Security Lessons from the Change Healthcare Ransomware Catastrophe

The $22 million paid by Change Healthcare’s parent company to unlock its systems “may have emboldened bad actors to further target the vulnerable industry,” writes Axios:
There were 44 attacks against the health care sector in April, the most that [cybersecurity firm] Recorded Future has seen in the four years it’s been collecting data. It was also the second-largest month-over-month jump, after 30 ransomware attacks were recorded in March. There were 32 attacks in February and May.

But an analysis by the security-focused magazine CSO says the “disastrous” incident also “starkly illustrated the fragility of the healthcare sector, prompting calls for regulatory action.”
In response to the attack, US politicians have called for mandated baseline cybersecurity standards in the health sector, as well as better information sharing. They have also raised concerns that industry consolidation is increasing cyber risk.

So what went wrong? The attackers used a set of stolen credentials to remotely access the company’s systems. But the article also notes Change Healthcare’s systems “suffered from a lack of segmentation, which enables easy lateral movement of the attack” — and that the company’s acquisition may have played a role:

Mergers and acquisitions create new cyber threats because they involve the integration of systems, data, and processes from different organizations, each with its own security protocols and potential vulnerabilities. “During this transition, cybercriminals can exploit discrepancies in security measures, gaps in IT governance, and the increased complexity of managing merged IT environments,” Aron Brand, CTO of CTERA told CSOonline. “Additionally, the heightened sharing of sensitive information between parties provides more opportunities for data breaches.”

And “In the end, paying the ransom failed to protect UHG from secondary attempts at extortion.”

In April, cybercriminals from the RansomHub group threatened to leak portions of 6TB of sensitive data stolen from the breach of Change Healthcare, and obtained through Nichy, according to an analysis by security vendor Forescout. An estimated one in three Americans had their sensitive data exposed as a result of the attack. Such secondary scams are becoming increasingly commonplace and healthcare providers are particularly at risk, according to compliance experts… The US Department of Health and Human Services (HHS) is investigating whether a breach of protected health information occurred in assessing whether either UHG or Change Healthcare violated strict healthcare sector privacy regulations.

Thanks to Slashdot reader snydeq for sharing the article.

Read more of this story at Slashdot.

Study Suggests Genetics as a Cause, Not Just a Risk, for Some Alzheimer’s

Pam Belluck reports via the New York Times: Scientists are proposing a new way of understanding the genetics of Alzheimer’s that would mean that up to a fifth of patients would be considered to have a genetically caused form of the disease. Currently, the vast majority of Alzheimer’s cases do not have a clearly identified cause. The new designation, proposed in a study published Monday, could broaden the scope of efforts to develop treatments, including gene therapy, and affect the design of clinical trials. It could also mean that hundreds of thousands of people in the United States alone could, if they chose, receive a diagnosis of Alzheimer’s before developing any symptoms of cognitive decline, although there currently are no treatments for people at that stage. The new classification would make this type of Alzheimer’s one of the most common genetic disorders in the world, medical experts said.

“This reconceptualization that we’re proposing affects not a small minority of people,” said Dr. Juan Fortea, an author of the study and the director of the Sant Pau Memory Unit in Barcelona, Spain. “Sometimes we say that we don’t know the cause of Alzheimer’s disease,” but, he said, this would mean that about 15 to 20 percent of cases “can be tracked back to a cause, and the cause is in the genes.” The idea involves a gene variant called APOE4. Scientists have long known that inheriting one copy of the variant increases the risk of developing Alzheimer’s, and that people with two copies, inherited from each parent, have vastly increased risk.

The new study, published in the journal Nature Medicine, analyzed data from over 500 people with two copies of APOE4, a significantly larger pool than in previous studies. The researchers found that almost all of those patients developed the biological pathology of Alzheimer’s, and the authors say that two copies of APOE4 should now be considered a cause of Alzheimer’s — not simply a risk factor. The patients also developed Alzheimer’s pathology relatively young, the study found. By age 55, over 95 percent had biological markers associated with the disease. By 65, almost all had abnormal levels of a protein called amyloid that forms plaques in the brain, a hallmark of Alzheimer’s. And many started developing symptoms of cognitive decline at age 65, younger than most people without the APOE4 variant.

Read more of this story at Slashdot.

PFAS Increase Likelihood of Death By Cardiovascular Disease, Study Shows

New submitter berghem shares a report from The Guardian: For the first time, researchers have formally shown that exposure to toxic PFAS increases the likelihood of death by cardiovascular disease, adding a new level of concern to the controversial chemicals’ wide use. The findings are especially significant because proving an association with death by chemical exposure is difficult, but researchers were able to establish it by reviewing death records from northern Italy’s Veneto region, where many residents for decades drank water highly contaminated with PFAS, also called “forever chemicals.” Records further showed an increased likelihood of death from several cancers, but stopped short of establishing a formal association because of other factors. […]

Veneto’s drinking water was widely contaminated by a PFAS-production plant between 1985 and 2018. Researchers first found an excess of about 4,000 deaths during this period, or about one every three days. Part of the region was supplied with water from a different source, giving researchers the opportunity to compare records for tens of thousands of people who drank contaminated water and lived near those who did not. Though PFAS can affect the cardiovascular system in different ways, it is largely a problem because it produces stubbornly high and dangerous levels of cholesterol. The levels are difficult to control because they aren’t caused by dietary or lifestyle choices that can be addressed with adjustments, but hormonal changes that affect the metabolism and the body’s ability to control plaque in arteries. The study’s authors suspect that post-traumatic stress disorder caused by the environmental disaster, which upended lives across the region, may also be contributing to circulatory disease. The evidence of a jump in kidney cancer was also “very clear,” [said Annibale Biggeri, the peer-reviewed study’s lead author, and a researcher with the University of Padua]. In the study’s first five years, 16 cases were recorded, while 65 were recorded in the last five years. It also found elevated levels of testicular cancer during some time periods.

The records “showed clearly” that earlier life exposures led to higher levels of mortality, except for women who have multiple children. Previous research has found levels were higher in women with only one child. The chemicals accumulate in placentas and are passed on to children during pregnancy, which reduces levels in the body. Mortality levels among women who were of child-bearing age were generally lower, but increased in older women. The chemicals will be passed down to children for generations, said Laura Facciolo, a Veneto resident who drank contaminated water. She said the findings underscore the need to ban PFAS, and the disaster’s injustice. The findings have been published in the journal Environmental Health.

Read more of this story at Slashdot.

Surgeons Perform UK’s First Operation Using Apple’s Vision Pro Headset

Surgeons in the United Kingdom have performed the first operation in the country using Apple’s Vision Pro headset. TechSpot reports: During a recent operation to repair a patient’s spine at the private Cromwell Hospital in London, a scrub nurse working alongside the surgeon used the Vision Pro to help prepare, keep track of the procedure, and choose the right tools, reports the Daily Mail. This marked the first operation in the UK where the Vision Pro was used. The software running on Apple’s headset during the operation comes from US company eXeX, which has made similar programs for Microsoft’s HoloLens. It offers nurses and technicians both holographic and touch-free access to the surgical setup and the procedural guides from within the sterile field of the operating room, according to the press release. The software also tracks each stage of an operation and can measure how well the op went compared to previous procedures performed by other surgeons.

“It eliminates human error and eliminates the guesswork,” said Suvi Verho, lead scrub nurse at London Independent Hospital. “It gives you confidence in surgery.” While this marked the first time that the Vision Pro was used during a UK surgery, the first-ever time the device was used in an operating room was last month, just three days after its release, when Orlando resident and world-renowned Neurosurgeon Dr. Robert Masson wore it during several spine reconstruction surgeries. “We are in a new era of surgery, and for the first time, our surgical teams have the brilliance of visual holographic guidance and maps, improving visuospatial and temporal orientation for each surgical team and for each surgery in all specialties,” said Masson.

Read more of this story at Slashdot.

University of Alabama Pauses IVF Services After Court Embryo Ruling

Following a recent ruling from the state supreme court, the University of Alabama at Birmingham health system said it is pausing all in vitro fertilization (IVF) treatments for fear of criminal prosecution or punitive damages. On Friday, the Alabama Supreme Court ruled that frozen embryos are “children,” entitled to full personhood rights, and anyone who destroys them could be liable in a wrongful death case. The Hill reports: “We are saddened that this will impact our patients’ attempt to have a baby through IVF, but we must evaluate the potential that our patients and our physicians could be prosecuted criminally or face punitive damages for following the standard of care for IVF treatments,” the health system said. […] It is standard practice in IVF to fertilize several eggs and then transfer one into a woman’s uterus. Any remaining normally developing embryos can be, at the patient’s request and consent, frozen for later use. But legal experts say it’s unclear if the standard practice is illegal in Alabama and could make IVF virtually inaccessible in the state.

According to the American Society of Reproductive Medicine, the best-developing embryo will be transferred into a patient for an attempt at a pregnancy while the rest are frozen for later use, in case the first one does not develop into a live birth, or the patient later desires another child. According to the Centers for Disease Control and Prevention, approximately 238,126 patients underwent IVF treatment in 2021, resulting in the births of 97,128 babies, the last year for which statistics were available. There are 453 IVF clinics nationwide.

Read more of this story at Slashdot.

Early Blood Test To Predict Dementia Is Step Closer As Biological Markets Identified

Researchers have made significant progress toward developing a blood test that can predict the risk of dementia up to 15 years before clinical diagnosis. The Guardian reports: Hopes for the test were raised after scientists discovered biological markers for the condition in blood samples collected from more than 50,000 healthy volunteers enrolled in the UK Biobank project. Analysis of the blood identified patterns of four proteins that predicted the onset of dementia in general, and Alzheimer’s disease and vascular dementia specifically, in older age. When combined with more conventional risk factors such as age, sex, education and genetic susceptibility, the protein profiles allowed researchers to predict dementia with an estimated 90% accuracy nearly 15 years before people received clinical confirmation of the disease.

For the latest study, blood samples from 52,645 UK adults without dementia were collected and frozen between 2006 and 2010 and analyzed 10 to 15 years later. More than 1,400 participants went on to develop dementia. Using artificial intelligence, the researchers looked for connections between nearly 1,500 blood proteins and developing dementia years later. Writing in Nature Aging, they describe how four proteins, Gfap, Nefl, Gdf15 and Ltbp2, were present in unusual levels among those who developed all-cause dementia, Alzheimer’s disease or vascular dementia. Higher levels of the proteins were warning signs of disease. Inflammation in the brain can trigger cells called astrocytes to over-produce Gfap, a known biomarker for Alzheimer’s. People with raised Gfap were more than twice as likely to develop dementia than those with lower levels.

Another blood protein, Nefl, is linked to nerve fibre damage, while higher than normal Gdf15 can occur after damage to the brain’s blood vessels. Rising levels of Gfap and Ltbp2 was highly specific for dementia rather than other brain diseases, the scientists found, with changes occurring at least 10 years before people received a dementia diagnosis. The researchers are speaking to companies to develop the test but said the cost, currently at several hundred pounds, would need to come down to make it viable.

Read more of this story at Slashdot.

WHO Warns Against Using Artificial Sweeteners

The World Health Organization (WHO) on Monday released guidance on non-sugar sweeteners (NSS), recommending against using them to control body weight. From the report: The recommendation is based on the findings of a systematic review of the available evidence which suggests that use of NSS does not confer any long-term benefit in reducing body fat in adults or children. Results of the review also suggest that there may be potential undesirable effects from long-term use of NSS, such as an increased risk of type 2 diabetes, cardiovascular diseases, and mortality in adults. The recommendation applies to all people except individuals with pre-existing diabetes and includes all synthetic and naturally occurring or modified non-nutritive sweeteners that are not classified as sugars found in manufactured foods and beverages, or sold on their own to be added to foods and beverages by consumers. Common NSS include acesulfame K, aspartame, advantame, cyclamates, neotame, saccharin, sucralose, stevia and stevia derivatives.

The recommendation does not apply to personal care and hygiene products containing NSS, such as toothpaste, skin cream, and medications, or to low-calorie sugars and sugar alcohols (polyols), which are sugars or sugar derivatives containing calories and are therefore not considered NSS. “Replacing free sugars with NSS does not help with weight control in the long term. People need to consider other ways to reduce free sugars intake, such as consuming food with naturally occurring sugars, like fruit, or unsweetened food and beverages,” says Francesco Branca, WHO Director for Nutrition and Food Safety. “NSS are not essential dietary factors and have no nutritional value. People should reduce the sweetness of the diet altogether, starting early in life, to improve their health.”

Read more of this story at Slashdot.

Sugar-Powered Implant Successfully Manages Type 1 Diabetes

Researchers have developed a novel fuel cell implant for type 1 diabetes that can successfully produce and release insulin when triggered. New Atlas reports: The fuel cell itself, which resembles a teabag that’s slightly larger than a fingernail, is covered in a nonwoven fabric and coated with alginate, an algae-derived product used widely in biomedicine because of its high degree of biocompatibility. When implanted under the skin, the cell’s alginate soaks up body fluid, allowing glucose to permeate the surface and flow into the power center. Inside the cell, the team developed a copper-based nanoparticle anode that splits glucose into gluconic acid and a proton to generate an electric current. “Many people, especially in the Western industrialized nations, consume more carbohydrates than they need in everyday life,” [Martin Fussenegger from the Department of Biosystems Science and Engineering at ETH Zurich] said. “This gave us the idea of using this excess metabolic energy to produce electricity to power biomedical devices.

The fuel cell was then coupled with an insulin capsule featuring the team’s beta cells, which could be triggered to secrete insulin via electric current from the implant. Overall, the two components provide a self-regulating circuit. When the fuel cell powered by glucose senses excess blood sugar, it powers up. This then stimulates the beta cells to produce and secrete insulin. As blood sugar levels dip, it trips a threshold sensor in the fuel cell, so it powers down, in turn stopping the insulin production and release. This self-sustained circuit could also produce enough power to communicate with a device such as a smartphone, which allows for monitoring and adjusting, and even has potential for remote access for medical intervention. The study was published in the journal Advanced Materials.

Read more of this story at Slashdot.