Weekly Cybersecurity Recap December 29

This week caps off our year of cyber breaches; in this week alone, we saw millions of records stolen, targeted health providers, mortgage servicers crumble, and the return of a year-old breach. ESO Solutions made the news first, reporting 2.7 million patient records stolen from their emergency response software. HealthEC was featured in our reporting soon after, announcing a 112k record data breach from their health analytics platform. Welltok’s MOVEit event also appeared, continuing the consequences of the global incident. Fidelity’s LoanCare appeared in the latter half of the week—announcing a 1.3 million borrower breach. Finally, National Amusements, the parent company of Paramount and CBS, announced a data breach impacting 82k—but it happened over a year ago. Find more about each breach below.

ESO Solutions Inc.

ESO Solutions is a developer and analytics solution for emergency services; they connect agencies, fire departments, hospitals, and state response offices. The information they collect comes from various sources, including patients. The data’s 2.7 million leaked records involve names, Social Security Numbers (SSNs), phone numbers, residential addresses, diagnosis and treatment data, insurance and medical record numbers, and claims payer information. Those exposed to this breach must act immediately to protect their identity and medical accounts.

HealthEC LLC.

HealthEC compiles information about patients using AI-assisted technology. The collected data provides the patient with the best options for their situation and availabilities. The data stolen in this event includes over 18 medical providers. The data exposed in this event differs between individuals and organizations; it includes patient names, addresses, birthdays, SSNs, taxpayer IDs, medical records, medical information, health insurance details, and billing information. Although the current impact figure sits around 112k, this number comes from the Maine Attorney General’s office and is subject to change. 

Welltok: EmblemHealth, OSF HealthCare System, Yale New Haven Health

It wouldn’t be a week in cybersecurity breaches without a MOVEit entry; Welltok appeared again in the news, with three more entities impacted by the MOVEit event. In May, MOVEit announced a zero-day vulnerability allowing cybercriminals into their clients’ systems. Welltok is a health and wellness vendor that uses MOVEit, and other organizations subsequently use them. The stolen data in this breach differs between patients and institutions. However, it most commonly includes names, dates of birth, treatment information, health insurance data, provider names, and some cases of SSNs. Nearly 2 million patients have had their data compromised in this event. 

LoanCare, LLC. 

LoanCare is a Fidelity National Financial sub-servicing solution. They assist providers and homeowners with finance and data functions. LoanCare reported suspicious activity to Fidelity, prompting both entities to launch security defenses. Both systems shut down, but the assailants still obtained an estimated 1.3 million data records. The information belongs to LoanCare borrowers, including names, SSNs, addresses, and loan numbers. Investigations may result in a higher impact figure overall if the assailants accessed the files of other sub-servicers through Fidelity’s systems. Victims at risk due to this breach must invest in identity, financial, and account monitoring services; these will alert the data owner to suspicious activity as soon as it happens.

National Amusements

The parent company of CBS and Paramount, National Amusements’ breach happened a year ago, around December 15th, 2022. The assailants stole the data of 82k people, including their names, financial account details, credit and debit card numbers, and associated permissions. The public has only just learned of the breach because of NA’s intensive threat response; consequently, those exposed to this breach must react immediately.