• Non-sensitive/public regulatory information
• Craneware employee data
• Customer and partner data

John Bruggeman, vCISO at CBTS, comments, “In incidents like this, the initial compromise is only part of the story. Healthcare technology providers are highly appealing targets. Healthcare sits in a position of trust between multiple organizations and often hold information attackers would have to target multiple organizations to steal directly. Healthcare Personal Information and electronic versions of HPI is data that carries value beyond its normal PII: patient information often includes additional details like drivers license, insurance information, payment information, all of which can be used by attackers for insurance fraud, medical identity theft, even tax fraud and synthetic identity creation. All of which are harder to detect because the attacker has real context.

“The bigger concern is how did the attacker get in and what could the attacker do after getting in? Was it a compromised credential, unpatched vulnerability, 3rd party breach? Did the security team have enough visibility to detect and contain the activity quickly?

“Compromising one provider can open a path to data from multiple targets by the attacker. That’s another reason medical environments are such valuable targets for criminals. A trusted connection turns into real risk when vendors hold more access than they need, or when organizations can’t quickly flag behavior that falls outside the norm. Attackers know the path of least resistance often runs through the partner that connects multiple organizations, not the largest single target. Now the healthcare environment can become the path for the attacker, and become the bad third party.

“Third-party risk cannot be treated as a one-time approval process any longer. Organizations need to understand the security implications of every vendor relationship, including how access is granted, how it is monitored, and how quickly it can be restricted when something changes. The goal is not just preventing a compromise, but limiting the impact when one occurs.”

At this time, neither company nor customer service operations have been disrupted. Furthermore, there are no lingering indicators of compromise.