September 4, 2026 • 4 mins
In this episode, Alex and Jen discuss recent cybersecurity threats affecting healthcare organizations, including the ShinyHunters breach of oncology company Novocure and the FBI disruption of a China-linked botnet targeting hospitals. They also cover new Paubox Email API features for scheduled sends and the Senate HELP Committee's advancement of legislation to extend HIPAA-style protections to health data held by non-covered entities.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_01 (00:00):
You're listening to Pow Box Weekly, fully automated.
SPEAKER_00 (00:03):
And I'm Jen, your friendly neighborhood
cybersecurity expert who's readone too many incident reports
this week.
SPEAKER_01 (00:09):
I'm Alex, healthcare IT guy, coffee enthusiast,
occasional optimist.
Good to have you with us.
SPEAKER_00 (00:15):
So, where do we start?
The extortion gang targetingcancer patients, or the
state-sponsored botnet hittinghospitals?
SPEAKER_01 (00:23):
Let's ease into it.
Powbox News first.
SPEAKER_00 (00:26):
Fair.
Something that won't make mesigh.
SPEAKER_01 (00:29):
The email API now supports scheduled sends, which
finally.
SPEAKER_00 (00:34):
Wait, that wasn't already a thing?
SPEAKER_01 (00:36):
It is now.
Developers can cue messagesahead of time.
Appointment reminders, billingnotices, time-sensitive stuff.
Set the delivery time, checkstatus, reschedule, cancel if
needed.
SPEAKER_00 (00:48):
That's actually huge for patient communication
workflows.
No more, oops, we sent that at 3a.m.
situations.
SPEAKER_01 (00:56):
Exactly.
And it came directly fromcustomer feedback.
People building real systemsasked for it.
SPEAKER_00 (01:02):
Love when product updates come from actual use
cases instead of a roadmap noone looked at.
SPEAKER_01 (01:07):
Also from Powbox, the 2026 Kahikina Scholarship
Class was just announced.
16 native Hawaiian studentsselected.
That's the STEM scholarship,right?
Yeah, encouraging nativeHawaiians to pursue tech and
STEM careers.
16 recipients this year.
SPEAKER_00 (01:24):
That's genuinely great.
We talk a lot about workforcegaps in healthcare IT and
security.
Programs like this matter.
SPEAKER_01 (01:32):
Agreed.
We'll drop the link in the shownotes if you want to learn more
about this year's class.
SPEAKER_00 (01:37):
Okay, now the less cheerful stuff.
SPEAKER_01 (01:39):
Shiny Hunters hit NovaCure, oncology company.
Over 1,400 U.S.
patient records accessed.
SPEAKER_00 (01:47):
Shiny Hunters, these guys again.
SPEAKER_01 (01:50):
You know them?
SPEAKER_00 (01:51):
Unfortunately.
They've got a pattern.
Healthcare targets, cloudplatforms, third-party
integrations.
They don't kick down the frontdoor, they find the side window
someone left cracked.
SPEAKER_01 (02:02):
So not direct network intrusions.
SPEAKER_00 (02:04):
Right.
They exploit the connections,the APIs, the vendor
relationships.
It's why supply chain securitykeeps coming up.
SPEAKER_01 (02:12):
And this is a cancer treatment company.
That data is deeply personal.
SPEAKER_00 (02:17):
It is.
Treatment histories, diagnoses.
It's not just identity theftrisk.
It's leverage for extortion.
These groups know exactly whatthey're doing.
The takeaway?
Audit your integrations.
Know what third parties haveaccess to.
Because if Shiny Hunters findsthem first, they'll let you
know.
SPEAKER_01 (02:36):
Moving on, the FBI and DOJ disrupted a botnet.
China-linked group called QTFY.
QTFY?
Yeah.
Investigators tied them to acompany in Nanjing, Xinji
Network Technology.
Sells stolen data and hackingservices to Chinese military and
intelligence.
Hackers for hire with governmentclients.
SPEAKER_00 (02:58):
That's the model we keep seeing.
SPEAKER_01 (03:00):
And they were targeting hospitals and health
systems specifically.
SPEAKER_00 (03:04):
Because healthcare has the data, and let's be
honest, not always the defenses.
SPEAKER_01 (03:09):
The botnet's been disrupted, but there's always
another one.
SPEAKER_00 (03:14):
These takedowns are wins, absolutely.
But they're not permanentsolutions.
You still need your own defensesin place.
SPEAKER_01 (03:21):
Speaking of defenses, there's movement on
the legislative front.
The Senate Help Committeeadvanced a privacy bill.
SPEAKER_00 (03:28):
The Health Information Privacy Reform Act?
SPEAKER_01 (03:30):
That's the one.
It would extend HIPAA-styleprotections to health data held
by companies not currentlycovered by HIPAA.
SPEAKER_00 (03:38):
So fitness apps, period trackers, mental health
platforms that aren't coveredentities.
SPEAKER_01 (03:44):
Exactly.
The bill would tie securityrequirements to existing
frameworks.
NIST, HHS CybersecurityPerformance Goals.
SPEAKER_00 (03:52):
That's smart.
Don't reinvent the wheel.
Use what's already working.
SPEAKER_01 (03:57):
It covers identifiable data about physical
or mental health, which is a lotof what's floating around out
there.
SPEAKER_00 (04:03):
And currently unprotected.
This has been a gap for years.
If it actually passes.
SPEAKER_01 (04:09):
Big if.
SPEAKER_00 (04:10):
Big if.
But progress is progress.
SPEAKER_01 (04:13):
Alright, let's tie this together.
What's the theme this week?
SPEAKER_00 (04:17):
Honestly, it's not bad luck.
It's bad configurations.
Blind spots.
The shiny hunter's breach,third-party access.
The botnet, compromisedendpoints.
The privacy gap, data sittingoutside existing protections.
SPEAKER_01 (04:32):
And most of it is fixable.
SPEAKER_00 (04:35):
That's the thing.
Scheduled sends, fixed.
Third party access controls?
Fixable.
Regulatory gaps, they're workingon it.
The tools exist, the frameworksexist.
SPEAKER_01 (04:46):
It's about closing the gaps before someone else
finds them.
Exactly.
That's all for this week.
Thanks for listening.
SPEAKER_00 (04:54):
Stay patched, stay skeptical.
We'll see you next time.
You're listening to Pow Box Weekly, fully automated.
SPEAKER_00 (00:03):
And I'm Jen, your friendly neighborhood
cybersecurity expert who's readone too many incident reports
this week.
SPEAKER_01 (00:09):
I'm Alex, healthcare IT guy, coffee enthusiast,
occasional optimist.
Good to have you with us.
SPEAKER_00 (00:15):
So, where do we start?
The extortion gang targetingcancer patients, or the
state-sponsored botnet hittinghospitals?
SPEAKER_01 (00:23):
Let's ease into it.
Powbox News first.
SPEAKER_00 (00:26):
Fair.
Something that won't make mesigh.
SPEAKER_01 (00:29):
The email API now supports scheduled sends, which
finally.
SPEAKER_00 (00:34):
Wait, that wasn't already a thing?
SPEAKER_01 (00:36):
It is now.
Developers can cue messagesahead of time.
Appointment reminders, billingnotices, time-sensitive stuff.
Set the delivery time, checkstatus, reschedule, cancel if
needed.
SPEAKER_00 (00:48):
That's actually huge for patient communication
workflows.
No more, oops, we sent that at 3a.m.
situations.
SPEAKER_01 (00:56):
Exactly.
And it came directly fromcustomer feedback.
People building real systemsasked for it.
SPEAKER_00 (01:02):
Love when product updates come from actual use
cases instead of a roadmap noone looked at.
SPEAKER_01 (01:07):
Also from Powbox, the 2026 Kahikina Scholarship
Class was just announced.
16 native Hawaiian studentsselected.
That's the STEM scholarship,right?
Yeah, encouraging nativeHawaiians to pursue tech and
STEM careers.
16 recipients this year.
SPEAKER_00 (01:24):
That's genuinely great.
We talk a lot about workforcegaps in healthcare IT and
security.
Programs like this matter.
SPEAKER_01 (01:32):
Agreed.
We'll drop the link in the shownotes if you want to learn more
about this year's class.
SPEAKER_00 (01:37):
Okay, now the less cheerful stuff.
SPEAKER_01 (01:39):
Shiny Hunters hit NovaCure, oncology company.
Over 1,400 U.S.
patient records accessed.
SPEAKER_00 (01:47):
Shiny Hunters, these guys again.
SPEAKER_01 (01:50):
You know them?
SPEAKER_00 (01:51):
Unfortunately.
They've got a pattern.
Healthcare targets, cloudplatforms, third-party
integrations.
They don't kick down the frontdoor, they find the side window
someone left cracked.
SPEAKER_01 (02:02):
So not direct network intrusions.
SPEAKER_00 (02:04):
Right.
They exploit the connections,the APIs, the vendor
relationships.
It's why supply chain securitykeeps coming up.
SPEAKER_01 (02:12):
And this is a cancer treatment company.
That data is deeply personal.
SPEAKER_00 (02:17):
It is.
Treatment histories, diagnoses.
It's not just identity theftrisk.
It's leverage for extortion.
These groups know exactly whatthey're doing.
The takeaway?
Audit your integrations.
Know what third parties haveaccess to.
Because if Shiny Hunters findsthem first, they'll let you
know.
SPEAKER_01 (02:36):
Moving on, the FBI and DOJ disrupted a botnet.
China-linked group called QTFY.
QTFY?
Yeah.
Investigators tied them to acompany in Nanjing, Xinji
Network Technology.
Sells stolen data and hackingservices to Chinese military and
intelligence.
Hackers for hire with governmentclients.
SPEAKER_00 (02:58):
That's the model we keep seeing.
SPEAKER_01 (03:00):
And they were targeting hospitals and health
systems specifically.
SPEAKER_00 (03:04):
Because healthcare has the data, and let's be
honest, not always the defenses.
SPEAKER_01 (03:09):
The botnet's been disrupted, but there's always
another one.
SPEAKER_00 (03:14):
These takedowns are wins, absolutely.
But they're not permanentsolutions.
You still need your own defensesin place.
SPEAKER_01 (03:21):
Speaking of defenses, there's movement on
the legislative front.
The Senate Help Committeeadvanced a privacy bill.
SPEAKER_00 (03:28):
The Health Information Privacy Reform Act?
SPEAKER_01 (03:30):
That's the one.
It would extend HIPAA-styleprotections to health data held
by companies not currentlycovered by HIPAA.
SPEAKER_00 (03:38):
So fitness apps, period trackers, mental health
platforms that aren't coveredentities.
SPEAKER_01 (03:44):
Exactly.
The bill would tie securityrequirements to existing
frameworks.
NIST, HHS CybersecurityPerformance Goals.
SPEAKER_00 (03:52):
That's smart.
Don't reinvent the wheel.
Use what's already working.
SPEAKER_01 (03:57):
It covers identifiable data about physical
or mental health, which is a lotof what's floating around out
there.
SPEAKER_00 (04:03):
And currently unprotected.
This has been a gap for years.
If it actually passes.
SPEAKER_01 (04:09):
Big if.
SPEAKER_00 (04:10):
Big if.
But progress is progress.
SPEAKER_01 (04:13):
Alright, let's tie this together.
What's the theme this week?
SPEAKER_00 (04:17):
Honestly, it's not bad luck.
It's bad configurations.
Blind spots.
The shiny hunter's breach,third-party access.
The botnet, compromisedendpoints.
The privacy gap, data sittingoutside existing protections.
SPEAKER_01 (04:32):
And most of it is fixable.
SPEAKER_00 (04:35):
That's the thing.
Scheduled sends, fixed.
Third party access controls?
Fixable.
Regulatory gaps, they're workingon it.
The tools exist, the frameworksexist.
SPEAKER_01 (04:46):
It's about closing the gaps before someone else
finds them.
Exactly.
That's all for this week.
Thanks for listening.
SPEAKER_00 (04:54):
Stay patched, stay skeptical.
We'll see you next time.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Breakfast Club
The World's Most Dangerous Morning Show, The Breakfast Club, With DJ Envy, Jess Hilarious, And Charlamagne Tha God!