OrthopedicsNY faces $1.95M penalty after INC Ransom attack

In this episode, we break down recent healthcare cybersecurity incidents including a $1.45 million class action settlement stemming from missing MFA and unencrypted data, a repeat ransomware attack on a small cardiology practice, and how attackers are bypassing traditional email authentication. We also discuss the emerging threat of AI-assisted cyberattacks and actionable steps organizations can take to address common security blind spots.

Episode Transcript

SPEAKER_00 (00:00):
You're listening to Pow Box Weekly fully automated.

(00:03):
I'm Jen.
I read breach reports, so youdon't have to.
Well, so we can both lose sleepover them.

SPEAKER_01 (00:08):
And I'm Alex.
I work in healthcare IT, whichmeans I spend a lot of time
explaining why password 123isn't a security strategy.

SPEAKER_00 (00:17):
This week we've got ransomware repeat offenders, a
massive ed tech breach, and AIthat's making the White House
nervous.
Fun times.

SPEAKER_01 (00:25):
Let's start in New York.
Orthopedics NY just agreed to a$1.45 million class action
settlement.
That's on top of a$500,000 statepenalty they already got hit
with.

SPEAKER_00 (00:37):
So nearly$2 million.

And here's the thing (00:39):
the INC ransom attack that caused all
this, it worked because theydidn't have multi-factor
authentication.
And they were storing patientdata unencrypted.
In 2023.
In 2023.
These aren't exoticvulnerabilities.
This is basic hygiene.
MFA and encryption.

SPEAKER_01 (00:59):
That's the floor, not the ceiling.

SPEAKER_00 (01:02):
Exactly.
And when you skip the floor, youfall through it.

SPEAKER_01 (01:05):
Hard.
Speaking of falling throughfloors, McGraw-Hill, the
education giant.
13.5 million records exposed.

SPEAKER_00 (01:14):
Shiny Hunters, or someone who looks a lot like
them, got into their Salesforceenvironment.
Misconfiguration.
Over 100 gigs of data just outthere now.

SPEAKER_01 (01:25):
And this is interesting because it wasn't a
flaw in Salesforce itself.

SPEAKER_00 (01:29):
Right.
It's how it was set up.
The article called it a broaderissue with Salesforce's
environment, meaning whoeverconfigured it left doors open.

SPEAKER_01 (01:38):
So the takeaway for our listeners managing any kind
of cloud platform.

SPEAKER_00 (01:43):
Audit your configurations regularly.
These platforms give you a lotof rope.
Make sure you're not hangingyourself with it.

SPEAKER_01 (01:50):
That's a visual.
You're welcome.
Okay, this next one is sneaky.
Attackers are now abusing GitHuband Jira notification systems to
send phishing emails.

SPEAKER_00 (02:01):
And these emails pass authentication.
SPF, DKIM, DMARC, all greenlights.
Because they're actually comingfrom GitHub and Jira
infrastructure.

SPEAKER_01 (02:11):
So traditional email security just waves them
through.

SPEAKER_00 (02:15):
Yep.
The signals we've trainedsystems to trust, attackers
figured out how to hijack them.

SPEAKER_01 (02:21):
Which is why AI-based email security is
becoming essential.

SPEAKER_00 (02:25):
It's not about the sender anymore.
It's about the intent.
You need systems that can lookat context.
What's the email asking you todo?
Does it make sense?

SPEAKER_01 (02:34):
Legacy filters can't answer that question.
No, they really can't.
Alright, this next one is rough.
Heart South Cardiovascular Groupin Alabama, small practice, just
disclosed their secondransomware breach in 18 months.

SPEAKER_00 (02:50):
Riceda Ransomware Group.
They posted sample data on aleak site, demanded 6 Bitcoin.
About$630,000.

SPEAKER_01 (02:59):
We don't know if they paid.

SPEAKER_00 (03:00):
We rarely do.
But two breaches in under twoyears?
That tells me whatever theyfixed after the first one wasn't
enough.

SPEAKER_01 (03:08):
Or they didn't fix it at all.

SPEAKER_00 (03:10):
Also possible.
And that's the danger forsmaller practices.
Limited budgets, limited staff.
But attackers don't care aboutyour org chart.

SPEAKER_01 (03:19):
If you've got patient data, you're a target.
Period.
Last story, and this one's alittle different.
Anthropic CEO Dario Amode metwith White House staff last
week.
First time since that dust-upwith the Pentagon.

SPEAKER_00 (03:34):
They were talking about their new AI system,
Mythos.
And the concern is that it couldmake complex cyber attacks
easier to pull off.

SPEAKER_01 (03:41):
So we're not just defending against humans
anymore.

SPEAKER_00 (03:44):
We're defending against humans with AI
assistance that can help themwrite better malware, find
vulnerabilities faster, craftmore convincing phishing
campaigns.

SPEAKER_01 (03:54):
That's comforting.

SPEAKER_00 (03:55):
It's reality.
And it means our defenses haveto evolve too.
AI on offense, AI on defense.
It's an arms race now.

SPEAKER_01 (04:04):
So let's tie this together.
We've got an orthopedic practicehit because of no MFA.
An ed tech giant breachedthrough a misconfiguration.
Phishing that slips pastauthentication.
A small practice hit twice.
An AI that could make all ofthis worse.

SPEAKER_00 (04:20):
The thread isn't bad luck.
It's blind spots, gaps in thebasics, configurations no one
checked, controls no oneenforced.

SPEAKER_01 (04:29):
And most of it, fixable.

SPEAKER_00 (04:31):
That's the frustrating part.
And the hopeful part.
You can do something about this.

SPEAKER_01 (04:36):
Audit your MFA.
Check your cloud configs.
Look at your email securitystack with fresh eyes.

SPEAKER_00 (04:42):
And if you got breached once, assume they'll
try again.

SPEAKER_01 (04:46):
That's our show.
Thanks for listening to PalboxWeekly.

SPEAKER_00 (04:49):
Stay safe out there.
And turn on MFA.
Seriously.
See you next week.