.webp)
Henry Schein, a Fortune 500 healthcare company, faced a severe cybersecurity incident, falling prey to the 'BlackCat/ALPHV' ransomware gang for the second time in a month. The most recent attack, detected on November 22, targeted critical systems, causing disruptions to the organization's applications and e-commerce platform. This recurrence underscores the persistence posed by the threat actor, necessitating a comprehensive response to safeguard the company's operations and sensitive data.
The BlackCat ransomware gang compromised Henry Schein's network, utilizing a method not yet explicitly disclosed in available information. However, the modus operandi may include phishing emails, compromised servers, or other sophisticated techniques. The organization likely became aware of the incident through anomalies in the network and unauthorized access, triggering an in-depth investigation into the nature and extent of the compromise.
The attack resulted in significant disruptions to Henry Schein's operations, particularly affecting applications and the e-commerce platform. The threat actor BlackCat claimed responsibility for the breach, asserting that they had stolen a substantial 35 terabytes of critical data. The potential compromise of sensitive information raises concerns regarding regulatory compliance, data integrity, and the company's reputation in the healthcare sector.
In response to the incident, Henry Schein promptly took critical applications offline to contain the threat and prevent further propagation. The organization communicated transparently with stakeholders, providing updates on the situation. The threat actors, however, claimed to have re-encrypted the company's devices during a restoration attempt, following a breakdown in negotiations with Henry Schein's team at the end of October. The attackers threatened to release internal payroll data and shareholder folders, heightening the urgency of the response.
The company has successfully restored its U.S. e-commerce platform, marking progress in the recovery phase. However, challenges persist, particularly with the potential release of sensitive data by the threat actors. The expected downtime and the overall impact on business operations remain uncertain, requiring ongoing efforts to restore affected systems and ensure business continuity.
To fortify defenses against ransomware attacks like this, organizations are advised to undertake the following measures:
Conduct a comprehensive review of the organization's cybersecurity infrastructure, identifying weaknesses and vulnerabilities. Implement advanced threat detection systems capable of identifying and mitigating evolving threats like BlackCat. Enhance data encryption protocols and access controls to protect sensitive information from unauthorized access. Invest in ongoing employee training and awareness programs to foster a security-conscious culture within the organization. The incident serves as a crucial learning opportunity, emphasizing the importance of adapting security practices, collaborating with cybersecurity experts, implementing proactive measures, and strictly avoiding ransom payments to discourage criminal activities and protect the integrity of organizational data and systems.
Access Point recommends that organizations:
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
