TechCrunch: Every day, millions of new medical images containing the personal health information of patients are spilling out onto the internet. Hundreds of hospitals, medical offices and imaging centers are running insecure storage systems, allowing anyone with an internet connection and free-to-download software to access over 1 billion medical images of patients across the world. About half of all the exposed images, which include X-rays, ultrasounds and CT scans, belong to patients in the United States. Yet despite warnings from security researchers who have spent weeks alerting hospitals and doctors’ offices to the problem, many have ignored their warnings and continue to expose their patients’ private health information….

beSpacific Subjects: E-Records, Health Care, Internet, Medicine, Search Engines

Sample category RSS: https://www.bespacific.com/category/e-records/feed/

TC RSS: https://techcrunch.com/feed/

The United States Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert that strongly urges users and administrators alike to update a VPN with long-since disclosed critical vulnerabilities. “Affected organizations that have not applied the software patch to fix a remote code execution (RCE) vulnerability,” the CISA alert warns, “can become compromised in an attack.” What has dictated the need for this level of Government agency interest and the urgency of the language used? The simple answer is the ongoing Travelex foreign currency exchange cyber-attack, thought to have been facilitated by no less than seven VPN servers that were late in being patched against this critical vulnerability. The vulnerability in question is CVE-2019-11510, first disclosed way back in April 2019 when Pulse Secure VPN also released a patch to fix it.Critical VPN security vulnerability timeline
The CISA alert provides a telling timeline that outlines how the Pulse Secure VPN critical vulnerability, CVE-2019-11510, became such a hot security potato. Pulse Secure first released an advisory regarding the vulnerabilities in the VPN on April 24, 2019.

• Amazon fired multiple employees over leaking customer information including email addresses and phone numbers, Business Insider has learned.
• “The individuals responsible for this incident have been terminated and we are supporting law enforcement in their prosecution,” Amazon’s spokesperson told Business Insider.
• It’s unclear how many customers and employees were affected by the incident.
• It’s the latest incident involving Amazon employees leaking customer data, but it also shows Amazon’s growing focus on protecting customer data.

Amazon notified a group of customers this week that at least one employee shared the customers’ email addresses and phone numbers “to a third-party in violation of our policies,” according to the email seen by Business Insider. It said the employee has been fired because of the leak, and that no other information related to the user accounts were shared externally.

The news was reported earlier by TechCrunch.

The move reflects Amazon’s recent efforts to further protect personal customer data. But it also shows how Amazon employees are looking to benefit from leaking customer data, as a similar incident was reported in 2018.

At the time, the Wall Street Journal reported that some Amazon employees sold customer data to third-party sellers and brokers, who then used the data to get better reviews and improve their sales. Those employees were also fired immediately, the report said.

Also, a number of sellers have told Business Insider recently that they are no longer able to view specific customer names and addresses on their order pages. The issue was brought up in Amazon’s public seller forum too, drawing dozens of responses from affected sellers.

The New York Times: “The National Security Agency has taken a significant step toward protecting the world’s computer systems, announcing Tuesday that it alerted Microsoft to a vulnerability in its Windows operating system rather than following the agency’s typical approach of keeping quiet and exploiting the flaw to develop cyberweapons. The warning allowed Microsoft to develop a patch for the problem and gave the government an early start on fixing the vulnerability. In years past, the National Security Agency has collected all manner of computer vulnerabilities to gain access to digital networks to gather intelligence and generate hacking tools to use against American adversaries. But that policy was heavily criticized in recent years when the agency lost control of some of those tools, which fell into the hands of cybercriminals and other malicious actors, including North Korean and Russian hackers. By taking credit for spotting a critical vulnerability and leading the call to update computer systems, the National Security Agency appeared to adopt a shift in strategy and took on an unusually public role for one of the most secretive arms of the American government. The move shows the degree to which the agency was bruised by accusations that it caused hundreds of millions of dollars in preventable damage by allowing vulnerabilities to circulate…”

• beSpacific Subjects: Cybercrime, Cybersecurity, Defense, Knowledge Management, Microsoft, PC Security

---

---

---