Healthcare organizations are increasingly reliant on interconnected systems, electronic health records, and telemedicine, making them a prime target for malicious actors looking to exploit vulnerabilities. The consequences of a healthcare cybersecurity breach are measured in compromised data as well as in jeopardized patient safety and trust. Help Net Security has provided some excerpts from cybersecurity-focused surveys conducted in the healthcare sector that were covered in 2023. With this data, security teams will gain insights that could help improve future security strategies.

AhnLab Security Emergency Response Center (ASEC) researchers are warning about attacks on poorly managed Linux SSH servers in which Distributed Denial-of-Service (DDoS) bots and CoinMiners are installed. During the reconnaissance phase, threat actors scan IP addresses for servers with the SSH service or port 22 activated, then carry out a brute force or dictionary attack to get the ID and password. They can sell compromised IP addresses and account credentials on the dark web.

Albania’s Parliament recently announced that it had suffered a cyberattack with hackers trying to get into its data system, resulting in a temporary halt in its services.  A statement said Monday’s cyberattack had not “touched the data of the system,” adding that experts were working to discover what consequences the attack could have.  It said the system’s services would resume at a later time.

German hospital network Katholische Hospitalvereinigung Ostwestfalen (KHO) has recently confirmed that service disruptions at three hospitals were caused by a Lockbit ransomware attack.  The attack began in the early morning of December 24, 2023.  It severely impacted the systems that support the operations of three hospitals in Bielefeld, Rheda-Wiedenbrück, and Herford, Germany.

Panasonic Avionics Corporation, a leading supplier of in-flight communications and entertainment systems, recently disclosed a data breach affecting an undisclosed number of individuals after its corporate network was breached more than one year ago, in December 2022.  The company stated that on December 30, 2022, it identified evidence of an issue potentially impacting certain systems in its corporate network environment that occurred on or around December 14, 2022.

A "recruiter" approached a blockchain developer on LinkedIn for a web development job and asked him to download npm packages from a GitHub repository, which led to the developer's MetaMask wallet emptying. It is not uncommon for legitimate technology interviews to include some kind of take-home exercise or proof-of-concept (PoC) assignment involving writing code or debugging, thus making the lure convincing even to technically savvy individuals like developers.

The Ohio Lottery has recently confirmed that it was targeted in a cyberattack, and a ransomware group claims to have stolen a significant amount of information from the organization’s systems.  The Ohio State Lottery informed customers on its website that it had experienced a “cybersecurity event” but assured the public that its gaming system was fully operational.  However, it said it decided to shut down some critical systems to contain the incident.

Mortgage servicing firm LoanCare recently started informing more than 1.3 million individuals of a data breach impacting their personal information.  A subsidiary of Fidelity National Financial (FNF), LoanCare provides loan subservicing for mortgage loaners, including banks, credit unions, and mortgage firms.  According to LoanCare, the data breach resulted from a cyberattack on FNF’s internal systems.  The incident was identified on November 19, resulting in business disruptions.  The company noted that the incident was contained on November 26, 2023.

A team of researchers from Umeå University, Paderborn University, Université du Luxembourg, and INRIA analyzed vulnerabilities in software written in Java, one of most widely used programming languages, in a study titled "An In-Depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities." They examined Java products that use deserialization, which is the process of restoring packaged information to its last state, such as user settings, game functions, shopping carts, or banking applications, and conducted a thorough analysis of vulnerabilities and attacks.

A recent study conducted by Rui Zhu, a Ph.D. candidate at Indiana University Bloomington, discovered a potential privacy threat posed by OpenAI's Large Language Model (LLM), GPT-3.5 Turbo.  As part of the experiment, Zhu used a GPT-3.5 Turbo feature that allows the model to recall personal data and successfully avoided the model's privacy safeguards. Although there were flaws, the model correctly provided the work addresses of 80 percent of Times employees tested.