Category: Cybersecurity

The Biggest Data Risks and Cybersecurity Trends for Law Firms

The biggest data risks and cybersecurity trends for law firms

The Biggest Data Risks and Cybersecurity Trends for Law Firms


In the digital age, law firms are operating within a high-risk environment. The number of cyber-attacks continues to rise, as do the associated costs. Recent studies suggest that, on average, small and medium-sized businesses spend more than $200 million annually on cyber security breaches.

These statistics show just how important it is for companies of all sizes to take cybersecurity seriously as well as highlight the risks involved in working with sensitive data. After all, no company wants their clients’ personal information to fall into the wrong hands.

We are excited to launch our 2022 Law Firm Data Breach Trend Report white paper. This report will be a compilation of data analysis from hundreds of law firms across the globe, as well as interviews with more than 100 partners and senior-level executives from the largest law firms in the US. We have learned a lot from these conversations and are excited to share our findings with you.

Download the white paper for free today!

Protecting Client Data:

The Biggest Challenge for Law Firms

Protecting client data is a top concern for law firms of all sizes. While most firms are diligent in protecting sensitive data and complying with local, state, and federal regulations, some are not.

After being asked to identify their most significant challenges when it comes to safeguarding client data, 58% of law firms cited, “managing the sheer volume of data,” and, “ensuring data is secure,” as their primary concern. These findings make sense if we consider that, on average, law firms store more than 5,000 gigabytes of data. The large volumes of data makes it difficult for law firms to constantly comply with the most up-to-date security protocols.


Top Threats

Your client’s data is constantly in danger from simple breaches, such as those resulting from a stolen laptop to even more extensive hacking schemes.

Here are a few actions you’re probably doing now that can endanger your clients most sensitive information.

  • Lawyers Getting Hacked – Most Popular Cyberattacks on Law Firms small

    Skipping Assessments – To help prevent a data breach, an annual inventory should be taken to understand what devices and data you have, where they are located, and who has access to them. It’s also essential to conduct a security and risk assessment. How vulnerable is your information? What would the ramifications be if it was stolen?

  • Understaffed and Underfunded IT Departments – A majority of IT departments are usually very understaffed and overburdened with day-to-day work. This leaves little time for them to improve their security infrastructure, as they always react rather than improve.
  • Lack of Employee Security Training – Analysts claim that non-malicious attacks are the most common security breach that law organizations face. Unfortunately, many legal companies have failed to adequately train their employees on IT security basics.
  • Cloud Migration & Apps – Your business needs to make sure it has a good strategy when it comes time to migrate, including fundamentals like access control and governance, API integrations, and continuous monitoring.


Recent Law Firm Breaches

New York City’s Law Department (July 2021)

Grubman Shire Meiselas & Sacks (May 2020)

Vierra Magen Marcus (May 2020)

Mossack Fonseca (April 2016)


Top Cybersecurity Trends for 2022

Use Password Authenticator – Password authentication is a method in which a user enters a unique ID and key compared to previously stored credentials. It is one of the quickest forms of security; you can set up your device to require some identification before letting someone access it. This can be done using a passcode, PIN, password, fingerprint, or a 2-factor authentication (2FA).

Use Effective EDR – Using effective EDR (Endpoint Detection and Response) tools can help you improve the security of your network by aggregating data on endpoints, including process execution, endpoint communication, and user logins.

Move to a Virtual Server – Moving to a virtual server is essential as it has many benefits that address the security concerns law firms face. These benefits include getting the ability to prioritize critical traffic and improving network agility while reducing the burden from the IT department.

Isolated Backups – A remote or isolated backup is stored separately from other backups and is inaccessible from the end-user layer. Creating a remote backup helps to reduce security breaches, especially ransomware attacks.

Know Your Network Map – Understanding the network map is critical to complying with data privacy regulations as it provides an overview of devices and data on your network. This overview is crucial in identifying and minimizing the attack surface of a system. It will also uncover devices that IT staff may not know are there—for instance, an old, decommissioned server.

Timely Software Updates – It sounds simple, but vulnerabilities caused by outdated software are a significant problem. Keeping all the software up to date is essential for better performance. It also helps discourage potential cybercriminals who like to take advantage of previously-found weaknesses in software.

Data Encryption – In 2022, law firms must use encryption methods for systems, data in the cloud, data at rest, and data in transit to protect their files. Hard drives, USB devices, and phones should also use encryption if they are holding sensitive data

To read the cybersecurity trends for 2022 in detail, download our free white paper today.


By 2023, 80% of law firms will have experienced a data breach, according to research from LexisNexis. Given the rising number of cyber-attacks law firms face, it is necessary to take cybersecurity seriously. Law firms can better protect their sensitive data against these cyber threats by investing in the latest security technologies.

Protecting sensitive client data is essential for all law firms.

Stay on top of the latest trends and best practices for data security by downloading our white paper today! We highlight what law firms should be doing to protect their data and prevent a breach from ever happening. Protected Harbor also has other resources to prevent a law firm data breach, which you can access free from our digital library.

Keep in touch for more tips on how to keep your company safe from cybercriminals.

These Cloud Vulnerabilities Will Cause Your Next Data Breach

These cloud vulnerablilities will cause your next data breach

These Cloud Vulnerabilities Will Cause Your Next Data Breach


Cyber security is a constant race between businesses and hackers in the digital world. Every new technology has potential risks that must be understood and addressed before implementation. New threats are emerging all the time and cloud computing is no different. Many types of cloud services are being used by businesses more than ever before.

In fact, according to Gartner, private cloud services will continue to grow faster than public cloud services in the next few years. However, some types of clouds are riskier than others regarding cyber security. Several vulnerabilities can expose your company’s data when using any cloud service or Software as a Service (SaaS) application.

This article lists common vulnerabilities you should know about before using any cloud-based system or software.


Understanding Cloud Vulnerabilities: Protecting Sensitive Customer Information

As businesses increasingly turn to the cloud for their computing needs, it’s important to consider the potential vulnerabilities of storing sensitive customer information in a shared infrastructure. Cyber attacks are a constant threat, and unauthorized access to personal data such as social security numbers, financial information, and other sensitive information can lead to identity theft and other serious consequences.

Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) are two popular cloud computing services businesses use to store and access their data. While the cloud offers many benefits, knowing the potential risks is important. Cloud providers are responsible for securing the underlying infrastructure and providing secure cloud access. Still, businesses are responsible for securing their own data and applications that run on top of the cloud infrastructure.

One way to protect sensitive customer information is by using a hybrid cloud model, which allows businesses to keep some of their data in a private data center while still taking advantage of cloud computing resources. This approach can provide additional security and control over customer data.

Another important consideration is the use of virtual machines in the cloud. Virtual machines can help isolate applications and data, limiting the impact of a potential cyber attack. It’s also important to implement access controls and encryption to prevent unauthorized access to sensitive information.


Public Exposure

The oldest blunder in the book is setting up a new cloud resource but leaving it entirely insecure and publicly visible. Your unprotected public assets will almost certainly be found because hackers today frequently use automated tools to scan target networks for any exposed assets.

By 2022, nearly 50% of businesses would unknowingly or accidentally have some IaaS storage devices, networks, apps, or APIs directly exposed to the public internet. This number is up from 25% in 2018.


Excessive Permissions

Fast company operations are one of the main advantages of switching to the cloud. However, access credentials are routinely distributed hurriedly and needlessly in the interest of expediency, resulting in many individuals having excessive permissions for which they have no business need for. If any of those credentials end up in the wrong hands, attackers would have unrestricted access to private information.

By 2023 (up from 50% in 2020) 25% of security breaches will be due to improper handling of login credentials, identities, and privileges, predicts Gartner.


Cloud Vulnerabilities middleLack of Multi-factor Authentication for Privileged Users

One of the most typical cloud vulnerabilities is the absence of Multi-Factor Authentication (MFA) for users assigned to privileged administrative positions in control. Access for privileged users must be as secure and feasible in any cloud environment. A company may suffer severe repercussions if a fundamental security measure like MFA is not enabled.

It is straightforward for malicious actors to exploit privileged accounts without MFA being enabled. These accounts are vulnerable to brute force assaults due to lacking MFA. Hackers can use these accounts to entirely disrupt an organization’s operations and steal its data because they often have high administrator permissions.


Insecure APIs

APIs, or Application Programming Interfaces, are frequently used to simplify cloud computing. APIs make it very simple to share data between other apps, improving convenience and efficiency. However, if they are not secured, this can lead to multiple cloud vulnerabilities and become an easy entry point for malicious attackers.

Threat actors can launch DDoS assaults and obtain access to sensitive company data by taking advantage of unsecured APIs while remaining unnoticed. In fact, by 2022, API abuses are anticipated to overtake other attack methods as the most popular, according to Gartner data.


Final Thoughts

If companies using the cloud do not consider limiting the dangers that accompany it, they are taking a preventable yet significant risk. The IT processes teams use to develop and deploy applications in the cloud infrastructure must be well integrated into a company’s strict cloud security rules.

The use of cloud computing has changed how businesses and hackers operate. Both new opportunities and threats related to cloud security have been introduced. Enterprises must continuously address the dangers and difficulties associated with cloud security while implementing the appropriate security technologies to facilitate operational work.

It’s essential to understand the potential vulnerabilities so that you can mitigate them. Suppose you have any concerns about your current cloud environment. In that case, you can consult with a cloud consulting company like Protected Harbor to help you assess the risks and implement practices to avoid data breaches.

Protected Harbor‘s cloud security solution integrates the latest security technologies with your cloud infrastructure. Businesses can take advantage of cloud computing’s capabilities with the right technology and the help of cloud security specialists.

We have researched and created an e-book for companies looking to migrate to the cloud. This e-book helps them to understand better the benefits as well as the risks that come with cloud migration so that they can plan. Get your free copy of the e-book today!

Malware Hits Millions of Android Users

malware hits millons of android users

Malware Hits Millions of Android Users:

The Top 5 Apps You Need to Uninstall Right Now


There’s nothing scarier than malware. When it comes to Android apps, users always have to look for possible threats. However, things are not as simple as they may seem. Researchers at Check Point discovered a new strain of malware called a, “false positive,” that targets users through Google Play by uploading malicious apps under user-friendly names.

This is how it works:

The malware tricks you into installing a seemingly harmless app onto your phone. But once you install it, the app will download other malicious apps and start reading your sensitive data without your permission or knowledge. You might be wondering about which apps are putting you at risk, but don’t worry, we have you covered.

Here’s a brief list of the top 5 offenders, which you need to uninstall immediately if you haven’t done so yet.


So, What Happened?

Another group of seemingly innocent Android apps that are meant to spread malware to endpoints and charge unsuspecting users for services has been discovered by researchers.

The Dr. Web antivirus team found the most recent batch, including wallpaper programs, keyboards, picture editors, video editors, and an occasional cache cleaner or system maintenance app. They have altogether received more than 10 million downloads overall.

After escaping Google’s stringent security measures, twenty-eight apps in total were discovered in the Google Play Store. You can see the complete list of infected android apps here.


Android Apps Hacked

Regarding the damages, the method is mainly unchanged.

Once the malware or “app,” is downloaded, most applications will try to hide, appearing as regular system apps in the app drawer. They do this with the hope that people won’t uninstall them. Then, to generate more revenue, the applications constantly push advertisements and try to sign the victim up for various premium services.

If users hadn’t granted the necessary permissions to the apps, none of this would have been possible. Even though the apps have a straightforward design and do what they claim to, they frequently request advanced permissions from users, such as the right to be exempt from battery-saving features, to run in the background even after the user closes the app, which is a big warning sign in and of itself.

Three of the apps are still available on the Play Store, though most have already been removed. Even if all of the apps were removed, they have still been downloaded millions of times. Thus, they will continue to pose a threat until they are completely deleted from the smartphones of all victims.

Below is a short list of the 5 malicious apps researchers have found that you should remove immediately:


FastCleaner: Cache Cleaner

Before Google discovered the true intentions of the app, Fast Cleaner had amassed over 50,000 installs. Using a time-tested technique, a brand-new banking trojan was introduced into the Android handsets of unsuspecting users across the country designed to steal login information as well as to intercept text messages and notifications without anybody noticing anything strange.


Malware hits millions of Android users middleES File Explorer

The most well-known file explorer app was probably ES File Explorer. That’s because five years ago, it was actually a really good app.

So, why is bad?  Bloatware and adware were prevalent within the free edition, and users were constantly nagged to download more apps via pop-up notifications that you couldn’t turn off. However, things worsened when the once-popular app was removed from the Play Store for engaging in click fraud through its advertisements.

For those unaware, click fraud is the practice of secretly clicking background advertisements on consumers’ devices.

You can still download dozens more imitators from the Play Store in addition to the ES File Explorer APK nowadays. However, the program should not be used in any of its iterations.


Virus Cleaner

Virus Cleaner – Antivirus Free and Phone Cleaner by Super Cleaner Studio, an app with over 14 million downloads, illustrates everything wrong with the Android ecosystem. It includes many advertisements, many of which are for products and services with a dubious reputation. Additionally, it “claims” to be an efficient security master, phone trash cleaner, WIFI security, super speed booster, battery saver, CPU cooler, and notification cleaner. None of which can at all be accomplished to any real degree by any software install.

Really, you should be ignoring any application that claims to be a “CPU cooler.”


SuperVPN Free

SuperVPN is one of the most popular VPN apps for Android, with over 100 million downloads. But earlier this year, cybersecurity experts alleged that the app has some serious flaws that might let hackers launch Man-in-the-Middle (MitM) attacks and steal user data like credit card numbers, photographs, and private chats.

According to reports, hackers can also take advantage of the flaws to redirect a user’s connection to harmful websites, thus jeopardizing the security and privacy of the user.


Notes – Reminders & Lists

It is recommended not to download this app from its official website as there are concerns regarding its security and safety. It was detected by many anti-virus software systems as malicious. This app may be a scam as it doesn’t seem to work properly and asks for inappropriate permissions. So far, Notes – Reminders & Lists are not available in Google’s Play Store. It can only be downloaded from its official website. Either way, we recommend you staying far away from this app, as it might be a scam and may have malware hidden inside.



It can be challenging to differentiate between trustworthy and malicious apps. The number of pointless permissions an app requests is the one clear sign that should always cause alarm. Does a flashlight app really need access to your location? Does a cleaning app really need access to the camera or microphone?

Richard Luna, CEO of Protected Harbor, stated: “This attack is not a surprise; it should be expected.  As more work is performed on mobile devices, those devices, like desktops, will be the main point of attack.  Application development platforms must be better hardened to defend against this malware.

What can an end user do? Enable security and Two-Factor Authentication on as many platforms and applications as available on any platform.  If you are concerned, use a desktop over a mobile device, desktops have been dealing with this type of attack for decades.”

Nick Solimando, Director of Technology at Protected Harbor, has 3 tips for businesses that operate through a lot of mobile apps:

  1. Only install mobile apps from providers you trust. Since harmful programs are getting better at hiding in plain sight, downloading from reputable sites is no longer the only recommendation.
  2. Always check the app store ratings and reviews before downloading. Users should check the reviews because they offer a reliable indication of the apps’ reliability. Additionally, be sure to verify, as threat actors have been known to spoof some of them. It’s better to avoid an app if there are few reviews for it.
  3. Periodically go through your mobile device and uninstall extra apps you no longer use. This will not only make you safe, but you’ll also ease memory space.

Despite Google’s constant efforts, thousands of risky apps, including malware, adware, spyware, and bloatware, may be found on the Play Store. The ones above have made it onto our list since they are some of the most frequently utilized risky Android apps.

These apps are very common and can be found on every device. However, they have been infected by malware, so they will likely try and more than likely, successfully steal your data. It’s best to uninstall them and proceed with extreme caution if you can. Always keep your device as well as apps up-to-date and avoid using third-party app stores. Android users can stay safe from potential threats by installing and keeping the latest version of their mobile operating system and using security software for mobile devices.

Protected Harbor uses the latest threat detection and prevention technology to keep your network safe and secure. Our devices are also updated regularly, keeping them secure and up to date with the latest security patches. Our software is installed in your systems to monitor suspicious activity – it can be installed on desktops, laptops, or in the cloud.

We secure your endpoints so that you can be assured your network is protected from malware and cyber threats. We protect your network by monitoring critical network assets, preventing unauthorized access to sensitive information, blacklisting malicious software, and providing real-time threat detection and response.

We are giving a free IT Audit and penetration testing for a limited time, contact us today and get one.

Third-Party Cloud-Apps’ Cybersecurity Risks in 2022

Cybersecurity Risks of 3rd Party Cloud-Apps in 2022

Healthcare data breaches are at an all-time high. The Ponemon Institute found that 66% of healthcare organizations experienced a breach of patient data in the past 12 months. And due to recent software vulnerabilities and cyberattacks on healthcare companies, we predict these numbers will continue to rise. The crux of the problem is that most healthcare vendors operate as a closed system that doesn’t sync with other systems outside of their ecosystem. If a vendor is breached, it almost always leads to a data breach for its partners. As such, healthcare organizations must modify their current strategy and begin working with third-party vendors who have a vested interest in protecting their sensitive information. Doing so will help cut down on the number of breaches being reported and improve operational efficiency across the board.

3rd party cloud apps are becoming more common in enterprise software as companies look to save money and time by outsourcing their software. However, businesses need to be aware of the cybersecurity risks of using these apps. Companies can use various best practices to protect themselves from 3rd party cloud app cyber risks.

We are excited to announce our white paper- Cybersecurity Risks of 3rd Party Cloud Apps in 2022. We have done the research so that you don’t have to, the white paper discusses the top cybersecurity threats, data breach trends in 2022, and how to stay safe. Download our white paper today to learn about 3rd party cloud apps.


Top 3 Cybersecurity Threats

These are the worst offenders regarding security threats in the healthcare industry.

Malicious Network Traffic- According to a 2019 analysis by Verizon, 81 percent of cybersecurity problems in healthcare are caused by privilege misuse, web apps, and other issues. Even though this form of malicious network activity may not be as well-planned as a full-scale ransomware operation, its presence in the sector should raise alarm bells for healthcare providers.

Ransomware Threat-  It prevents or restricts users from accessing computer systems by locking out or corrupting the data until a ransom is paid. Usually, the only way to unlock the system is to pay the ransom, hence the name “ransomware.”

Phishing Scams- Phishing is the process of requesting sensitive information through correspondence that claims to be from a reputable source, such as a mortgage business or official government webpage. This often comprises a personal identification number, login information, and payment information.


Data-Breaches-via-3rd-Party-Platform-Vulnerabilities middle


These Are the Data Breach Trends We Expect to See In 2022

  • Increased Healthcare Breach Notification Laws- The number of healthcare breach notification laws continues to grow. As such, we expect breach notification laws to become more stringent and begin to include stiff fines.
  • The Rise of Cloud-based EHRs- As organizations begin to rely on cloud-based EHRs, we expect data breaches to increase. This is because EHRs are not designed to be safe outside of the organization’s environment. Thus, if a breach does occur, it can quickly spread to other partners and vendors.
  • Increased Focus on Software Application Security Organizations that fail to prioritize application security will pay the price. We expect to see organizations place an increased focus on third-party application security and the security within their own applications. -## TOP 10 Largest Healthcare Data Breaches of Q1 2022

Largest Healthcare Data Breaches Of Q1 2022

Provider Records Affected
North Broward Hospital District 1351431
Medical Review Institute/ America 134571
Medical Healthcare Solutions 133997
Ravkoo 105000
TTEC Healthcare 86305

As we’ve outlined, healthcare companies have seen a massive increase in data breaches. This is mainly due to SaaS providers’ weak security and inability to protect their customers’ data. Download our white paper to see the complete list of healthcare data breaches in Q1 2022.


SaaS Security Threats in Healthcare

The simplicity, usability, and cost advantages of SaaS (Software as a Service) solutions have encouraged healthcare firms to adopt them at a never-before-seen rate. Every healthcare company, however, needs to be aware of a few risks associated with using third-party apps.

Man In the Middle Vulnerabilities: An app and the hospital backend do not directly exchange data. Data is sent back and forth between the two parties via a communication channel. Bad actors can intercept the data at any point along their transit and potentially harm the backend.

Limited Cloud Infrastructure: Because a cloud-based architecture differs from an on-premises data center, traditional security technologies and tactics are frequently unable to defend it successfully. However, nothing you can do will make your third-party software secure if the foundational elements are not correctly set up.

Lack of Regulations: The usage of health data by third-party apps is primarily up to individual businesses rather than established regulations. Cloud service providers are not regarded as business associates under HIPAA and are not covered by HIPAA. Instead, most third-party apps are covered by the FTC Act’s protections and the agency’s authority.

Data Control Issues: A 2019 National Library of Medicine (NLM) study found that 79 percent of healthcare apps resell or share data. There is no law requiring patient consent for this downstream use, which may raise privacy-related concerns.

Inadequate Due Diligence: Organizations fail to do adequate due diligence on their third-party vendors, leaving them vulnerable to cyberattacks. The Ponemon Institute found that 87% of healthcare organizations fail to perform a third-party risk analysis.

How Can Healthcare Reduce the Risk of Cyber-attacks?

The best method to reduce threats is to prevent them. Often, businesses begin by collaborating with their internet service provider (ISP) and hiring a third-party security risk assessment team. The easiest method to lessen risks within your healthcare company is to follow these cybersecurity best practices: Patch management priorities, least access privilege policies, email, and traffic filtering, and many more. Download the white paper to learn more about how businesses can protect patient data.

Examine Third-party IT and Cybersecurity Practices: Audit all vendors’ third-party IT and cybersecurity practices, including software providers. If the vendors fail to meet security standards, terminate contracts and seek new vendors that meet standards.



With the increase in the adoption of SaaS and other cloud-based software solutions, a vast amount of sensitive data is now stored in the cloud and is thus made more vulnerable to data breaches. Cloud apps are prone to security breaches due to their shared hosting environments.

Cloud apps are the most likely to cause a data breach due to their very nature. Most of them are designed for ease of use, not security. And even those that are secure by design are often hosted on shared servers, making them a security risk.

Even if you use a secure cloud app, there is always a chance that the service provider itself may be hacked, and your data may end up in the wrong hands. Stay connected with us and keep reading our blogs to know about the latest updates about 3rd party cloud apps. In the meantime, you can download and read the white paper Cybersecurity Risks of 3rd Party Cloud Apps in 2022.

A Quick Guide to Proactive Cybersecurity Measures: How to Keep Yourself Safe From Hackers

A quick guide to proactive cybersecurity measures how to keep yourself safe from hackers

A Quick Guide to Proactive Cybersecurity Measures: How to Keep Yourself Safe From Hackers


Cybersecurity has become an important topic in today’s society. In the digital age, cybersecurity is critical to protecting data and intellectual property from unauthorized access, modification, disclosure, or destruction. However, cyber threats continue to grow in number and sophistication. A recent study by Intel Security found that 66% of businesses experienced at least one cyberattack during the year 2021. Cybersecurity for small businesses is important because they are often easy targets for cybercriminals who seek to steal sensitive data or disrupt operations, leading to significant financial losses and reputational damage. As more organizations are confronted with this reality, many have also begun to realize their current security measures aren’t enough.

In this blog post, we will unpack some proactive cybersecurity measures you can take to protect your organization’s data and reduce your risk of being a victim of cybercrime.


What is Proactive Cybersecurity?

Proactive cybersecurity is an organization’s effort to protect its data and software systems from threats before they happen. A proactive approach to cybersecurity can help organizations to stay ahead of emerging threats by using data-driven insights, continuous monitoring, and risk assessments. There are many ways to implement proactive cybersecurity measures.

Focusing on cybersecurity policies and procedures is a great place to start. You can also consider implementing tools that automate security tasks, such as Endpoint Detection and Response (EDR).


Cyber-Threat Analysis

When adopting proactive cybersecurity measures, there are various risks your company can face. To determine your top cybersecurity risks and vulnerabilities, you must do a thorough threat analysis. You’ll want to know how many cyber attacks happen daily based on your sector, geography, and relevant exposure. You must be aware of your defenses’ weak and strong points. Additionally, you must have a specific cybersecurity attack and defensive strategy.

Cybersecurity threats can come from various sources, including human error, natural disasters, hardware failures, malicious software, unsecured networks, and more. Before implementing proactive cybersecurity measures, you should analyze your organization’s cyber threats. You can use cyber threat modeling to identify the most significant risks to your organization. This process maps the threats to your organization and involves breaking down the organization’s infrastructure into components and mapping the threats against them.

What You Can Learn from Cyber Threat Analysis Are:

Assets: System administrators and cybersecurity experts should identify and safeguard the most critical assets in your organization. This includes sensitive data, intellectual property, and critical systems.

Attack vectors: Attacks can come from a variety of sources. The most common attack vectors include infected websites, malicious code, unsecured networks, and social engineering tactics.

Controls: You can use threat modeling to identify the controls and protect your assets. This will help you determine where additional controls might be needed.


Educate Your Team

One important proactive cybersecurity measure is to ensure that your team understands the potential threats facing your organization and how they can reduce their risk of being attacked. This can be done through regular cybersecurity training that educates employees on best practices and how they can contribute to better cybersecurity. It can also help them learn how to protect themselves and their colleagues.


Quick Guide to Proactive Cybersecurity Measures smallThreat Hunting

Cyber threat hunting continuously monitors networks and systems to identify malicious activity and threats in real-time. During threat hunting, you should also look for information that could be useful in tracking down and identifying potential attackers. This will allow you to respond to threats and attacks quickly. It could be an Advanced Persistent Threat (APT), a sophisticated cyber-attack, or even an insider threat. Regardless of the potential attack, the threat-hunting process can help you identify the nature of the threat and take the appropriate action to mitigate it before any real impacts on your business.


Penetration Testing

Penetration testing is testing your cybersecurity measures by breaking into your own systems. You can also refer to this as ethical hacking or red teaming. Once you have identified a potential threat, you can use penetration testing to simulate the attack and determine the outcome of this threat. This will help you understand the threat’s risk and choose the best way to respond to it. A vulnerability assessment is also an essential tool to use during a penetration test. It will help you to identify areas of your network where you are at risk of being attacked. It is important to remember that penetration testing is only a simulation and will help your business down the road.


Get Help

The cyber threats facing organizations today are constantly growing. Proactive cybersecurity measures must be implemented to protect your organization’s data and intellectual property. This includes cyber threat analysis, educating your team, threat hunting, and penetration testing.

Now, one final proactive cybersecurity measure we recommend is to get help. Even well-resourced organizations often struggle to fully protect themselves from cyber threats. Therefore, engaging with cybersecurity experts who can help your organization improve its cybersecurity posture is important. Working with our team at Protected Harbor is also essential as it provides an unbiased third-party perspective that can help you to identify vulnerabilities you may be unaware of.

Calling in the experts is the most straightforward preventative cybersecurity strategy for if this all sounds a bit overwhelming. You and your IT team may feel less pressure if you enlist a group of professionals to assist at each stage, and your organization may be better protected.

Let our staff of cybersecurity professionals start taking preventative steps to secure your company. Get in touch with Protected Harbor today to learn more about our Threat Monitoring, Detection, & Response services.

This Month, You Should Avoid the Top 5 Email Scams

top 5 email scams you need to look out this month

Top 5 Email Scams You Need to Look Out for This Month

Companies, especially in today’s modern world where hackers and scammers are on the rise, have been making increased efforts to train their employees in recognizing scams the moment they hit their inboxes. However, people still continue to fall for them.

The effects of data breaches are becoming more severe than ever. More than 15 million phishing emails were sent in 2021, and fixing them would have cost a business an average of $1.85 million.

So, why are people continuing to fall for these scams? Often for the same reasons they always have, such as carelessness, gullibility, curiosity, courtesy, and apathy.

Email is one of the most common ways for scammers to reach their potential victims and they are targeting all businesses, regardless of size. Hackers are becoming more sophisticated, making it increasingly difficult for companies to spot a scam before it’s too late. The best way to protect your company from scammers is by arming yourself with not only security but more importantly, knowledge.

Below we will discuss the top 5 scams you need to look out for this month.


1. The PayPal Invoice Scam

Traditionally, scammers will send an email asking you to transfer money to a third party. However, these scammers are now impersonating PayPal and asking you to send money to them. Scammers create an online PayPal account in the name of well-known companies, such as Risenest Technology, Target, or GoDaddy, to name a few. They next send a customized invoice via PayPal using that account. At that instance, PayPal alerts you that an invoice has been received.

The fact that the invoice notification is REAL makes it challenging. You may view and pay the scammers’ invoices on your PayPal app. The con artists want more, not just money. They can alter the invoice’s message to fraudulently indicate that you will be charged a subscription fee for their “service.” Then they tell you that you should phone a certain number if you have any questions.

The person who answers the phone if you call them will ask you to download “remote control” software to your phone. Avoid doing this! Scammers will access your device and take additional stored credentials along with your PayPal log-in information. With these, scammers can carry out other crimes like identity theft.

If you ever receive this email, call PayPal immediately to confirm whether the email in question is legitimate. Remember that an invoice’s source may be shady even if the email appears genuine. If they did NOT send this email, report it to the company as a scam so others can be warned. Check if a web address is safe, and never respond to any invoices or requests for money that you do not recognize.


Top 5 Email Scams small2. The Official Looking Email Scam

An email that appears to be from a government official, bank, or other company you may do business with is one of the most common email schemes. The scammers will try to make the email appear legitimate by using a similar email address to the one used by the actual organization. They may also use official-looking letterhead, logos, and other branding details to make the email seem real. If you get an official-looking email, inspect the email address carefully against any other email communications you’ve had previously with that company. If something seems a little off, do NOT open the email—scammers often use malicious links or attachments to steal your sensitive information.

If you are ever in doubt, call the company’s customer service department immediately to confirm the email’s legitimacy.


3. The Aging Accounts Scam

A company’s financial department uses aging reports, also known as accounts receivable schedules, to track clients who haven’t yet made payments on items or services they purchased on credit.

It was discovered during some recent engagements that BEC fraudsters were attempting to obtain a copy of an aging report by using the identity of the criminals’ preferred persona: the company CEO. These scammers sent a straightforward request for the document using free and temporary email addresses and display name deception.

Unlike previous BEC scams, this one did not demand that the victim transfer money to a vendor bank account or buy gift cards for performing staff. Instead, they requested that the target provide them a copy of the accounts receivable (or “A/R”) department’s aging report.

The scammers’ next targets would be the clients of our fictitious organization once they had this information—customer names, outstanding amounts, and contact details. They can use this information to make an email account alias that appears legitimate, pose as a member of our finance team, and ask them to pay the unpaid debt listed on the aging report.

The scammers will probably provide incentives to pay off their “debts” more quickly, such as lowering their total debt if they immediately pay off their unpaid balance. The only thing left for the actor to do at that point is to inform the payee that the banking information has recently changed and to provide them with the most recent account information for a bank account that the hackers control.

We advise using a multilayered strategy to prevent your employees, companies, and clients from falling prey to this attack. Strong email protections against advanced email attacks are a crucial foundation layer to neutralize the threat because, logically, none of this can happen if the original CEO identity deception misses the mailbox of the intended target.


4. The “Problem with Your Delivery” Scam

These scams can be spread in various ways; some demand delivery payment, while others ask for your email address to track a parcel. The hackers frequently utilize fictitious tracking numbers, delivery dates, and times.

You will often receive these emails from companies like UPS, FedEx, or the U.S. Postal Service, but they actually aren’t from these companies at all.

Sometimes, if you were to send a package, these scammers may even claim that there was a problem with your delivery and that the recipient could not be reached. They will then ask you to resend the package using a prepaid label they provide.

The way this works is quite ingenious. They expect for you to fall for their scam and send the package back out using their label as instructed. After a few days, you will receive the package you sent out with their label—and the scammer will have your money.

To avoid this scam, don’t fall for the pressure to act quickly. Instead, contact the real company to confirm whether there was a problem with your delivery.


5. The DocuSign Scam

Attackers are sending phishing links and documents through the electronic agreement management company Attackers are sending phishing links and documents through the electronic agreement management company DocuSign.

A hostile actor first creates a free DocuSign account or compromises another user’s account. Afterward, they add a file to the account. The attacker then mails their target a DocuSign envelope. DocuSign then sends the recipient an email invitation. It asks customers to click on a hyperlinked “View Document” button to review and sign an electronic document.

Since the email is technically sound, it avoids detection. The phishing link is hosted on DocuSign’s servers, making it possible to reach a recipient’s inbox.

The signature procedure is the same as it would be for a genuine file. The receiver is redirected after clicking the link, which is the only difference. They arrive at a phishing website meant to steal their Microsoft, Dropbox, and other account information.

This method works because DocuSign files, including PDFs, Word documents, and other file kinds, continue to be clickable up to the final page. (To prevent attacks, DocuSign turns other uploaded document file formats into static PDFs.) When offered the option to download the file, a signer can access the link and embedded files, even if those resources are dangerous.

Users can defend themselves from phishing scams that pose as DocuSign by refraining from opening suspicious email attachments. Additionally, consider hovering over embedded links to see where those URLs lead. Use the DocuSign website to access documents directly. These factors can be incorporated into an organization’s security awareness training programs.



Scams are becoming more sophisticated and difficult to spot, especially in the ever-changing world of technology. If something seems suspicious, don’t react impulsively. If you receive an email that seems off, do not click on any links or open any attachments.

Instead, report it to your IT department to investigate further and then delete the email.

Protected Harbor email security solution can protect users against malicious emails, zero-day attacks, and phishing scams. The best part about this email security solution is that it comes with a spam filter that has the ability to block more than 99.9% of spam emails. Thanks to its AI-based phishing keyword detection, it can identify phishing emails and block them before they reach the user.

Contact us today and get complete protection against email threats with zero trust security, MFA, and end-to-end email encryption.

Keep your email and company data safe from hackers.

How to Prevent Cyberattacks Against Law Firms?

Cyberattacks against law firms and how to prevent them

Cyberattacks Against Law Firms and How to Prevent Them?

No company of any size, including law firms, can afford to ignore the extensive media coverage of cyber security and its hazards. It would be a mistake to believe that smaller firms are not being targeted. On the contrary, according to the Verizon Data Breach Investigations Report,

  • Human error was responsible for 85 percent of the breaches.
  • Phishing was implicated in 36% of breaches, up 11% from the previous year.
  • Ransomware was used in 10% of breaches this year, up from 5% last year.

Due to the large quantities of money, information, and customer data that law firms hold, cyber-attacks against them are becoming more common. According to the American Bar Association, more than 25% of law firms have experienced cyber-attacks. This proportion was 35% among law businesses with 10 to 49 attorneys, implying that over one-third of small law firms had been hacked. During the poll, 99% of participants said their legal firm employs password management security.

The fact that 25% of survey respondents said their legal business had been hacked at some point is perhaps the most surprising number. Law firms are an obvious target for cybercriminals; with so much data on so many people and businesses, law firms are a one-stop-shop for harvesting a wealth of data.

Why Are Law Firms More Vulnerable to Cyber Attacks?

Law firms are vulnerable because they often deal with sensitive information on behalf of their clients. This includes client files, billing information, and other confidential data such as intellectual property rights or personal information about employees or associates.

In addition to their vulnerability to cyberattacks, law firms also have network security issues because many rely on third-party vendors for cloud storage or email services. A single breach could expose all of their data at once if it is not adequately secured.

Types of Cyberattacks Against Law Firms

The following are some of the most common types of cyberattacks against law firms:

1.    Malware Infections

Malware is software used to gain access to private computer systems and networks. According to an American Bar Association research, 29% of law firms reported a security breach, with more than 1 in 5 unsure if there was a breach and 36% reporting previous malware attacks in their systems.

2. Ransomware

This malware locks down files on your computer until the victim pays a ransom. It’s become an increasingly common tactic among cybercriminals in recent years.

Law firms, unfortunately, are more vulnerable than other types of enterprises. According to a research issued in May by security firm BlueVoyant, 15% of a global sample of tens of thousands of legal firms had indicators of infiltrated networks, and all organizations were targeted by focused threat activity.

3. Phishing attacks

Phishing attacks are one of the most common types of a cyberattack against law firms. These attacks occur when an email is sent out to employees with a link to a fake website or attachment. This attack aims to get confidential information from the victim, such as usernames, passwords, and bank account details. By 2021, Phishing attacks have climbed by 11%, causing the law firms massive trouble.

4. Insider Threats

According to Egress, insider breach risk is a crucial worry for 96% of IT leaders in the legal sector. It’s simple to dismiss these risks as “your staff.” It’s correct, yet it’s also lacking. Insider threats are divided into two categories.

  • These employees are deliberately causing hurt, devastation, and turmoil in your organization.
  • Employees who acquire access due to carelessness, negligence, or inadequate systems and processes.

5. Credential theft

This attack involves a hacker obtaining valid login credentials from someone who has legitimate access to a law firm’s network or system. Last year, credential theft was used in 61% of data breaches, posing a significant risk to businesses. It usually begins with a phishing email intended to dupe partners, lawyers, or employees into revealing login credentials.

6. Fraudulent invoicing

Law firms receive invoices for services rendered by other companies. Attackers can send fake invoices to law firms and request payment using a fraudulent bank account or routing number.

Cyberattacks Against Law Firms smallHow to Protect Your Law Firm Against Cyberattacks

Here are some ways you can protect your law firm against cyberattacks:

Improve your security culture

The most important step you can take in improving your organization’s security culture. Make it clear that everyone in your firm is responsible for the security and that there will be consequences if they don’t follow proper procedures.

Implement basic cybersecurity measures

Install antivirus software on all computers and servers, set up firewalls, encrypt sensitive data and conduct regular audits of your IT infrastructure. These basic measures will go a long way toward protecting your firm from cyberattacks.

Practice secure file sharing

A critical first step for safeguarding your firm from cybercrime is practicing secure file sharing. This means using a secure connection when uploading files such as Word documents and PDFs onto an online storage service like Box or Google Drive. It would be best if you also use two-step verification whenever possible, which requires users to enter an additional passcode sent via text message each time they log in from an unrecognized device or location.

Budget for Security

Law firms often prioritize cybersecurity because it seems like something that can be dealt with later. However, it’s important to remember that this is not just about protecting confidential information but also protecting client trust and business relationships with other companies. And when you lose those things due to a data breach, they’re tough to regain.

Encrypt sensitive data

Encryption is one of the most effective ways to protect your sensitive information from hackers. It’s important to note that encryption doesn’t just apply to emails and other documents

s containing personal information but also to files containing sensitive client information such as names and addresses. The more secure your data is, the harder it will be for hackers to access it.

Be Proactive

Hire an outside firm to conduct security audits and provide recommendations for improvements. You should also invest in advanced technologies, such as firewalls and intrusion detection systems (IDS), which can help prevent attacks.

Protecting your network with firewalls

Firewalls are software programs that filter incoming traffic on a network to prevent unauthorized access and block malicious traffic such as malware or viruses. Firewalls should protect all devices on your network so unauthorized users can’t access them remotely.

Installing antivirus software on all devices

Antivirus software scans files before they’re opened or run to ensure they’re not infected with viruses or malware (including ransomware). All computers used by employees should have antivirus software installed on them and any mobile devices used by employees outside the office (e.g., laptops, smartphones).

Final Words

In today’s online world, hackers look for loopholes in organizations’ IT infrastructure. Law firms particularly need to take a proactive approach when it comes to cyber threats. They should implement robust cybersecurity measures to secure client data, employee and company information, contracts, and valuable intellectual property. By doing so, they can protect themselves and their clients from cybercriminals targeting the legal industry in the future.

Protected Harbor prevents malicious actors from gaining unauthorized access to your data and systems, keeping your clients’ data secure and your company out of the headlines. It also keeps your employees safe from phishing scams and malware. With a robust data backup system in place, your law firm will always have a backup plan in case of disaster. You can keep your team focused on serving your clients and growing your business instead of worrying about keeping themselves and your data safe from hackers. We are giving free IT audits and tests for law firms. Contact us today, be secured.

Data Breach Strikes California’s Largest Hospital System: 69,000 Patients Affected


data breach strikes Californias largest hospital system 69000 patients affected


Hackers gained access to the test results of tens of thousands of patients at California’s leading hospital system.


What Happened

Kaiser Permanente, the nation’s largest nonprofit health plan provider, has announced a data breach that exposed almost 70,000 individuals’ sensitive health information.

According to TechCrunch, the breach of Kaiser Permanente’s systems was first disclosed to patients in a June 3 letter. According to the letter, the breach was first discovered on April 5, when officials learned that an “unauthorized entity” had accessed a Kaiser employee’s emails. The emails contained “protected health information” about tens of thousands of Kaiser customers. According to a second filing with the Department of Health and Human Services, the total number of people affected by the breach is 69,589.

The exposed data includes first and last names, medical record numbers, dates of service, and laboratory test result information according to the disclosure letter. Still, no social security or credit card details were involved.

According to Kaiser’s email to customers, which was published, “we terminated the unauthorized access within hours of it occurring and promptly initiated an investigation to identify the magnitude of the event.” “We found that the emails contained protected health information, and while we have no evidence that an unauthorized party accessed the material, we cannot rule out the possibility.”

Though the HHS document classifies the incident as a “Hacking/IT Incident,” it’s unclear how the “unauthorized person” got access to the emails.


What It Means

Over the last few years, the healthcare business has seen an influx of unwanted attention from cybercriminals. A data breach at a Massachusetts healthcare company exposed information on the treatments that up to two million people had received, as well as their names, birthdays, and Social Security numbers, only last week. We recently saw a data breach at Eye Care Leaders, so it’s becoming common for healthcare organizations every day. During the pandemic, hospitals and healthcare providers were popular targets, and it’s easy to see why. Medical facilities are attractive targets for cybercriminals because they store massive databases of personal information that can be ransomed, stolen, or sold on the dark web. The cybersecurity defenses provided by hospitals’ antiquated digital infrastructure aren’t the finest in the world.

Human Error is Still a Threat to Security

The event also highlights what has always been and continues to be the most significant security risk businesses face in human error.

According to Verizon’s 2022 Data Breach Investigations Report (DBIR), which takes a complete look at data breaches from the previous year, 82 percent of the intrusions studied last year featured “the human element,” which can mean a variety of things.

“Whether it’s the use of stolen credentials, phishing, misuse, or simply an error,” researchers wrote in the report, “humans continue to play an eminent part in incidents and breaches alike.”


Protected Harbor’s Take on The Matter

“The threat of Business Email Compromise (BEC), which appears to have occurred in the Kaiser incident, is particularly serious.”- said Richard Luna, CEO of Protected Harbor. Socially designed phishing and other malicious email campaigns trick unwary employees into giving up credentials to their business email accounts have become increasingly sophisticated.

Once a threat actor has secured early access to a firm network, this might lead to more malicious operations, such as ransomware or other financially driven cybercrimes.

In fact, BEC has become a big financial drain for businesses, with the FBI recently reporting that companies spent $43 billion on this type of attack between June 2016 and December 2021. In fact, there was a 65 percent increase in BEC schemes between July 2019 and December 2021, which the FBI ascribed to the epidemic forcing most business activity to take place online.

Tips to stop BEC & Common Attacks

Upstream Spam Filter- Spam filters detect unsolicited, unwanted, and virus-infested emails (also known as spam) and prevent them from reaching inboxes. Spam filters are used by Internet Service Providers (ISPs) to ensure that they are not transmitting spam. Spam filters are also used by small and medium-sized organizations (SMBs) to protect their employees and networks.

Inbound email (email that enters the network) and outbound email (email that leaves the network) are both subject to spam filtering (email leaving the network). ISPs use both strategies to protect their clients. Inbound filters are usually the focus of SMBs.

2FA– 2FA is an additional layer of protection that verifies that anyone is attempting to access an online account are who they claim to be. The user must first provide their username and password. They will then be requested to submit another piece of information before they can receive access. This provides an additional layer of security to the process of gaining access.

Applying Recent Security Updates– Updating your software is very important, and it’s something that you should never overlook. Frequently updating your devices and installing the latest security updates can help to protect you from cyber threats and keep your devices secure.

Restricting User Access to Core Files (Access Control)– Access control is a security approach regulating who or what can view or utilize resources in a computing environment. It is an essential security concept that reduces the risk to the company or organization. Access control is a critical component of security compliance programs because it guarantees that security technology and access control policies are in place to secure sensitive data, such as customer information.

Network Monitoring for Malicious Activity– Network security monitoring is an automated procedure that looks for security flaws, threats, and suspicious activity in network devices and traffic. It can be used by businesses to detect and respond to cybersecurity breaches quickly. Network monitoring identifies and analyzes weaknesses, notifying you of potential security threats. Cybersecurity alerts enable you to swiftly safeguard your company from network attacks and the resulting calamities.

User Activity Monitoring- User activity monitoring (UAM) solutions are software tools that track and monitor end-user behavior on company-owned IT resources such as devices, networks, and other IT resources. Enterprises can more easily spot suspicious behavior and manage risks before they occur in data breaches, or at least in time to minimize damages, by deploying user activity monitoring.


Final Thoughts

In a world where cyber-attacks are common and more sophisticated than ever before, businesses must take steps to protect themselves and their customers from data breaches and other cyber threats. One way to do this is by partnering with a trusted company that offers unparalleled cybersecurity solutions.

Thanks to our innovative cloud-based approach to security, you can be sure that your company will be well protected against the ever-evolving threats to data security. By thoroughly examining your company’s network security and other aspects of its IT infrastructure, we can identify areas of weakness and suggest ways to correct them.

Visit today to get a risk-free review of your current IT security solution. You’ll receive a detailed assessment of your current security setup and recommendations for improving your security posture.[/vc_column_text][/vc_column][/vc_row]

What Is Network Observability, And Why Is It Demanded In The Cloud And IoT Era?

What is network observability why is it demanded in the cloud IoT era


What Is Network Observability, And Why Is It Demanded In The Cloud And IoT Era?


What Is Network ObservabilityImplementing dynamic network infrastructure design has become more critical than ever to securely connect with people, devices, applications, and data to support our evolving working environment. What can be the first thing we need to consider for this challenge? We cannot control or secure all kinds of connectivity if we don’t see what is happening in our network. By default, networks are distributed systems, and network visibility is vital in distributed systems. However, can network monitoring be good enough to better network visibility in the Cloud and IoT era? If not, what can be the solution?

Today’s enterprise digital infrastructure is comprised of hybrid cloud and on-premise solutions. Complex operational models manage these technologies, but their operational visibility continues to be a concern for most businesses. Read how large enterprises are securing their data?

The best way to gain network visibility is by leveraging network observability rather than network monitoring. This article explains what network observability is, why it’s necessary, and how it can help you manage your hybrid cloud and IoT infrastructure.

What Is Network Monitoring?

Monitoring is a passive data collection and surveillance practice used to measure the performance against pre-set standards. Monitoring equipment has been deployed over the years depending on more static, traditional network environments without frequent changes. However, these tools can be deployed throughout the corporate network.

It offers a centralized view of the operational health of the underlying network and infrastructure. Network monitoring might give alerts based on connectivity, downtime, or service degradation but does not give deeper cause or hypothetical exploration of unknowns provided by an observability platform.


What Is Network Observability?

According to Gartner, Observability is the evolution of monitoring into a process that offers insight into digital business applications, speeds innovation, and enhances customer experience. So we should use observability to extend current monitoring capabilities. Network observability is intended to have a deep knowledge of network health to provide an optimal end-user experience. When teams observe networks deeply, they understand ways to solve problems, correct them, and improve network performance to prevent future errors. Here are the main differences:

Network Observability Network Monitoring
  • It focuses on network health from the end-user perspective
  • reduce administrator time to detect root cause and remediation
  • Applies a broader range of information to pinpoint the leading cause
  • provide service assurance to guarantee quality services
  • uses next-generation AI and streaming telemetry
  • less focused on network health
  • NetOps staff handle alerts manually
  • Monitors deviations and baselines traffic
  • Uses proven protocols and tools

The Current Challenges With Network Monitoring

What Is Network Observability And Why Is It Demanded

The rapid shift towards cloud technology and related trends, such as SD-WAN, has changed the concept of network monitoring. Still, the traditional network performance monitoring tools are not keeping up with advanced networking technologies. Here are some issues regarding conventional network performance monitoring tools.

  • Traditional Network Performance Monitoring (NPM) tools do not include metadata or routing policy, network security, or cloud orchestration information.
  • Basic network connectivity info such as IP/MAC and port numbers are insufficient to analyze network traffic securely.
  • The tools can’t handle cloud scalability, as cloud customers produce terabytes of VPC flow logs every month. So Typical network packet sniffer solutions do not work in the cloud environment.



As mentioned above, challenges associated with network observability can be solved by implementing a combination of network monitoring and network analytics solutions. These solutions can help you get a high-level view of network activities across your hybrid cloud and on-premise environment. – Network monitoring: Network monitoring solutions are responsible for gathering network data from all network devices. They can help you identify issues that may affect business continuity and performance. – Network analytics: Network analytics solutions can be used to gain insights into network activities, such as network anomalies, performance, and capacity issues. Additionally, the data from the network monitoring solutions can be used to build network analytics dashboards.


Protected Harbor Zero Trust NAC can solve the challenge.

Network observability is necessary to ensure that the networks remain secure, reliable, and scalable. It is crucial for organizations that rely on hybrid cloud and IoT architecture. A hybrid cloud architecture, cloud migration, and end-to-end digital transformation are the primary reasons for network observation being demanded. A Zero Trust network architecture is the best way to achieve network observability.

Protected Harbor’s Hybrid Cloud Network Orchestration and Security platform is powered by a Zero Trust Network Access Control (NAC) engine. This network access control engine is designed to enforce a Zero Trust architecture and help achieve network observability by:

Device identity: Identify devices and enforce access rules based on device identity and user identity.

User identity: Identify users and enforce access rules based on user identity.

Endpoint compliance: Detect and enforce endpoint compliance using agentless endpoint compliance and vulnerability assessment.

Endpoint threat detection: Detect and quarantine endpoints with malicious activities in real-time.

Session visibility: Monitor and analyze all network traffic to detect suspicious activities during a session.

Session compliance: Detect and enforce session compliance based on policies.

Session threat detection: Detect and quarantine sessions with malicious activities.

Session compliance enforcement: Ensure all network traffic conforms to the policy.

Session visibility: Monitor and analyze all network traffic for all sessions.

Port visibility: Monitor and analyze all traffic on ports.

Protected Harbor Zero Trust Network Access Control (NAC) can log and monitor traffic coming from all branches and remote users using Cloud Gateway. The total network traffic can be observed. However, you can only watch and control unauthorized or non-compliant devices.

Most importantly, Protected Harbor Device Platform Intelligence powered by Cloud technology can enhance network visibility more contextually by correlating network connectivity info with business context (e.g., Connected devices’ EoL, EoS, manufacturer) and risk-related information like CVE. Overall, you can monitor and control all connected devices’ activities holistically without losing business performance, so you can substantially boost the success of an organization’s operations.

If you want to know more about how network observability can help your business, or if you want to see how you can simplify your network infrastructure, we’d love to talk.

Eye Care Leaders Data Breach Caused by Cloud EHR Vendor. Don’t be the Next.

eye care leaders data breach caused by cloud ehr endor dont be the next


Eye Care Leaders Data Breach Caused by Cloud EHR Vendor. Don’t be the Next.

Data Breach Caused by Cloud EHR VendorThe databases and system configuration files for Eye Care Leaders, a manufacturer of cloud-based electronic health record and practice management systems for eye care practitioners, were recently hacked.

What Happened

The breach reportedly compromised the organizations’ cloud-based myCare solution, with hackers obtaining access to the electronic medical record, patient information, and public health information (PHI) databases on or around December 4, 2021, according to breach notification letters provided by some of the affected practices. The hacker then erased the databases and system configuration files.

When the breach was discovered, the company promptly locked its networks and initiated an investigation to avoid additional unauthorized access. That investigation is still underway, and it’s unclear how much patient data was exposed. However, it’s possible that sensitive data was seen and exfiltrated before the database was deleted. Patients’ names, dates of birth, medical record numbers, health insurance information, Social Security numbers, and personal health information regarding care received at eye care offices were all stored in the databases.

More than 9,000 ophthalmologists use the Durham, NC-based company’s products. It’s unclear how many providers have been affected at this time. Summit Eye Associates, situated in Hermitage, Tennessee, has revealed that it was hacked and that the protected health information of 53,818 patients was potentially stolen. Evergreen Health, a Kings County Public Hospital District No. 2 division, has also acknowledged that patient data has been compromised. According to reports, the breach affected 20,533 people who got eye care at Evergreen Health. The breach has been confirmed by Allied Eye Physicians & Surgeons in Ohio, which has revealed that the data of 20,651 people was exposed.

The records of 194,035 people were exposed due to the breach at Regional Eye Associates, Inc. and Surgical Eye Center of Morgantown in West Virginia. Central Vermont Eye Care (30,000 people) recently reported a data breach affecting EHRs. However, HIPAA Journal has not been able to establish whether the cyberattack caused the data loss at Central Vermont Eye Care on Eye Care Leaders.


Confidential Information Exposed

In this distressing incident, Eyecare Leaders, a prominent eye care technology company, experienced a severe data breach, compromising the sensitive patient information of numerous Retina Consultants of Carolina patients. The breach has raised significant concerns about the security and privacy of patients’ medical records and personal data.

Eyecare Leaders, known for providing comprehensive technology solutions to eyecare practices, play a crucial role in managing and safeguarding sensitive information within the healthcare industry. However, this breach has exposed vulnerabilities within their systems, potentially leading to unauthorized access and misuse of patient data.

The breach, possibly a ransomware attack, highlights the pressing need for robust cybersecurity measures in the healthcare sector, urging organizations like Eyecare Leaders to strengthen their data protection protocols and mitigate the risk of future breaches. Meanwhile, Retina Consultants of Carolina patients are advised to monitor their accounts, remain vigilant against potential identity theft, and seek guidance from healthcare providers to ensure the security of their confidential information.



Over the last two weeks, the number of eye care providers affected by the hack has increased. The following is a list of eye care practitioners who have been identified as being affected:

Affected Eye Care Provider Breached Records
Regional Eye Associates, Inc. & Surgical Eye Center of Morgantown in West Virginia 194,035
Shoreline Eye Group in Connecticut 57,047
Summit Eye Associates in Tennessee 53,818
Finkelstein Eye Associates in Illinois 48,587
Moyes Eye Center, PC in Missouri 38,000
Frank Eye Center in Kansas 26,333
Allied Eye Physicians & Surgeons in Ohio 20,651
EvergreenHealth in Washington 20,533
Sylvester Eye Care in Oklahoma 19,377
Arkfeld, Parson, and Goldstein, dba Ilumin in Nebraska 14,984
Associated Ophthalmologists of Kansas City, P.C. in Missouri 13,461
Northern Eye Care Associates in Michigan 8,000
Ad Astra Eye in Arkansas 3,684
Fishman Vision in California 2,646
Burman & Zuckerbrod Ophthalmology Associates, P.C. in Michigan 1,337
Total 522,493

Data Breach Caused by Cloud EHR Vendor smallProtected Harbor’s Take On The Matter

There are more than 1,300 eye care practices in the United States alone. And with more than 24 million Americans affected by some form of visual impairment, the demand for eye care services continues to grow.  In response to these growing needs, we have seen an increase in cloud-based electronic health record management software solutions to streamline operations while increasing efficiency and security.

Unfortunately, this also means that cybercriminals see the eye care industry as a prime target for hackers because their information is so sensitive and accessible. That’s why you must know which cloud EHR vendors were hacked recently.

Protected Harbor’s 5 ways to prevent unauthorized access to your company data:

  1. Strong Password Policy– Having your users add symbols, numbers, and a combination of characters to their passwords makes them more difficult to crack. Having a minimal amount of characters and changing it periodically (every 60 or 90 days) ensures that outdated passwords aren’t reused for years, making it much easier to get unwanted access to the account.
  2. MFA– Multi-factor authentication is a great approach to ensure you only access the account. You will need another device (usually your mobile device) nearby in addition to your usual login and password since you will be required to enter a code that will be produced instantly.
  3. Proactive Monitoring- Preventing unauthorized access is the initial step, but monitoring login attempts and user behaviors can also provide insight into how to prevent it best. For example, if you have logs of failed login attempts for a single user. You can launch an inquiry to see whether the user merely forgot their password or if someone is attempting to breach the account.
  4. IP Whitelisting- IP Whitelisting compares the user’s IP address to a list of “allowed” IP addresses to determine whether or not this device is authorized to access the account. If your firm only uses one or a limited number of IP addresses to access the internet, as is usually the case, you can add a list of IP addresses that are granted access. All other IPs will be sent to a page that isn’t allowed.
  5. SSO (Single Sign-On)- If your firm has a centralized user directory, using it to acquire access makes things more accessible and more manageable for you. You’ll have to remember one password, and if something goes wrong, your network administrator can deactivate all of your applications at once.

Richard Luna, CEO of Protected Harbor, stated: Unfortunately, this is how things will be in the future. The development tools used to create websites and mobile applications were created in the 1990s. Data transferability, or the ability to move data from one device to another, was a critical concern back then. The emphasis back then was on data proliferation. FTP comes to mind as a secure method with no encryption. Authentication was designed for discerning between good actors, not to harden data and protect against data theft because all data exchanges were between good actors back then. Now that we live in a different environment, we may expect more data breaches unless security is built into data transfer protocols rather than bolted on as an afterthought.

We’ve been helping businesses respond to these attacks for some time, including ransomware attacks and cross-pollinating destructive IP attacks across numerous access points and multiple AI use. If a company has 50 public IPs and we’re proactive monitoring the services behind them, and a bad actor assaults one of them, ban them from all entry points in all systems, even if it involves writing a synchronized cron job across firewalls or other protection devices. Add in artificial intelligence (AI) and comprehensive application monitoring, and a corporation has the tools to detect and respond to such threats quickly.

Final Thoughts

Data security isn’t a one-time or linear process. You must invest in software vendors, ongoing resources, time, and effort to ensure data security against unwanted access.

Cybercriminals are becoming more sophisticated every day, and they are employing cutting-edge technologies to target businesses and get illicit data access.

As the number of data breaches rises, you must become more attentive. It’s critical that your company implements concrete security measures and that each employee prioritizes cybersecurity.

If you’d want us to conduct an IT security audit on your current security policies, we’ll work with you to ensure that you’re well-protected against unauthorized data access and other cyber risks. Contact us today!