Cyber Scan End of Week Wrap: Healthcare Cybersecurity Act & Disney Data Breach

Another development this week underlines the ongoing, evolving impact of digital threats. Australia’s healthcare system is of course dearly held and the fresh information around the scale of the MediSecure breach shines a light on its fragility. We also issue a spotlight on legal consequences of the Medibank breach in Australia.

‍

Further afield we take a look at the latest American attempt to shore up healthcare, while we also review an iconic global brands, AT&T and Disney, as it has become the latest victim of a cyber attack that could, arguably, already be identified as one the most exposed in terms of vulnerability affecting a leading brand in 2024.

‍

Watch out for these stories and many more as we delve into the most significant developments in cyber briefings, business, and global Security affairs.

MediSecure Data Breach: 12.9 Million Australians Affected

‍

The latest revelation about the magnitude of the MediSecure data breach has sent shockwaves through Australia's healthcare sector and government circles. In a startling disclosure, it has been confirmed that approximately 12.9 million Australians, nearly half of the country's population, have had their personal and health information compromised in one of the largest cyber attacks in the nation's history.

‍

The fallout from this breach has been swift and severe. Unable to shoulder the financial burden of managing the aftermath, MediSecure entered voluntary administration in June 2024, following the federal government's refusal to provide financial assistance. 

‍

‍

The Australian government, led by the National Cyber Security Coordinator Lieutenant General Michelle McGuinness, has taken a firm stance on the incident. While assuring the public that there is no disruption to current prescription services, the government has emphasised the gravity of the situation. Lt Gen McGuinness has strongly advised against searching for or accessing the stolen data on the dark web, warning that such actions could be illegal and inadvertently support cybercriminal activities.

‍

In terms of public advisory, authorities are urging Australians to be vigilant against potential scams related to the breach. Citizens are advised to be wary of unsolicited contacts referencing the MediSecure data breach and to independently verify any requests for personal or financial information. The government has also stressed that despite the breach, people should continue to access their medications and fill their prescriptions as usual, as the current national prescription delivery service remains unaffected.

Strengthening Cybersecurity: A Global Health Sector Imperative

‍

The recent introduction of the Healthcare Cybersecurity Act by U.S. Senators Jacky Rosen, Todd Young, and Angus King marks a significant step towards enhancing cybersecurity in the healthcare sector. This bipartisan legislation mandates collaboration between the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS), establishing a special liaison within CISA to coordinate during cybersecurity incidents. The act aims to fortify defenses and protect sensitive patient data as healthcare systems globally face relentless cyber threats, underscored by recent attacks in the UK and Australia.

‍

In the UK, cybercriminals have repeatedly targeted the healthcare sector, with the 2024 breach of the Health Service Executive (HSE) disrupting nationwide services and exposing severe cybersecurity gaps. Similarly, the Barts Health NHS Trust fell victim to the ALPHV ransomware gang, compromising 7 terabytes of sensitive data.

‍

These incidents, affecting millions of patients, highlight the urgent need for enhanced cybersecurity measures. Additionally, an investigation revealed that 20 NHS trusts had been sharing patient data with Facebook without consent, further eroding public trust in the security of health information.

‍

Australia's healthcare sector has also faced significant cyber crises. The NSW Ambulance data breach exposed sensitive information of its workers, leading to a class action lawsuit. Major cyberattacks on Medibank and NSW Ambulance services have compromised vast amounts of patient data, causing operational disruptions and financial losses.

‍

In 2024, the e-prescription delivery service MediSecure suffered a ransomware attack, exposing personal information on the dark web. These breaches underscore the vulnerabilities within Australia's healthcare system, necessitating robust legislative and defensive measures.

Disney's Internal Communications Leaked in Major Hack

‍

Data from Walt Disney's internal Slack channels were leaked online, exposing sensitive information related to ad campaigns, studio technology, and job candidate interviews. The breach, executed by the hacking group NullBulge, revealed over 1 terabyte of data spanning back to at least 2019. The leaked information includes discussions on managing Disney’s corporate website, software development, and job applicant evaluations.

‍

Nullbulge, self-described as "hacktivists protecting artists' rights," claims to have exfiltrated and leaked approximately one terabyte of data from Disney's internal Slack channels. This treasure trove of sensitive information allegedly includes unreleased projects, raw images and code, login credentials, internal API links, and messages from nearly 10,000 Slack channels. The leaked data, dating back to at least 2019, also contains discussions about ad campaigns, job applicant assessments, and even revenue data from Disneyland Paris.

‍

Cybersecurity experts suggest that hackers may have exploited stolen or leaked API keys, which developers sometimes accidentally expose on platforms like GitHub or Postman. “Developers often integrate Slack into their automation tools, and in the process, sometimes accidentally leak these keys,” explained Rahul Sasi, CEO of CloudSEK. This misconfiguration allowed hackers access to public Slack rooms, leading to the extensive data breach. The incident is reminiscent of Twitch's 2021 data breach, where 125 GB of data, including source code and streamer payouts, was leaked.

‍

Similar to the Twitch breach, Disney's incident highlights the vulnerabilities within digital infrastructures and the critical need for enhanced security measures. Chandrasekhar Bilugu, CTO of SureShield, emphasised the importance of behavioural analytics tools to monitor and flag unusual activities. Past incidents, like Facebook's 2019 data leak that exposed personal information of over 530 million users, underline the continuous threat of cyberattacks and the necessity for robust cybersecurity protocols.

‍

Our Cyber Scan end-of-week wrap-up delves into two major stories that have captured headlines and attention across the tech world: the massive AT&T data breach and its aftermath, and the ongoing legal consequences faced by Medibank in Australia. These incidents not only highlight the ongoing challenges faced by organisations in protecting sensitive data but also emphasise the urgent need for robust cybersecurity measures and proactive legislation to safeguard digital assets in an increasingly interconnected world.