Normal view

There are new articles available, click to refresh the page.
Today — 26 June 2026Main stream

Colorado Health Network Notifies Patients of Last Year’s Breach—But Key Details Remain Undisclosed

By: Dissent
25 June 2026 at 12:23
In August 2025, DataBreaches added the Colorado Health Network (CHN) to our non-public worksheets after threat actors called Cephalus added the provider to its’ dark web leak site with a claim that they had acquired 900 GB of data. Cephalus disappeared from public view days later, and never leaked the data on any server that...

Source

Federal court rules Trump election-focused executive order illegal

By: djohnson
25 June 2026 at 12:16

A federal judge in Massachusetts struck down major sections of a Trump administration executive order  that would have restricted mail-in ballots through the U.S. Postal Service and required states to adopt federally approved voter lists.

The ruling Thursday from Judge Indira Talwani of the U.S. District Court of Massachusetts found those parts of the order were unconstitutional, while declaring another section that directs federal law enforcement agencies to investigate and prosecute noncompliant state and local officials legally nonbinding.

Talwani wrote that the U.S. Constitution empowers States and Congress in different roles but “does not grant the President any specific power over elections.”

While the White House has cited the 2002 Help America Vote Act (HAVA) and Civil Rights-era voting laws as justification, Talwani found those laws do not authorize the government to regulate state voter registration practices.

“Notably, nowhere in HAVA does Congress prescribe who should be included on State voter lists,” Talwani wrote. “Further, neither in HAVA nor any other federal statute does Congress authorize the federal government to create their own voting database. Instead, Congress, consistent with the Constitution, has left that authority to the States alone.”

Talwani also declined to remove President Trump and Commerce Secretary Howard Lutnick as named defendants in the suit, rejecting the administration’s argument that the court could not regulate or intrude upon the president’s’ constitutional authority “in the performance of his official duties.”

“Contrary to Defendants assertion, Presidential action is not inherently unreviewable,” Talwani wrote.

The order, issued in March, instructs the Homeland Security secretary, the director of U.S. Citizenship and Immigrations Services and the commissioner of the Social Security Administration to compile lists of American voters for each state, including their supposed citizenship status.

To build the lists, the agencies would rely on the controversial Systemic Alien Verification for Entitlements (SAVE) database that DHS has been building under the Trump administration, as well as Social Security and federal citizenship and naturalization records.

Those lists would then be sent to states, most of which have already refused similar Trump administration efforts to control voter registration.. The order instructs the Department of Justice to investigate  and prosecute  state and local election officials who issue  ballots to ineligible voters. 

The order also requires mail-in ballots to be sent in special barcoded envelopes for tracking. Crucially, it demands states provide lists of voters eligible for mail-in voting, and threatens to deny ballots to states that refuse. It also claims the attorney general is entitled to withhold federal funding from noncompliant states.

Talwani found that states have shown they already have a rigorous voter registration and verification process to ensure non-citizens and other ineligible voters aren’t able to vote in U.S. elections, and have laws in place to investigate and prosecute those who do.

Executive branch lawyers argued the order was merely an internal federal directive that does not impedestate authorities. But Talwani noted that states like Connecticut were already pulling staff from critical activities, such as translating election materials required under the Voting Rights Act, to develop compliance plans for the order.

Nearly half of the states in the lawsuit have already purchased mail-in ballots for this election cycle that are out of compliance with the Postal Service’s envelope and design standards.

Despite a string of losses in the courts and Congress, the White House has continued to assert broad authority over the way states and localities administer elections.

The Department of Justice has sued dozens of states to force them to hand over sensitive voter data. In the 10 cases decided so far, states have won every one.

In their opinions, judges cited the executive branch’s lack of inherent authority to create state voter lists. Others accused the DOJ of misusing Civil Rights-era laws designed to protect Black and minority voters,  creating an “unreliable” database that would disenfranchise  legitimate voters.

The Massachusetts ruling comes to the same conclusion, with Talwani writing “it is clear that the federal agencies charged with compiling Confirmed Citizen Lists lack the ability to create complete and accurate lists of the U.S. citizens residing in every State.”

On Wednesday, Trump canceled a signing ceremony for a bipartisan housing bill in an attempt to pressure  congressional Republicans to pass the SAVE America Act, which would implement many of the same changes to U.S. elections. In a Truth Social post, Trump said he considered passage of the bill to be a “National Emergency.”

The post Federal court rules Trump election-focused executive order illegal appeared first on CyberScoop.

Before yesterdayMain stream

Two men, believed to part of Scattered Spiders, plead guilty over £39m TfL cyber attack

By: Dissent
22 June 2026 at 15:17
Two members of Scattered Spider, who were arrested in 2024 and 2025, have reportedly changed their pleas to guilty just before their trials were set to begin. Victoria Collins reports: Two men have pleaded guilty to offences in connection with a massive cyber attack which caused Transport for London (TfL) months of disruption and cost...

Source

Xsolis breach affected 1,396,519 of its clients’ patients

By: Dissent
22 June 2026 at 12:04
Xsolis, Inc. is a business associate in the healthcare sector, providing utilization and case management services. They describe themselves as applying “industry-leading AI and automation to ensure appropriate care settings and accelerate collaboration across a connected network of providers and payers.” On June 19, California Attorney General’s Office posted a copy of a breach notification...

Source

Cherry Health provides preliminary notice of recent data breach

By: Dissent
22 June 2026 at 11:22
On April 19, 2026, Cherry Health in Michigan detected suspicious network activity. Investigation revealed that an unknown person or persons had gained access to its network and copied data. On June 18, Cherry Health published a preliminary notice on its website.  The notice makes no mention of any earlier reporting on the incident that had...

Source

Two Data Breaches Didn’t Sink Novo Nordisk’s Stock. Why Not?

By: Dissent
21 June 2026 at 12:27
June was a challenging month for Novo Nordisk regarding cybersecurity and intellectual property protection. The pharma giant allegedly had some of its data — including intellectual property — stolen by two independent groups of threat actors. Unaware of each other, each group claimed to have acquired a large amount of valuable information. One demanded $25...

Source

Blue Fish Pediatrics notifies 41,485 Texans about data breach last year

By: Dissent
18 June 2026 at 20:58
Ahmed Humble reports that 41,485 Texans may have had personal and protected health information exposed in a data breach involving a Houston-based Blue Fish Pediatrics. The breach reportedly occurred between July 11 and July 17, 2025, but patients are only first being notified now. The types of information included: Full names Dates of birth Social...

Source

Amazon-Owned One Medical Faces Alleged 8.8TB Data Breach

By: Dissent
18 June 2026 at 20:58
Emily Hill reports: One Medical, the primary care provider acquired by Amazon in 2023, is facing questions after the cybercriminal group ShinyHunters claimed it stole 8.8 terabytes of company data and threatened to publish the information unless negotiations begin by June 22. The allegation remains unverified, and the group has not released any sample data to support...

Source

HHS’ Office for Civil Rights Settles Ransomware Investigation with Spencer Gifts Health Plan for $450k, Corrective Action Plan

By: Dissent
18 June 2026 at 20:56
The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today announced a settlement with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans (the Plan), the employer-sponsored group health plan of Spencer Gifts LLC, a national retail company, over potential violations of the Health Insurance Portability and Accountability Act of...

Source

UK: More than one year later, HCRG is first notifying patients of ransomware attack

By: Dissent
18 June 2026 at 13:32
In February 2025, after the Medusa ransomware gang claimed responsibility for an attack on the UK healthcare provider HCRG Care Group, HCRG confirmed it had been breached but would only say it was investigating. While they remained silent, SuspectFile obtained and reported on data provided to them by Medusa. SuspectFiles‘s reporting made it clear that...

Source

Hospital worker suspected of accessing Princess of Wales’s medical records to face prosecution

By: Dissent
17 June 2026 at 12:05
Russell Myers reports: A hospital worker at the private clinic where the Princess of Wales had abdominal surgery is set to face a criminal prosecution following an investigation into claims that the Princess’ medical records had allegedly been accessed by staff in 2024, it is understood. A total of three trusted employees, who worked at The...

Source

IE: HSE fined €300,000 after Tullamore hospital data breach

By: Dissent
17 June 2026 at 07:47
Louise Hickey reports: The HSE has been fined €300,000 by the Data Protection Commission (DPC) over a breach of patient’s personal data in 2018 at the Midland Regional Hospital, Tullamore. The Data Protection Commission has announced its final decision on the fine following an inquiry into a ransomware attack on the laboratory information system in...

Source

One threat actor demanded $50 million from Novo Nordisk. Another one demanded $25 million. Neither got paid.

By: Dissent
16 June 2026 at 14:24
Yesterday, DataBreaches reported that FulcrumSec had hacked Danish pharmaceutical giant Novo Nordisk. FulcrumSec followed up on that reporting by releasing their own very detailed report on their dark web leak site about the incident and what they had acquired. This morning, DataBreaches woke up to find messages waiting on Signal from someone claiming they, too, had hacked...

Source

Scoop: FulcrumSec Leaks Novo Nordisk Data After $25M Demand Goes Unpaid (2)

By: Dissent
15 June 2026 at 20:51
Danish pharma giant Novo Nordisk disclosed a cybersecurity incident last week, and although the firm’s name may not be familiar to everyone, they are a major producer of insulin and semaglutide. Semaglutide is marketed as Wegovy for weight loss and Ozempic for Type 2 diabetes. In its June 11 update, the firm stated that the...

Source

Novo Nordisk reports data breach, tells clinical trial patients to ‘remain vigilant’

By: Dissent
14 June 2026 at 09:51
Eric Sagonowsky reports: As cybersecurity threats have proliferated across industries in recent years, biopharma companies have emerged as prominent targets, with intellectual property, patient data and other sensitive information at stake. Now, Novo Nordisk is the latest drug giant to report a data breach. In a Thursday incident notice, Novo said it recently identified a security...

Source

Labcorp reaches $35M settlement over American Medical Collection Agency breach

By: Dissent
12 June 2026 at 15:32
Do you remember the horrific American Medical Collection Agency (Retrieval-Masters Creditors Bureau Inc.) breach in 2019?  You can refresh your memory by scrolling through the Related posts below this one, but TL;DR: LabCorp was one of AMCA’s clients that was affected by the breach, and in July 2019, they notified HHS that 10,251,784 patients had...

Source

Women’s health advocacy organization prepares mass suit against Clinical Diagnostics

By: Dissent
11 June 2026 at 11:29
In July 2025, the Nova ransomware gang stole cervical cancer screening data on 850,000 women held by Clinical Diagnostics (“Eurofins”). The lab paid them an undisclosed ransom amount, but that has not been the end of the lab’s problems. In May 2026, the Dutch Health and Youth Care Inspectorate concluded that the laboratory had failed...

Source

ZA: Confidential medical records of 3,000 South African Police Service officers leaked

By: Dissent
9 June 2026 at 13:12
Genevieve Serra reports: In a shocking breach of privacy, the confidential medical records of almost 3 000 local police officers have been leaked among staff, raising serious concerns about the security of sensitive data within the South African Police Service (SAPS). With an independent investigation currently taking place, the matter has prompted a widespread call...

Source

JP: Hokkaido hospitals data leak may hit 510k, HDDs sold online blamed

By: Dissent
8 June 2026 at 16:53
NHK News reports: Japan’s National Hospital Organization says hard drives from two hospitals in Hokkaido were listed on auction sites, resulting in a leak of personal information from at least 180,000 patients and employees. The group warns that the leak could potentially affect up to 510,000 people. Last June, the Hokkaido Medical Center — part...

Source

Essex NHS hospitals records compromised in cyber attack

By: Dissent
8 June 2026 at 08:38
Mason Lewsey reports: Thousands of Essex patient records were compromised in a cyber attack linked to a major NHS data breach, MSE has confirmed. Mid and South Essex NHS Foundation Trust revealed that around 2,380 patient test records were stolen in the attack, which affected data held by third-party provider Synnovis. The trust operates Southend...

Source

❌
❌