securityaffairs.com Open in urlscan Pro
2606:4700:3031::ac43:8cd3  Public Scan

Form analysis
3 forms found in the DOM

GET https://securityaffairs.com

<form method="get" action="https://securityaffairs.com">
  <input type="search" name="s" placeholder="Search.." class="site-search-field" value="">
  <input type="submit" class="sm-icon">
</form>

<form class="comment">
  <div class="row">
    <div class="col-sm-12 col-md-6 col-lg-6">
      <div class="mb-3">
        <input type="name" name="cmnt_auth_name" class="form-control cmnt_auth_name" placeholder="Name">
      </div>
    </div>
    <div class="col-sm-12 col-md-6 col-lg-6">
      <div class="mb-3">
        <input type="email" name="cmnt_auth_email" class="form-control cmnt_auth_email" placeholder="Email">
      </div>
    </div>
    <div class="col-sm-12 col-md-12 col-lg-12">
      <div class="mb-3">
        <textarea name="cmnt_msg" class="form-control cmnt_msg" placeholder="Comments" rows="3"></textarea>
      </div>
    </div>
    <div class="col-sm-12 col-md-12 col-lg-12">
      <input class="cmnt_submit_btn btn btn-blue btn-inline btn-big" type="submit" name="cmnt_submit" value="Leave comment">
      <input type="hidden" name="pid" class="pid" value="MTUwOTQ5">
      <input type="hidden" name="parentcommentid" class="parentcommentid" value="0">
    </div>
  </div>
</form>

POST /150949/cyber-crime/north-carolina-hospitals-data-breach.html?_gl=1#wpcf7-f149934-p150949-o1

<form action="/150949/cyber-crime/north-carolina-hospitals-data-breach.html?_gl=1#wpcf7-f149934-p150949-o1" method="post" class="wpcf7-form init" aria-label="Contact form" novalidate="novalidate" data-status="init">
  <div style="display: none;">
    <input type="hidden" name="_wpcf7" value="149934">
    <input type="hidden" name="_wpcf7_version" value="5.8">
    <input type="hidden" name="_wpcf7_locale" value="en_US">
    <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f149934-p150949-o1">
    <input type="hidden" name="_wpcf7_container_post" value="150949">
    <input type="hidden" name="_wpcf7_posted_data_hash" value="">
  </div>
  <div class="form-field"><span class="wpcf7-form-control-wrap" data-name="your-email"><input size="40" class="wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email" autocomplete="email" aria-required="true"
        aria-invalid="false" placeholder="Your email address" value="" type="email" name="your-email"></span><input class="wpcf7-form-control wpcf7-submit has-spinner" type="submit" value="SIGN UP"><span class="wpcf7-spinner"></span></div>
  <div class="wpcf7-response-output" aria-hidden="true"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

MUST READ

Earth Lusca expands its arsenal with SprySOCKS Linux malware

 | 

Microsoft AI research division accidentally exposed 38TB of sensitive data

 | 

German intelligence warns cyberattacks could target liquefied natural gas (LNG)
terminals

 | 

Deepfake and smishing. How hackers compromised the accounts of 27 Retool
customers in the crypto industry

 | 

FBI hacker USDoD leaks highly sensitive TransUnion data

 | 

North Korea's Lazarus APT stole almost $240 million in crypto assets since June

 | 

Clop gang stolen data from major North Carolina hospitals

 | 

CardX released a data leak notification impacting their customers in Thailand

 | 

Security Affairs newsletter Round 437 by Pierluigi Paganini – International
edition

 | 

TikTok fined €345M by Irish DPC for violating children’s privacy

 | 

Dariy Pankov, the NLBrute malware author, pleads guilty

 | 

Dangerous permissions detected in top Android health apps

 | 

Caesars Entertainment paid a ransom to avoid stolen data leaks

 | 

Free Download Manager backdoored to serve Linux malware for more than 3 years

 | 

Lockbit ransomware gang hit the Carthage Area Hospital and the Clayton-Hepburn
Medical Center in New York

 | 

The iPhone of a Russian journalist was infected with the Pegasus spyware

 | 

Kubernetes flaws could lead to remote code execution on Windows endpoints

 | 

Threat actor leaks sensitive data belonging to Airbus

 | 

A new ransomware family called 3AM appears in the threat landscape

 | 

Redfly group infiltrated an Asian national grid as long as six months

 | 

Mozilla fixed a critical zero-day in Firefox and Thunderbird

 | 

Microsoft September 2023 Patch Tuesday fixed 2 actively exploited zero-day flaws

 | 

Save the Children confirms it was hit by cyber attack

 | 

Adobe fixed actively exploited zero-day in Acrobat and Reader

 | 

A new Repojacking attack exposed over 4,000 GitHub repositories to hack

 | 

MGM Resorts hit by a cyber attack

 | 

Anonymous Sudan launched a DDoS attack against Telegram

 | 

Iranian Charming Kitten APT targets various entities in Brazil, Israel, and the
U.A.E. using a new backdoor

 | 

GOOGLE FIXED THE FOURTH CHROME ZERO-DAY OF 2023

 | 

CISA adds recently discovered Apple zero-days to Known Exploited Vulnerabilities
Catalog

 | 

UK and US sanctioned 11 members of the Russia-based TrickBot gang

 | 

New HijackLoader malware is rapidly growing in popularity in the cybercrime
community

 | 

Some of TOP universities wouldn’t pass cybersecurity exam: left websites
vulnerable

 | 

Evil Telegram campaign: Trojanized Telegram apps found on Google Play

 | 

Rhysida Ransomware gang claims to have hacked three more US hospitals

 | 

Akamai prevented the largest DDoS attack on a US financial company

 | 

Security Affairs newsletter Round 436 by Pierluigi Paganini – International
edition

 | 

US CISA added critical Apache RocketMQ flaw to its Known Exploited
Vulnerabilities catalog

 | 

Ragnar Locker gang leaks data stolen from the Israel's Mayanei Hayeshua hospital

 | 

North Korea-linked threat actors target cybersecurity experts with a zero-day

 | 

Zero-day in Cisco ASA and FTD is actively exploited in ransomware attacks

 | 

Zero-days fixed by Apple were used to deliver NSO Group’s Pegasus spyware

 | 

Apple discloses 2 new actively exploited zero-day flaws in iPhones, Macs

 | 

A malvertising campaign is delivering a new version of the macOS Atomic Stealer

 | 

Two flaws in Apache SuperSet allow to remotely hack servers

 | 

Chinese cyberspies obtained Microsoft signing key from Windows crash dump due to
a mistake

 | 

Google addressed an actively exploited zero-day in Android

 | 

A zero-day in Atlas VPN Linux Client leaks users' IP address

 | 

MITRE and CISA release Caldera for OT attack emulation

 | 

ASUS routers are affected by three critical remote code execution flaws

 | 

Hackers stole $41M worth of crypto assets from crypto gambling firm Stake

 | 

Freecycle data breach impacted 7 Million users

 | 

Meta disrupted two influence campaigns from China and Russia

 | 

A massive DDoS attack took down the site of the German financial agency BaFin

 | 

"Smishing Triad" Targeted USPS and US Citizens for Data Theft

 | 

University of Sydney suffered a security breach caused by a third-party service
provider

 | 

Cybercrime will cost Germany $224 billion in 2023

 | 

PoC exploit code released for CVE-2023-34039 bug in VMware Aria Operations for
Networks

 | 

Security Affairs newsletter Round 435 by Pierluigi Paganini – International
edition

 | 

LockBit ransomware gang hit the Commission des services electriques de Montréal
(CSEM)

 | 

UNRAVELING EternalBlue: inside the WannaCry’s enabler

 | 

Researchers released a free decryptor for the Key Group ransomware

 | 

Fashion retailer Forever 21 data breach impacted +500,000 individuals

 | 

Russia-linked hackers target Ukrainian military with Infamous Chisel Android
malware

 | 

Akira Ransomware gang targets Cisco ASA without Multi-Factor Authentication

 | 

Paramount Global disclosed a data breach

 | 

National Safety Council data leak: Credentials of NASA, Tesla, DoJ, Verizon, and
2K others leaked by workplace safety organization

 | 

Abusing Windows Container Isolation Framework to avoid detection by security
products

 | 

Critical RCE flaw impacts VMware Aria Operations Networks

 | 

UNC4841 threat actors hacked US government email servers exploiting Barracuda
ESG flaw

 | 

Hackers infiltrated Japan’s National Center of Incident Readiness and Strategy
for Cybersecurity (NISC) for months

 | 

FIN8-linked actor targets Citrix NetScaler systems

 | 

Japan's JPCERT warns of new 'MalDoc in PDF' attack technique

 | 

Attackers can discover IP address by sending a link over the Skype mobile app

 | 

Cisco fixes 3 high-severity DoS flaws in NX-OS and FXOS software

 | 

Cloud and hosting provider Leaseweb took down critical systems after a cyber
attack

 | 

Crypto investor data exposed by a SIM swapping attack against a Kroll employee

 | 

China-linked Flax Typhoon APT targets Taiwan

 | 

Researchers released PoC exploit for Ivanti Sentry flaw CVE-2023-38035

 | 
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


 * Home
 * Breaking News
 * Cyber Crime
 * Hacking
 * Clop gang stolen data from major North Carolina hospitals


CLOP GANG STOLEN DATA FROM MAJOR NORTH CAROLINA HOSPITALS

Pierluigi Paganini September 17, 2023



RESEARCHERS AT HEALTHCARE TECHNOLOGY FIRM NUANCE BLAME THE CLOP GANG FOR A
SERIES OF CYBER THEFTS AT MAJOR NORTH CAROLINA HOSPITALS.

The Microsoft-owned healthcare technology firm Nuance revealed that the Clop
extortion gang has stolen personal data on major North Carolina hospitals as
part of the Progress MOVEit Transfer campaign.

MOVEit Transfer is a managed file transfer that is used by enterprises to
securely transfer files using SFTP, SCP, and HTTP-based uploads.



The Clop ransomware gang (aka Lace Tempest) was credited by Microsoft for the
campaign that exploited a zero-day vulnerability, tracked as CVE-2023-34362, in
the MOVEit Transfer platform.

In June, the Clop ransomware group claimed to have hacked hundreds of companies
globally by exploiting MOVEit Transfer vulnerability.

Among the victims of the Clop group, there is also Microsoft’s Nuance
health-care technology subsidiary.

Nuance launched an investigation into the incident with the help of cyber
security experts and a law firm.

The company on Friday said that Clop group may have stolen personal data at
numerous North Carolina hospitals and other health care providers, including:

 * Atrium Health, the Charlotte-based health care system giant.
 * Catawba Valley Medical Center in Hickory.
 * Charlotte Radiology.
 * Duke University Health System.
 * DLP Central Carolina Medical Center in Sanford.
 * Greenville-based ECU Health.
 * Pinehurst-based FirstHealth of the Carolinas.
 * Asheville-based Mission Health System.
 * Winston-Salem-based Novant Health.
 * Novant Health New Hanover Regional Medical Center in Wilmington.
 * Chapel Hill-based UNC Health.
 * Raleigh-based Wake Radiology Diagnostic Imaging.
 * Raleigh-based WakeMed Health & Hospitals.

According to the Nuance news release. threat actors also had access to services
people received and their demographic information.

Compromised data included the services people received and their demographic
information,

Nuance announced to have immediately addressed the issue after the software
vendor, Progress, disclosed the flaw and released security updates to fix it on
May 31.

“Patches were installed as soon as they were available,” the Nuance release said
in a press release. “Data privacy and security are among Nuance’s highest
priorities,” reads a statement published by the company. “The company has
extensive measures in place to protect information entrusted to us.”

People are recommended to review account statements and monitor their free
credit reports for suspicious activity.

US hospitals are under pressure, recently several facilities suffered cyber
attacks.

Recently the Rhysida ransomware group made the headlines because
it announced the hack of Prospect Medical Holdings and the theft of sensitive
information from the organization.

In early August, a cyberattack disrupted the computer systems of multiple
hospitals operated by Prospect Medical Holdings, which are located in multiple
states, including California, Texas, Connecticut, Rhode Island, and
Pennsylvania.

Some emergency rooms in multiple hospitals in several states were forced to
close and ambulances were diverted due to a cyberattack against their networks.

A few days ago, Rhysida Ransomware group added three more US hospitals to the
list of victims on its Tor leak site after the PROSPECT MEDICAL attack. The
systems at three hospitals and other medical facilities operated by Singing
River Health System were hit by a cyber attack at the end of August.

The Singing River Health System runs 3 hospitals and 10 clinics and is the
second largest employer on the Mississippi Gulf Coast.

In June, the Idaho Falls Community Hospital was hit by a cyber attack that
impacted its operations. Officials at the hospital confirmed that some clinics
closed due to the cyber attack and some ambulances have been diverted to nearby
hospitals.

Another hospital in the same region, the Mountain View Hospital, suffered a
cyber attack. Officials confirmed that a malware infected some systems of the
hospital’s IT infrastructure.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, North Carolina hospitals)





--------------------------------------------------------------------------------

facebook linkedin twitter

--------------------------------------------------------------------------------

clop ransomware Cybercrime Hacking hacking news hospitals information security
news IT Information Security North Carolina hospitals Pierluigi Paganini
Security Affairs Security News

YOU MIGHT ALSO LIKE

Pierluigi Paganini September 19, 2023

12,000 JUNIPER SRX FIREWALLS AND EX SWITCHES VULNERABLE TO CVE-2023-36845

Read more
Pierluigi Paganini September 19, 2023

EARTH LUSCA EXPANDS ITS ARSENAL WITH SPRYSOCKS LINUX MALWARE

Read more

LEAVE A COMMENT



NEWSLETTER

SUBSCRIBE TO MY EMAIL LIST AND STAY
UP-TO-DATE!



RECENT ARTICLES

EARTH LUSCA EXPANDS ITS ARSENAL WITH SPRYSOCKS LINUX MALWARE

APT / September 19, 2023



MICROSOFT AI RESEARCH DIVISION ACCIDENTALLY EXPOSED 38TB OF SENSITIVE DATA

Data Breach / September 18, 2023



GERMAN INTELLIGENCE WARNS CYBERATTACKS COULD TARGET LIQUEFIED NATURAL GAS (LNG)
TERMINALS

Hacking / September 18, 2023



DEEPFAKE AND SMISHING. HOW HACKERS COMPROMISED THE ACCOUNTS OF 27 RETOOL
CUSTOMERS IN THE CRYPTO INDUSTRY

Hacking / September 18, 2023



FBI HACKER USDOD LEAKS HIGHLY SENSITIVE TRANSUNION DATA

Data Breach / September 18, 2023



To contact me write an email to:

Pierluigi Paganini :
pierluigi.paganini@securityaffairs.co

LEARN MORE

QUICK LINKS

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

Copyright@securityaffairs 2023



We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version