Week of March 11, 2024: HHS opens a Change Healthcare HIPAA probe, and EU lawmakers pass the AI Act

What mattered to security leaders in the week of March 11, 2024? The HHS Office for Civil Rights opened an investigation into whether Change Healthcare and parent UnitedHealth Group complied with HIPAA after the ransomware attack that disrupted billing across US healthcare, and the European Parliament approved the AI Act by 523 votes to 46. The FCC also adopted its voluntary Cyber Trust Mark for connected devices, and MarineMax filed an Item 1.05 incident report.

HHS civil rights office investigates Change Healthcare and UnitedHealth

On Wednesday, March 13, the Office for Civil Rights at the US Department of Health and Human Services published a letter opening an investigation into the ransomware attack on Change Healthcare, which had disrupted billing and care operations at hospitals, clinics and pharmacies for weeks. Director Melanie Fontes Rainer said the inquiry would examine whether protected health information was compromised and whether Change Healthcare and UnitedHealth Group met HIPAA rules. The letter followed a Tuesday White House meeting with industry and UnitedHealth's chief executive. (The Record)

European Parliament passes the AI Act

The European Parliament voted through the EU's AI Act on Wednesday, March 13, with 523 in favor, 46 against and 49 abstentions. The law sorts AI systems by the harm they could cause, from low-risk tools such as spam filters to high-risk uses in critical infrastructure, and bans an unacceptable-risk tier outright. Its rules phase in over two years after a final legal-linguistic check and endorsement by the European Council. Security and risk teams deploying AI in the EU gained a concrete compliance timeline to plan against. (The Record)

FCC approves the voluntary U.S. Cyber Trust Mark

At its open meeting on Wednesday, March 13, the Federal Communications Commission voted unanimously to approve a voluntary cybersecurity labeling program for wireless consumer Internet of Things products. Manufacturers whose devices meet NIST-developed criteria, covering items such as unique default passwords, data protection, software updates and incident detection, may display the U.S. Cyber Trust Mark. For enterprises, the label offers a quick screening signal for devices that end up on corporate and home-office networks. (The Record)

MarineMax files an Item 1.05 report on unauthorized access

Boat retailer MarineMax filed a Form 8-K on March 12 under Item 1.05, saying it determined on March 10 that a third party had gained unauthorized access to parts of its information environment. Containment steps disrupted a portion of the business, though operations continued in all material respects, and the company said the affected environment did not hold sensitive data. MarineMax said the incident had not materially affected operations and it was still assessing any financial impact. (MarineMax, SEC Form 8-K)

French government services hit by attacks of "unprecedented intensity"

The French prime minister's office said on Monday, March 11, that several government agencies had faced intense cyberattacks beginning Sunday night, carried out with familiar technical means at unprecedented intensity. The Record noted that the description matched distributed denial-of-service activity, which floods servers but cannot steal data, and that the government did not attribute the attacks. Public-facing service owners had another reminder to test upstream DDoS protection before a crisis. (The Record)

NHS Dumfries and Galloway reports a focused, ongoing cyberattack

NHS Dumfries and Galloway, the health board for Scotland's southernmost region of just under 150,000 people, announced on Friday, March 15 that it was the target of a focused and ongoing cyberattack that could disrupt services. Its patient update page referred to incursions into its systems and warned that hackers may have acquired a significant quantity of data. The Scottish Government, Police Scotland and the National Cyber Security Centre were informed. The nature of the attack was not disclosed. (The Record)

IMF says 11 email accounts were compromised in February

The International Monetary Fund said on Friday, March 15 that a cyber incident detected on February 16 led to the compromise of 11 IMF email accounts. With outside experts, it determined the nature of the breach, took remediation steps and re-secured the accounts, and said it had no sign of further compromise at that point. A spokesperson declined to confirm attribution or say what information was accessed. (The Record)