From the cyber breaches front, Health IT Security reports on the latest healthcare breaches.

From the cybersecurity justice front —

The Washington Post informs us,

• “Former Uber chief security officer Joe Sullivan avoided prison Thursday as he was sentenced for covering up the 2016 theft of company data on 50 million Uber customers while the company was being investigated by the Federal Trade Commission over a previous breach.
• “Sullivan had been convicted in October of obstruction of justice and hiding a felony, making him the first corporate executive to be found guilty of crimes related to a data breach by outsiders.
• “U.S. District Judge William Orrick sentenced Sullivan to three years of probation, noting his significant past work in protecting people from the sort of crime he later concealed. He also said that Sullivan’s steps had succeeded in keeping the stolen data from being exposed.
• “Orrick said he felt former Uber chief executive Travis Kalanick was equally responsible for what he considered a serious offense, and he wondered aloud why Kalanick had not been charged. The judge also said he was influenced by the unprecedented nature of the case, warning that future offenders would be jailed, even if they were the pope.”

Cybersecurity Dive tells us,

• “A New Jersey appellate court upheld a prior ruling in favor of Merck, a major pharmaceutical company embroiled in a closely watched case involving $1.4 billion in claims stemming from the 2017 NotPetyacyberattack.
• “The court agreed Monday that insurers could not deny coverage under war exclusion language contained in the policies, saying the circumstances didn’t apply in the Merck case. 
• “The decision is considered a major victory for companies seeking claims for cyberattacks at a time when hackers linked to rogue nation-states have stepped up threat activity through supply chain attacks, ransomware and other malicious threats.”

From the cyber vulnerabilities front, the Cybersecurity and Infrastructure Security Administration added three more known exploited vulnerabilities to its catalog.

Cybersecurity Dive points out “three areas of generative AI the NSA is watching in cybersecurity.
Generative AI is a “technological explosion,” NSA Cybersecurity Director Rob Joyce said. While it is a game-changing technology, it hasn’t delivered quite yet.”

From the ransomware front —

Cyberscoop relates that “Victims’ reluctance to report ransomware stymies efforts to curb cyberattacks, say federal officials. Federal officials say they need more victims to report when they’ve been hit by ransomware in order to better defend against the problem.”

Here is a link to Bleeping Computer’s latest Week in Ransomware.

• “This week’s ransomware news has been dominated by a Royal ransomware attack on the City of Dallas that took down part of the IT infrastructure.
• “The attack occurred early Monday, affecting the Dallas Police dispatch system and the public library’s computer network. Additional systems, including the City’s website, were shut down as time passed.
• “On Wednesday, the City’s network printers began printing ransom notes from the attack. BleepingComputer obtained a screenshot of this note, allowing us to identify that the Royal ransomware operation was behind the attack.”

From the cyber defenses front, Cybersecurity Dive notes

• “Google rolled out a feature Wednesday that allows account holders to create passkeys, part of a wider move to phase out passwords across the industry.
• “Passkeys are stored on local computers or mobile devices, reducing the risk of credentials being hacked through a phishing attack. Passkeys allow users to sign into apps and sites the same way as they would access their devices, such as a face scan or fingerprint. 
• “Dashlane separately announced a feature called passwordless login on Wednesday, which means users of the password manager will no longer need to create a master password to access the service.”