A ransomware attack exposed the information of more than 3.3 million patients on Dec. 1, 2022. Multiple medical groups are affected under the Heritage Provider Network in California. These are:

• Lakeside Medical Organization
• Regal Medical Group
• ADOC Medical Group
• Greater Covina Medical
• Understanding Ransomware

Ransomware is a malicious computer program that attempts to infect computers and data systems. Its goal is to locate sensitive files and prevent users from accessing them. It then sends a message to pay an amount or perform a specific action. If the users fail to meet the demands, the perpetrators delete the files. That is where the program gets its name.

Businesses that get affected by ransomware have two problems to face. First, they lose access to sensitive files and information needed to continue their operations. Second, it affects their customer data, meaning it falls into the wrong hands. That opens a whole can of worms leading to multiple legal actions and putting the organization in jeopardy.

What Was Stolen?
An investigation by cybersecurity experts reveals that the following patient data was compromised during the attack:

• Patient name
• Social security numbers
• Phone number
• Address
• Date of birth
• Medical diagnosis and treatment
• Laboratory test results
• Prescription
• Health plan with member number

In other words, there is a high probability that cybercriminals now have all this critical data. From there, they can sell the information to other criminals or use it to enact their campaigns to defraud other people using the stolen information.

How Ransomware Affects Businesses
Customers entrust their personal information to businesses and organizations to perform a service. The recipient must keep the data safe and provide access only to the people who need it.

Aside from legal action, customers would lose trust in a brand that lost their data. It shows incompetence or lack of care. The trust between the organization and customers is damaged.

Defending Against Ransomware
Businesses should enact guidelines in dealing with cybersecurity threats to avoid similar scenarios. Many threats are around the internet and continue to evolve. Continuous employee training in identifying malicious programs is the first line of defense.
Companies should invest in security software and networks to protect against potential threats. Regularly back up sensitive data and store them with secure encryption.
Ransomware could be damaging to any company. By taking the proper steps, they could protect themselves from cybercriminals who attempt to attack the most vulnerable systems.

Cybersecurity company Sentinel Labs has discovered a new malvertising campaign targeting AWS users. Sentinel Labs warns that cybercriminals have established a campaign on Google Ads programs that take users to a fake landing page to steal their credentials and other details.

What Is a Malvertising Campaign?
A malvertising campaign is a digital ad intended to inject malicious code when clicked. It is complex and challenging to carry out, as shown by the investigation carried out by Sentinel Labs on Jan. 30, 2023.

The malicious ad appears second in most search results after typing “aws” in the search bar, making it look credible. It avoided Google’s fraud detection systems by using redirections of its landing page.

“The ad itself goes to a hop domain, which is an actor-controlled blogger website,” says Tom Hegel, the senior threat researcher in Sentinel Labs.

Users land on a page designed to phish for their credentials. After submitting, visitors are redirected to the legitimate landing page of AWS. It is an effort to evade detection by the most cautious users and automated monitors.

Furthermore, the fake landing page asks victims to select if they are root or IAM users. That helps the cybercriminals categorize the value of the stolen data.

They use JavaScript code to take it further and disable controls like right clicks, keyboard shortcuts, and middle mouse button clicks. Researchers speculate that this was to discourage potential victims from navigating away from the landing page.

Actions Taken
According to the investigation, the attackers are probably Brazilian. CloudFlare received the report and promptly shut down the malicious account connected to the campaign. However, Google ads were still active during that time.

Criminals would try to leverage legitimate platforms to conduct their nefarious activities. It gives their campaign a fake veil of credibility. Who would think that an ad shown and sponsored by Google would be malicious?

Protecting Your Business Credentials 
Businesses need to have their team take training regarding cybersecurity and how to identify potential threats. You can never be too careful when on the internet, whether it is surfing, researching, or communicating with someone.

All it takes is one click for an attack to be successful. And that is what criminals count on, that single second you let your guard down. Do not give them that opportunity.

Modern businesses rely on computers and the internet to perform their daily operations. An example is the use of emails, which is essential for client and internal communications.

Companies also collect data from their customers and use that to perform their services. An online shop needs to process personal information and credit card payments. Hospitals use computers to store patient records so doctors can reference them later. The point is that your organization has data and crucial files that could be valuable to someone else.

Cybersecurity Threats
There is a massive effort by criminals to try and infiltrate company networks. From there, they can steal information and disrupt operations. A common way they do this is through ransomware attacks.

Ransomware is a malicious program that “kidnaps” files and data in an infected computer. Cybercriminals demand the owner to pay or do some other action. If not done in the given timeframe, they delete the data.

Imagine losing years’ worth of files. That can have a significant effect on any organization. Not to mention that customer data could fall into the wrong hands, and you now have a lawsuit in your hands.

How Criminals Infiltrate Networks
Infiltrating networks and computers is not like in movies where a hacker types some code from far away and instantly gains access. They need to create a connection. They implement malware and viruses for that.

Viruses can get into a network in a variety of ways. Criminals could send malicious emails with dirty links. Once clicked, it downloads the malware onto the victim’s computer. Browsing unsafe websites is also a good way to get viruses.

More sophisticated methods involve a social engineering approach. Criminals would study potential targets within the company and contact them through email or phone to get them to perform an action they want.

Protection Against Cybersecurity Threats
Businesses need to have multiple layers of protection against cyberattacks. Cybercriminals are resilient, and so should your defenses.

Here are some ways to do that:

• Install a security program for your network.
• Use strong passwords everywhere.
• Secure data storage through encryption.
• Protect company devices like laptops and mobile phones.
• Keep your devices updated.

Most attacks rely on people letting their guards down. Keep employees up to speed on what to do regarding potential threats and suspicious activities through continuous training.

You can also consult with security experts to establish comprehensive network security that is ever-evolving to combat the latest cyber threats out there.

Adobe and Microsoft announced on Feb. 8, 2023, a collaboration to transform the PDF reading experience by bringing Acrobat to Edge. They aim to provide stronger security and improved performance through the new partnership.

Microsoft Edge and Adobe Acrobat
Edge is the official web browser of Microsoft. It is the successor to the Internet Explorer program from years ago. Released with Windows 10, Microsoft Edge is more streamlined to handle modern user demands and requirements.

Adobe Acrobat is for managing and viewing PDF files. It became available in 1993 and has since become the most well-known and reliable program for this purpose.
“PDF is essential for modern business, accelerating productivity in a world where automation and collaboration are more critical than ever,” said Ashley Still, the SVP and GM of Adobe.

What to Expect With the Partnership
Microsoft says users will get a unique PDF experience through more accurate colors, graphics, higher fidelity, and better accessibility features like read-aloud narration and text solutions. All of that while remaining free of charge.

However, the features would only be available for Windows 10 and 11 at the launch, with macOS support to follow in the future.

Another limitation is in editing anything on a PDF. The partnership focuses on improving the experience of only viewing the files. If you need advanced features like editing and combining files, you will need a paid subscription. It can be through MS Edge directly as an extension. Existing subscribers only need to log in to their account after installing it.

MS Edge and Adobe Acrobat Rollout
The Adobe Acrobat experience on Microsoft Edge will not be seen or felt by everyone immediately. The transition is scheduled in phases. Users can expect the start of the changes in March 2023. The complete rollout is expected by September 2023.
Businesses and organizations using managed devices could opt into the new experience. Aside from being free, the update will not remove any legacy features.
There is a small trade-off, though. Users would now see an Adobe watermark at the corner of their PDF viewer on MS Edge and a button to try the new features.

Reddit, a popular social news site, disclosed that it was hacked on Sunday night (pacific time). The company announced on February 9th in a posting that they first became aware of the incident that happened on February 5th. It refers to it as “sophisticated phishing” targeting Reddit employees.

According to the CEO, the unidentified persons accessed internal documents, internal dashboards, business systems, and codes. But at the same time, the company reveals that there isn’t proof of a security breach on the systems that run the platform and store most of their data. While they admit that the stolen data included details of their advertisers, they insist that passwords and credit card information were not breached.

What Happened and Reddit Response?

There is still scarce information on this incident and its effect. However, Reddit assures users that it is under investigation. But, according to the firm, attackers gained access to the company’s data using a targeted phishing campaign.

The attacker sent “plausible-sounding prompts” to employees that redirected them to a website masquerading as the firm’s intranet portal. They did this to attempt to steal information and two-factor authentication (2FA) tokens.

Fortunately or unfortunately, they only managed to steal one employee’s credentials. But, this enabled the attacker to access Reddit’s internal systems. The said employee self-reported the incident to Reddit’s security teams, prompting them to act immediately. The teams removed the attackers’ access and commenced an immediate investigation.

The firm believes there was limited contact with the current and former employees, and advertiser information was exposed. They insist that personal user and non-public data was not compromised. The attacker only managed to access some internal documents, code, and internal business systems. According to the firm, even the stolen information hasn’t been published or distributed online.

Reddit Recommendation to Users

While Reddit believes personal users and businesses were not affected, the platform still encourages individuals to take some measures to protect their data. The management recommended users to set up two-factor authentication (2FA) on their accounts. This adds another layer of protection even if someone has your password.

Reddit also suggests that users update their passwords monthly. However, most security professionals discourage this. Instead, it is best to use a password manager to help you create a strong and hard-to-guess password or passphrase.

But, as the investigations are still going on on the extent of the damage, it is best to change your Reddit account password, even though it hasn’t been compromised in this incident. If we are learning something from these cyberattacks is that the platform only notices the incidents days or even months after the initial attack. So, it is better to be safe than sorry.

Reddit has been a victim of cyberattacks several times. About five years ago, the firm shared a similar thread announcing that they had been hacked in somehow a similar way. The good news is that the firm has always been transparent and upfront with such incidents. But unfortunately, “we don’t think any of your personal data has been hacked” has become their response before they announce a large breach. Nevertheless, there is no indication that users and businesses were affected this time.

Russian search engine Yandex offers a slew of online services to replace Google, Netflix, Spotify, Amazon, and Uber. However, a recent Yandex data leak contains nearly 50 gigabytes of data with leaked files, including information ranging from API (application programming interface) keys to search engine behaviors. Information released by the leaker as “Yandex git sources” contains source code for most of Yandex’s online services.

What Was Leaked

Most data leaks involve hackers trying to collect user information like emails, phone numbers, and credit card information. The Yandex data leak doesn’t include user data or personally identifiable information but offers a wealth of information that reveals how the search engine works and source codes for Yandex’s major services, except for their anti-spam rules.

Most of the leaked information included back-end coding related to Yandex’s search engine and online services. Some API keys also leaked, though these appear as test keys and not permanent, usable ones.

Search Engine Ranking Factors

Part of the leak reveals Yandex’s ranking factors for search results, a feature that controls which search results appear when you type in a search query. The leak shows that Yandex’s ranking factors include the following:

• Page rank
• Text relevance
• Link relevance
• Link quality

Yandex uses 1,922 ranking factors. The leak allows SEO (search engine optimization) specialists and marketing professionals to find details on how search engines rank their search results.

Yandex Service Source Code

The Yandex data leak also exposed the source code for most of its major services. These services mirror many that exist in the United States. Source code for the following services was leaked, which are similar to several Google services:

• Mail (similar to Gmail)
• Direct (Adwords)
• Disk (Google Drive)
• Maps (Google Maps)
• Metrika (Google Analytics)
• Yandex360 (Google Workspaces)

Source code for Yandex services similar to other American tech giants were leaked, including:

• Taxi (similar to Uber)
• Pay (Stripe)
• Market (Amazon)
• Alice (Siri or Alexa)
• Travel (Booking.com)

Yandex Denies Being Hacked
Yandex blames a former employee for the leak, denying a hack. The company stated that the information released does not reflect the inner workings of Yandex’s current search engine system. In their own words, “Our security service found code fragments from an internal repository in the public domain, but the content differs from the current version of the repository used in Yandex services.”

While Yandex searches for the source of the leak, they state that users shouldn’t expect any platform downtime and that none of the leaked data included user information.

Yandex doesn’t yet know who caused the breach, but the timing seems suspicious. The leaker appears to have pulled information from February 24, 2022, the same day Russia invaded Ukraine. Many believe that though the leaker released the information on January 25, 2023, the date the code came from may indicate a politically motivated leak.

Whatever the reason, the Yandex data leak reveals important information regarding a top-tier web service’s ability to scan and index online code and data about its online services.

Microsoft has decided to retire its MS Teams Free (classic) app.

Released in 2017, MS Teams is a communication platform where users chat and call each other over the internet. While the primary concept is nothing new, the innovation comes with bells and whistles included. It is geared towards being a collaboration platform.

The product is available in both paid and free versions. The company has recently announced it would be retiring the free version.

When Is the MS Teams Free (Classic) Version Retiring?

Microsoft is set to retire the MS Teams Free (classic) version on April 12, 2023. The app will no longer be available, and data will be erased. That means organizations using the program need a transition plan right now.

What Should You Do?

Organizations using MS Teams Free (classic) have several options to switch. The first and understandably most promoted option by Microsoft is upgrading your Teams plan.

There are two paid versions available:

• Teams Essentials
• Microsoft 365 Business Basic

Essentials is a straightforward option. It allows you to keep all your files, chats, teams, and meetings in one cloud storage. On top of that, you get 300 participants per meeting, 10 GB storage per user, and unlimited group meetings up to 30 hours long. Who meets for 30 hours straight? We do not want to be the ones to know. This upgrade costs $4 per user per month.

The retirement of MS Teams Free could be an opportunity for your organization to switch to the MS 365 Business Basic. It is a complete productivity suite built for small to medium-sized businesses. At $6 per user per month, you get access to everything mentioned above, plus the following:

• Recordings with transcript
• MS 365 productivity apps like Word and Excel
• Manage customer appointments
• 1 TB cloud storage per user

If your organization is not ready to invest in paid productivity platforms yet, you still have the option to download and use the new Microsoft Teams Free app. Yes, they will retain a free version, offering:

• Unlimited group meetings for up to an hour
• Up to a hundred participants
• 5 GB cloud storage per user

The caveat is that it will use a new account. That means whatever data you have saved on your classic Teams would not be transferred to the new one.

Whatever you choose, it is wise to start downloading and backing up all the data on your classic Teams after reading this part. If you are interested in alternatives to MS Teams, read on.

Microsoft Teams Alternatives

We would be remiss to discuss MS Teams alternatives without mentioning Zoom. It is a communication platform for chats and calls. Key features include meeting recording, instant messaging during video calls, and cloud phone solutions. It can link with your Google Calendar, too.

If you are interested in Google products, their Meet platform integrates with other systems like Gmail, Calendar, and more. It is a web-based platform, meaning you can use it on any modern browser.

Now, do not forget to back up your Teams data.

Schools in Tucson, AZ, and Nantucket, MA, became the most recent targets of cyberattacks within hours of each other during the last week of January. The two attacks appear to be unrelated.

The hackers behind the Tucson Unified District ransomware attack specifically mentioned low spending on crucial cyber services as a reason for infecting their systems. A note allegedly written by the attackers states, “If you are reading this it means that your system(s) were hit by Royal. Most likely what happened was that you decided to save some money on your securi(ty).”

Royal ransomware infects computers, encrypts and copies data, then threatens to post the information online in public forums. The hackers using this human-operated ransomware then demand a “modest royalty” in exchange for the return of the stolen data. While Tucson began investigating its cyberattack in partnership with the FBI, another school district fell victim.

Ransomware infected four Nantucket, MA, schools, sending 1,700 students home halfway through the school day. The school district warned students and staff members not to use laptops, tablets, or other school-issued tech devices in case of ransomware activity.

Cyberattacks Targeting Schools Are on the Rise

Nantucket Public Schools is the fifth school in the United States to report a data breach in January 2023.

Cyberattacks target schools due to the rise in online learning. As a byproduct of the pandemic, school closures forced education online. Many schools now operate in person but still issue computers or tablets so students can access online libraries and assignments. Unfortunately, most schools have shallow budgets for IT specialists and online security while failing to enforce basic protections like strong passwords.

Devices and systems with low cyber security standards make perfect targets for hackers. School systems contain a wealth of personal information and internal documentation, which ransomware attackers hold hostage. If ransomware demands remain unmet, the operators may release their collected information, leaving everything from social security numbers to phone numbers publicly disclosed.

As more cyberattacks target schools, cyber security experts search for ways to address the problem while not going over the school’s allotted IT budget. Many school districts fear that they, like Nantucket Public Schools, may suffer a complete shutdown due to a ransomware attack. Schools suffered data breaches even before the pandemic. Tucson’s school district received negative remarks regarding online security in a performance audit in 2018. Some of the issues mentioned included:

• Weak password requirements
• Former employees retained access to the school system
• A lack of planning for possible equipment or system malfunctions or failure

These problems, in addition to low budgets, make it impossible for schools to protect their systems against ransomware attacks like Royal safely.

Staying Vigilant and Prepared Against Cyberattacks

While these recent cyberattacks target schools, everyone from business owners to private citizens should reconsider their own cyber security. Installing antivirus software, using strong passwords, and ensuring past employees or users cannot access your systems all help protect computers and servers. Good cyber security tactics and training lower your chances of becoming the next target of a cyber attack.

Google Fi users have received emails regarding a recent data breach at T-Mobile. From November 2022 through January 2023, hackers were able to obtain unauthorized access to data for 37 million T-Mobile customers. Google Fi, a wireless plan, uses T-Mobile networks to provide wireless service to customers. Google Fi wireless plan users also had information stolen, a side effect of using T-Mobile’s 5G network.

What Information Was Leaked?

The hackers gained access to a limited amount of Google Fi customer data, including:

• Phone numbers
• SIM card serial numbers
• Customer plan information
• Serial number account status (active or inactive users)

While these details sound alarming, Google Fi had extra security measures around particular customer information to protect them from unauthorized eyes. The hackers were unable to access crucial customer data, including:

• Name
• Date of birth
• Email address
• PINs or passwords
• Payment information
• Financial account information
• SMS messaging or phone call information
• Government IDs (e.g., driver’s licenses)

How Did T-Mobile Handle the Data Breach?

T-Mobile reports that it has yet to discover the source of the data breach. In the meantime, T-Mobile has notified the U.S. Securities and Exchange Commission and law enforcement agencies. Besides letting T-Mobile customers know about the breach, T-Mobile has also informed other companies that utilize the T-Mobile wireless network.
Google sent an email to affected customers but has not yet named the number of compromised accounts.

What Does This Mean for Google Fi Users?

Google Fi users don’t need to do anything regarding this data breach. Wireless service will continue uninterrupted. Since hackers did not access the most private and personally identifiable information throughout the Google Fi data leak, customers can continue to use their wireless plans safely.

Google and T-Mobile announced they will place extra security measures to protect against future data leaks.

What Does This Mean for My Google Accounts?

According to Google’s email, the suspicious activity specifically targeted “a third-party system that contains a limited amount of Google Fi customer data.” Gmail, Google Drive, and other Google apps remained safe throughout the data breach, and the hackers did not break into any Google systems.

What Could Hackers Do with My Google Fi Information?
The data breach didn’t provide hackers with much private information, but they did take enough data to do some damage. If you were affected, hackers could use your phone number with your SIM card information, make and take phone calls, or use the number for two-factor authentication security measures.

Google Fi users should also use caution when accepting calls from unknown numbers, as scammers may have enough information to sound convincing. Scammers could use this information to talk you into paying a nonexistent bill.

Although a data breach sounds scary, the Google Fi data leak only provided hackers with specific phone or phone plan information. Your most important data, like passwords, PINs, and payment information, remains safe. Practice good judgment with unknown phone calls or emails, and you shouldn’t need to worry about your private information.