By Darius Tahir, KFF Health News

Central Oregon Pathology Consultants has been in business for nearly 60 years, providing molecular testing and other diagnostic services east of the Cascade Range.

Starting last winter, the corporate operated for months without pay, living on money, Pra

said Tice manager Julie Tracewell. The practice is reeling from the fallout from one of the significant digital attacks in American history: the February hack of payment manager Change Healthcare.

COPC recently learned that Change had begun processing some outstanding claims, which totaled about 20,000 as of July, but Tracewell didn't know which of them, she said. The patient payment portal stays closed, stopping customers from paying their bills.

“It will take months to calculate the total loss of this downtime,” she said.

Healthcare is essentially the most common goal of ransomware attacks: In 2023 says the FBIOf these, 249 were directed at healthcare facilities – essentially the most of any sector.

And health care leaders, advocates and people in Congress are concerned that the federal government's response is insufficient, underfunded and too focused on protecting hospitals — at the same time as changes have proven that vulnerabilities are widespread.

The Department of Health and Human Services' “current approach to healthcare cybersecurity – self-regulation and voluntary best practices – is woefully inadequate and has left the healthcare system vulnerable to criminals and foreign government hackers,” said Sen. Ron Wyden (D-Ore.). , Chairman of the Senate Finance Committee, wrote in a recent letter to the agency.

The money isn't there, said Mark Montgomery, senior director of the Center on Cyber ​​and Technology Innovation on the Foundation for Defense of Democracies. “We’ve seen extremely incremental to almost no effort” to take a position more in security, he said.

The task is urgent – ​​2024 has been a yr of healthcare hacks. Hundreds of hospitals throughout the Southeast faced with disruptions their ability to receive blood for transfusions after nonprofit OneBlood, a donation service, fell victim to a ransomware attack.

Cyberattacks are making on a regular basis and complicated tasks equally difficult, said Nate Couture, chief information security officer on the University of Vermont Health Network, which was hit by a ransomware attack in 2020. “We can’t mix a chemo cocktail with the eye,” he said. referring to cancer treatments, at an event in June in Washington, DC

In December, HHS develop a cybersecurity strategy is meant to support the sector. Several proposals focused on hospitals, including a carrot-and-stick program to reward providers who adopted certain “essential” safety practices and penalize those that didn’t.

It could take years for even this narrow focus to materialize: Under the Departmental budget proposalFrom the 2027 budget yr, money would flow to hospitals with “strong need”.

The give attention to hospitals is “not appropriate,” Iliana Peters, a former law enforcement attorney on the HHS Office for Civil Rights, said in an interview. “The federal government needs to go further” by also investing within the organizations that offer and contract with providers, she said.

The department's interest in protecting patient health and safety “puts hospitals at the top of our list of priority partners,” Brian Mazanec, deputy director of the Administration for Strategic Preparedness and Response at HHS, said in an interview.

Responsibility for cybersecurity within the country's healthcare system is shared by three offices in two different agencies. The Department of Health and Human Services' civil rights office is a sort of police officer on duty, monitoring whether hospitals and other health groups have adequate patient privacy protections and potentially fining them in the event that they don't.

The Department of Health and Human Services' Preparedness Office and the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency are helping construct defenses—for instance, requiring medical software developers to make use of auditing technology to confirm their security.

Both are required to attract up an inventory of “systemically important units” whose operations are crucial for the right functioning of the health system. These entities could possibly be given special attention, comparable to by including them in government threat briefings, Josh Corman, co-founder of cyber advocacy group I Am The Cavalry, said in an interview.

Federal officials had been working on the list when news of the Change hack broke — but Change Healthcare was not on the list, Jen Easterly, head of Homeland Security's cybersecurity agency, said at an event in March.

Nitin Natarajan, deputy director of the cybersecurity agency, told KFF Health News that the list is barely a draft. The agency previously estimated It would finalize the entity list – across industries – last September.

The Department of Health and Human Services' preparedness office is alleged to coordinate with the Department of Homeland Security's cybersecurity agency and all the Department of Health and Human Services, but congressional staffers said the office's efforts were inadequate. There are “silos of excellence” in HHS “in which the teams don’t talk to each other, [where it] It wasn’t clear who people should turn to,” Matt McMurray, chief of staff to Rep. Robin Kelly (D-Ill.), said at a conference in June.

“Is the Health Department’s on-call office ‘the right home for cybersecurity?’ I’m not sure,” he said.

Historically, the office focused on disasters within the physical world – earthquakes, hurricanes, anthrax attacks, pandemics. It inherited cybersecurity as Trump-era department leadership sought more cash and authority, said Chris Meekins, who worked for the preparedness office under Trump and is now an analyst at investment bank Raymond James.

But since then, Meekins said, the agency has shown it’s “not qualified to do this.” There is an absence of funding, an absence of commitment, an absence of specialist knowledge.”

The on-call office has only a “small handful” of employees focused on cybersecurity, said Annie Fixler, director of the FDD Center for Cyber ​​and Technology Innovation. Mazanec acknowledges the number just isn’t high, but hopes additional funding will allow for more hiring.

The office was slow to reply to outside feedback. When a cyber threat industry clearinghouse tried to coordinate together with her to develop an incident response process, “it probably took three years to find someone willing to support the effort,” said Jim Routh, the then CEO of the Health Information Sharing and Analysis Center group.

During the NotPetya attack in 2017 — a hack that caused widespread damage to hospitals and drugmaker Merck — Health-ISAC itself ultimately shared information with its members, including the perfect method to contain the attack, Routh said.

Advocates are taking a have a look at the change hack — said to be attributable to an absence of multifactor authentication, a technology quite common in American workplaces — and say HHS needs to make use of regulations and incentives to push the health care sector into higher defenses to introduce. The ministry's strategy, published in December, set out a comparatively limited list of targets for the health sector, most of that are voluntary at this stage. The agency is “exploring” creating “new enforceable” standards, Mazanec said.

Much of the HHS strategy is anticipated to be implemented in the approaching months. The department has already requested more funding. The Preparedness Office, for instance, is asking for a further $12 million for cybersecurity. The civil rights office, with a flat budget and shrinking enforcement staff, is anticipated to release an update to its privacy and security rules.

“The entire industry still faces major challenges,” said Routh. “I don’t see anything on the horizon that will necessarily change that.”

---

©2024 KFF Health News. Distributed by Tribune Content Agency, LLC.

When space systems comparable to GPS were hacked and brought offlinemuch of the world would immediately revert to Fifties communications and navigation technologies. But at a time of heightened geopolitical tensions, cybersecurity in space is basically invisible to the general public.

Cyberattacks on satellites have for the reason that Eightiesbut the worldwide wake-up call only began a number of years ago. One hour before Russia invaded Ukraine on February 24, 2022, its government agents hacked Viasat's satellite web services to disrupt communications and create confusion in Ukraine.

I Studying ethics and recent technologies and function Advisor to the US National Space Council. My colleagues and I at California Polytechnic State University Group Ethics and New Sciences published a Report funded by the US National Science Foundation on 17 June 2024 to elucidate the issue of cyber attacks in space and help to anticipate recent and surprising scenarios.

Space and also you

Most people aren’t aware crucial role that space systems play of their day by day lives, not to say military conflicts. For example, GPS uses signals from satellites. GPS-enabled precise timing is important in financial services, where every detail – comparable to the time of payment or withdrawal – should be accurately recorded and coordinated. Even making a cell phone call is dependent upon precise time coordination within the network.

In addition to navigation for airplanes, boats, cars and other people, GPS can also be vital for coordinating Truck fleets who transport goods day by day to provide local shops.

Earth commentary satellites are “eyes in the sky” with a singular vantage point that helps predict weather, monitor environmental changes, track and reply to natural disasters, increase agricultural crop yields, manage land and water use, monitor troop movements, and more. The loss of those and other space services could possibly be fatal to people vulnerable to natural disasters and crop failures. It could also seriously threaten global economies and security.

Factors in play

In our report several aspects identified that contribute to the growing threat of cyberattacks from space. For example, it is vital to acknowledge that the world is firstly of a brand new space race.

According to all reports, space increasingly overcrowded and more controversial. Both nation states and personal firms which might be under-regulated and now most satellites in orbit, preparing for compete for resources And Research locations.

Because space is so distant and difficult to access, someone who desired to attack an area system would likely need to accomplish that through a cyberattack. Space systems are particularly attractive targets because their hardware can’t be easily upgraded after launch, and this Uncertainty gets worse over timeAs complex systems, they will long supply chainsand more links within the chain increase the likelihood of vulnerabilities. Large space projects also face the challenge of maintaining with best practices. Decade or more needed to construct them.

And in space, the stakes are unusually high. Orbital debris races around at speeds of 6 to 9 miles per second and may easily destroy a spaceship in an impact. It may also mean the tip of space programs worldwide, considering Kessler syndrome where the Earth is ultimately trapped in a cocoon of debris. These consequences argue in favor of cyberattacks from space over physical attacks, for the reason that debris problem is more likely to affect the attacker as well.

Over and beyond Critical space infrastructure and services comparable to GPS, conflicts in space can trigger or exacerbate conflict on Earth, even those in cyberspace. For example, Russia warned in 2022 that hacking one in every of its satellites interpreted as a declaration of warwhich represents a dramatic escalation in comparison with the previous Norms surrounding warfare.

Conjuring up scenarios

Even security experts who recognize the severity of this threat to space cybersecurity face a significant challenge. At least in unclassified forums, only a number of unspecified scenarios are frequently considered: something vague about satellite hacking and something vague about signals Jammers or spoofing.

But not considering all the chances can have devastating consequences for security planning, especially against hackers who diverse entities with different motivations and goals. These variables are vital to discover, as they supply clues as to which strategies and levers defenders find only in response. For example, an attack by a state-sponsored hacker may require a unique approach than, for instance, a criminal hacker in search of money or a Chaos Agent.

To help with this a part of the safety puzzle, our report provides a taxonomy – the ICARUS matrix – that captures these variables and may create greater than 4 million unique variable mixtures, which we call scenario prompts. ICARUS is an acronym for “Imagining cyberattacks to anticipate risks unique to space.”

Here are three of the 42 scenarios we included within the report.

A 3D or additive printer might be a useful resource on space missions to supply parts quickly and on demand. A hacker could gain access to a printer on an area station and reprogram it in order that the printed parts have tiny imperfections. Some of those doomed components could possibly be parts of critical systems.

A hacker could manipulate the information from a planetary probe and thus provide false information concerning the atmosphere, temperature or water content. For example, the manipulated data from a Mars rover could falsely indicate that an area has a big underground layer of water ice. Any further mission to explore the world would then be futile.

In 1938 radio play about an alien attack caused panic when many listeners didn’t realize that it was fiction. Likewise, a hacker could access the Messaging Extraterrestrial Intelligence interception feeds, or SETand insert into METI's transcription something harking back to an alien language. They could then leak it to the media, potentially causing panic world wide and setting off financial markets.

Other scenarios in our report include insider threats, AI vulnerabilities, false flag attacks, eco-terrorism, ransomware during a launch, and more distant scenarios involving asteroid mining, alien colonies, and space pirates.

Stories for more safety

persons are hardwired to answer storieswhether or not they are shared around prehistoric campfires or on digital platforms today. Developing novel and surprising scenarios can subsequently help bring the invisible threat of cyberattacks from space to life and highlight nuances in several scenarios that will interdisciplinary experts to tackle together.

WASHINGTON — Cyberattacks on water utilities across the country have gotten more frequent and severe, the Environmental Protection Agency warned Monday because it issued an enforcement alert urging water systems to take immediate motion to guard the nation's drinking water.

About 70% of utilities inspected by federal officials last yr violated standards designed to forestall breaches or other interference, the agency said. Officials even urged small water systems to enhance protection against hacking attacks. Recent cyberattacks by groups linked to Russia and Iran have targeted smaller communities.

The warning says some water systems have fundamental flaws, including failure to vary default passwords or block system access to former employees. Because water utilities often depend on computer software to operate treatment plants and distribution systems, protecting information technology and process controls is critical, the EPA said. Potential impacts of cyberattacks include disruptions to water treatment and storage; Damage to pumps and valves; and changing chemical concentrations to dangerous levels, the agency said.

“In many cases, systems are not doing what they are supposed to do, which is to conduct a risk assessment of their vulnerabilities, which includes cybersecurity and ensuring that a plan is available and provides information about the way they conduct their business,” said the EPA Acting Administrator Janet McCabe.

Attempts by private groups or individuals to penetrate a water utility's network and destroy or deface web sites are usually not recent. More recently, nonetheless, attackers haven’t only targeted web sites, but in addition the operations of utility firms.

The recent attacks are usually not only carried out by private firms. Some recent hacking attacks on water utilities are linked to geopolitical rivals and may lead to disruptions in the provision of fresh water to homes and businesses.

McCabe named China, Russia and Iran because the countries “actively seeking the opportunity to cripple U.S. critical infrastructure, including water and wastewater.”

Late last yr, an Iran-linked group called “Cyber ​​Av3ngers” targeted several organizations, including a small Pennsylvania town’s water utility, forcing it to modify from a distant pump to manual operation. They were targeting a tool made in Israel that the energy supplier had used in the midst of Israel's war against Hamas.

Earlier this yr, a Russian-linked “hacktivist” attempted to disrupt the operations of several Texas utilities.

A China-linked cyber group called Volt Typhoon has compromised the knowledge technology of several critical infrastructure systems, including drinking water, within the United States and its territories, U.S. officials said. Cybersecurity experts consider the China-allied group is positioning itself for possible cyberattacks within the event of an armed conflict or increasing geopolitical tensions.

“By working behind the scenes with these hacktivist groups, these (nation states) now have plausible deniability and can let these groups carry out destructive attacks. “And that to me is a game changer,” said Dawn Cappelli, cybersecurity expert at industrial cybersecurity firm Dragos Inc .

The world's cyber powers are believed to have been infiltrating their competitors' critical infrastructure for years and planting malware that could be triggered to disrupt essential services.

The enforcement alert is intended to highlight the severity of the cyber threats and inform utilities that the EPA will continue its inspections and impose civil or criminal penalties if they find serious problems.

“We want to make sure we let people know that we have a lot of problems here,” McCabe said.

The EPA did not say how many cyber incidents there have been in recent years, and the number of attacks known to be successful so far is small. The agency has issued nearly 100 enforcement actions related to risk assessments and emergency response since 2020, but said that was just a small snapshot of the threats facing water systems.

Preventing attacks on water utilities is part of the Biden administration's broader efforts to combat threats to critical infrastructure. In February, President Joe Biden signed an executive order to protect U.S. ports. Health systems have been under attack. The White House has also urged utilities to strengthen their defenses. EPA Administrator Michael Regan and White House National Security Advisor Jake Sullivan have asked states to develop a plan to combat cyberattacks on drinking water systems.

“Drinking water and wastewater systems are an attractive target for cyberattacks because they are a vital sector of critical infrastructure, but often lack the resources and technical capacity to implement rigorous cybersecurity practices,” Regan and Sullivan wrote in a March 18 letter to all 50 US governors.

Some of the fixes are straightforward, McCabe said. For example, water utilities should not use default passwords. You must develop a risk assessment plan that addresses cybersecurity and put backup systems in place. The EPA says they will provide free training to water providers who need help. Larger utilities typically have more resources and the expertise to defend against attacks.

“In a perfect world … we would love everyone to have a basic level of cybersecurity and give you the chance to certify that they’ve it,” said Alan Roberson, executive director of the Association of State Drinking Water Administrators. “But that's a good distance off.”

Some obstacles are fundamental. The water sector is very fragmented. There are roughly 50,000 municipal water suppliers, most of which serve small towns. Modest staffing levels and meager budgets in lots of places make it difficult enough to take care of what's essential – providing clean water and maintaining with the newest regulations.

“Certainly cybersecurity is part of it, but that was never their main competency. Now you’re asking a water utility to develop an entirely new department to deal with cyber threats,” said Amy Hardberger, a water expert at Texas Tech University.

But Missouri, Arkansas and Iowa, together with the American Water Works Association and one other water industry group, challenged the orders in court, saying the EPA lacks authority under the Safe Drinking Water Act. After a legal setback, the EPA withdrew its requirements but urged states to take voluntary motion anyway.

The Safe Drinking Water Act requires certain water providers to develop plans for specific threats and certify that they’ve done so. But his power is restricted.

“There is simply no authority for (cybersecurity) in the law,” Roberson said.

Kevin Morley, federal relations manager for the American Water Works Association, said some water utilities have components which can be connected to the web – a typical but significant vulnerability. Overhauling these systems is usually a large and expensive task. And without significant federal funding, water systems struggle to search out resources.

The industry group has released guidelines for utilities and is looking for the creation of a brand new organization of cybersecurity and water experts to work with the EPA to develop and implement recent policies.

“Let’s bring everyone along in a sensible way,” Morley said, adding that small and enormous utilities have different needs and resources.