IBJI agrees to $4 million settlement after breach

This episode examines recent healthcare data breaches and settlements, including the $4 million IBJI case involving extended attacker dwell time, Mission Community Hospital's $1.5 million RansomHouse extortion settlement, and third-party vendor risks exposed by the La Perouse billing breach. We also discuss Rutgers University research showing hospitals using third-party tracking pixels are 46 percent more likely to experience breaches, emphasizing the critical need for system patching, vendor oversight, and web property audits.

Episode Transcript

SPEAKER_00 (00:00):
You're listening to Pow Box Weekly fully automated.

SPEAKER_01 (00:02):
And I'm Jen, cybersecurity analyst, breach
report enthusiast, occasionalpessimist.

SPEAKER_00 (00:08):
I'm Alex, healthcare IT guy who keeps hoping next
week's news will be boring.
It never is.

SPEAKER_01 (00:15):
Spoiler alert, it's not boring this week either.

SPEAKER_00 (00:18):
No, it is not.
Let's start with Illinois Boneand Joint Institute.
IBJI.
They've agreed to a$4 millionsettlement after a breach last
year.

SPEAKER_01 (00:29):
This one's a slow burn.
Attackers had access from lateMay through July 4th, over a
month inside the network.

SPEAKER_00 (00:36):
And they didn't detect it until Independence
Day, which ironic?

SPEAKER_01 (00:41):
Very on the nose.
But here's what matters.
The class action lawsuits camefast, consolidated into one big
settlement.
$4 million.

SPEAKER_00 (00:50):
The takeaway for administrators?
Dwell time kills.
If you're not actively huntingfor threats, you might not know
they're there until it's way toolate.
And too late now comes with aprice tag.
Speaking of price tags, MissionCommunity Hospital in San
Fernando Valley.
They're settling for one and ahalf million after a ransom

(01:11):
house attack in 2023.

SPEAKER_01 (01:13):
Ransom House is interesting.
They don't encrypt anything.
No ransomware in the traditionalsense.

SPEAKER_00 (01:19):
Wait, so what's their play?

SPEAKER_01 (01:21):
Pure extortion.
They steal your data, in thiscase, two and a half terabytes,
and threaten to publish it ifyou don't pay.
When negotiations failed, theyposted it publicly.

SPEAKER_00 (01:32):
Two and a half terabytes?

SPEAKER_01 (01:34):
That's a lot of patient data.
It's everything.
And they got in throughvulnerabilities in Paragon and
Cisco systems.
Known vulnerabilities.
Patchable vulnerabilities.

SPEAKER_00 (01:46):
So the lesson here isn't beware of sophisticated
hackers, it's patch your stuff.
It's almost always patch yourstuff.
Alright, next up, a breach at amedical billing company called
La Peruse.
Based in Vegas, at least sevenhealthcare providers affected.

SPEAKER_01 (02:03):
And here's where it gets messy.
The breach didn't even happen atLa Peruse directly.
It happened at one of theirthird-party billing platforms.

SPEAKER_00 (02:11):
So patients are connected to a provider who uses
La Peruse, who uses anothervendor who got breached.

SPEAKER_01 (02:18):
Exactly.
Two degrees of separation.
And La Peruse didn't name theplatform that was actually
compromised.

SPEAKER_00 (02:24):
Which makes it almost impossible for the
affected organizations to assesstheir own risk.

SPEAKER_01 (02:30):
That's the problem with vendor sprawl.
You can't secure what you can'tsee.
And if your vendors havevendors, good luck.

SPEAKER_00 (02:37):
The practical takeaway?
Ask your billing partners whothey're working with.
Get it in writing.

SPEAKER_01 (02:45):
And make sure your contracts include breach
notification requirements allthe way down.

SPEAKER_00 (02:50):
Alright, last story.
And this one's a bit different.
Rutgers University did someresearch on tracking pixels.
You know, those little bits ofcode that follow users around
the web.

SPEAKER_01 (03:02):
Third-party tracking pixels specifically.
The study found hospitals usingthem were 46% more likely to
experience a breach.
46%?

SPEAKER_00 (03:12):
That's not a rounding error.

SPEAKER_01 (03:14):
No.
And the reason is, these pixelslet third-party vendors
aggregate data across multiplesites.
They can piece together browsingbehavior, infer health
conditions, build profiles.

SPEAKER_00 (03:25):
Even without accessing medical records
directly.

SPEAKER_01 (03:28):
Right.
Someone visits a cancer center'swebsite, then a pharmacy page,
then a clinical trial sign-up.
You can connect those dotspretty quickly.

SPEAKER_00 (03:37):
What about first-party pixels?
The ones you control.

SPEAKER_01 (03:41):
No significant relationship with breaches.
It's the third-party stuffthat's the risk.

SPEAKER_00 (03:46):
So the move here is audit your website.
Know what's running.
If you've got third-partytrackers embedded, ask yourself
if you really need them.

SPEAKER_01 (03:55):
And if the answer is marketing wants them, have a
longer conversation withmarketing.

SPEAKER_00 (04:01):
Fair.
Okay, so stepping back, whatties all of this together?
Configuration, visibility, blindspots.
IBJI.
Attackers inside for over amonth.
Mission Community, unpatchedsystems.
LaPerouse, vendors you didn'teven know existed.

(04:21):
Tracking pixels, code you forgotwas there.

SPEAKER_01 (04:25):
None of this is bad luck.
It's bad hygiene.
And most of it, fixable.

SPEAKER_00 (04:30):
Patch your systems, know your vendors, audit your
web properties, hunt for threatsbefore they find you.

SPEAKER_01 (04:38):
It's not glamorous work, but it's the work that
keeps you off next week'sepisode.

SPEAKER_00 (04:43):
That's all for this week.
Thanks for listening.

SPEAKER_01 (04:45):
Stay secure out there, or at least try.

SPEAKER_00 (04:48):
We'll see you next time.