Cyber News Bytes: What’s Happening in Cybersecurity This Week

1. One phishing click exposed Social Security numbers for 1.3 million people in Arizona’s court system

Arizona’s Supreme Court confirmed that hackers copied backup court files after an employee clicked a malicious link in a phishing email. The attack began on September 24, and the stolen data includes names, Social Security numbers, and case numbers for about 1.3 million people with unpaid court fines, fees, and restitution, with records going back as far as 30 years.

The attackers also took records on nearly 30,000 active and inactive protective orders, plus more than 150,000 Foster Care Review Board reports dating back to 2010, which include details about children and their cases. Court IT staff shut the attack down roughly two hours after spotting it, and officials say no records were altered or deleted. The court has been notifying affected people by text and email and urging them to freeze their credit.

Why it matters: Two hours is a fast response, but the damage came from what was sitting on the backup server: decades of sensitive data in one place. If you manage backups, treat them like production, with the same access controls, encryption, and retention limits, because attackers know backups are often the least watched copy of everything.

Read more at The Record

2. Hackers pulled account data for 400,000 Georgia Power and Alabama Power customers through the online portal

Southern Company is notifying roughly 400,000 customers that an unauthorized third party accessed their utility account information through its online customer portal. About 300,000 of the affected accounts belong to Georgia Power and about 100,000 to Alabama Power, and Mississippi Power customers were also affected, though no number has been released.

The exposed data includes names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers, and other basic account details. Southern Company says bank account numbers, payment cards, and driver’s license numbers were not accessed. The breach happened in September but customers were not notified until October, and each person is being offered a year of free credit monitoring. Georgia Power and Alabama Power have also warned customers about fraudulent calls, texts, and websites pretending to be the utility.

Why it matters: Southern Company serves more than 9 million customers, and a breach at a utility this size gives scammers a convincing script. The company has not said how attackers got into the portal, but customer portals are a common target, so make sure yours has MFA, rate limiting, and alerts for unusual login patterns.

Read more at SecurityWeek

3. A heart monitor maker is notifying 360,000+ patients about a breach from four months ago

iRhythm, the company behind the Zio patch that patients wear for long-term cardiac monitoring, began sending breach notices this month for an incident that happened between June 3 and June 8. The company confirmed that data was taken from third-party business applications, after a threat actor contacted it claiming to have stolen patient information.

The stolen data includes names, addresses, phone numbers, email addresses, patient account numbers, device serial numbers, insurance numbers, dates of birth, and dates of service. Notices filed in just Texas and South Carolina cover more than 360,000 people, and the total is likely higher, since iRhythm’s devices are used by about 8 million patients in the US and Europe. iRhythm says it has found no evidence of identity theft misuse so far.

Why it matters: Health data can’t be changed like a password, and the gap between the June breach and October notification left patients unaware for months. If your organization stores patient or customer data in third-party business apps, inventory who has access to those apps, enforce MFA, and make sure you can detect large exports quickly.

Read more at HIPAA Journal

4. The FBI says hackers are locking companies out of their own Fortinet firewalls, then selling the access to ransomware gangs

The FBI and Secret Service issued a joint advisory on October 6 warning that the FortiBleed campaign is still active. Attackers are scanning internet-facing Fortinet FortiGate firewalls and VPN gateways and logging in with credentials from old leak dumps and infostealer logs, using credential stuffing and password spraying. SOCRadar has verified more than 86,000 compromised devices across 194 countries.

Some victims have been locked out entirely after attackers deleted or changed admin passwords, and the agencies say the access is being sold to ransomware affiliates, currently including INC/Lynx and Payload. Fortinet has said this is not a new software vulnerability, so there is no patch to apply, and the advisory notes that remediation goes beyond standard patching and password resets.

Why it matters: This is a reminder that stolen or reused passwords can be just as dangerous as a zero-day. If you run FortiGate devices, require MFA on VPN logins, remove admin interfaces from the public internet, and audit for any admin accounts you don’t recognize.

Read more at Help Net Security

This week’s stories all came down to ordinary access: a phishing click, a customer portal, a third-party app, and a reused password, none of them needed a brand new exploit.

Stay secure out there!

Sandra | Cyber With Sandra