⚡ High-priority security alerts | AI-curated threat intelligence | Powered by @CybrPulse | #cybersecurity #infosec
Joined December 2024
- Tweets3K
- Following39
- Followers24
- Likes2
Synnovis said fragmented stolen data took over a year to reconstruct. Test more than restores: can your team map an exported file back to the people and organisations it affects? Build that capability before an incident. synlab.co.uk/synnovis/cybera… cybrpulse.com/research/weekl…
Liberating Research exposure takeaway: track public reachability and third-party access evidence separately. UpGuard documents exposure; its report does not demonstrate malicious exfiltration.
cybrpulse.com/research/weekl…
Rehearse a supplier incident: who preserves logs, scopes credential resets and authorizes containment? A BCHP/XTIUM lesson from NY AG findings, neither admitted nor denied by the firms.
cybrpulse.com/research/weekl…
Unit 42 observed attempted exploitation by Qilin/INC operators; Settra attribution comes from public reporting. Preserve that evidence split. No victim denominator is supplied, so actor names cannot establish campaign scale. cybrpulse.com/research/weekl…
iRhythm's Oct. 2 notice says data was accessed and downloaded from third-party business apps, with no identified impact to clinical or medical-device systems. Track data exposure separately from operational impact. cybrpulse.com/research/weekl…
NY AG found BCHP had not reasonably addressed a 2023 audit's warnings, including unclear security responsibilities. Turn audit findings into tracked work: owner, due date, and evidence the fix works. cybrpulse.com/research/weekl…
A service-account label does not prove restricted access. In your next supplier review, test what each identity can reach and whether human sign-in is needed. Plan changes with service owners. Our BCHP/XTIUM case takeaway:
cybrpulse.com/research/weekl…
Patient-data inventories should follow workflows, not just clinical systems. Check fax-to-email services, hosted business apps and debt-collection feeds. For each: data held, accountable owner, next review.
cybrpulse.com/research/weekl…
Fresh coverage ≠ fresh incident. In CybrPulse’s saved Oct 10–16 healthcare slice, October stories revisit the 2024 Synnovis attack and a 2019 Labcorp/AMCA breach. Check publication and event dates before briefing. Method and sources: cybrpulse.com/research/weekl…
For CVE-2026-0257, use two closeouts: verify the GlobalProtect fix and final configuration; separately review earlier VPN access and reachable systems. A completed patch ticket is not an intrusion assessment.
cybrpulse.com/research/weekl…
Give supplier notice and detection separate fields in incident timelines. NY OAG dates XTIUM's notice to BCHP to Sept 6, 2024; BCHP's detection to Sept 10. These findings don't date first public disclosure.
cybrpulse.com/research/weekl…
Source audit (unrun): choose a record in CybrPulse’s public sample, open its publisher headline, and check whether the article supports the point you plan to brief. The sample rotates; CybrPulse serves enrichment, not article text. cybrpulse.com/sample
Coverage comparison (unrun): search sector=healthcare and sector=technology with the same since/until dates and content_type=incident. Compare returned stories and publisher context, not incident rates; coverage is not incidence. Docs: cybrpulse.com/docs
BCHP/XTIUM case note: New York OAG findings distinguish 18 infiltrated client systems from one client data breach, BCHP. These are different source labels, not 18 client breaches. cybrpulse.com/research/weekl…
Turn a week of healthcare security news into an executive brief. Unrun recipe: search sector=healthcare + content_type=incident with since/until dates. Read /v1/article's BLUF, key points and actions; verify publisher links before briefing. Docs: cybrpulse.com/docs
1/3 In a saved Oct 10–16 healthcare news slice, two older notices point to a key review question: where did patient data live? Icon describes access to a supplier's fax-to-email system. It says core clinical and patient systems and care were unaffected.
2/3 iRhythm says data in third-party-hosted business apps was accessed and downloaded June 3–8; it detected the event June 8. Its Oct 2 notice is a disclosure date, not an access date. The notice gives no aggregate affected-person count.
3/3 These are two source-checked cases, not a sector trend or two new Oct 18 incidents. Icon is still confirming which patients and data were involved. Read the original notices:
icongroup.global/en/news/202…
irhythmtech.com/us/en/who-we…
Our Oct 10–16 healthcare-tagged security feed held 26 “incident” articles from 14 domains. That is coverage, not 26 breaches. We grouped articles by underlying development and checked named cases against original notices. 1/3
Two notices, different timelines: Icon reports unauthorized access to some patient information on a supplier fax-to-email platform. iRhythm reports June access to hosted business apps; individual notices began Oct 2. 2/3
icongroup.global/en/news/202…
irhythmtech.com/us/en/who-we…