Microsoft warns of a phishing campaign bypassing MFA protections

In this episode, we examine a Microsoft-flagged phishing campaign that bypassed MFA across 13,000 organizations, analyze Saint Anthony Hospital's breach notification that expanded from 6,500 to 146,000 affected individuals, and discuss the ransomware attack impacting 92,000 patients at a Puerto Rico community hospital. Key takeaways include the importance of layered email security, thorough incident scoping, and addressing configuration blind spots before threat actors exploit them.

Episode Transcript

SPEAKER_00 (00:00):
You're listening to Palbox Weekly, fully automated.

SPEAKER_01 (00:02):
I'm Jen, cybersecurity analyst,
professional paranoid.

SPEAKER_00 (00:06):
And I'm Alex, healthcare IT guy who still
believes in happy endings.
Sometimes.
Optimist.
Someone has to be.
Alright, let's get into it.
Microsoft dropped a warning thisweek about a phishing campaign
that, honestly, Jen, the scaleon this one.

SPEAKER_01 (00:23):
Yeah.
35,000 phishing attempts inthree days, over 13,000
organizations.
And here's the kicker.
It bypassed MFA.

SPEAKER_00 (00:32):
Which is supposed to be our safety net.

SPEAKER_01 (00:34):
Right.
These emails were disguised asinternal communications.
So you're not getting the usualNigerian prince vibes.
You're getting something thatlooks like it came from your own
IT department.

SPEAKER_00 (00:45):
92% of targets were US-based.
Healthcare orgs were definitelyin the mix.

SPEAKER_01 (00:51):
The takeaway here: MFA is necessary.
But it's not magic.
You still need emailauthentication.
You still need user training.
Layers, people.
Layers.

SPEAKER_00 (01:01):
Onions.
Ogres.
Security.
Did you just quote Shrek?
Moving on.
Let's talk about something thathappened closer to home.
St.
Anthony Hospital in Chicago.

SPEAKER_01 (01:13):
This one's rough.
They had an email compromiseback in early 2024.
Initially reported around 6,500affected individuals.
And now?
That's more than 22 times theoriginal estimate.
It took over a year to fullyscope.
Two employee email accounts werecompromised, and the data

(01:33):
exposed included PHI, names,medical records, the works.

SPEAKER_00 (01:38):
So what's the lesson here?

SPEAKER_01 (01:40):
Incident response isn't just about stopping the
bleeding, it's about knowing howdeep the wound goes.
A lot of orgs underestimateinitial breach scope because
they haven't done the forensicwork yet.
And then the notificationupdates keep coming.
Which is its own kind ofreputational damage.
Get it right the first time, oras close as you can.

SPEAKER_00 (01:59):
Alright, staying in the breach lane, Puerto Rico, a
45-bed community hospital inFajardo.

SPEAKER_01 (02:05):
Hospital Del Nino.
92,000 patients notified after aFebruary ransomware attack.
Claimed by a group callingthemselves the Gentlemen.

SPEAKER_00 (02:15):
Very polite name for a double extortion gang.

SPEAKER_01 (02:17):
They posted the hospital's data on a dark web
leak site, gave them about 10days to respond before
threatening to publisheverything.
And we don't know if a ransomwas paid?
Nope.
Not confirmed.
Which usually means eitherthey're negotiating or they paid
and don't want to say.

SPEAKER_00 (02:33):
45 beds, 92,000 patients affected.
That's a small hospital with amassive data footprint.

SPEAKER_01 (02:41):
Community hospitals are prime targets.
Fewer resources, older systems,same sensitive data as the big
guys.

SPEAKER_00 (02:48):
The fix isn't always budget.
Sometimes it's just visibility.
Knowing what you have and whereit lives.
Exactly.
Okay, let's end on something alittle lighter.
Powbox News, the KahikinaScholarship.
I actually didn't know half ofthis stuff.
Right?
So the scholarship supportsnative Hawaiians pursuing STEM

(03:10):
or tech careers.
$1,000 a year, recurring untilgraduation.

SPEAKER_01 (03:15):
That's the part I love.
It's not a one-time thing.

SPEAKER_00 (03:18):
It follows you through your degree.
And now it's officially anon-profit, which means
donations are tax deductible.

SPEAKER_01 (03:26):
And you can apply at any stage, undergrad, grad
school, even beyond.

SPEAKER_00 (03:30):
If you know someone who qualifies, or you want to
contribute, we'll drop the linkin the show notes.

SPEAKER_01 (03:36):
It's a good program.
Tech needs more pads in, notfewer.

SPEAKER_00 (03:40):
Agreed.
Alright, let's bring it home.
What's the thread this week?

SPEAKER_01 (03:44):
It's not bad luck.
It's bad configurations.
Blind spots.
Ransomware hitting smallhospitals because they didn't
know what they were exposed to.

SPEAKER_00 (04:02):
And most of it, fixable.

SPEAKER_01 (04:04):
That's the thing.
None of this is inevitable.
It's just unaddressed.

SPEAKER_00 (04:09):
So address it.

SPEAKER_01 (04:10):
Before someone else does it for you.

SPEAKER_00 (04:12):
That's the show.
Thanks for listening to PalBoxWeekly fully automated.

SPEAKER_01 (04:17):
Stay safe out there, and maybe double check that
internal email before you click.

SPEAKER_00 (04:21):
See you next week.