Week of October 24, 2022: Medibank says every customer's data was accessed, and OpenSSL flags a critical fix

What mattered to security leaders in the week of October 24, 2022? Australian insurer Medibank said on October 26 that attackers had accessed the personal data of all its customers plus large amounts of health claims data, a sharp reversal of its earlier assurances, and Australian Clinical Labs disclosed a separate breach affecting 223,000 people. The OpenSSL project also warned that a fix for a critical flaw in version 3.0 would ship on November 1, giving teams days to find where they ran it.

Medibank: attackers reached personal data for every customer

Medibank's October 26 update said the ransomware intruders had accessed personal data for all Medibank, ahm and international student customers, along with significant amounts of health claims data. The insurer had evidence that some data had been removed and warned that the number of affected customers could grow substantially. The previous week it had told its 2.8 million customers there was no evidence customer data had been accessed or exfiltrated. The swing is a case study in why early breach statements should be framed as provisional. (BleepingComputer)

Australian Clinical Labs discloses a Medlab breach affecting 223,000 people

On October 27 Australian Clinical Labs disclosed that a February 2022 attack on its Medlab Pathology business exposed medical records and other sensitive information for 223,000 people. Its notice listed 128,608 Medicare numbers with full names, 28,286 credit card numbers and 17,539 medical and health records tied to pathology tests. The Quantum ransomware gang had claimed the attack and posted the stolen files on its Tor site on June 14, 2022. ACL said it had notified Australia's cyber centre and privacy regulator earlier in the year. (BleepingComputer)

OpenSSL preannounces a critical fix in version 3.0.7

The OpenSSL Project said it would release OpenSSL 3.0.7 on November 1, 2022, to fix a vulnerability it rated critical, its highest severity, reserved for flaws that affect common configurations and are likely to be exploitable. Versions before 3.0 were not affected. Because the library is embedded in operating systems, web and mail servers, network appliances and industrial systems, the advance notice kicked off inventory work across many organizations. When the release shipped on November 1, the severity had been downgraded. (Help Net Security)

Apple patches its ninth exploited zero-day of the year

Apple fixed CVE-2022-42827, an out-of-bounds write in the iOS and iPadOS kernel that a malicious app could use to run code with kernel privileges, and said it was aware of a report that the flaw may have been actively exploited. The fix arrived in iOS 16.1 and iPadOS 16, alongside patches for 19 other CVEs, and Apple later extended it to the iOS 15 branch. Help Net Security counted it as the ninth time in 2022 that Apple patched an exploited zero-day. Mobile device management policies that enforce prompt updates carry real weight at that pace. (Help Net Security)

Microsoft ties Raspberry Robin USB worm infections to Clop ransomware

Microsoft reported on October 27 that a group it tracks as DEV-0950, which overlaps with FIN11 and TA505, deployed Clop ransomware on a network previously infected with the Raspberry Robin worm. In October its researchers saw Raspberry Robin infections followed by Cobalt Strike activity and, in some cases, Truebot before Clop was deployed; since September 19 the worm had also delivered IcedID, Bumblebee and TrueBot. The pattern suggests Raspberry Robin's operators were selling access. Removable-media controls matter because the worm spreads through infected USB drives. (BleepingComputer)

CISA, FBI and MS-ISAC publish a DDoS response guide

On October 28 CISA, the FBI and the Multi-State Information Sharing and Analysis Center released a joint guide on understanding and responding to distributed denial-of-service attacks, written for both network defenders and leaders and covering proactive steps to reduce their likelihood and impact. CISA also issued a Capacity Enhancement Guide for federal civilian agencies that pointed to contract vehicles and services for DDoS protection. The pairing gave executives a plain-language primer and procurement teams a shortlist. (CISA)