May 1, 2026 • 4 mins
In this episode, we break down the FBI's latest Internet Crime Report naming healthcare as the top ransomware target, OCR's four new HIPAA settlements totaling over $1 million, and the Medtronic data extortion incident affecting millions of records. We also examine findings from Paubox's Healthcare Email Security Maturity Index, which reveals critical gaps in AI-based defenses despite rising AI-driven attacks, and discuss what these trends mean for your organization's security posture.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:00):
You're listening to Pow Box Weekly, fully automated.
SPEAKER_01 (00:02):
And I'm Jen.
I read breach reports, so youdon't have to.
Well, actually, you still haveto.
Sorry.
SPEAKER_00 (00:08):
I'm Alex, healthcare IT guy who keeps hoping one week
the news will be boring.
This is not that week.
Is it ever?
Fair point.
So let's start with the FBI'sannual internet crime report.
Healthcare is officially themost targeted sector for
ransomware in 2025.
Number one.
We're number one.
SPEAKER_01 (00:29):
Not the trophy anyone wanted.
But not surprising either.
The logic is simple (00:32):
attackers go where the pain is highest.
Hospitals can't just pause.
Every hour of downtime ispatient care on the line.
That pressure makes people pay.
And it wasn't just ransomware.
SPEAKER_00 (00:45):
Business email compromise was actually the most
damaging attack type overall.
Which tracks.
SPEAKER_01 (00:51):
BEC doesn't need malware, it needs one person to
trust the wrong email.
And in healthcare, wherecoordination happens constantly
over email, it's a rich target.
SPEAKER_00 (01:01):
So the takeaway here
headlines, but email compromiseis quietly draining accounts.
Both deserve your attention.
Neither is going away.
Speaking of ransomware, OCR justannounced four HIPAA
settlements, all tied toransomware incidents.
Over 427,000 individualsaffected.
SPEAKER_01 (01:22):
And the settlements totaled$1.165 million, which,
honestly, for fourorganizations, that's not
catastrophic.
But it's the principle.
SPEAKER_00 (01:33):
OCR Director Paula Stannard made the point clearly.
Implementing the security rulebefore a breach isn't just the
law.
It's your best shot atpreventing or surviving an
attack.
Right.
SPEAKER_01 (01:45):
These weren't fines for getting hit.
They were fines for not beingready.
SPEAKER_00 (01:48):
Risk analysis, access controls, the basics.
The unsexy stuff that saves you.
Meanwhile, Medtronic confirmed acyber attack this week.
Shiny Hunters, the group behindit, claims they stole over 9
million records.
And they're doing the classicextortion play.
Pay up or we publish.
This is the shift we keepseeing.
(02:10):
It's not just encrypt and ransomanymore, it's steal and
threaten.
Which changes the calculus.
SPEAKER_01 (02:16):
Even if you have backups, even if you can
recover, your data is still outthere.
That's the leverage now.
SPEAKER_00 (02:23):
So what's the defense?
SPEAKER_01 (02:25):
Layers.
Encryption.
Segmentation.
Monitoring for exfiltration, notjust malware.
And honestly, assume breach.
Plan for what happens when, notif, someone gets in.
SPEAKER_00 (02:37):
Let's talk about Powbox's new report, the
Healthcare Email SecurityMaturity Index.
SPEAKER_01 (02:43):
This one's a gut check.
They surveyed 170 healthcare ITleaders across eight dimensions
of email security.
And the numbers are sobering.
58% of organizations werebreached through email in the
last two years.
64% have been hit by anAI-generated email attack.
SPEAKER_00 (03:00):
But only 38% have AI-based defenses fully deployed
and monitored.
SPEAKER_01 (03:06):
So the attackers are using AI, and most defenders
aren't keeping up.
SPEAKER_00 (03:11):
The report maps organizations into maturity
tiers.
It's a good benchmark if youwant to see where you stand.
Links in the newsletter.
And finally, Absolute Dental, aNevada-based practice, just
agreed to a$3.3 million classaction settlement after a breach
earlier this year.
SPEAKER_01 (03:30):
Million-dollar lawsuits are becoming routine.
That's not an exaggeration.
We've seen it over and over.
SPEAKER_00 (03:36):
And it's not just the fine.
It's legal fees, its reputation,its years of fallout.
SPEAKER_01 (03:42):
The breach itself is just day one.
The cost curve keeps climbinglong after.
SPEAKER_00 (03:47):
So let's bring it together.
FBI says healthcare is the toptarget.
OCR is settling ransomware casesleft and right.
Most organizations aren't readyfor AI-driven attacks, and
lawsuits are stacking up.
SPEAKER_01 (04:04):
And the through line isn't bad luck.
It's bad configurations, blindspots, gaps that were fixable
before they became expensive.
SPEAKER_00 (04:12):
Risk assessments that didn't happen.
Defenses that weren't deployed.
SPEAKER_01 (04:19):
The good news?
Most of this is preventable.
Not all of it, but most.
SPEAKER_00 (04:24):
That's the work.
SPEAKER_01 (04:25):
That's always the work.
Thanks for listening, everyone.
Stay safe out there.
And check your email securitysettings.
Seriously.
You're listening to Pow Box Weekly, fully automated.
SPEAKER_01 (00:02):
And I'm Jen.
I read breach reports, so youdon't have to.
Well, actually, you still haveto.
Sorry.
SPEAKER_00 (00:08):
I'm Alex, healthcare IT guy who keeps hoping one week
the news will be boring.
This is not that week.
Is it ever?
Fair point.
So let's start with the FBI'sannual internet crime report.
Healthcare is officially themost targeted sector for
ransomware in 2025.
Number one.
We're number one.
SPEAKER_01 (00:29):
Not the trophy anyone wanted.
But not surprising either.
The logic is simple (00:32):
attackers go where the pain is highest.
Hospitals can't just pause.
Every hour of downtime ispatient care on the line.
That pressure makes people pay.
And it wasn't just ransomware.
SPEAKER_00 (00:45):
Business email compromise was actually the most
damaging attack type overall.
Which tracks.
SPEAKER_01 (00:51):
BEC doesn't need malware, it needs one person to
trust the wrong email.
And in healthcare, wherecoordination happens constantly
over email, it's a rich target.
SPEAKER_00 (01:01):
So the takeaway here
headlines, but email compromiseis quietly draining accounts.
Both deserve your attention.
Neither is going away.
Speaking of ransomware, OCR justannounced four HIPAA
settlements, all tied toransomware incidents.
Over 427,000 individualsaffected.
SPEAKER_01 (01:22):
And the settlements totaled$1.165 million, which,
honestly, for fourorganizations, that's not
catastrophic.
But it's the principle.
SPEAKER_00 (01:33):
OCR Director Paula Stannard made the point clearly.
Implementing the security rulebefore a breach isn't just the
law.
It's your best shot atpreventing or surviving an
attack.
Right.
SPEAKER_01 (01:45):
These weren't fines for getting hit.
They were fines for not beingready.
SPEAKER_00 (01:48):
Risk analysis, access controls, the basics.
The unsexy stuff that saves you.
Meanwhile, Medtronic confirmed acyber attack this week.
Shiny Hunters, the group behindit, claims they stole over 9
million records.
And they're doing the classicextortion play.
Pay up or we publish.
This is the shift we keepseeing.
(02:10):
It's not just encrypt and ransomanymore, it's steal and
threaten.
Which changes the calculus.
SPEAKER_01 (02:16):
Even if you have backups, even if you can
recover, your data is still outthere.
That's the leverage now.
SPEAKER_00 (02:23):
So what's the defense?
SPEAKER_01 (02:25):
Layers.
Encryption.
Segmentation.
Monitoring for exfiltration, notjust malware.
And honestly, assume breach.
Plan for what happens when, notif, someone gets in.
SPEAKER_00 (02:37):
Let's talk about Powbox's new report, the
Healthcare Email SecurityMaturity Index.
SPEAKER_01 (02:43):
This one's a gut check.
They surveyed 170 healthcare ITleaders across eight dimensions
of email security.
And the numbers are sobering.
58% of organizations werebreached through email in the
last two years.
64% have been hit by anAI-generated email attack.
SPEAKER_00 (03:00):
But only 38% have AI-based defenses fully deployed
and monitored.
SPEAKER_01 (03:06):
So the attackers are using AI, and most defenders
aren't keeping up.
SPEAKER_00 (03:11):
The report maps organizations into maturity
tiers.
It's a good benchmark if youwant to see where you stand.
Links in the newsletter.
And finally, Absolute Dental, aNevada-based practice, just
agreed to a$3.3 million classaction settlement after a breach
earlier this year.
SPEAKER_01 (03:30):
Million-dollar lawsuits are becoming routine.
That's not an exaggeration.
We've seen it over and over.
SPEAKER_00 (03:36):
And it's not just the fine.
It's legal fees, its reputation,its years of fallout.
SPEAKER_01 (03:42):
The breach itself is just day one.
The cost curve keeps climbinglong after.
SPEAKER_00 (03:47):
So let's bring it together.
FBI says healthcare is the toptarget.
OCR is settling ransomware casesleft and right.
Most organizations aren't readyfor AI-driven attacks, and
lawsuits are stacking up.
SPEAKER_01 (04:04):
And the through line isn't bad luck.
It's bad configurations, blindspots, gaps that were fixable
before they became expensive.
SPEAKER_00 (04:12):
Risk assessments that didn't happen.
Defenses that weren't deployed.
SPEAKER_01 (04:19):
The good news?
Most of this is preventable.
Not all of it, but most.
SPEAKER_00 (04:24):
That's the work.
SPEAKER_01 (04:25):
That's always the work.
Thanks for listening, everyone.
Stay safe out there.
And check your email securitysettings.
Seriously.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Breakfast Club
The World's Most Dangerous Morning Show, The Breakfast Club, With DJ Envy, Jess Hilarious, And Charlamagne Tha God!