Source: heimdalsecurity.com – Author: Madalina Popovici
A third-party security breach at the Department of Health and Human Services (HHS) may have exposed the personal information of at least 100,000 people, a department official stated last week, making it the latest US government agency to be hit by a widespread cyberattack tied to Russian-speaking cybercriminals.
On June 27, HHS informed Congress of the breach and promised to keep them updated as the investigation progressed. According to the procedures, agencies must notify Congress if a data breach compromises the personal information of 100,000 or more people.
While no HHS systems or networks were compromised, attackers gained access to data by exploiting the vulnerability in the MOVEit Transfer software of third-party vendors.
MOVEit is a popular file transfer software that has been exploited in recent weeks by suspected Russian-speaking cybercriminals to compromise dozens of companies, institutions, and government agencies in the United States and abroad.
US-based Progress Software, the developer of MOVEit, issued a security patch for the software, but hackers had a few days’ head start and succeeded in infiltrating systems.
Bloomberg News was the first to report that HHS was affected.
CLOP Ransomware Group, Allegedly Behind the Attack
The Clop ransomware group has already compromised the personal information of over 17 million people by taking advantage of a vulnerability in the MOVEit file transfer tool, and the list of affected businesses keeps growing.
Cybersecurity firm Emsisoft’s threat analyst Brett Callow tweeted that 179 companies and the personal information of over 17 million people were compromised in the MOVEit attacks. According to him, 16 of those are government agencies in the United States.
Among the victims were companies and organizations such as: Ernst & Young, Honeywell, the New York City Department of Education, UCLA, Siemens Energy, BBC, British Airways, Boots, and many more. The US Department of Energy received ransom requests from hackers after two of its entities were compromised.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and YouTube for more cybersecurity news and topics.
If you liked this post, you will enjoy our newsletter.
Get cybersecurity updates you’ll actually want to read directly in your inbox.
Original Post URL: https://heimdalsecurity.com/blog/hhs-data-at-risk-after-moveit-hack-impacted-third-party-vendors/
Category & Tags: Cybersecurity News – Cybersecurity News
Views: 0