PrivacySignal
Analysis ← Front page
Breach

HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network

DataBreaches.net · · International · Data Breaches

HHS' Office for Civil Rights has reached a settlement with Lehigh Valley Health Network over a 2023 ransomware breach carried out by the BlackCat group. The attack became widely known after hackers published nude images of cancer patients, and a separate civil lawsuit brought by patients settled for $65 million.

Why this matters: This is what happens when a ransomware attack stops being an IT problem and becomes something patients cannot unsee. Nude images of cancer patients were posted publicly as leverage. That is not a data exposure in the abstract — it is a targeted humiliation of sick people. The civil settlement put a $65 million price on that harm. The HHS action puts a regulatory one. Health systems need to understand that patient data carries a human cost, not just a compliance one, and that federal regulators will follow civil courts when the breach is serious enough.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance

#breach#enforcement#security
Read the original at DataBreaches.net → Browse the archive

This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

Logged Is Not Authorized

Georgia law restricts police use of license plate data to law enforcement purposes. A new lawsuit alleges deputies searched a man's vehicle five times while he was suing their sheriff. Two recorded reasons were "info" and "37." The system accepted both.

· 6 min read Read →
Deep Signal · Part I of III

The Algorithm Said So

Federal rulemakers are deciding what to do when artificial intelligence produces the kind of conclusion that once required an expert. They disagree about how to regulate it. They also disagree about whether the problem has arrived.

· 10 min read Read →

Related stories

Breach
Krebs on Security · · International

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet's access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.

Who should care: Cybersecurity · Privacy officers · Administrators

#breach#security Read original →
Breach
The Guardian — Tech · · International

AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028

The UK's National Cyber Security Centre has assessed it as highly likely that AI-powered malware will be used to attack critical national infrastructure — including power stations, airports, and hospitals — before 2028, with ransomware seen as a probable vector.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy

#breach#ai#security Read original →
Breach
DataBreaches.net · · International

Hackers hit UNM hospital, then apologize and offer patients $2,500. In a new statement, they reveal more about the incident.

In more than 20 years of blogging about breaches, DataBreaches has never seen ransomware threat actors offer monetary compensation to patients affected by their attack. We have seen threat actors regret hitting a hospital or a facility providing direct patient care and then offer them a free decryptor and drop the ransom demands, but this...

Who should care: Cybersecurity · Privacy officers · Administrators

#breach#security Read original →
Breach
DataBreaches.net · · International

UK: Second Liverpool hospital investigates staff over breach of Southport attack patient records

A second Liverpool hospital, Liverpool Heart and Chest Hospital, is investigating two staff members suspected of improperly accessing medical records linked to the Southport terror attack. The cases were internally detected, adding to a pattern of insider snooping reported across the region following the attack.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals

#breach#enforcement#healthcare Read original →
Breach
DataBreaches.net · · International

JPN: Suntory Holdings says personal data of around 100,000 people leaked

Suntory Holdings, the Japanese beverage conglomerate, disclosed that unauthorized access to an external cloud service exposed personal data belonging to roughly 100,000 individuals, including employees. The company said it has not yet confirmed any misuse of the leaked information.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy

#breach#privacy Read original →
Breach
DataBreaches.net · · International

Hong Kong privacy watchdog investigates data leaks linked to major airlines and retailers

Hong Kong's privacy regulator has opened investigations into data breaches affecting multiple airlines, including Hong Kong Airlines, Cathay Pacific, and Malaysia Airlines, as well as electronics retailers Yoho Hong Kong and Broadway. By late October, the watchdog had recorded nearly 100 complaints and inquiries tied to these incidents.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy

#breach#privacy Read original →