Feed aggregator

Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.

The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek.

The New York attorney general (AG) has reached a settlement over a medical data breach that affected 13.3 million people after basic security failures.

Perry Johnson & Associates (PJ&A) and four related companies have agreed to pay $300,000 and implement extensive security reforms following a breach that exposed personal and medical information belonging to more than 13.3 million people. They face another $9.7 million in penalties if they fail to meet the settlement’s terms.

New York AG Letitia James announced the agreement on November 6, alongside the attorneys general of Connecticut, Michigan, and New Jersey. Approximately 4.2 million of the people affected were New York residents.

The investigation describes a series of failures: remote access without multifactor authentication, nearly identical passwords circulated by email, sensitive files without file-level encryption, and security software that detected malicious activity but did not alert security staff.

The result: the companies only discovered the attack when the attackers contacted them on May 2, 2023, and demanded payment.

How many people were affected?

The stolen database files contained records associated with more than 13.3 million people, including approximately 4.2 million New Yorkers.

Earlier reporting put the number of affected patients at approximately 8.95 million. The settlement documents now give the larger figure of more than 13.3 million. The total could be higher, since the AG found that attackers also accessed files in shared network storage containing personal and health information, but the companies did not review those files to identify additional affected people.

The information included:

• Names, dates of birth, and home addresses.
• Social Security numbers.
• Medical record and hospital account numbers.
• Insurance information.
• Admission diagnoses and dates of treatment.
• Clinical information from medical transcriptions, including test results, medications, treatment facilities, and healthcare providers.

See if your personal data has been exposed.

SCAN NOW

Notifications were also slow. PJ&A began contacting clients about the stolen database files in July 2023, and its clients notified affected individuals between October 31, 2023, and February 8, 2024. The New York AG found that the companies violated state requirements to disclose a breach as quickly as possible and without unreasonable delay.

The settlement

Although the announcement describes a settlement worth up to $10 million, the companies must pay $300,000 in penalties to the states. The remaining $9.7 million is suspended and could become payable. New York will receive $100,000 from the initial payment. These are payments to the states, not an announced compensation payout to patients.

The exposed information could be valuable to criminals. Our research found stolen identity packages selling for as little as 95 cents apiece on the dark web.

The settlement also requires extensive security changes for the relevant active companies, including:

• MFA for individual user accounts, including administrator accounts, and remote network access.
• Stronger password management and access restricted to what employees need for their jobs.
• Encryption of personal and protected health information.
• Monitoring that automatically alerts security personnel to suspicious activity.
• Annual risk assessments and penetration testing.
• Network segmentation and measures to detect and prevent unauthorized data transfers.
• Written incident response procedures and clearer rules for retaining and securely disposing of sensitive information.

Given the carelessness, number of exposed records and people, do you think the companies got off cheap? Let us know in the comments.

How to stay safe

A breach does not automatically mean someone has misused your information, but you can take these precautions while you wait for more details:

• Verify unexpected messages independently. Don’t let a message about the breach rush you into clicking a link, sharing sensitive information, or making a payment. Go to your healthcare provider or insurer’s official website yourself or use contact details you already trust.
• Review medical bills and insurance statements. Look for appointments, tests, prescriptions, or services you did not receive. The Federal Trade Commission (FTC) identifies unfamiliar medical bills and unexpected items on an Explanation of Benefits statement, which explains how your insurer processed a claim, as warning signs of medical identity theft. Report discrepancies to your healthcare provider and your insurer.
• Review your credit reports. Look for unfamiliar accounts or debts and dispute errors. Free reports are available through AnnualCreditReport.com.
• Act if you find signs of identity theft. Visit IdentityTheft.gov for a recovery plan. If someone has received care in your name, ask the providers involved for copies of your medical records and request corrections in writing.

Medical identity theft is not just a financial problem; it can also affect your care. Someone using your identity to obtain treatment or submit insurance claims could introduce incorrect information into your health records. Checking medical statements and reporting anything unfamiliar can help you catch that misuse.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it.

The post Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers appeared first on SecurityWeek.

Italian Foreign Minister Antonio Tajani said Saturday that his personal data had been disseminated on the dark web.

The post Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web appeared first on SecurityWeek.

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.

The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on SecurityWeek.

Hackers stole personal, health, and insurance information, including Social Security numbers, from the company’s internal systems.

The post Amplifon Americas Data Breach Impacts 1.3 Million appeared first on SecurityWeek.

Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students.

The post Over 3 Million People Hit by Frontline Education Data Breach appeared first on SecurityWeek.

Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.

Working with cryptographers, DeepMind’s AI agents cut the cost of forging RSA-1024 signatures and found a cheaper way to factor keys.

The post Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack appeared first on SecurityWeek.

Last week on Malwarebytes Labs:

• Big Tech sues over California plan to limit kids’ scrolling
• Attacks on supermarket and blood storage systems prompt US warning
• Phone return scams: where a real delivery and a fake return end up in a bill for you
• NIKKE PC launcher compromise put players’ passwords and personal files at risk
• Scammers use AI-generated images of missing pets to extort owners
• Vizio, Samsung smart TVs seem to ignore tracking opt outs
• The fake $750 Apple Cash reward that pays out nothing
• mSecure tells users to change passwords but won’t say why [updated]
• Chrome 157 fixes 213 security issues, including 7 critical flaws
• A hidden backdoor put 1.3 million TV boxes to work for criminals
• Hackers put porn on public billboards and claim it was “far too easy”
• Revolve card breach: 1.5 million people may be affected
• 5 stars for sale: Inside the underground fake review trade
• Applebee’s customer data exposed by password left in app

Stay safe!

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Is it worth paying for a pre-configured GPU for open-source LLM inference instead of using a traditional pay-per-token provider? The biggest advantage seems to be having no usage limits

Comments URL: https://news.ycombinator.com/item?id=50420874

Points: 1

# Comments: 0

Article URL: https://www.youtube.com/watch?v=vxB-jh96kVY

Comments URL: https://news.ycombinator.com/item?id=50420862

Points: 1

# Comments: 1

Article URL: https://blog.zortax.de/posts/a-critique-of-gpui

Comments URL: https://news.ycombinator.com/item?id=50420857

Points: 1

# Comments: 0

Article URL: https://www.rnz.co.nz/life/relationships/family/new-zealand-children-can-t-hold-a-pencil-properly-new-study

Comments URL: https://news.ycombinator.com/item?id=50420840

Points: 1

# Comments: 0

Article URL: https://metaversejs.github.io/peercompute/inference/

Comments URL: https://news.ycombinator.com/item?id=50420822

Points: 1

# Comments: 1

Article URL: https://lifeadminpilot.com/tool

Comments URL: https://news.ycombinator.com/item?id=50420808

Points: 1

# Comments: 0

Article URL: https://briankitano.com/essays/patient-sandbox/

Comments URL: https://news.ycombinator.com/item?id=50420766

Points: 1

# Comments: 0

Article URL: https://github.com/g91/PlusOS

Comments URL: https://news.ycombinator.com/item?id=50420737

Points: 2

# Comments: 0

Article URL: https://twitter.com/AgentMemoryL/status/2118704959344493029

Comments URL: https://news.ycombinator.com/item?id=50420732

Points: 3

# Comments: 0