Wellstar Health System Reveals Data Breach

Wellstar Health System announced on Friday afternoon that its email system had been hacked.

Well, it happened again. A data breach occurred at yet another healthcare firm. This time, it was Wellstar Health System. Unauthorized attackers obtained access to two email accounts two months ago, the organization discovered on Friday. Through those email accounts, gained access to patients’ health care information and it was exposed, including patient laboratory information. They missed the 2021 Healthcare Data Breach Trend Report from Protected Harbor at HIMSS.

Emails are one of the most common ways that hackers access sensitive information. This is because people often use their work email for personal purposes, so it is easier to get access to it. Hackers can use different methods and tricks to an email account. They might trick health workers into sharing their passwords, or they could send them a virus that tries to steal employee passwords from company computers.

If you are reading this, you understand that it’s essential to keep any critical emails secure when handling sensitive information. After all, Patient Health Information (PHI) and Electronic Health Records (EHR) can earn a few hundred dollars each on the dark web. That means healthcare employees are more targeted by hackers. And still, many healthcare organizations are not taking the proper steps to protect company email from hacking.

This article will go over how to defend yourself against important threats and what email security precautions you should take.

Install the Right Software

One of the essential email security precautions you can take is installing the right software to protect your emails. Many software options offer various levels of protection, so find out which one will work best for your needs. If you’re in healthcare, consider higher levels of security because you have a lot more sensitive information. Healthcare IT staff may also want to invest in Malwarebytes, a well-rounded antivirus solution, to provide another layer of protection against hacking.

Spam Hero is a software that looks for spam scans messages for infections before it reaches the Stopping malware emails before reaching an inbox can help keep hackers out of any sensitive documents you may come across in the future. Think how many emails with attachments are sent each day; if they were all scanned before recipients could open them, this would significantly decrease the chances of hackers getting a hold of sensitive information like PHI and EHR.

Monitor Your Inbox Activities

One of your email inboxes has received ten emails in one day. However, you only get about two a day, you do not remember sending out any emails that day, and it’s a Sunday. Is there a cybersecurity breach on your network? It could indicate that someone is trying to gain access to company information and has begun by accessing people’s email accounts. Monitor account activity regularly, and if you notice anything suspicious, have a playbook to implement additional security measures if you see something odd. Set up a new email address if necessary and measures such as multifactor authentication or changing all passwords. It is also important to routinely change passwords, even when there is no evidence of a breach; no system is perfect, and it’s better to be safe than sorry!

Educate your Employees & Staff

As exposed recently, hackers find new ways to trick healthcare employees into giving up sensitive information. Here are four easy things every HCIT department can do to improve their company’s employee cyber safety awareness:

1. Encourage employees to come forward if they suspect an email of being bogus.
2. Educate employees on what dangerous emails might look like. A recent study showed that over a quarter of doctors could not identify a malware email.
3. Tell your employees not to open attachments unless 100% confident that it is a trusted source. Installing a filter those auto-checks attachments is even better.
4. Have an Email Password Checklist for all of your employees.

We all have complex emails, but make it a requirement, set up failsafes to avoid re-used passwords, and help make it easier for your staff with some tips and how-tos. These simple tips will help protect against email cyber-attacks.

Use Two-Factor Authentication

Two-factor authentication is a great way to add an extra layer of security to your online accounts and protect yourself against email cyber-attacks. 2FA prevents hackers from simply guessing passwords and lets you focus on protecting other healthcare network vulnerabilities. By implementing these simple steps, you can protect your business and its data without adding too much time or hassle into everyday workflows.

One of the easiest ways to protect yourself from hacking is to turn on two-factor authentication. 2FA will help ensure your information is more secure, and it doesn’t take much more time or effort than what you were doing before.

You might think it’s unnecessary to use two-step verification when you already have high-end cybersecurity software, but that is not true. Software and two-step verification work together to make sure your information is safe. A bad actor can bypass a security measure, so it’s necessary to have other protections in place too. This is where software and 2FA come in handy again.

Use Encryption

One of the most effective ways to protect yourself from hackers is by using encryption. Encryption scrambles the content of your email so that only you and the intended recipient can read it. It means that if a hacker does manage to intercept your email, they won’t be able to understand what it says. Even if they could break the encryption, any sensitive information in your email will be rendered indecipherable.

One such solution is ProtonMail, a secure email service that encrypts all of your messages by default. The only person who can decrypt your email is someone you sent it to or someone in the same organization (if they have a shared account).

Protect your Physical Computer and Network

Cybersecurity does not produce images of big burly security guards, but physical computer and network safety are just as crucial as virtual. This means having physical security checkpoints at entrances and exits of your healthcare organization. It would help if you also were careful about which devices employees plug into the network. Just because a power strip is plugged in doesn’t mean that it’s safe to plug in their mobile device.

Auto-lock and Remote Wipe Apps

Just think of how many texts you receive each day. You might likely be one of the unlucky people who have had their phone hacked. All someone needs to do is get a hold of your phone, and they can easily access any sensitive information on it, including work passwords. It may seem like locking your phone is a no-brainer, but not every employee does it. If your company hands out company phones or lets employees use their personal phones for work email, then decrease the auto-lock time to 30 seconds and install remote wiping.

Remote wipe is a security feature that allows a network administrator or device owner to send a command to a computer device that erases data. It’s usually used to wipe data from a lost or stolen device so that the information isn’t jeopardized if it comes into the wrong hands. It can also be used to erase data from a device that has changed owners or administrators and is no longer accessible physically.

Closing Thoughts

There are no easy answers when it comes to healthcare cybersecurity and email security. All of the things described above, and more, could have been performed by Wellstar Health System. Finally, attacks are growing more sophisticated, data is becoming more readily available, network connection points are rising, and healthcare IT professionals are being spread thin. When it comes to safeguarding your healthcare networks and servers, the first step is to determine which employees have access to sensitive information and which staff require specific data access.

Any strategy must also be adaptable and responsive to changes as they occur. Protected Harbor focuses on more than just software but hardware integration, special application connectivity, and employee workflows to create an always-safe environment. It is likely that at some point, HCIT will need to seek professional help to tackle the security breaches, so it is better to assign the task of managing the system security to an external agency. This way, you will no longer have to worry about data and network security, and your team will be able to focus on medical-related tasks.

An experienced, outside partner can help you see the bigger picture. Protected Harbor has the best practice knowledge on securing managed file transfers, HIPAA-compliant emails, data management, and security. We make sure your data is safe by using robust auditing and encryption technology that meets or exceeds HIPAA requirements for healthcare organizations.

Check out our 2021 Healthcare Data Breach Trend Report from HIMSS and our free eBook Optimizing the Healthcare Stack for Performance to learn more. We are also offering free IT Audits to all healthcare organizations for the next month following this attack. Reach out to schedule one today.

Microsoft Vulnerabilities and Solutions

Technological advancement in the current digital era has increased vulnerabilities in businesses using Microsoft products. It has affected most managed service providers (MSPs) as they have become primary targets of cyber attackers. Small businesses are also exposed to severe dangers as cybercriminals target them to exploit their systems and paralyze operations.

Microsoft vulnerabilities are the stuff that nightmares are made of for many companies. There are so many vulnerabilities in Microsoft systems that might leave you wondering why you even use Microsoft products. Well, the answer is simple — Microsoft products are fantastic. And, because it is so popular, it’s no wonder that there are so many vulnerabilities. The truth is that despite having so many vulnerabilities, Microsoft has come a long way in fixing them with their monthly updates. Here, we break down all critical Microsoft vulnerabilities and provide solutions to protect against them.

Microsoft Exchange Server vulnerability

What Happened?  

Microsoft exchange server vulnerability is a serious threat that has affected Microsoft recently. In March 2021, the company had to conduct an emergency patching after discovering four types of vulnerabilities known as ProxyLogon in its products. After Hafnium, a Chinese-based threat team invaded thousands of corporations, this incident occurred. The heightened security concerns and attacks forced the court to command the FBI to instantly eliminate Web shells that the intruders utilized to launch their invasions of companies. In September 2021, Proxy Token, another flaw in the Exchange Server, emerged, giving attackers a channel to copy or forward targeted emails to an account that an assailant controls.

How Dangerous Microsoft Exchange Server Vulnerability Is For Small Businesses 

Microsoft exchange server vulnerability is a serious threat to small businesses. It contributes to organization data theft, leading to unauthorized access to company records. It also enables attackers to create malicious codes that give them remote administrative rights to access the company network. These practices can lead to the leaking of confidential customer information, which would later destroy the business image.

Ways Small Businesses Can Fix This Issue

Small businesses have a variety of solutions to embrace to avoid Microsoft exchange server vulnerability. One of them entails configuring their Exchange framework to define change requests and validating any newly created files. Enterprises should also practice continuous patching of software to reduce the risk exposure.

Microsoft Patches Six Zero-Day Security Vulnerabilities

What Happened?  

In December 2021, Microsoft released patches for 67 Common Vulnerabilities and Exposures (CVEs) in its products, 60 of which were essential and seven extremely critical, including six zero-day susceptibilities (https://cisomag.eccouncil.org/microsoft-december-2021-patch-tuesday/). These susceptibilities included CVE-2021-43890, which attackers utilized to distribute malware like BazarLoader, TrickBot, and Emotet. CVE-2021-43240 affected Windows NTFS by setting short names, which elevated privilege vulnerability. CVE-2021-41333 impacted Windows Print Spooler elements, while CVE-2021-43880 invaded Windows Mobile management appliances. CVE-2021-43893 interfered with windows file encryption systems, while CVE-2021-43883 interrupted the Windows installer.

How Dangerous Microsoft Patches Six Zero-Day Security Vulnerabilities Are For Small Businesses 

Microsoft patches six zero-day security vulnerabilities that are severe threats to small businesses. For example, they enable unsuspecting computer users to open infected files and documents. Attackers use this avenue to execute malicious malware codes. They also exploit susceptibilities via malicious programs like Bazaloader, Trickbot, and Emotet. Such elements contribute to the destruction of data backups and security infrastructure besides disclosing company critical information to intruders. Businesses that experience these factors make intensive capital and customers losses that affect their financial bases.

Ways Small Businesses Can Fix This Issue.

Small industries have numerous solutions to Microsoft patches six zero-day security vulnerabilities. One of them includes using Microsoft-provided updates and installing them in their systems. Patching all Microsoft programs and software is also an important initiative for enterprises.

Windows Print Spooler Vulnerability

What Happened? 

Windows Print Spooler vulnerability is a severe threat in Microsoft systems. In 2021 July, Microsoft discovered another type of the above susceptibility known as CVE-2021-36958. This component gave local attackers a means of gaining access to SYSTEM privileges on their machines. This vulnerability misused Print features, Print drivers, and Windows print spooler settings configurations. Cyber attackers in this scenario connected to a remote printer server, and as a result, they could view, delete, change, and form new accounts with exclusive user rights.

How Dangerous Windows Print Spooler Vulnerability Is For Small Businesses  

Windows Print Spooler vulnerability is a risky sensation in small businesses that adversely affect their operations. When attackers access a compromised computer, they assign system and admin-level rights, making it hard for the users to detect the susceptibility quickly. Such characters can steal sensitive information and use it for malicious activities in the long run. The remote code execution in this kind of susceptibility destroys records and applications, generating significant losses to small businesses.

Ways Small Businesses Can Fix This Issue

Enterprises have multiple ways to eliminate the Windows Print Spooler susceptibility. One of them entails applying CVE-2021-34527 security updates to secure their systems and configuring some registry settings to zero, including HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint, NoWarningNoElevationOnInstall, and UpdatePromptSettings. Another viable solution is disabling the sprinter spooler on susceptible workstations and servers.

Microsoft Exchange Autodiscover Vulnerability

What Happened?

Microsoft Exchange Autodiscover vulnerability is a severe system threat that has affected most businesses in 2021. This aspect led to the leaking of around 100,000 passwords and login names of users of the Windows domain all over the world (https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-autodiscover-bugs-leak-100k-windows-credentials/). Researchers identified that the primary cause of this problem was the wrong execution of Autodiscover protocol. As a result, the system sent personal details to third parties and untrusted sites.

How Dangerous Microsoft Exchange Autodiscover Vulnerability Is For Small Businesses 

Microsoft Exchange Autodiscover vulnerability exposes an entire organization to severe dangers. Attackers use this mechanism to get genuine credentials to access user accounts and disseminate ransomware. As a result, they infect company records and steal sensitive information such as customer and financial details, which they can later use to execute malicious activities. Such issues can tarnish the enterprise’s reputation, thus negatively affecting its revenue generation methods as clients shifts to other providers.

Ways Small Businesses Can Fix This Issue

Businesses have multiple ways of mitigating Microsoft Exchange Autodiscover susceptibility. One of them includes blocking all the Autodiscover. [tld] domains in their DNS servers or firewall. This initiative ensures that their devices do not connect with such parts. Disabling Basic authentication is another effective mechanism that prevents the dissemination of credentials in explicit texts.

Microsoft Azure Customers’ Data Leak by WIZ Researchers

What Happened?  

A data breach is a serious threat to businesses and a prevalent issue in the current digital society. For instance, the Microsoft Azure customers’ data disclosure occurred in February 2021, where WIZ researchers obtained databases and accounts of thousands of Microsoft Azure customers, including Coca-Cola and ExxonMobil, in the Fortune 500 companies’ category. Information technology specialists discovered that the primary cause of this catastrophe was clients’ misconfiguration of Microsoft Azure. After Wiz examiners from Israel informed Microsoft about the issue, the company resolved it instantly.

How Dangerous Microsoft Azure Customers’ Data Leak Is For Small Businesses 

Data leakage can be a bad experience in a company if the leaked information lands in the hands of malicious individuals. If businesses encounter the scenario mentioned above, cyber attackers illegally access enterprise data, including customer particulars, and can later use it for ill purposes such as money theft.

Ways Small Businesses Can Fix This Issue.

Small businesses experiencing Microsoft Azure customers’ data leak security problems can employ techniques such as requesting their clients to modify their login particulars as a precautionary measure. They can also ensure consistent updates of Azure containers used to patch known vulnerabilities. Such enterprises should also encourage their customers to utilize security software that quickly detects malicious attacks to ensure that they instantly respond to them once they occur.

Microsoft MSHTML

What Happened?  

In September 2021, Microsoft revealed the prevalence of a remote code execution (RCE) susceptibility in MSHTML, also called Trident. The threat allowed hackers to launch arbitrary programs on a victim’s computer through ActiveX control, which they sent through spear-phishing. Using the CVE-2021-40444 vulnerability, the intruder crafts malicious ActiveX using the Microsoft Office document hosting the browser. This individual then convinces users to open the harmful document, and the hazardous program executes on opening it. Cyber attackers, in this case, target Office 365 on diverse versions of the Windows operating systems.

How Dangerous Microsoft MSHTML Vulnerability Is For Small Businesses

Microsoft MSHTML vulnerability enables attackers to execute harmful codes from the logged-in user, which in the long run compromises the network and computer systems. This phenomenon gives ways for the attackers to steal essential records and sensitive data as they have total control of the system. Data theft can adversely affect the business’s reputation and lead to the loss of customers. In severe cases, enterprises become challenging to operate, leading to their closure.

Ways Small Businesses Can Fix This Issue Microsoft MSHTML Vulnerability

Small business should train their employees to avoid opening documents from individuals they do not know to hinder Microsoft MSHTML vulnerability. System users should also shun disabling Microsoft protected view option in the office suite to allow the read-only capability of files and thwart the introduction of malicious contents. Enterprises should also disable ActiveX control through modification of the appropriate registry keys. They should also enable Application Guard, a security container that separates an individuals’ data from unknown records.

Manageengine Adselfservice plus Vulnerabilities

What Happened? 

In its application programming interface, the ManageEngine ADSelfService Plus vulnerability was initially discovered on 8th September 2021. ManageEngine ADSelfService Plus allowed users to reset and update passwords details on the directory. Research by the U.S. cyber security personnel showed that this susceptibility targeted U.S. companies. The threat allowed hackers to execute arbitrary codes on user systems, thus enabling them to take control of the computer system and install malware programs.

How Dangerous ManageEngine ADSelfService Plus Vulnerabilities Is For Small Businesses 

ManageEngine ADSelfService Plus vulnerabilities cause devastating results in small enterprises, including loss of sensitive company and customer records. Another drawback of the threat mentioned above in corporations entails intensive disruption of operations and subversion of company focus. Such issues can severely affect a firm and even lead to its discontinuation.

Ways Small Businesses Can Fix This Issue

Small businesses should practice frequent updating of internet interfaces of the ADSelfService Plus to enhance protection against ManageEngine ADSelfService Plus vulnerabilities. It is also always advisable for enterprises to frequently review their system security recommendations and make the necessary changes.

Wrapping it up

It’s essential to update your Microsoft software to protect yourself and because your customers should have the best experience possible with your products.

The fact that you’re reading this means you care about computer security. That’s great! Because we do too. As Microsoft continues to find new and exciting ways to keep your data secure, we will continue to bring you the latest news and advice on staying protected in a fast-paced digital world.

Protected Harbor is your one-stop solution for all IT needs, including data center real-time monitoring, 99.99% uptime, safety, and security. We are not just your regular MSP; we treat clients as partners and build a solution from scratch according to your business needs and requirements. We want to know how we deliver an unmatched experience; our expert IT team is dedicated to satisfying your needs. That’s not it; learn more here; contact us now.

What is the most common cause of healthcare data breaches?

Patient’s medical records are a goldmine for malicious hackers—if they can get their hands on them. According to Cisco Internet Security Threat Report, healthcare is currently the most targeted industry by cybercriminals.

Health data breaches have been on the headlines for a while now. From the crippling breach of Anthem to the compromising of 10 million patient records at UCLA Health — nothing is sacred when it comes to cyberattacks these days. While the impact of security incidents might differ depending on their magnitude, it seems that poorly protected IT systems and hacking/IT incidents are often the biggest culprits in causing privacy and financial setbacks.

Healthcare data breaches are on the rise. Although many are concerned with hacking, several factors could potentially cause a significant healthcare data breach.

Common causes of healthcare data breaches!

Data breaches are becoming more and more common. With the rise of hacking, phishing, malware attacks, and new security regulations, all healthcare organizations need to stay proactive in protecting their data.

The most common cause of data breaches for healthcare organizations is malicious or cyber-criminal attacks. Data breaches can come from various sources, including hackers stealing protected health information (PHI) from an organization’s database, unencrypted devices, or a weak, stolen password. One of the biggest causes of healthcare data breaches is misconfigured medical devices and office equipment. Medical device security remains a major concern for organizations. Click here to know how do breaches happen and how to prevent them?

Hacking/ IT Incidents accounts for 47% of healthcare data breaches making it the #1 cause of healthcare data breaches.
(Source: Electronic Health Reporter)

Patient Data Theft: High risk
Health care industry members are all too familiar with data theft and new methods of exfiltrating information from connected medical devices such as electronic medical records (EMRs) and protected health information (PHIs). IP-enabled medical devices can be easily exploited by experienced hackers because of minimal access controls and known vulnerabilities. A hacker may then take data directly from the medical device, but since medical devices typically contain limited data, he is more likely to go to servers, data centers, or other devices on the network, like the XP workstation that is connected to the electronic medical record. Data breaches in healthcare are defined as theft and loss 32% of the time, compared to only 15% in different industries, 2^nd to Hacking and IT incidents, as per Healthcare drive. With the number of high-profile breaches in healthcare over the past three years, healthcare organizations need tighter controls to mitigate this risk.

What is the cost to your company?

According to IBM’s Cost of Data Breach Report 2021:

• Healthcare organizations spent an average of $161 per breached record in 2021, which is expected to increase in the future.
• On average, it takes 329 days to identify a breach.

The reports show that the cost of data breaches has risen once again, reaching a record high since IBM first published the report 17 years ago. The average cost of a data breach increased by 10% year over year, to $4.24 million per incident and that of healthcare data breaches increased by $2 million to $9.42 million per incident in 2021. The average cost of ransomware attacks was $4.62 million per incident.

How can you avoid a data breach?

• Back up data– Having a proper backup schedule and implementing a secure process to access the off-site data is a preliminary requirement. Confirm that your backup/recovery partner is also HIPAA compliant. Cloud hosting solutions can also be considered for better security.
• Two factor authentication- Multi-factor authentication, also known as 2FA, is a simple concept that can be implemented by companies easily. A key benefit of two-factor verification lies in its very name: it requires two variables to access an account, just as you need two keys to enter a house. The security is therefore twice as strong.
• Safeguard data and devices- Ensure that the tools and policies for security are implemented, securing all the devices accessing your network. Remote monitoring for unauthorized access and unusual activity can opt. Limit and set proper data control and access for the devices.
• Train and educate staff– create a policy for regular security training and practice sessions. Identifying phishing emails, ensuring password complexity, and adhering to anti-malware protocols should be a part of this training. More details

To wrap things up!

Security and compliance are among the top factors healthcare organizations consider when adopting new technologies. Many organizations didn’t or were not able to take the time to strategically align new cloud-based tools and platforms with existing security standards as they transitioned to remote work after the pandemic.
Security and privacy should be a priority when working with technology partners in healthcare. It is a trusted partner’s responsibility to ensure users’ privacy and security, having incorporated a variety of safeguards into their processes, designs, and code, as well as constructing the infrastructure to ensure careful protection of user information. Cisco, Greenway, GE Healthcare, and Protected Harbor are some of the most trusted and reliable healthcare IT solution providers who take pride in their experience of delivering solutions to healthcare and other organizations.