Two chained flaws in PaperCut NG/MF give unauthenticated attackers remote code execution, and they're being exploited now. The first emergency patch was bypassed, so a second shipped Friday. Here's what to do this weekend.
JadePuffer is the first ransomware attack run end-to-end by an AI agent, with no human operator. The break-in techniques were old; the operator wasn't.
Medtronic disclosed on April 24 that an unauthorized party accessed corporate IT systems. ShinyHunters claims 9 million records and terabytes of internal data. Medtronic confirms only the corporate-IT scope and says products, patient safety, and manufacturing networks are unaffected — a careful framing that healthcare IT readers will recognize.
Anubis claims 2 TB of patient data from Signature Healthcare's Brockton Hospital. Ambulances were diverted, chemo was canceled, and staff will be working off paper for two more weeks.
ChipSoft — the Dutch EHR vendor whose HiX platform runs patient records at roughly 80% of Netherlands hospitals — was hit by ransomware on April 7. Eleven hospitals disconnected, and the bigger story is the concentration risk that made this inevitable.
A ransomware attack on the University of Hawaii Cancer Center compromised Social Security numbers for 1.24 million people — roughly 85% of Hawaii's population. The university paid the ransom, waited six months to notify victims, and it's the second time the UH system has paid attackers in three years.
A ransomware attack has forced the University of Mississippi Medical Center to close all 35 clinics statewide, canceling surgeries and chemotherapy while staff revert to paper records. It's the latest in an escalating pattern of attacks that now cost the industry billions annually and measurably increase patient mortality.