The new cybersecurity startup is focused on helping companies prepare and respond to a "cyber crisis" by consolidating the three Rs: readiness, response, and recovery.

Source: Jacob Lund via Alamy Stock Photo

Organizations are increasingly focused on resiliency — the ability to adjust and keep operating during an ongoing attack as well as to mitigate and recover as quickly as possible. But one of the reasons organizations struggle with response and recovery is due to poor communication among stakeholders. It takes time to find out who needs information and what level of detail they need. And then there is the delay waiting for stakeholders to make decisions on next steps and how to proceed.

Cytactic is a new cybersecurity startup that aims to consolidate crisis readiness, response, and recovery into a software-as-a-service (SaaS) platform. The Cytactic platform provides security teams with a simplified, orchestrated, step-by-step methodology involving relevant stakeholders, the company said. The platform also recognizes that businesses react and respond differently to incidents and so offers a variety of business profiles and risk landscapes.

The company did not provide specifics on how the platform consolidates the various activities, how organizations will use the platform as part of their incident-response planning, or how the platform will be used during an active incident.

Making it easier to provide relevant information to affected stakeholders and speeding up decision-making can help mitigate — or avert — issues resulting from an incident. Gartner recently noted that organizations that focus on synchronized readiness and management in their incident-response preparation increase their chances for a successful outcome.

"Conducting incident response planning and having a formal third-party contingency plan increased third-party cyber risk management effectiveness by 42% and 43%, respectively," according to Gartner.

Cytactic launched on July 10 with the announcement of a $16 million seed funding round led by Evolution Equity Partners. The company's founder, Nimrod Kozlovski, is a former venture capitalist.

**About the Author(s)**

Cytactic Focuses on Stakeholder Communication to Boost Incident Response

Russian hacktivists claim DDoS attacks against basic tourist websites. Is it real, or just smoke and mirrors?

Source: Hemis via Alamy Stock Photo

Against the backdrop of the upcoming Paris Olympics, Russian hacktivists have claimed denial-of-service (DoS) attacks against a few notable French websites.

For months now, the news media has warned of both physical and cyber threats to the upcoming Olympic Games. The fears are well-founded: Any major event these days is a target, and prior Olympics have seen their fair share of incidents.

A potential opening salvo rang out in June, Cyble notes in a new report, when the Russian hacktivist groups HackNeT and the People's Cyber Army claimed a series of distributed DoS attacks on their social media channels. The Sandworm-linked People's Cyber Army referred to the attacks as mere "training."

**Pre-Olympics DDoS Attacks**

On June 23, the hacker collectives posted a series of screenshots of victim websites, and website uptime monitoring tools to demonstrate their downing.

At 8:30 UTC, for example, the People's Cyber Army claimed an attack on the website of the La Rochelle International Film Festival. Shortly thereafter, HackNet published news of another attack against the site for the Grand Palais. Cyble labeled these many claims as "possibly true" but couldn't confirm their legitimacy.

The pattern of targeting relatively mundane websites belonging to popular tourist attractions fits neatly into a picture of amateurish hacktivists seeking attention.

"I think it's mostly about being recognized as a formidable player in this whole space of cyber hacktivism — being seen taking up causes, and appearing to be fighting for it," says Kaustubh Medhe, head of research and intelligence at Cyble. "You have to keep your voice heard and be in the headlines all the time. And it's also a chance for groups to gather more mass support."

The People's Cyber Army in particular has historically done quite well on those fronts. Though it's only just over two years old, its Telegram channel sports more than 50,000 subscribers.

**Cyber Threats to the Paris Olympics**

When it comes to the myriad cyber threats to the Paris Olympics, "I delineate between risks that are scary, and those that are more of a nuisance," says Bojan Simic, co-founder and CEO of HYPR.

"Nuisance types of scenarios are: the Olympics app doesn't work and people don't know where the next event is and it's annoying. And taking down specific events from TV or streaming," he says. Politically motivated hacktivism against static websites — of the kind so boasted about by HackNet and the People's Cyber Army — also falls under this banner.

The problem, Medhe warns, is that nuisances can provide a screen for more ambitious attacks. "There have been instances in the past where DDoS attacks are a distraction to throw off a security team, to focus them on something less important, while some other threat groups are trying to get in some other way, and there is a more advanced attack in progress," he says.

Besides physical threats to athletes and fans, advanced cyber attacks might take the form of a major data breach, such as when Russia's Fancy Bear stole sensitive medical data on athletes at the 2016 games in Rio. This was a major interference, like the Olympic Destroyer attack at Pyeongchang 2018 that disrupted broadcasting, ticketing, various Olympics websites, and Wi-Fi at the host stadium. Attacks might also take some other form not yet seen at prior Games.

"I think they're generally reasonably well prepared," Simic says of the Olympic committee this time around, "but I think their preparations are going to be largely based off of previous attacks. I think they've been on the lookout for DDoS attacks, making sure that they have the ability to automatically scale the environment if they need to, to make sure that disruptions are minimized. Their ability to stop newer attacks is to be seen.

"We haven't really seen organizations adapt to modern, AI-based attacks involving malware and social engineering. That gives me some discomfort around the Olympic Committee being able to stop \[certain\] attacks."

**About the Author(s)**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

'Trial' DDoS Attacks on French Sites Portend Greater Olympics Threats

The cybercrime group demands ransoms of varying degrees, from thousands to even millions of dollars — in some cases, 2 bitcoin per encrypted customer.

Source: ronstik via Alamy Stock Photo

SEXi ransomware group, a cybercrime group that has targeted a variety of organizations in attacks that started in February of this year, has been operating under the name of APT Inc. since June.

The group uses a leaked Babuk encryptor to target VMware ESXi servers, and a leaked LockBit 3 encryptor to target Windows servers.

Now, having rebranded, the group continues to use its original methods of encryption as it wreaks havoc on new victims, requesting ransom demands that vary from thousands to millions dollars.

Some victims have publicly shared their experiences with the APT Inc. attacks, such are sharing ransom notes like the following:

"You got hacked! We are APT INC; Go to https://getsession\[dot\]org/; download & install; then add 05c5dbb3e0f6c173dd4ca479587dbeccc1365998ff9042581cd294566645ec7912 to your contacts and send us a message with this codename - - - > GARAKLY; You gave 1 week to pay, then your decryptor will be deleted," stated one ransom note. "The longer you wait the more money you will have to pay. Don't involve 3rd parties — they can't help you, they will charge you money for nothing, moreover, we always tell them to fuck off; Are you the admin? Talk to your boss right now !!!"

Currently, there are no known weaknesses to Babuk and LockBit 3 encryptors, and there is no free method to recovering the files. 

**About the Author(s)**

SEXi Ransomware Rebrands as 'APT Inc.,' Keeps Old Methods

A malicious Telegram bot is the key to a veritable flourishing garden of nefarious cybercriminal activity, which was discovered via a series of Python packages.

Source: Picturebank via Alamy Stock Photo

A sprawling criminal network has emerged in Iraq, linked to a Telegram bot that dates back to 2022 and contains more than 90,000 messages, mostly in Arabic.

According to researchers at Checkmarx, the bot is the key to a larger, sophisticated cybercriminal ecosystem, including a thriving underground marketplace offering social media manipulation services and financial theft tools, and a suite of malicious PyPI packages that exfiltrate user data.

**Malicious PyPI Packages for Data Theft**

A series of malicious, Arabic-language Python packages recently surfaced on the Python code repository PyPI according to Checkmarx, uploaded by a user named "dsfsdfds." Upon further examination, the researchers found them to contain a malicious script that was pilfering sensitive user data out to a Telegram bot chat.

"The malicious script … begins by scanning the user's file system, focusing on two specific locations: the root folder and the DCIM folder," according to the report, released today. "During this scanning process, the script searches for files with extensions such as .py, .php, and .zip files, as well as photos with .png, .jpg, and .jpeg extensions."

The packages also contained a hardcoded Telegram ID and token, which Checkmarx researchers used to gain direct access to the attacker's Telegram bot, where they discovered "a significant history of activity, with records dating back to at least 2022, long before the malicious packages were released on PyPI."

Ultimately, the 90,000 messages pointed to an origin in Iraq, with ties with many other bots to boot. In all, it's clear that Iraq is home to a heretofore unknown, thriving cybercriminal enterprise with a raft of illicit services on offer.

"The discovery of the malicious Python packages on PyPI and the subsequent investigation into the Telegram bot have shed light on a sophisticated and widespread cybercriminal operation," the report concluded. "What initially appeared to be an isolated incident of malicious packages turned out to be just the tip of the iceberg, revealing a well-established criminal ecosystem based in Iraq."

The discovery underscores the role that open source software continues to play when it comes to providing an attack vector for compromising enterprise information, the researchers noted, adding that they plan to release further details on the Iraq underground discovery in the coming months.

"As the fight against malicious actors in the open-source ecosystem persists, collaboration and information sharing among the security community will be critical in identifying and thwarting these attacks," they said. "Through collective effort and proactive measures, we can work towards a safer and more secure open-source ecosystem for all."

**About the Author(s)**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Well-Established Cybercriminal Ecosystem Blooming in Iraq

The breach affects older customer information involved in purchases made from June 6, 2017, up until July 30, 2018.

Source: Robert K. Chin - Storefronts via Alamy Stock Photo

This morning Rite Aid, an American drugstore chain, revealed news of falling victim in a data breach last month in what it called a "limited cybersecurity incident."

On June 6, a third-party threat actor impersonated a company employee and gained access to certain company systems. This unauthorized access was detected soon after, and the company launched an investigation to determine the scope of the breach and whether any data was compromised.

Though the company has determined that no Social Security numbers, financial information, or patient information was affected in the breach, the threat actors did acquire data connected to purchases of retail products, including names, addresses, dates of birth, and driver's licenses or government IDs.

The company has not released an official statement revealing who the threat actors are, but RansomHub gang has claimed that it breached the company's systems.

"While having access to the Rite-Aid network, we obtained over 10GB of customer information equating to around 45 million lines of people's personal information," the ransomware group said on its Dark Web leak site. "This information includes name, address, dl\_id number, DoB, Rite Aid rewards number."

Rite Aid reportedly stopped negotiating a ransom, prompting the ransomware group to share snippets of what it claims is stolen data as proof and add a two-week deadline before more information will be leaked.

**About the Author(s)**

Rite Aid Becomes RansomHub's Latest Victim After Data Breach

Good risk management is necessary to protect customers, ensure operational continuity, safeguard intellectual property, and maintain fiscal responsibility.

Source: Ron Buskirk via Alamy Stock Photo

COMMENTARY

Manufacturers have been feeling urgency around cybersecurity for several years — and it's little wonder given their sector remains the No. 1 ransomware target. Ransomware attacks threaten to affect manufacturers by interrupting operations that ripple through supply chains, leading to significant financial losses through ransom payments, revenue decline, and recovery costs.

Despite the looming threats, there is a notable shortage of cybersecurity professionals who can shield manufacturers from bad actors. But with the proper training and tools, manufacturers can still implement a strong security posture, even if they don't have a security expert on staff. Let's drill down on how can manufacturers can bolster their cybersecurity defenses and, should an attack occur, steps they should take to control the damage.

**Considerations for Securing the Entire Ecosystem**

Small to midsize manufacturing businesses are especially vulnerable to cyber threats due to a lower level of preparedness as compared to enterprises, unprotected data, and willingness to pay ransoms. Strengthening cybersecurity is crucial for product safety, quality assurance, and operational efficiency. For instance, implementing stringent controls on industrial control systems (ICS), operational technology (OT), and enterprise resource planning (ERP) systems can reduce vulnerabilities.

With a comprehensive risk management strategy, manufacturers can protect end customers, ensure operational continuity, safeguard intellectual property, and maintain fiscal responsibility. However, even with robust preventive measures, the possibility of a cyberattack remains. Therefore, manufacturers need to be prepared to identify risks.

**Warning Signs of Ransomware**

Timing is critical when assessing cyber threats in manufacturing, and early detection is the most effective way to prevent ransomware. The longer a breach goes undetected, the more damage attackers can inflict on production lines, supply chains, and intellectual property. Fortunately, even lean manufacturing IT teams can implement robust defense measures without the need for a dedicated cybersecurity expert.

In manufacturing, common warning signs include unusual activity on the network segments that control machinery, production lines, or ERP systems. Another common indicator is unusual network traffic, which can mean that someone has external data access or is conducting other malicious activities within the system. Manufacturers might notice unexpected data transfers from supervisory control and data acquisition (SCADA) systems or other critical OT components.

Consider a scenario where a manufacturer notices an unusual spike in network traffic late at night when production lines are typically idle. This anomaly could indicate an unauthorized party is attempting to transfer data or conduct other malicious activities. Other red flags include unauthorized administrative activities, such as installing programs without official approval or user sign-ins from unusual locations or unfamiliar devices.

Recognizing these warning signs is crucial for early detection and prompt response, preventing minor breaches from turning into major incidents. However, if a ransomware attack occurs, act quickly and efficiently to mitigate damage and begin recovery.

**What to Do in the Event of an Attack**

If hackers strike, manufacturers should take these critical steps to prevent significant damage and begin the recovery process:

1.  Isolate impacted systems: Immediately identify and isolate compromised systems — including production machinery, assembly lines, SCADA systems, or ERP software — from the network. If isolation is not possible, shut them down to prevent further spread.
    
2.  Create an incident document: Maintain and update a document to log discoveries and affected systems — e.g., computer numerical control (CNC) machines, robotic systems, or programmable logic controllers (PLCs) — and coordinate response efforts across the team.
    
3.  Examine detection systems: Review existing detection systems — such as antivirus, endpoint detection and response (EDR), security, information, and event management (SIEM), and intrusion prevention (IPS) systems — for signs of compromise, such as newly created accounts, or indications of persistence mechanisms. This process should include checking logs from ICS and OT monitoring tools.
    
4.  Report the incident: Contact agencies, such as the US Cybersecurity and Infrastructure Security Agency (CISA), your security vendors, the FBI, or the US Secret Service for assistance and to report the attack. Additionally, inform industry-specific bodies or associations that may provide support.
    
5.  Coordinate communication: Work with communications staff to ensure accurate information is shared internally and externally, according to the company's corporate communications guidelines. Use nonstandard communication methods (e.g., phone calls and encrypted messaging apps) to avoid alerting attackers. Notify key stakeholders, including suppliers and customers, about potential impacts on production schedules.
    
6.  Rebuild and restore systems: Prioritize and rebuild critical systems, focusing on restoring manufacturing operations, such as manufacturing execution systems (MES), human-machine interfaces (HMI), and other essential production control systems. Issue password resets for affected accounts and restore data from offline encrypted backups to ensure the integrity and availability of production data.
    
7.  Document lessons learned: After the incident is under control, document your insights and update organizational policies, plans, and procedures accordingly. Conduct a post-incident review to identify gaps in the response and improve resilience against future attacks. Include lessons learned about specific manufacturing processes and impacted technologies.
    

Manufacturing organizations and professionals know the urgency required to address cybersecurity threats. By recognizing early warning signs, responding swiftly to incidents, and strengthening their cybersecurity posture, manufacturers can protect themselves against the growing wave of attacks, allowing the industry to build resilience and ensure the continuity of critical manufacturing processes.

**About the Author(s)**

CTO and Co-Founder, Blumira

Matt is CTO and Co-Founder of Blumira, a leading cybersecurity provider of automated threat detection and response technology. At Blumira, he leads the security and engineering efforts to provide actionable insights into cybersecurity risks at scale. Matt has over 10 years of experience in IT, Information Security, and Software Engineering, focusing on business strategy, architecture, compliance, threat detection and penetration testing. Previously, he was Director of Security Services, Development & Security at NetWorks Group, responsible for defensive information security and services.

How Manufacturers Can Secure Themselves Against Cyber Threats

Careful planning and proactive measures can ensure smooth and secure transitions, paving the way for a successful merger or acquisition.

Source: Mohd Izzuan Roslan via Alamy Stock Photo

COMMENTARY

Mergers and acquisitions (M&As) are exciting ventures, but they come with their share of challenges, especially in the realm of cybersecurity. Integrating systems, data, and cultures from two distinct organizations can introduce various cybersecurity risks that can impact both the transaction and the future operations of the newly combined entity.

**7 M&A Cybersecurity Risks and Tips for Dealing With Them**

Here are the top seven cybersecurity risks commonly associated with M&As, and suggestions on how to mitigate each.

1.  Data breaches: The integration phase in an M&A significantly increases the risk of data breaches. As systems and data from two different organizations are merged, vulnerabilities can be exploited, leading to unauthorized access. To combat this challenge, organizations should adopt a phased integration approach and maintain continuous security monitoring. It's also critical to have a solid incident response plan ready to quickly address any potential breaches.
    
2.  Limited due diligence: Skipping a thorough assessment of the cybersecurity posture of the acquisition target can lead to inheriting unresolved security issues or even ongoing breaches. As such, organizations should perform detailed cybersecurity audits and assessments during the due diligence process. This approach helps uncover and fix any existing vulnerabilities or breaches before they become a problem.
    
3.  Integration challenges: Combining IT systems can be complex and may create security gaps. In particular, differences in security architectures, policies, and practices between the two organizations can lead to vulnerabilities. By developing a detailed integration plan that includes security protocols and standards, organizations can ensure a smooth and secure merging of IT systems, addressing potential security gaps proactively, instead of reactively.
    
4.  Compliance issues: Each company involved in the merger may be subject to different regulatory requirements for data protection and privacy. And, what's more, ensuring the merged entity meets all legal standards can be challenging. Organizations should conduct a comprehensive compliance review to identify all regulatory requirements. They should also create a compliance roadmap to ensure the merged entity meets all necessary legal and regulatory standards.
    
5.  Insider threats: The M&A process can create uncertainty and discontent among employees, increasing the risk of insider threats, such as intentional data leaks or sabotage. Because of this, organizations should implement robust insider threat monitoring and establish clear communication channels to address employee concerns. Reducing uncertainty can help mitigate the risk of insider threats.
    
6.  Legacy systems: Supporting outdated or unsupported technology within the merged entity can pose significant security risks, as these systems are often more vulnerable to cyberattacks. To solve this problem, organizations should prioritize the assessment and modernization of legacy systems. Ensuring these systems are properly secured until they can be replaced or updated will significantly reduce vulnerabilities.
    
7.  Resource allocation: Resources may be spread thin during an M&A, leading to neglected cybersecurity practices or delayed incident responses. Involvement of multiple third parties, such as consultants and advisers, can also increase the risk of data exposure. Organizations can get ahead of this issue by allocating dedicated resources for cybersecurity during the M&A process. They also need to ensure that third-party partners adhere to strict security standards and practices to maintain data security.
    

Navigating the cybersecurity risks in mergers and acquisitions can be daunting, but with careful planning and proactive measures, it's possible to ensure a smooth and secure transition. By following the suggestions above, organizations can mitigate risks and pave the way for a successful merger or acquisition.

**About the Author(s)**

Chief Innovation Officer, Axiad

Bassam Al-Khalidi is the chief innovation officer at Axiad. He is an industry expert with more than 20 years of experience designing and deploying identity and access management solutions across large government, enterprise, and healthcare organizations. He is a leading expert in authentication, CAC/PIV smart card, and PKI deployment, and has been involved in multiple enterprise-class authentication deployments over the past several years.

7 Tips for Navigating Cybersecurity Risks in M&amp;As

PRESS RELEASE

Lineaje, a leader in continuous software supply chain security management, today announced that Lineaje SBOM360 has been selected by the Department of the U.S. Air Force’s (DAF) for a Small Business Technology Transfer (STTR) Phase 1 contract. As the industry’s first software supply chain and software bill of materials (SBOM) manager, SBOM360 will automate the detection and remediation of today’s most pressing software supply chain challenges within the U.S Air Force.

In the past year alone, more than 75% of software supply chains were exposed to cyberattacks —and 40% of organizations took a month or longer to recover. Due to the sensitivity of the data in applications built and bought by the U.S. Air Force and other federal entities, these organizations are often a top target for today’s adversaries.

SBOM360 supports the full life-cycle management of software that is sourced, built, sold, or bought by the U.S. Air Force. With our solution, the U.S. Air Force can ensure all software supply chain risks and threats are identified and remediated and meet organizations’ security policies and compliance mandates, such as Executive Order 14028, automatically. In addition, the U.S. Air Force will be able to search its software in seconds to find any newly discovered vulnerabilities and indicators of compromise (IOCs) within the most deeply embedded components, dramatically reducing discovery time. Lineaje generates a full lineage of software and discovers inherent and tampers risks by scanning source code, containers, mobile APKs, POM files, and even SBOMs. Lineaje can also generate SBOMs as well if you don’t already have one.

“Being selected for the STTR Phase 1 contract program is a testament to Lineaje’s commitment to revolutionizing the software supply chain security space,” said Javed Hasan, CEO and Co-founder, Lineaje. “SBOM360’s innovative and comprehensive approach will empower the U.S. Space Force and Department of the Air Force to fortify their defenses against cyberthreats. We are extremely proud to play a pivotal role in safeguarding the nation’s critical software infrastructure.”

The STTR Contract Program

The DAF began offering the competitive, awards-based Open Topic Small Business Innovation Research (SBIR)/STTR program in 2018 to expand the range of innovations the DAF funded. The programs are designed to encourage domestic small businesses to engage in federal research and development.

Recently, the Air Force Research Laboratory and SpaceWERX, the innovation arm of the U.S. Space Force, partnered to streamline the SBIR and STTR process by accelerating the small business experience through a faster proposal to award timelines, changing the pool of potential applicants by expanding opportunities to small businesses, and eliminating bureaucratic overhead by continually implementing process improvement changes in contract execution. By completing Phase I of the program, Lineaje has established the scientific, technical, and commercial merit and feasibility of SBOM360’s innovation.

To learn more about SBOM360, please visit www.lineaje.com/sbom360.

You May Also Like

Lineaje Awarded Contract by the Department of the US Air Force

PRESS RELEASE

BROWNWOOD, Texas, June 26, 2024 /PRNewswire/ -- Landmark Admin, LLC ("Landmark"), is providing notice of a recent data security incident. Landmark is a third-party administrator for life insurance carriers and may have received certain personal information from producers, insureds, policy owners or policy beneficiaries for insurance policies which Landmark administered.

What Happened?

On or about May 13, 2024, Landmark detected suspicious activity on its system and later learned that an unauthorized third party accessed its network. Upon discovery of this incident, Landmark immediately disconnected indicated systems and remote access to the network and promptly engaged a specialized third-party cybersecurity firm and IT personnel to assist with securing the environment, as well as to conduct a comprehensive forensic investigation to determine the nature and scope of the incident. While the forensic investigation remains ongoing, Landmark found evidence to suggest some of its files may have been compromised by an unauthorized third-party.

Based on these findings, Landmark began reviewing the affected systems to identify the specific individuals and the types of information that may have been compromised.

What Information Was Impacted? 

The following information may have been subject to unauthorized access: first name/initial and last name; address; Social Security number; tax identification number; driver's license number/state-issued identification card; passport number; financial account number; medical information; date of birth; health insurance policy number; and life and annuity policy information.

The information varies by individual. Affected individuals will be notified by mail of information that was impacted.

What Remediation Measures Were Taken?

Landmark takes the privacy and security of personal information seriously. Since the discovery, Landmark moved quickly to investigate and secure its systems. Landmark has taken steps to further enhance its network security, and took steps, and will continue to take steps, to mitigate the risk of future harm.

What Steps Can Individuals Take?

Landmark encourages everyone to remain vigilant against incidents of identity theft by reviewing their account statements and monitoring their credit reports for any suspicious activity. Individuals can obtain free copies of their credit reports by going to the following website: www.annualcreditreport.com or by calling them toll-free at 1-877-322-8228. (Hearing impaired consumers can access their TDD service at 1-877-730-4204.)

You can also obtain more information from the Federal Trade Commission (FTC) about identity theft and ways to protect yourself. The FTC has an identity theft hotline: 877-438-4338; TTY: 1-866-653-4261. They also provide information on-line at www.ftc.gov/idtheft.

Other Important Information: 

If you have questions about the Incident not addressed in this notice please call the help line at 1-844-428-5109 and representatives are available for 90 days from the date of this letter to assist you between the hours of 8:00 a.m. to 8:00 p.m. Eastern time, Monday through Friday excluding U.S. holidays.

Landmark sincerely regrets any concern or inconvenience this matter may cause and remains dedicated to ensuring the privacy and security of all information in our control.

Landmark Admin, LLC Provides Notice of Data Privacy Incident

PRESS RELEASE

MOUNT KISCO, N.Y., June 26, 2024 /PRNewswire/ -- The Mount Kisco Surgery Center LLC d/b/a The Ambulatory Surgery Center of Westchester ("ASCW"), has learned of a data security incident that may have impacted data belonging to certain current and former employees and patients.

On November 3, 2023, ASCW discovered unusual activity in one employee's email account. Upon discovering this activity, it immediately took steps to secure the account. ASCW also engaged a digital forensics and incident response firm to conduct an investigation to determine why any data within the mailbox may have been affected. The investigation determined that certain files stored within the email accounts were accessed between October 23, 2023, and November 3, 2023.

ASCW then undertook a comprehensive review of the potentially affected data. On May 30, 2024, ASCW identified that certain individuals' personal and/or protected health information was contained in the account. The potentially affected information may include individuals' names, Social Security numbers, driver's license or state identification numbers, dates of birth, medical information, including diagnosis information, treatment information, and prescription information, and health insurance information, including claim information and health insurance ID numbers, and financial account information. On June 26, 2024, ASCW provided written notification of the incident via US mail to impacted individuals.

ASCW has implemented additional measures to enhance network security and minimize the risk of a similar incident occurring in the future.

ASCW has established a toll-free call center to answer questions about the incident and to address related concerns. Call center representatives are available Monday through Friday between 9am – 9pm EST and can be reached at 1-888-715-8252. 

ASCW is located at 34 S. Bedford Rd., Mount Kisco, NY 10549.

SOURCE The Mount Kisco Surgery Center LLC d/b/a The Ambulatory Surgery Center of Westchester

You May Also Like

Source

DARKReading