Business Continuity Management / Disaster Recovery , Fraud Management & Cybercrime , Governance

A ransomware attack last fall on a company that provides billing and other business services to health plans and hospitals resulted in a breach affecting more than 600,000 individuals, according to Michigan state officials.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

The incident highlights the difficulty some organizations have in determining whether to report ransomware attacks as breaches to comply with the HIPAA Breach Notification Rule.

More than 600,000 Michigan residents may have had their information compromised in the breach at Detroit-based Wolverine Solutions Group, according to a statement from Michigan Attorney General Dana Nessel and Anita Fox, director of the state's department of insurance and financial services.

Clients Affected

Wolverine Solutions Group's clients affected by the breach include Blue Cross Blue Shield of Michigan, Health Alliance Plan, McLaren Health Care, Three Rivers Health, and North Ottawa Community Health System, the Michigan officials say.

A statement about the incident posted on Three River Health's website notes that Wolverine Solutions Group is a subcontractor to a company the hospital uses for patient collection services.

"Wolverine Solutions Group is taking full responsibility for the incident and is in the process of notifying affected patients and offering free credit monitoring and protection services," the Three River, Michigan-based hospital's statement notes.

Health Alliance Plan tells Information Security Media Group that the Wolverine incident potentially exposed information on about 120,000 of the insurer's members.

Other affected Wolverine Solutions Group clients listed in the statement from state officials did not immediately respond to a request for comment.

Wolverine Solutions Group also did not immediately respond to a request for more information, including whether additional companies or individuals in other states were also impacted by the ransomware attack.

Ransomware Attack

According to a Feb. 27 statement posted on Wolverine Solution Group's website, information potentially exposed in the breach includes names, addresses, phone numbers, dates of birth, Social Security numbers, insurance contract information and medical information. The company says it does not believe any of the personal information was extracted by the ransomware attackers.

"On approximately Sept. 25, 2018, WSG discovered that an unauthorized party gained access to its computer system and infected the system with malware. The malware encrypted many of WSG's records, which made them inaccessible, in an effort to extort money from us," the company says.

After the company learned of the ransomware incident, it began an internal investigation and hired outside forensic security experts to begin the decryption and restoration process.

"All impacted files needed to be carefully 'cleaned' of any virus remnants prior to their review by forensic investigators. Most critical programs requiring decryption were restored by Oct. 25, 2018, and WSG's critical operations were running by Nov. 5, 2018," the company's statement says.

As the forensic team continued its decryption efforts to determine the type of information that was impacted, the identities of those affected - including the company's healthcare clients and specific individuals - began to emerge, the company says.

"Beginning in November and continuing in December, January and early February, WSG discovered and was able to identify those healthcare clients whose information was impacted by the incident. The timing of our notices to impacted individuals has been based on these 'rolling' discovery dates," the company says.

The first notices were mailed on Dec. 28, 2018, while additional notices were mailed in February and further notices are being sent in March, the company says.

"As a result of our investigation, WSG believes that the records were simply encrypted. There is currently no indication that the information itself was extracted from WSG's servers. Nevertheless, given the nature of the affected files ... we mailed letters to all impacted individuals recommending that they take immediate steps to protect themselves from any potential misuse of their information."

As of Wednesday, the Department of Health and Human Services' HIPAA Breach Reporting Tool website, which tracks health data breaches impacting 500 or more individuals, did not contain any breach report entries that appear to be related to the Wolverine Solution Group incident.

Reportable Breaches Under HIPAA?

Despite HHS Office for Civil Rights guidance issued in 2016 advising that most ransomware attacks result in breaches that must be reported under the HIPAA Breach Notification Rule, many covered entities and business associates hit with ransomware attacks still struggle in their breach assessments of those incidents.

"The question of when to report a ransomware event under HIPAA is very tough," says privacy attorney Adam Greene of the law firm Davis Wright Tremaine.

"The OCR ransomware guidance indicates that organizations should consider lack of availability when determining whether an incident is a reportable breach, but there is no consensus on how much weight this factor should be given. As a result, organizations come to very different conclusions regarding whether a ransomware incident, where evidence indicates no exfiltration of data, is reportable."

Kate Borten, president of privacy and security consulting firm The Marblehead Group, offers a similar perspective.

"Most PHI ransomware cases need to be treated as a HIPAA breach, unless forensic examination clearly shows no data exfiltration," she notes.

"But that analysis may take time and money. And even then, the organization may not have retained logs sufficient to make a solid case for no exfiltration. That's the challenge of proving a negative."

Determining Factors

Keith Fricke, principal consultant at tw-Security, says several factors affect the determination of whether a ransomware attack resulted in a reportable health data breach. The difficulty in determination "depends on what level of audit logging and retention of logs exists in an organization," he notes.

"Having logged events to refer back to can help determine the likelihood of a breach due to ransomware. Reviewing firewall logs can help identify if ransomware exfiltrated data. It also matters if the organization is inspecting some of its encrypted outbound traffic," Fricke says.

"Data-exfiltrating malware often extracts sensitive information over outbound encrypted channels. Without the necessary inspection in place, an organization may not be able to tell what specific information may have been exfiltrated."

Taking Action

In recent years, ransomware attacks on business associates have affected a variety of healthcare clients, and, in some cases, disrupted those vendors' own operations (see: Recent Ransomware Incidents Serve Up Lessons).

What steps can covered entities take to prevent becoming victims to ransomware or other cyberattacks on their vendors?

"Covered entities should prepare for PHI stored by a BA to be unavailable, and plan on how they will operate without such PHI," Greene suggests.

"Also, covered entities can consider as part of their due diligence asking questions about data backup plans, testing of recovery plans and network segmentation to avoid corruption of backups in a ransomware event."

Vendors need to be more transparent with their customers about their security practices, Fricke says. "Many CEs still have BAs sign the required HIPAA business associate agreement but do nothing further to assess the risks of doing business with that vendor," he notes.

But many healthcare organizations have relatively little control over these vendor-related risks, Borten warns.

"Most covered entities lack the resources and will to closely manage their business associates," she notes. "While vetting new BAs is essential, once the relationship is established, it's not realistic to imagine CE oversight that would prevent ransomware attacks."

Cybercrime , Fraud , Fraud Management & Cybercrime

A newly discovered variant of the long-running Ursnif banking Trojan is able to better evade security protection and has the ability to steal not only financial information but also email user accounts, the content of inboxes and digital wallets, researchers report.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Researchers at Cybereason first noticed the new Ursnif campaign earlier this year. The Trojan, which also goes by the name Gozi, has been around for more than 10 years, but it has become more popular since 2015, when someone posted the source code on Github.

Since then, malicious actors have tweaked the code to meet their needs, and several variants of Ursnif have appeared - mainly attacking banks and other financial institutions. Researchers at Cybereason found the new variant by monitoring customer data and other information from January and February.

In this latest campaign, which Cyberseason analysts describe in a March 12 blog post, the Trojan has only been spotted in Japan, and the full extent of these attacks is still under investigation.

Assaf Dahan, a security researcher with Cybereason, tells Information Security Media Group that the actors behind these types of Trojans generally know which banks and which customers they want to target.

Targeted Attacks

While other versions of Ursnif have been observed in attacks elsewhere, including the U.S., Brazil, Asia and Europe, the new version has been customized to target Japanese-speaking bank customers, according to Cybereason.

"It's in the interest of the attackers to make the target as deliberate as possible," Dahan said. "If by accident, this malware reaches someone in Brazil, or an American laptop, it simply wouldn't run. They wouldn't want to waste their time targeting an audience that they could not make money from. ... In addition to social engineering, the malware makes sure that the computer settings are in Japanese."

As banking security has hardened and more customer have used mobile banking apps, attackers have switched to using Trojans such as Ursnif to steal other types of data, including email configurations, as well as credentials and passwords stored in web browsers and even digital wallets, according to Cybereason.

"You put in the hard work of infiltrating a system or infecting a machine, and you make sure you bypass all the security products - why would you only steal banking information?" Dahan asked. "There are other things, such as personal information, that can be sold later in the black market for a lot of money. If they are already there, they might as well collect all the information that they can get their hands on. ... With this variant, it's much more focused on stealing other information, especially email information."

If Ursnif embeds within a corporate network, it has the potential to steal internal emails, which may contain proprietary information that can either be sold or used to create a larger footprint within the network, Dahan added.

How It Starts

Attacks using the latest version of Ursnif start with a phishing attack. In many cases, a phishing email is sent to a victim that contains a malicious attachment - typically an Excel spreadsheet. If the victim clicks on an "Enable Content" button, they will not see the spreadsheet; rather an embedded macro code, which contains PowerShell commands, is then downloaded, according to Cybereason.

The commands also ensure that the infected PC has Japanese country settings.

The PowerShell code then downloads an image from an image-sharing website. The attackers use steganography to hide their intent, Cybereason reports.

A Stealthy Campaign

One of the new features within this Ursnif variant is what researchers deem a stealthy persistence mechanism, or "last minute persistence." This is a method of trying to install the malicious payload in the shortest time possible to avoid detection by security software.

"This malware, unlike other versions, changes its persistence to be stealthy," Dahan said. "In previous versions, they just write this key and drop their files and configure the file to run as soon as the machine boots, or when the user logs into the machine. But since it's written on a disk or in Windows registry, it's easy to detect if you know where to look for it. In this variant, you wouldn't see it because it simply does not exist on the disk. At the very last minute, when the PC shuts down, it will create its persistence. When the user logs back in, in a fraction of a second, it then deletes that persistence and removes any evidence from the disk."

Once the infected PC is turned back on, the full attack starts.

The initial payload hidden in the PowerShell code is another Trojan called Bebloh - also known as URLZone and Shiotob - which is used as a downloader that runs a number of tests to ensure that it's running within the system and not an isolated virtual machine being used as a sandbox. If the coast is clear, the main Ursnif malware begins downloading and then can start stealing credentials, passwords and data.

Dahan noted that researchers are starting to notice more of these types of attacks using two different types of Trojans. In the latest campaign tracked in Japan, the attackers coupled Ursnif with Bebloh because Bebloh is better at detecting sandboxes and helps to ensure that the attack is carried out without detection.

It's not clear what group may be behind the new variant Ursnif. And, so far, it's only appeared in Japan, Dahan says. But that could change.

Banking Trojan Surge

Ursnif is one of thousands of banking Trojan in use - and the numbers keep increasing. A recent report from Kaspersky Lab found that in 2018, 889,452 users of the company's security tools were attacked by banking Trojans. That's an increase of about 16 percent from 2017.

Of all the Trojan attacks recorded in 2018, 24 percent were within the corporate sector, which includes not only employees giving away banking and other data, but also malware allowing cybercriminals to compromise financial resources, Kaspersky found.

Cybersecurity , Governance , Privacy

Retired RSA Chairman Art Coviello is optimistic about the rise of privacy and the progression in how enterprises secure their critical, expanded networks. But he also has significant concerns.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

In a video interview with Information Security Media Group at RSA Conference 2019 in San Francisco, Coviello discusses:

Coviello has more than 30 years of strategic, operating and financial management experience at high-technology companies and is one of the most recognized figures within the cybersecurity industry. He became CEO of RSA Security Inc. in 2000 and continued to lead the company following the acquisition by EMC in 2006 until he retired as executive chairman in 2015. Coviello has played a leading role in several national cybersecurity initiatives, including as a founding board member of the Cyber Security Industry Alliance, and has served as an adviser to key government agencies as well as public-private initiatives. He is currently a partner at Rally Ventures.