Brightline Hack Exposes Data of Over 780,000 Child Mental Health Patients
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-0669 | Pre-Authentication Deserialization RCE in Fortra GoAnywhere MFT Fortra (formerly HelpSystems) GoAnywhere MFT is vulnerable to pre-authentication remote code execution (CWE-502) in the License Response Servlet, which deserializes an attacker-controlled object without validating it. An unauthenticated attacker who can reach the exposed administrative interface can send a crafted serialized object to the servlet and trigger code execution on the server. Successful exploitation gives the attacker the ability to run arbitrary code in the context of the application, which has been leveraged for ransomware operations. All organizations running GoAnywhere MFT with the affected component reachable by untrusted networks are in scope. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-02-10, ransomware use is confirmed, and EPSS puts the 30-day exploitation probability at 100%. Do: Apply the vendor's updates for GoAnywhere MFT immediately, per Fortra's instructions, as required by the CISA KEV catalog. Until patched, restrict or block untrusted/internet access to the administrative interface hosting the License Response Servlet, and review logs for signs of exploitation given confirmed in-the-wild and ransomware use. | 7.2 | 100% | KEV ransomware PoC ×3 |
| moderate≈1,000–10,000 internet-exposed GoAnywhere MFT instances (public internet scans of the exposed administrative interface) |
Full article320 words · extracted from infosecurity-magazine.com · click to collapse
Pediatric mental health provider Brightline has warned patients that their data may have been compromised as a result of a breach related to a zero-day vulnerability in Fortra's GoAnywhere MFT secure file-sharing platform.
“Through its investigation, Fortra states that it identified a previously-unknown vulnerability which an unauthorized party used to gain access to certain Fortra customers’ accounts and download files, including ours,” reads the notice.
Brightline said its investigation determined the incident was limited to the Fortra service and did not impact its network. However, the data stolen from the breach included patients’ confidential information.
“[This] potentially [includes] some combination of the following data elements: individuals’ names, addresses, dates of birth, member identification numbers, date of health plan coverage, and/or employer names,” the company wrote.
According to Bleeping Computer, these attacks were conducted by the Clop ransomware gang using the command injection vulnerability CVE-2023-0669.
Read more on the vulnerability and Clop here: Clop Ransomware Group Exploits GoAnywhere MFT Flaw
“The fact that this exploit led to patient data leakage from Brightline's environment is very telling of the current state of information security in the healthcare industry,” commented David Benas, an associate principal consultant at the Synopsys Software Integrity Group.
Writing to Infosecurity in an email, Brightline said that the company acted immediately upon notification from Fortra, and confirmed with Fortra (whose system the vulnerability was on) that the Brightline-specific instance had been remediate. The company also noted that Clop never compromised Brightline’s systems, but Fortra's solution.
Regardless, James Graham, VP of RiskLens, said healthcare industry members are often targeted by threat actors, which means healthcare organizations need to be exceptionally sure of their cybersecurity investments.
“Part of this is performing quantitative risk assessments using the FAIR standard to provide an overview of risk in terms of probability and cost, allowing for security investments to be made more efficiently.”
Article updated on 05/05/2023 with Brightline Comments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/brightline-hack-exposes-data/