July 3, 2026 • 3 mins
In this episode, Jen and Alex discuss Paubox's new MFA options, the ShinyHunters breach involving legacy Iora Health data, World Cup-related phishing scams, and a Senate bill addressing cybersecurity risks in Chinese-made medical devices. The hosts emphasize the importance of addressing legacy systems, conducting thorough asset inventories, and implementing foundational security controls to protect patient data.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_01 (00:00):
You're listening to Powbox Weekly, fully automated.
SPEAKER_00 (00:03):
I'm Jen.
I stare at threat reports so youdon't have to.
SPEAKER_01 (00:06):
And I'm Alex.
I translate those reports intosomething your board might
actually read.
It's been a week.
It's always been a week.
Let's start with some good newsfor once.
Powbox rolled out new MFAoptions.
SPEAKER_00 (00:20):
Finally, more ways to prove you are who you say you
are.
Pass keys, authenticator apps,text, email, recovery codes.
SPEAKER_01 (00:28):
The idea being, even if someone gets your password,
they still can't get in.
SPEAKER_00 (00:33):
That second factor is the difference between close
call and incident response.
SPEAKER_01 (00:38):
And there are guardrails now to keep you from
locking yourself out.
Which, let's be honest, happensmore than anyone admits.
Moving on, Shiny Hunters is backin the news.
Of course they are.
They're claiming nearly nineterabytes of data stolen from
one medical.
That's Amazon's primary caresubsidiary.
SPEAKER_00 (00:58):
Here's the thing though, this wasn't current One
Medical data.
It was archived records fromIora Health, which they acquired
back in 2021.
SPEAKER_01 (01:06):
So legacy systems.
Again.
SPEAKER_00 (01:09):
Legacy systems.
Always.
The breach didn't touch broaderOne Medical or Amazon
infrastructure.
But those old records, stillpatient data, still protected.
The lesson here?
When you acquire a company, youacquire their technical debt
too, including whatever'ssitting in a forgotten storage
bucket.
SPEAKER_01 (01:27):
Alright, shifting gears.
The World Cup.
Oh, the fishing bonanza.
Researchers found over 600typosquat domains mimicking
FIFA's official site.
Plus, 33 fake merchandise storestied to 2,500 ads.
SPEAKER_00 (01:44):
People bought jerseys they never received.
And in exchange, they handedover payment card data, personal
info, everything.
SPEAKER_01 (01:52):
And that data's already circulating on the dark
web.
SPEAKER_00 (01:55):
Because of course it is.
Big events are hunting seasonfor these guys.
The emotional pull of fandommakes people click first.
Think later.
SPEAKER_01 (02:03):
So if you're shopping for gear.
SPEAKER_00 (02:05):
Go directly to the official site.
Type it yourself.
Don't trust that ad.
SPEAKER_01 (02:10):
Now, some legislative news.
There's a Senate bill targetingcybersecurity risks in
Chinese-made medical devices.
SPEAKER_00 (02:17):
This one's actually interesting.
It would have the FDA and CISAdo a retroactive review of
legacy devices already deployedin healthcare settings.
SPEAKER_01 (02:26):
So devices that are already in hospitals, clinics.
SPEAKER_00 (02:30):
Right.
And if they're flagged asthreats, FDA could recall them.
SPEAKER_01 (02:34):
These devices often collect, transmit, or store PHI.
SPEAKER_00 (02:38):
Exactly.
They're not just sitting in acorner.
They're connected.
They're talking to networks.
And if they're compromised,that's a direct line to patient
data.
SPEAKER_01 (02:48):
Something for compliance teams to watch.
Definitely put it on the radar.
And finally, some fun.
PalBox hosted a social mixer inSan Francisco last week.
At the Lark Bar.
Customers, prospects, friends ofPalbox.
Apparently they made some newconnections too.
I heard the pics are up.
(03:08):
They are.
Worth a look if you want to seewhat happens when security folks
get to relax for a minute.
SPEAKER_00 (03:14):
We do occasionally leave our desks.
SPEAKER_01 (03:16):
So, wrapping up, what's the thread this week?
SPEAKER_00 (03:19):
It's not bad luck, it's bad configurations, blind
spots, legacy systems nobody'slooking at.
SPEAKER_01 (03:26):
Archive data from acquisitions.
Devices deployed years ago.
Phishing domains that prey ondistraction.
SPEAKER_00 (03:33):
And most of it?
MFA is fixable.
Asset inventory is fixable.
User education is fixable.
SPEAKER_01 (03:42):
The stakes are real, but so are the solutions.
SPEAKER_00 (03:45):
Do the boring work.
It pays off.
SPEAKER_01 (03:48):
That's it for this week.
Stay safe out there.
SPEAKER_00 (03:51):
And patch your stuff.
You're listening to Powbox Weekly, fully automated.
SPEAKER_00 (00:03):
I'm Jen.
I stare at threat reports so youdon't have to.
SPEAKER_01 (00:06):
And I'm Alex.
I translate those reports intosomething your board might
actually read.
It's been a week.
It's always been a week.
Let's start with some good newsfor once.
Powbox rolled out new MFAoptions.
SPEAKER_00 (00:20):
Finally, more ways to prove you are who you say you
are.
Pass keys, authenticator apps,text, email, recovery codes.
SPEAKER_01 (00:28):
The idea being, even if someone gets your password,
they still can't get in.
SPEAKER_00 (00:33):
That second factor is the difference between close
call and incident response.
SPEAKER_01 (00:38):
And there are guardrails now to keep you from
locking yourself out.
Which, let's be honest, happensmore than anyone admits.
Moving on, Shiny Hunters is backin the news.
Of course they are.
They're claiming nearly nineterabytes of data stolen from
one medical.
That's Amazon's primary caresubsidiary.
SPEAKER_00 (00:58):
Here's the thing though, this wasn't current One
Medical data.
It was archived records fromIora Health, which they acquired
back in 2021.
SPEAKER_01 (01:06):
So legacy systems.
Again.
SPEAKER_00 (01:09):
Legacy systems.
Always.
The breach didn't touch broaderOne Medical or Amazon
infrastructure.
But those old records, stillpatient data, still protected.
The lesson here?
When you acquire a company, youacquire their technical debt
too, including whatever'ssitting in a forgotten storage
bucket.
SPEAKER_01 (01:27):
Alright, shifting gears.
The World Cup.
Oh, the fishing bonanza.
Researchers found over 600typosquat domains mimicking
FIFA's official site.
Plus, 33 fake merchandise storestied to 2,500 ads.
SPEAKER_00 (01:44):
People bought jerseys they never received.
And in exchange, they handedover payment card data, personal
info, everything.
SPEAKER_01 (01:52):
And that data's already circulating on the dark
web.
SPEAKER_00 (01:55):
Because of course it is.
Big events are hunting seasonfor these guys.
The emotional pull of fandommakes people click first.
Think later.
SPEAKER_01 (02:03):
So if you're shopping for gear.
SPEAKER_00 (02:05):
Go directly to the official site.
Type it yourself.
Don't trust that ad.
SPEAKER_01 (02:10):
Now, some legislative news.
There's a Senate bill targetingcybersecurity risks in
Chinese-made medical devices.
SPEAKER_00 (02:17):
This one's actually interesting.
It would have the FDA and CISAdo a retroactive review of
legacy devices already deployedin healthcare settings.
SPEAKER_01 (02:26):
So devices that are already in hospitals, clinics.
SPEAKER_00 (02:30):
Right.
And if they're flagged asthreats, FDA could recall them.
SPEAKER_01 (02:34):
These devices often collect, transmit, or store PHI.
SPEAKER_00 (02:38):
Exactly.
They're not just sitting in acorner.
They're connected.
They're talking to networks.
And if they're compromised,that's a direct line to patient
data.
SPEAKER_01 (02:48):
Something for compliance teams to watch.
Definitely put it on the radar.
And finally, some fun.
PalBox hosted a social mixer inSan Francisco last week.
At the Lark Bar.
Customers, prospects, friends ofPalbox.
Apparently they made some newconnections too.
I heard the pics are up.
(03:08):
They are.
Worth a look if you want to seewhat happens when security folks
get to relax for a minute.
SPEAKER_00 (03:14):
We do occasionally leave our desks.
SPEAKER_01 (03:16):
So, wrapping up, what's the thread this week?
SPEAKER_00 (03:19):
It's not bad luck, it's bad configurations, blind
spots, legacy systems nobody'slooking at.
SPEAKER_01 (03:26):
Archive data from acquisitions.
Devices deployed years ago.
Phishing domains that prey ondistraction.
SPEAKER_00 (03:33):
And most of it?
MFA is fixable.
Asset inventory is fixable.
User education is fixable.
SPEAKER_01 (03:42):
The stakes are real, but so are the solutions.
SPEAKER_00 (03:45):
Do the boring work.
It pays off.
SPEAKER_01 (03:48):
That's it for this week.
Stay safe out there.
SPEAKER_00 (03:51):
And patch your stuff.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Joe Rogan Experience
The official podcast of comedian Joe Rogan.