. A lawsuit provides further details of the incident, while blaming the breach on inadequate security.

The Supply Chain Security Training Act and State and Local Government Cybersecurity Act now head to the House, where companion legislation has been introduced.

Proposed legislation would elevate the roles of CISA and the National Cyber Director's Office when it comes to overseeing federal cybersecurity, but some members of Congress and the OMB are wary of changes that could add new bureaucratic complexities.

This week’s healthcare breach roundup includes multiple breach disclosures that may not comply with the 60-day breach disclosure timeline required by HIPAA.