◆ A former hospital worker in Arizona was sentenced to 54 months in prison and ordered to pay restitution after pleading guilty to two felony counts involving identity theft and health information disclosure. In the plea deal, Rico Prunty acknowledged he accessed medical intake forms, copied protected health information and personal identifying information of more than 300 individuals, and forwarded the forms to co-conspirators in Indiana. The information was used to open financial accounts in the names of those individuals without their knowledge, authority or permission, the plea agreement states. Over the course of the scheme—which took place between July 2014 and May 2017—Prunty illegally accessed the individually identifiable health information of nearly 500 patients, resulting in a total loss of $132,521.98, according to the Department of Justice. Prunty originally faced nine felony counts, including one count of conspiracy to commit identity theft, seven counts of aggravated identity theft, and one count of HIPAA violation. Three co-conspirators previously were sentenced for their roles in the scheme to prison terms ranging from 121 months to 154 months.^[1]

◆ The federal Health Sector Cybersecurity Coordination Center (HC3) is urging health care organizations to prioritize defenses against the cybercriminal group FIN11, which often runs high-volume operations mainly targeting companies with CLoP ransomware. “The group has targeted pharmaceutical companies and other health care targets during the COVID-19 pandemic and continues to target the health sector,” HC3 said in a bulletin. “The group is behind multiple, high-profile, widespread intrusion campaigns leveraging zero-day vulnerabilities. It is likely that FIN11 has access to the networks of far more organizations than they are able to successfully monetize, and choose if exploitation is worth the effort based on the location of the victim, their geographic location, and their security posture.” HC3 said it could not determine exactly how many and which CLoP ransomware attacks have been propagated by FIN11; however, it said it has observed around 30 incidents involving CLoP ransomware in the U.S. health care sector since 2021. FIN11 has been involved in exploiting the MOVEit Transfer secure managed file transfer software zero-day vulnerability, HC3 said. “HC3 recommends that healthcare organizations consider FIN11 a top priority for their security teams,” the agency said.^[2]