Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / Veradigm Discloses Third Party Data Breach as Hackers Threaten to Publish Data

Transcript

Veradigm Discloses Third Party Data Breach as Hackers Threaten to Publish Data · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:15
  SPEAKER_01: Today, we were looking at a recent breach that started with a third-party partner and spiral into an extortion threat that could hit healthcare providers across the country.
• 0:24
  SPEAKER_00: That's right.
• 0:25
  SPEAKER_00: The incident involved a Chicago-based practice management, an electronic health record company that discovered its partner's systems had been compromised.
• 0:35
  SPEAKER_01: Can you walk us through how the breach unfolded?
• 0:37
  SPEAKER_00: The attackers gained unauthorized access to the partner's network, exfiltrated sensitive records, and then positioned themselves to threaten a public release of that data.
• 0:48
  SPEAKER_01: So the primary organization only found out when they were doing routine monitoring?
• 0:52
  SPEAKER_00: Exactly.
• 0:53
  SPEAKER_00: The breach was identified through routine monitoring, but the partner's systems weren't under the same level of scrutiny, allowing the attackers to operate undetected for an extended period.
• 1:04
  SPEAKER_01: What kind of data was at risk?
• 1:06
  SPEAKER_00: Protected health information, including patient records that are protected under HIPAA, was exfiltrated.
• 1:13
  SPEAKER_01: Why is this such a big deal for regulated organizations?
• 1:16
  SPEAKER_00: Because a breach that originates outside the primary organization can trigger regulatory penalties, reputational damage, and financial loss if not handled properly.
• 1:27
  SPEAKER_01: The article mentions extortion.
• 1:29
  SPEAKER_01: How does that factor in here?
• 1:31
  SPEAKER_00: The attackers issued a threat to release the compromised information unless a ransom is paid, a form of ransomware that targets the organization's reputation and patient trust.
• 1:43
  SPEAKER_01: What does that mean for the patients themselves?
• 1:45
  SPEAKER_00: Patients could face identity theft, insurance fraud, or unauthorized disclosure of medical conditions, especially if the data is published publicly.
• 1:55
  SPEAKER_01: The breach also raises regulatory expectations.
• 1:59
  SPEAKER_01: What are regulators looking for?
• 2:01
  SPEAKER_00: Regulators expect healthcare providers to maintain strong controls over all entities that handle protected health information.
• 2:09
  SPEAKER_00: And the breach highlights gaps in vendor oversight.
• 2:12
  SPEAKER_01: So the partner's security posture was aligned with the organization's risk tolerance?
• 2:17
  SPEAKER_00: That's correct.
• 2:18
  SPEAKER_00: The misalignment created a vulnerability that attackers exploited, underscoring the need for comprehensive vendor risk assessments.
• 2:26
  SPEAKER_01: What would a mature security program look like in this context?
• 2:29
  SPEAKER_00: It would include continuous monitoring, threat intelligence, and rigorous vendor oversight, with structured risk assessment frameworks that evaluate technical, operational, and compliance dimensions.
• 2:42
  SPEAKER_01: The article talks about penetration testing and vulnerability scanning.
• 2:46
  SPEAKER_01: How do those fit in?
• 2:47
  SPEAKER_00: Regular penetration testing and vulnerability scanning of third-party systems that interface with the organization help identify weaknesses before attackers can exploit them.
• 3:00
  SPEAKER_01: Contractual language is mentioned too.
• 3:02
  SPEAKER_01: Why is that important?
• 3:03
  SPEAKER_00: Clear contractual language that requires vendors to report incidents promptly and maintain adequate safeguards creates accountability and ensures timely response.
• 3:14
  SPEAKER_01: And incident response plans?
• 3:16
  SPEAKER_00: Integrated incident response plans delineate responsibilities across the organization and its partners, ensuring a coordinated and swift reaction when a breach occurs.
• 3:28
  SPEAKER_01: Post-incident reviews are also part of the loop.
• 3:31
  SPEAKER_00: Yes, post-incident reviews feed lessons learned back into vendor selection and monitoring processes, tightening controls over time.
• 3:39
  SPEAKER_01: The article outlines HIPAA breach notification requirements.
• 3:43
  SPEAKER_01: What does that entail?
• 3:45
  SPEAKER_00: Under HIPAA, covered entities must notify affected individuals and regulators within a specified timeframe after discovering a breach, involving confirmation, risk assessment, drafting a notification letter, and distribution.
• 4:00
  SPEAKER_01: Failure to comply can lead to civil penalties, right?
• 4:03
  SPEAKER_00: Exactly.
• 4:04
  SPEAKER_00: Noncompliance can result in civil penalties and loss of trust among patients and partners.
• 4:10
  SPEAKER_01: The Verdyme incident illustrates the need for a ready breach response plan.
• 4:15
  SPEAKER_01: What should that plan include?
• 4:16
  SPEAKER_00: It should cover containment, notification, remediation, and post-incident analysis, and specifically address extortion scenarios and communication strategies with patients, regulators, and the media.
• 4:30
  SPEAKER_01: What about the risk of data loss to patient harm?
• 4:32
  SPEAKER_00: When sensitive records are exposed, patients may suffer financial, emotional, or physical harm.
• 4:39
  SPEAKER_00: So a robust response is critical to mitigate that risk.
• 4:43
  SPEAKER_01: The article mentions accreditation and certification programs.
• 4:47
  SPEAKER_01: How can a breach jeopardize those?
• 4:49
  SPEAKER_00: Accreditation programs evaluate security posture.
• 4:52
  SPEAKER_00: So a third-party breach can jeopardize accreditation's status if the organization fails to demonstrate adequate controls.
• 5:00
  SPEAKER_01: Similarly, for certification programs focused on electronic health record security.
• 5:05
  SPEAKER_00: Yes, those programs may require evidence of vendor oversight.
• 5:09
  SPEAKER_00: So a breach can trigger compliance investigations.
• 5:13
  SPEAKER_01: The article expands beyond health care to defense contractors, legal services, and financial services.
• 5:19
  SPEAKER_01: Why is that relevant?
• 5:21
  SPEAKER_00: Because all these sectors handle highly regulated or sensitive data, and a breach in a partner can expose classified information or client confidentiality, leading to national security concerns, legal risks, or financial loss.
• 5:36
  SPEAKER_01: Defense contractors need strict security controls on all partners, right?
• 5:39
  SPEAKER_00: They must enforce strict controls, conduct regular audits, and maintain a comprehensive supply chain risk management program.
• 5:48
  SPEAKER_01: And they should have integrated incident response plans that include defense-specific protocols and coordination with federal agencies.
• 5:55
  SPEAKER_00: That's correct.
• 5:56
  SPEAKER_00: Ensuring that any breach is handled with the appropriate level of urgency and coordination.
• 6:02
  SPEAKER_01: For healthcare, the article suggests a holistic approach to vendor risk.
• 6:07
  SPEAKER_00: Including detailed security assessments of all third-party vendors, handling protected health information, and embedding contractual obligations that require timely breach notification and adherence to HIPAA.
• 6:21
  SPEAKER_01: Continuous monitoring of vendor environments through managed detection and response services is also highlighted.
• 6:27
  SPEAKER_00: Managed detection and response provides real-time visibility across the supply chain, allowing organizations to detect anomalous activity in partner environments.
• 6:38
  SPEAKER_01: Keeping the breach response playbook up to date is essential, especially for extortion scenarios.
• 6:43
  SPEAKER_00: A well-crafted playbook outlines steps for containment, notification, remediation, and post-incident analysis, ensuring the organization can respond decisively.
• 6:55
  SPEAKER_01: The article also mentions legal services and the importance of protecting client confidentiality.
• 7:01
  SPEAKER_00: Law firms must treat vendor risk assessments as part of their overall risk management strategy, ensuring partners meet the same security standards required of the firm.
• 7:11
  SPEAKER_01: And for financial services, the stakes include customer accounts and transaction histories.
• 7:17
  SPEAKER_00: Exactly.
• 7:18
  SPEAKER_00: So firms must enforce rigorous vendor oversight, including penetration testing, compliance verification, and real-time monitoring of partner systems.
• 7:28
  SPEAKER_01: Now let's talk about practical action steps for organizations.
• 7:32
  SPEAKER_00: First, initiate a comprehensive vendor risk assessment program that evaluates technical controls, governance, and compliance status.
• 7:41
  SPEAKER_01: In our assessments, we consistently see that organizations lack a formalized framework for evaluating third-party security.
• 7:48
  SPEAKER_00: Embedding contractual language that obligates vendors to report incidents promptly, provide detailed incident reports, and maintain alignment with relevant regulatory frameworks such as HIPAA, NISD SB 800-171, and ISO 27001 is a key part of that.
• 8:08
  SPEAKER_01: Deploy continuous monitoring solutions like managed detection and response services to detect anomalous activity in partner environments.
• 8:17
  SPEAKER_00: Our managed XDR platform offers real-time visibility across the supply chain, correlating alerts and automating response actions to reduce the mean time to detection and containment.
• 8:29
  SPEAKER_01: Develop a detailed breach response playbook that includes steps for containment, notification, remediation, and post-incident analysis.
• 8:39
  SPEAKER_00: The playbook should also address extortion scenarios and outline communication strategies with patients, regulators, and the media.
• 8:47
  SPEAKER_01: Conduct periodic penetration testing and vulnerability assessments of partner systems that interface with your environment.
• 8:54
  SPEAKER_00: This proactive approach can uncover weaknesses before attackers do, giving you a chance to remediate before a breach.
• 9:01
  SPEAKER_01: Establish a cross-functional incident response team that includes representatives from security, legal, compliance, and public relations.
• 9:09
  SPEAKER_00: That team should be trained to respond to third-party incidents swiftly and transparently, ensuring all stakeholders are informed.
• 9:17
  SPEAKER_01: Maintain an up-to-date inventory of all third-party relationships, including the nature of data shared, contractual obligations, and security certifications.
• 9:27
  SPEAKER_00: Implement a vendor risk management platform that automates assessment workflows, tracks remediation progress, and provides audit trails for compliance purposes.
• 9:38
  SPEAKER_01: Engage with a virtual CISO or a managed security service provider to supplement internal expertise, especially during incident response and remediation efforts.
• 9:47
  SPEAKER_00: A virtual CISO can provide strategic leadership, policy development, and incident response oversight without the overhead of a full-time executive.
• 9:57
  SPEAKER_01: Conduct regular training sessions for staff and vendors on security best practices, phishing awareness, and incident reporting procedures.
• 10:06
  SPEAKER_00: Training ensures that everyone involved understands their role in preventing and responding to breaches, reducing the likelihood of human error.
• 10:15
  SPEAKER_01: The article explains how Petronella Technology Group can help.
• 10:18
  SPEAKER_00: Petronella Technology Group specializes in delivering end to end security and compliance solutions tailored to regulated industries.
• 10:27
  SPEAKER_01: Their vendor risk assessment services provide a structured framework that evaluates technical controls, governance, and regulatory alignment.
• 10:35
  SPEAKER_00: They also offer gap analysis, remediation planning, and continuous monitoring to ensure third-party partners remain compliant over time.
• 10:44
  SPEAKER_01: For HIPAA breach response, they have a proven methodology covering containment, notification, remediation, and post-incident analysis.
• 10:53
  SPEAKER_00: The team helps organizations meet HIPAA notification requirements and communicate with stakeholders transparently.
• 11:00
  SPEAKER_01: After the Viridine breach, the first thing that jumps out is how a single third-party failure can ripple into a cascade of regulatory and reputational consequences for a regulated organization.
• 11:11
  SPEAKER_01: If the breach goes unnoticed for weeks, the organization may miss the HIPAA notification window and face civil penalties.
• 11:18
  SPEAKER_00: Exactly.
• 11:19
  SPEAKER_00: The incident shows that even routine monitoring can miss a partner that has weaker controls.
• 11:24
  SPEAKER_00: So the primary organization must treat vendor environments with the same rigor as its own systems.
• 11:31
  SPEAKER_01: This means that a vendor risk assessment must go beyond a simple questionnaire.
• 11:35
  SPEAKER_01: It should include technical testing, governance review, and a look at the vendor's own incident response plan.
• 11:40
  SPEAKER_00: And it should be repeatable.
• 11:42
  SPEAKER_00: A one-off assessment is only useful if you keep checking for changes in the vendor's security posture over time.
• 11:49
  SPEAKER_01: Another deep implication is the threat of extortion.
• 11:52
  SPEAKER_01: Attackers can leverage the high value of protected health information to demand payment or threaten a public release.
• 11:58
  SPEAKER_00: That dual threat, financial and reputational, puts pressure on organizations to act quickly, but it also creates a moral dilemma about whether to negotiate.
• 12:08
  SPEAKER_01: Regulators expect you to have a clear breach response playbook that covers third-party incidents.
• 12:13
  SPEAKER_01: That playbook should detail containment, notification, remediation, and post-incident analysis.
• 12:20
  SPEAKER_00: Containment starts with isolating the compromised partner's environment to stop further exfiltration.
• 12:27
  SPEAKER_00: Then, you must request a detailed incident report from the vendor.
• 12:31
  SPEAKER_01: Once you have that information, you can assess the risk to affected individuals.
• 12:36
  SPEAKER_01: Hipower requires you to determine whether the breach poses a reasonable risk of identity theft.
• 12:41
  SPEAKER_00: If it does, you need to notify affected patients and the Department of Health and Human Services within 60 days, unless the breach is unlikely to cause harm.
• 12:51
  SPEAKER_01: Many organizations make the mistake of treating vendor breaches as a secondary concern.
• 12:57
  SPEAKER_01: In reality, they can be the primary source of a data loss event.
• 13:00
  SPEAKER_00: A common error is not maintaining an up-to-date inventory of all third-party relationships.
• 13:06
  SPEAKER_00: Without that inventory, you can't know which data flows where.
• 13:28
  SPEAKER_01: Speaking of remediation, one concrete step is to embed contractual language that requires vendors to report incidents promptly and provide detailed incident reports.
• 13:38
  SPEAKER_00: It's also wise to require that vendors maintain alignment with frameworks such as HIPAA, NISD SB 800-171, and ISO 2701.
• 13:51
  SPEAKER_01: Continuous monitoring is another key practice.
• 13:54
  SPEAKER_01: Managed detection and response services can give you real-time visibility across partner environments.
• 14:00
  SPEAKER_00: Our managed XDR platform correlates alerts from endpoints, network traffic, and cloud logs and can automatically contain threats before they spread.
• 14:10
  SPEAKER_01: But technology alone isn't enough.
• 14:12
  SPEAKER_01: You need a cross-functional incident response team that includes security, legal, compliance, and public relations.
• 14:19
  SPEAKER_00: That team should be trained to respond to third-party incidents swiftly and transparently so you can keep stakeholders informed.
• 14:28
  SPEAKER_01: Training is often overlooked.
• 14:30
  SPEAKER_01: Regular security training for staff and vendors on phishing awareness and incident reporting can reduce human error.
• 14:35
  SPEAKER_00: When vendors are trained as part of the program, they become partners in your security posture rather than just service providers.
• 14:43
  SPEAKER_01: Another mistake organizations make is failing to test vendor controls.
• 14:47
  SPEAKER_01: Penetration testing and vulnerability scanning of partner systems that interface with your environment should be routine.
• 14:53
  SPEAKER_00: Testing can uncover weaknesses before attackers do, and it gives you a baseline to measure improvement over time.
• 15:00
  SPEAKER_01: For defense contractors, the stakes are even higher.
• 15:04
  SPEAKER_01: A breach in a single subcontractor can expose classified information and trigger national security concerns.
• 15:10
  SPEAKER_00: That's why defense contractors must enforce strict security controls on all partners, conduct regular audits, and maintain a comprehensive supply chain risk management program.
• 15:22
  SPEAKER_01: Legal firms also face similar risks.
• 15:24
  SPEAKER_01: A breach in a cloud service can compromise privileged information, eroding client confidence.
• 15:30
  SPEAKER_00: Legal entities should treat vendor risk assessments as part of their overall risk management strategy, ensuring partners meet the same security standards required of the firm.
• 15:41
  SPEAKER_01: Financial institutions process highly sensitive personal and transactional data.
• 15:46
  SPEAKER_01: A third-party breach can expose customer accounts and credit information.
• 15:49
  SPEAKER_00: The threat of data publication can lead to significant reputational damage and regulatory scrutiny.
• 15:56
  SPEAKER_00: So rigorous vendor oversight is essential.
• 15:59
  SPEAKER_01: So what should an organization do right now after discovering a third-party breach?
• 16:03
  SPEAKER_00: First, isolate the compromised partner's environment to prevent further data loss.
• 16:09
  SPEAKER_01: Second, notify the partner of the breach and request a detailed incident report.
• 16:14
  SPEAKER_00: Third, activate your breach response playbook, ensuring all stakeholders are informed and regulatory notification requirements are met.
• 16:23
  SPEAKER_01: Finally, conduct a forensic investigation to understand the scope and impact of the breach.
• 16:28
  SPEAKER_00: When evaluating a vendor's security controls, start with a formal vendor risk assessment that examines technical safeguards, governance structure, and compliance certifications.
• 16:39
  SPEAKER_01: Verify that the vendor conducts regular penetration testing, maintains up to date security policies, and has a documented incident response plan.
• 16:48
  SPEAKER_00: Make sure contractual agreements require timely breach notification and adherence to HIPAA standards.
• 16:55
  SPEAKER_01: Manage detection and response solutions provide continuous monitoring of network traffic, endpoint activity, and cloud logs.
• 17:02
  SPEAKER_00: By correlating alerts across multiple data sources, these platforms can detect anomalous behavior that originates from partner systems.
• 17:11
  SPEAKER_01: Automated response actions can contain threats before they spread, reducing the likelihood of data exposure.
• 17:17
  SPEAKER_00: A virtual CISO brings strategic oversight and incident response expertise without the overhead of a full-time executive.
• 17:26
  SPEAKER_01: During a breach, the virtual CISO coordinates cross-of-functional teams, ensures compliance with regulatory requirements, and communicates with external stakeholders.
• 17:36
  SPEAKER_00: This leadership is critical for swift, coordinated action.
• 17:40
  SPEAKER_01: A mature vendor risk program mitigates the risk of extortion by continuously assessing and monitoring the security posture of partners.
• 17:48
  SPEAKER_00: Strong contractual obligations, rapid incident reporting, and real-time monitoring reduce the window of opportunity for attackers to threaten data publication.
• 17:58
  SPEAKER_01: Additionally, a robust breach response plan ensures that the organization can respond decisively, reducing the leverage of extortionists.
• 18:07
  SPEAKER_00: Listeners often ask, what should a healthcare organization do immediately after discovering a third-party breach?
• 18:14
  SPEAKER_01: The answer is to isolate the partner's environment, notify the partner, activate your breach response playbook, and conduct a forensic investigation.
• 18:23
  SPEAKER_00: Another common question is how to evaluate whether a vendor's security controls meet HIPAA requirements.
• 18:29
  SPEAKER_01: Start with a formal vendor risk assessment that looks at technical safeguards, governance structure, and compliance certifications.
• 18:37
  SPEAKER_00: Verify the vendor's penetration testing schedule, security policy updates, and incident response documentation.
• 18:44
  SPEAKER_01: Then ensure contractual agreements require timely breach notification and adherence to HIPAA standards.
• 18:50
  SPEAKER_00: Listeners also ask about the role of managed detection and response in protecting against third-party threats.
• 18:57
  SPEAKER_01: Managed detection and response solutions provide continuous monitoring of network traffic, endpoint activity, and cloud logs.
• 19:05
  SPEAKER_00: By correlating alerts across multiple data sources, these platforms can detect anomalous behavior that originates from partner systems.
• 19:14
  SPEAKER_01: They also offer automated response actions that can contain threats before they spread.
• 19:18
  SPEAKER_00: Another question is why a virtual CISO is valuable during a breach involving a third-party partner.
• 19:26
  SPEAKER_01: A virtual CISO brings strategic oversight and incident response expertise without the overhead of a full-time executive.
• 19:33
  SPEAKER_00: During a breach, the virtual CISO coordinates cross-functional teams, ensures compliance with regulatory requirements, and communicates with external stakeholders.
• 19:44
  SPEAKER_01: Listeners often wonder how a mature vendor risk program mitigates the risk of extortion.
• 19:50
  SPEAKER_00: By continuously assessing and monitoring the security posture of partners, organizations can identify weaknesses before attackers exploit them.
• 19:59
  SPEAKER_01: Strong contractual obligations, rapid incident reporting, and real-time monitoring reduce the window of opportunity for attackers to threaten data publication.
• 20:08
  SPEAKER_00: A strong breach response plan ensures that the organization can respond decisively, reducing the leverage of extortionists.
• 20:17
  SPEAKER_01: In practice, the first step is to conduct a comprehensive vendor risk assessment program that evaluates technical controls, governance, and compliance status.
• 20:27
  SPEAKER_00: Then embed contractual language that obligates vendors to report incidents promptly, provide detailed incident reports, and maintain alignment with relevant regulatory frameworks such as HIPAA, NISD SB 800-171, and ISO 2701.
• 20:46
  SPEAKER_01: Deploy continuous monitoring solutions, such as managed detection and response services to detect anomalous activity in partner environments.
• 20:55
  SPEAKER_00: Develop a detailed breach response playbook that includes steps for containment, notification, remediation, and post-incident analysis.
• 21:04
  SPEAKER_01: The playbook should address extortion scenarios and outline communication strategies with patients, regulators, and the media.
• 21:11
  SPEAKER_00: Conduct periodic penetration testing and vulnerability assessments of partner systems that interface with your environment.
• 21:19
  SPEAKER_01: Establish a cross-functional incident response team that includes representatives from security, legal, compliance, and public relations.
• 21:29
  SPEAKER_00: This team should be trained to respond to third-party incidents swiftly and transparently.
• 21:34
  SPEAKER_01: Maintain an up-to-date inventory of all third-party relationships, including the nature of data shared, contractual obligations, and security certifications.
• 21:44
  SPEAKER_00: Implement a vendor risk management platform that automates assessment workflows, tracks remediation progress, and provides audit trails for compliance purposes.
• 21:54
  SPEAKER_01: Engage with a virtual CISO or a managed security service provider to supplement internal expertise, especially during incident response and remediation efforts.
• 22:04
  SPEAKER_00: A virtual CISO can provide strategic leadership, policy development, and incident response oversight without the overhead of a full-time executive.
• 22:14
  SPEAKER_01: Conduct regular training sessions for staff and vendors on security best practices, phishing awareness, and incident reporting procedures.
• 22:22
  SPEAKER_00: Training ensures that everyone involved understands their role in preventing and responding to breaches, reducing the likelihood of human error.
• 22:31
  SPEAKER_01: The article explains how Petronella Technology Group can help.
• 22:35
  SPEAKER_00: Petronella Technology Group specializes in delivering end-to-end security and compliance solutions tailored to regulated industries.
• 22:44
  SPEAKER_01: Their vendor risk assessment services provide a structured framework that evaluates technical controls, governance, and regulatory alignment.
• 22:51
  SPEAKER_00: They also offer gap analysis, remediation planning, and continuous monitoring to ensure third-party partners remain compliant over time.
• 23:01
  SPEAKER_01: For HIPAA breach response, they have a proven methodology covering containment, notification, remediation, and post-incident analysis.
• 23:10
  SPEAKER_00: The team helps organizations meet HIPAA notification requirements and communicate with stakeholders transparently.
• 23:17
  SPEAKER_01: Thank you for that thorough overview.
• 23:19
  SPEAKER_00: It's been a pleasure to dive into the practical steps that can protect organizations from third party breach and extortion.
• 23:26
  SPEAKER_01: If you'd like to discuss how to strengthen your vendor risk program or improve your breach response capabilities, reach out to Petronella Technology Group, Inc.
• 23:35
  SPEAKER_01: at 919 348 4912.