July 17, 2026 • 4 mins
In this episode, Alex and Jen discuss a major breach affecting 542,000 individuals at Centers Laboratory, a $500,000+ ransomware settlement involving a Pennsylvania treatment facility, and the HHS delay of the final HIPAA Security Rule update to 2027. They also cover practical tools like the new Paubox Email API template gallery and emphasize how consistent security fundamentals can prevent costly incidents.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:00):
You're listening to Pow Box Weekly, fully automated.
SPEAKER_01 (00:03):
And somehow, still powered by caffeine and mild
paranoia.
SPEAKER_00 (00:06):
I'm Alex, Healthcare IT.
Been in the trenches long enoughto know that quick fix is
usually neither.
SPEAKER_01 (00:12):
And I'm Jen, cybersecurity side of things.
I read breach reports for fun.
Well, not fun.
SPEAKER_00 (00:18):
Obligation.
So let's get into it.
First up, Powbox email APIcustomers got a nice quality of
life upgrade this week.
SPEAKER_01 (00:27):
Template gallery.
Six pre-built designs.
You pick one, preview it live,and you're off to the races.
SPEAKER_00 (00:34):
And it works exactly like any template you'd build
yourself.
No weird limitations.
SPEAKER_01 (00:39):
No additional cost either.
Which, in 2026, feels almostsuspicious.
SPEAKER_00 (00:44):
It's not suspicious.
It's just helpful.
I know.
I'm adjusting.
If your team's been buildingemail templates from scratch
every time, this saves realhours.
Check it out in the APIdashboard.
SPEAKER_01 (00:58):
Alright, heavier stuff now.
Center's laboratory disclosed abreach.
542,000 individuals affected.
SPEAKER_00 (01:06):
And this one's been lurking.
WorldLeaks claimedresponsibility back in October
2025.
SPEAKER_01 (01:12):
Yeah, they posted it on their leaks site, said they
had 1.6 million files, 720 gigs.
SPEAKER_00 (01:19):
That's a lot of lab data.
SPEAKER_01 (01:21):
It is.
And WorldLeaks isn't just aransomware crew.
They run an extortion as aservice model.
SPEAKER_00 (01:27):
So they're basically franchising the shakedown.
SPEAKER_01 (01:30):
Exactly.
You don't even need your ownmalware anymore.
Just rent the misery.
SPEAKER_00 (01:35):
The takeaway here, if you're a lab, a clinic,
anyone handling PHI, you're atarget.
Period.
SPEAKER_01 (01:42):
And the gap between we detected something and we
disclosed it can be months.
That's months of exposure.
SPEAKER_00 (01:49):
Speaking of lawsuits, drug and alcohol
treatment services inPennsylvania just settled for
over half a million dollars.
SPEAKER_01 (01:57):
This stems from a ransomware attack in October
2024.
About 22,000 patients exposed.
SPEAKER_00 (02:03):
And not just names, prescription info, treatment
records, account numbers.
Interlock is believed to bebehind it.
SPEAKER_01 (02:10):
And the litigation dragged on for years.
SPEAKER_00 (02:13):
Years.
For 22,000 records.
SPEAKER_01 (02:17):
That's the thing.
A breach doesn't end when yourestore systems.
It ends when the last lawsuitsettles.
If it ends.
SPEAKER_00 (02:24):
So the real cost isn't just remediation.
It's legal fees, settlements,reputation damage.
All of it.
SPEAKER_01 (02:32):
And most of it's avoidable with better access
controls and segmentation.
SPEAKER_00 (02:36):
Alright, lighter note.
Powbox held its July Zoom socialmixer earlier this month.
Unmoderated chaos, my favoritekind.
It was actually prettyproductive.
Healthcare IT folks, marketers,all comparing notes.
SPEAKER_01 (02:50):
One customer demoed an AI-built security dashboard,
which, okay, I was skeptical,but it was solid.
SPEAKER_00 (02:57):
There was also a good discussion on AI clinical
scribes.
Lots of interest, lots ofquestions about data handling.
SPEAKER_01 (03:04):
And PALBox announced they shipped four features that
came directly from customerfeedback at the previous mixer.
SPEAKER_00 (03:10):
That's the kind of loop you want.
Users ask, product teamdelivers.
SPEAKER_01 (03:14):
If you're a Powbox customer and you're not joining
these mixers, you're missingout.
SPEAKER_00 (03:19):
Now, regulatory news.
HHS pushed the final HIPAAsecurity rule update to 2027.
SPEAKER_01 (03:26):
July 2027.
At the earliest.
SPEAKER_00 (03:29):
So we're still waiting.
SPEAKER_01 (03:31):
Still waiting.
But here's what's interesting: the privacy rule update? (03:32):
undefined
That's still moving forward.
SPEAKER_00 (03:37):
So they're decoupling the two.
SPEAKER_01 (03:38):
Seems like it.
And if the security rule landsas proposed, it's a big shift.
No more required versusaddressable.
Which means everything becomesrequired?
Essentially, if it's in therule, you do it.
No more, we addressed it bydeciding not to.
SPEAKER_00 (03:56):
That's going to be a wake-up call for a lot of
organizations.
SPEAKER_01 (03:59):
Allowed one.
So use this extra year wisely.
Audit now.
Don't wait for the final rule toscramble.
SPEAKER_00 (04:06):
Alright, wrapping up.
What's the thread connecting allof this?
SPEAKER_01 (04:10):
It's not bad luck.
It's not sophisticated zerodays.
It's gaps, misconfigurations,blind spots.
SPEAKER_00 (04:18):
A lab with 720 gigs of data exposed.
A treatment center paying half amillion in settlements.
Delayed regulations leavingpeople unsure what to
prioritize.
SPEAKER_01 (04:29):
But most of it, fixable.
Segmentation, access controls,encrypted email.
The basics done consistently.
SPEAKER_00 (04:37):
And community helps.
Whether it's a PAL box mixer orjust talking to peers, you learn
what's working.
SPEAKER_01 (04:44):
You learn what's breaking too, which is sometimes
more valuable.
That's the show.
Thanks for listening.
Stay patched, stay paranoid, butlike a healthy amount.
See you next week.
You're listening to Pow Box Weekly, fully automated.
SPEAKER_01 (00:03):
And somehow, still powered by caffeine and mild
paranoia.
SPEAKER_00 (00:06):
I'm Alex, Healthcare IT.
Been in the trenches long enoughto know that quick fix is
usually neither.
SPEAKER_01 (00:12):
And I'm Jen, cybersecurity side of things.
I read breach reports for fun.
Well, not fun.
SPEAKER_00 (00:18):
Obligation.
So let's get into it.
First up, Powbox email APIcustomers got a nice quality of
life upgrade this week.
SPEAKER_01 (00:27):
Template gallery.
Six pre-built designs.
You pick one, preview it live,and you're off to the races.
SPEAKER_00 (00:34):
And it works exactly like any template you'd build
yourself.
No weird limitations.
SPEAKER_01 (00:39):
No additional cost either.
Which, in 2026, feels almostsuspicious.
SPEAKER_00 (00:44):
It's not suspicious.
It's just helpful.
I know.
I'm adjusting.
If your team's been buildingemail templates from scratch
every time, this saves realhours.
Check it out in the APIdashboard.
SPEAKER_01 (00:58):
Alright, heavier stuff now.
Center's laboratory disclosed abreach.
542,000 individuals affected.
SPEAKER_00 (01:06):
And this one's been lurking.
WorldLeaks claimedresponsibility back in October
2025.
SPEAKER_01 (01:12):
Yeah, they posted it on their leaks site, said they
had 1.6 million files, 720 gigs.
SPEAKER_00 (01:19):
That's a lot of lab data.
SPEAKER_01 (01:21):
It is.
And WorldLeaks isn't just aransomware crew.
They run an extortion as aservice model.
SPEAKER_00 (01:27):
So they're basically franchising the shakedown.
SPEAKER_01 (01:30):
Exactly.
You don't even need your ownmalware anymore.
Just rent the misery.
SPEAKER_00 (01:35):
The takeaway here, if you're a lab, a clinic,
anyone handling PHI, you're atarget.
Period.
SPEAKER_01 (01:42):
And the gap between we detected something and we
disclosed it can be months.
That's months of exposure.
SPEAKER_00 (01:49):
Speaking of lawsuits, drug and alcohol
treatment services inPennsylvania just settled for
over half a million dollars.
SPEAKER_01 (01:57):
This stems from a ransomware attack in October
2024.
About 22,000 patients exposed.
SPEAKER_00 (02:03):
And not just names, prescription info, treatment
records, account numbers.
Interlock is believed to bebehind it.
SPEAKER_01 (02:10):
And the litigation dragged on for years.
SPEAKER_00 (02:13):
Years.
For 22,000 records.
SPEAKER_01 (02:17):
That's the thing.
A breach doesn't end when yourestore systems.
It ends when the last lawsuitsettles.
If it ends.
SPEAKER_00 (02:24):
So the real cost isn't just remediation.
It's legal fees, settlements,reputation damage.
All of it.
SPEAKER_01 (02:32):
And most of it's avoidable with better access
controls and segmentation.
SPEAKER_00 (02:36):
Alright, lighter note.
Powbox held its July Zoom socialmixer earlier this month.
Unmoderated chaos, my favoritekind.
It was actually prettyproductive.
Healthcare IT folks, marketers,all comparing notes.
SPEAKER_01 (02:50):
One customer demoed an AI-built security dashboard,
which, okay, I was skeptical,but it was solid.
SPEAKER_00 (02:57):
There was also a good discussion on AI clinical
scribes.
Lots of interest, lots ofquestions about data handling.
SPEAKER_01 (03:04):
And PALBox announced they shipped four features that
came directly from customerfeedback at the previous mixer.
SPEAKER_00 (03:10):
That's the kind of loop you want.
Users ask, product teamdelivers.
SPEAKER_01 (03:14):
If you're a Powbox customer and you're not joining
these mixers, you're missingout.
SPEAKER_00 (03:19):
Now, regulatory news.
HHS pushed the final HIPAAsecurity rule update to 2027.
SPEAKER_01 (03:26):
July 2027.
At the earliest.
SPEAKER_00 (03:29):
So we're still waiting.
SPEAKER_01 (03:31):
Still waiting.
But here's what's interesting: the privacy rule update? (03:32):
undefined
That's still moving forward.
SPEAKER_00 (03:37):
So they're decoupling the two.
SPEAKER_01 (03:38):
Seems like it.
And if the security rule landsas proposed, it's a big shift.
No more required versusaddressable.
Which means everything becomesrequired?
Essentially, if it's in therule, you do it.
No more, we addressed it bydeciding not to.
SPEAKER_00 (03:56):
That's going to be a wake-up call for a lot of
organizations.
SPEAKER_01 (03:59):
Allowed one.
So use this extra year wisely.
Audit now.
Don't wait for the final rule toscramble.
SPEAKER_00 (04:06):
Alright, wrapping up.
What's the thread connecting allof this?
SPEAKER_01 (04:10):
It's not bad luck.
It's not sophisticated zerodays.
It's gaps, misconfigurations,blind spots.
SPEAKER_00 (04:18):
A lab with 720 gigs of data exposed.
A treatment center paying half amillion in settlements.
Delayed regulations leavingpeople unsure what to
prioritize.
SPEAKER_01 (04:29):
But most of it, fixable.
Segmentation, access controls,encrypted email.
The basics done consistently.
SPEAKER_00 (04:37):
And community helps.
Whether it's a PAL box mixer orjust talking to peers, you learn
what's working.
SPEAKER_01 (04:44):
You learn what's breaking too, which is sometimes
more valuable.
That's the show.
Thanks for listening.
Stay patched, stay paranoid, butlike a healthy amount.
See you next week.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Bobby Bones Show
Listen to 'The Bobby Bones Show' by downloading the daily full replay.