IT and Security Guidance for Ohio Practices

Weekly Briefing • September 4, 2026

None of the three incidents we tracked this week involved anyone breaking in. In every one, the person who got hit did the install. A web page asked an employee to paste one line into Windows, and they did. A recruiter asked a target to load a meeting app for an interview, and the app was a remote-control tool. And nineteen browser extensions that did exactly what they advertised, one of them for about 80,000 users, turned into credential grabbers through a routine automatic update nobody was asked to approve.

There is no attachment to filter and no exploit to patch in any of that, which is the point. Here's what happened, and what it means for how your firm runs.

The Employee Ran the Attacker's Command Themselves

Huntress documented the current run of ClickFix attacks, and the mechanism is worth knowing by name because it is built to get past every filter you have. A web page shows a fake "verify you're human" check, or a broken-file error, or a download prompt, and it walks the visitor through opening the Run box (Windows key + R) and pasting what's on the clipboard. The page already put the command there. All the person does is press a few keys. There is no attachment for the mail filter to strip and no download for endpoint protection to block, because your employee typed a command into their own computer, and that is exactly what it looks like.

What runs is an infostealer. It reads every saved password and every session token out of the browser, usually in under a minute, and sends them out. The session token is the part that changes the math. It isn't a password to guess. It's the record of a login your employee already completed, second factor and all, and replaying it in another browser produces a signed-in session with no MFA prompt at all. Since most firms have put email, files, and the finance and HR systems behind one Microsoft or Google login, one harvested token opens all of them at once. The theft happens on the workstation in seconds. The damage happens in the cloud, hours or days later, from somewhere else, and it looks like your employee logging in.

Huntress describes what that kind of access turns into once someone holds it. A small real estate firm had MFA on every account except the CEO's, removed at his own request. The attacker sat in that mailbox and learned how he wrote to his finance team: a customer name, an account number, an amount, and a one-word confirmation back. Then they copied the pattern and sent a test payment comfortably under $1,000. It cleared. The amounts climbed until the CEO noticed the balance looked wrong and asked for a transaction list, and finance sent back the emails he had supposedly written. One personal exception, and the business almost missed payroll; every other control was in good shape. Two things follow for your firm. The accounts that ask for an MFA exception are usually the ones with payment authority, and the exception is where this lands. And if an account is ever compromised, changing the password does not sign the attacker out. The active sessions have to be revoked first, or the reset closes a ticket while the intruder keeps working. The full chain and the identity controls that break it: Identity Hardening Controls That Blunt ClickFix and Credential Abuse.

The Remote-Access Tool Was Genuine. Nobody Authorized It.

Huntress and AnyDesk's fraud team traced a set of scam call-center operations, several of them in Kolkata, running their fraud through the same remote monitoring and management software an IT company uses: cracked, self-hosted ScreenConnect servers resold to other crews as branded subdomains, alongside AnyDesk. The way onto the victim's machine is a conversation. Matt Caldwell, AnyDesk's director of fraud prevention, got the lure in his own inbox: a fake Pepsi recruiter asking him to download a meeting app for the interview. The app was a cracked remote-control client. No exploit and no malware in the usual sense, just a believable reason to run an installer and a pretext the target would rather not mention to anyone who might stop it. Huntress puts remote-access-tool abuse up 277% last year and finds it in almost 40% of the incidents its response team investigates, which makes it the number one threat they track across roughly five million endpoints.

The reason it works is that a rogue install is identical to a legitimate one: the same signed installer from the vendor, the same folder on disk, the same connection back to the vendor's relay servers. Antivirus has nothing to object to. In one case Huntress worked, a user clicked a ScreenConnect lure in February and the operator didn't sign in until July. The tool sat there for five months, because a remote-access client on a business PC doesn't look out of place. When the operator finally connected, they worked inside the user's own session: the browser, the mailbox, new inbox rules to hide replies, and a run of spam from the firm's own domain pushing a second remote tool at new targets. That outbound mail is what tripped the alert.

Now think about what's on the screen of the person who takes that call at your practice: the bank portal, the payment approval queue, the one-time code they type while the operator watches, patient or client records open in another window. If a wire goes out from a session your own employee started, the bank has a strong argument that the instruction was legitimate, and the loss tends to stay with you. And if regulated records were visible during the session, your counsel may have to treat that as access to the data, which can put you into notification territory with nothing copied. The fix is a decision before it is a product: name the one remote-support tool your IT provider uses, and treat any other one on a workstation as an incident rather than a maintenance ticket. The detection and response sequence is in the full breakdown: Attackers Abuse AnyDesk and ScreenConnect RMM Tools for Remote Access.

The Extension You Approved Last Year Isn't the One You Have Now

Socket's researchers identified nineteen browser extensions, eighteen in the Chrome Web Store and one in Microsoft's Edge store, carrying code that steals credentials, session cookies, and cryptocurrency wallet data. The crypto angle gets the headline and probably doesn't touch your practice. The mechanism does. The operator built fourteen of the extensions from scratch and bought the other five from their original developers, and those five had real users and worked exactly as advertised until a new version arrived with the payload. The largest, Enable Right Click & Copy, has about 80,000 users across Chrome and Edge. Chrome updates extensions automatically by default, so the poisoned build landed on every one of those users with no click, no warning, and no new permission prompt.

Once active, the code strips the security headers from every page the browser loads and injects its own scripts: a form grabber that captures whatever gets typed into any login page, account stealers for Facebook and LinkedIn, a browser-history collector, and a fake browser-update prompt that walks the user through pasting a command, the same trick as the first story. An extension with access to all sites reads the authenticated pages your staff already have open, which means whatever they're signed into: practice management, webmail, the payroll portal. No password is needed, because the extension is inside the session. We flagged a banned extension that had reappeared in the Web Store in the August 15 briefing; this is the same lesson at scale. A store listing tells you an extension was clean when it was reviewed and nothing about who owns it now. Removal from the store doesn't uninstall it from the machines that already have it, and no signal fires anywhere when a developer sells. The durable fix is an allowlist on managed devices, so nothing installs or updates without someone looking at it first. All nineteen extension IDs and the removal steps: 19 Malicious Chrome and Edge Extensions Steal Wallet Data and Drain Crypto.

Also on Our Radar This Week

GTG-1002 Abuses Claude Code While EchoLeak Hits Microsoft 365 Copilot — the half of this that matters for a practice is EchoLeak: a single crafted email, read by Microsoft 365 Copilot during a routine summary, pulled data out of OneDrive, SharePoint, and Teams with nobody clicking anything (rated 9.3 out of 10). Microsoft fixed it on their side. What they didn't fix is that Copilot reads everything the user's account can technically open, including the shared folders nobody remembers granting access to, so if you've turned it on, the permissions cleanup comes first.

Rhysida Ransomware Hits Berlin State Network as City Refuses to Pay — Berlin refused, and the operators posted a claim of 5.79 terabytes across roughly 1.44 million files. The route documented for this group includes a Microsoft domain-controller flaw patched in August 2020 that still works wherever the fix was installed but the enforcement setting was never switched on, so a patch report can say done and be wrong. Seven days passed between the first reported outflow and the network being cut off; decide now who in your firm makes the pay-or-don't call, so nobody is working it out that week.

DPRK IT Workers Tied to FAMOUS CHOLLIMA Use Astrill VPN and IPRoyal Proxy — Huntress has helped identify five suspected North Korean nationals hired into partner companies so far this year, in IT, sales and marketing, and medicine. Nobody broke in; HR sent the offer letter and IT shipped the laptop. The tell in one case was a new hire who wouldn't turn the camera on or show the room. If you hire remote staff, cameras on for every interview round, and ship equipment only to an address you've verified yourself.

Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.

Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.

Weekly Briefing • August 28, 2026

Three of the incidents we tracked this week are the same con in different clothes: the attacker shows up as someone your staff already trusts with computer problems. A phishing kit poses as the Microsoft 365 sign-in page and lets your real MFA do its work before stealing the result. A malware crew opens a Microsoft Teams chat as "the IT help desk" and offers a cleanup tool. And the extortion group that just breached Apollo Global Management got in the way it has been getting into law firms and financial firms all summer — a phone call from "IT support." Nobody exploited a firewall. They asked.

Here's what happened, and what each one is asking of your firm.

The Phishing Kit That Lets Your MFA Succeed First

Mirage2FA is a commercial phishing toolkit that researchers at ANY.RUN have linked to activity against 4,532 organizations' email domains between 2024 and 2026, most of them in the United States. Across the campaign they recorded more than 9,000 potential compromise events, and assessed that 48% of the email addresses it targeted were potentially compromised. Roughly half. Not the single-digit click rates most phishing math assumes.

The mechanism is why it works so well. The victim clicks an emailed link and lands on what looks like the Microsoft 365 sign-in page. It is actually a relay: everything the victim types passes through to the real Microsoft login, which validates the real password, sends the real MFA challenge, and — once the victim approves it — issues a real session cookie. The toolkit keeps a copy of that cookie. Replayed into the attacker's browser, it opens an already-signed-in Microsoft 365 session with everything the account can reach: mailbox, OneDrive, SharePoint, and any application connected through single sign-on. There is no failed-login spike to notice, because every login succeeded.

In the last briefing the pattern was systems doing exactly what they were built to do while nobody got an alert. This is that pattern aimed at the login itself: Microsoft validated a genuine password and logged a genuine sign-in. The habit that beats it costs nothing — when a login page arrives by emailed link, you close it and sign in the way you always do, from your own bookmark or by typing the address. A sign-in prompt you navigated to is yours. One that was delivered to you deserves suspicion, no matter how perfect it looks. Full analysis: Mirage2FA Abuses Microsoft 365 Login Flows at 4,500 US and EU Companies.

The "Help Desk" That Messages You on Teams

Security firm Expel documented a new malware family called SynkLoader, first distributed around July 28, that arrives through a Microsoft Teams message from someone impersonating the target company's own IT help desk. The lure is a fake "PowerShell Cleaner" installer — hosted in Microsoft Azure, so the download link carries a Microsoft domain and looks like something your own IT team sanctioned. Once it runs, the operators choose from a menu: a fake Windows lock screen that captures the account password when the user types it, a proxy that tunnels the attacker into internal systems, live desktop viewing and control, and a profiler that counts how many computers are in the company's directory. Researcher Marcus Hutchins reads that last module the obvious way — the operators are measuring how big the environment is because they are scoping it for ransomware.

The delivery is the part your staff can actually see. A Teams message feels internal by default — that assumption is the whole attack, and Microsoft flagged help-desk impersonation earlier this year as an increasingly common opening move. No legitimate support process begins with an unannounced chat and an installer link. If a request like that appears, the verification step is a phone call to the IT number your firm already uses — not a reply in the same chat, because you would be replying to the attacker. Full analysis: SynkLoader Malware Hits Microsoft Teams Users in New Phishing Campaign.

Apollo's Breach Started With a Phone Call

Apollo Global Management — $1.05 trillion under management — confirmed that attackers reached some of its cloud platforms between July 6 and July 10, and determined in mid-August that the compromised data included names, dates of birth, home addresses, and Social Security numbers. Apollo is the first victim to formally confirm personal data loss from a wave of attacks that has been working through private equity firms, law firms, financial rating agencies, and medical technology companies. Google attributes the campaign to BlackFile, a group affiliated with The Com that runs its extortion under four interchangeable brand names. Demands reportedly open around $3 million and settle below $1 million.

The method is the reason this belongs in your briefing and not just Apollo's. There was no software flaw and no malware — operators call employees, impersonate IT support, and talk them through handing over credentials or approving an authentication prompt. The script does not care about assets under management; it cares about help desk conventions, and a fifteen-person practice has those too. The defense is procedural and free: nobody at your firm hands over a credential or approves a sign-in prompt on the strength of an inbound call, ever. Full analysis: Apollo Discloses Data Breach as Attack Wave Hits Financial Sector Firms.

Also on Our Radar This Week

Identity-as-a-Service Markets Sell Executive SSNs Through Bankomat and Xilo — Rapid7 tracked dark-web storefronts selling executives' Social Security numbers for $0.25 to $4 a record, searchable by name and state. The partner whose signature moves your firm's money is cheap to impersonate — which is why payment changes get verified by procedure, not by plausibility.

Fake Recruiter Phishing Targets Corporate Credentials on Mobile Devices — Zimperium documented fake-recruiter flows that reach staff on their phones and reject personal email addresses so only work credentials get through. A job hunt on a personal phone can end with your firm's password in someone else's hands.

Wi-Fi Pineapple Device Disrupts Delta Flight in Onboard Wi-Fi Hack — a passenger knocked a Delta flight's Wi-Fi offline and stood up a look-alike network with a credential-harvesting portal. The same few-hundred-dollar trick works in any airport lounge or hotel, so a login page appearing where it shouldn't is a reason to stay off, not to sign in.

Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.

Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.

Weekly Briefing • August 21, 2026

Three of this week's cases end in the same place: somebody has access to a Microsoft 365 account, and at no point did they need a working password. In the first, the user completes a genuine Microsoft sign-in, approves a genuine MFA prompt, and the attacker collects the token. In the second, a fake login window passes the one-time code to the real service while the user is still typing it, and keeps the session that comes back. In the third, the malware never signs in to the tenant at all — it runs its command channel through SharePoint and Teams.

We flagged a smaller version of this in the last briefing: a trojan stealing session cookies, where nobody gets prompted for a second factor on a session that is already signed in. This week it is the whole pattern, and it changes what containing an incident has to mean. Here's what happened, and what each one is asking of your firm.

The Sign-In Page Was Real, and So Was the MFA Prompt

Huntress is tracking a run of Microsoft 365 account takeovers in which no password is ever captured. The technique abuses the OAuth device authorization flow — the sign-in path built for equipment that cannot handle a browser login, like smart TVs, conference room displays, and command-line tools. The device shows a short code, and the person signs in on a phone or laptop to finish the job. An attacker starts that flow himself, sends your user the code with a plausible reason to enter it, and the user completes an authentic sign-in on Microsoft's own page. The token that comes out the other end goes to whoever started the flow.

There is no counterfeit portal to spot, because the portal is microsoft.com/devicelogin. There is no password to steal, because the password goes to Microsoft. MFA fires and the user approves it, because from Microsoft's point of view the sign-in is legitimate — and it is. What the attacker walks away with is a token, and the token is the thing that actually opens mail, files, and Teams data. In your own tenant logs it records as an ordinary successful sign-in by a real employee.

Huntress reports an influx of this through 2026, and the volume is concrete. An earlier wave ran through Railway, a platform-as-a-service, and was attributed to a phishing-as-a-service kit called EvilTokens. A second wave came from a VPS reseller called BL Networks starting April 13, 2026. Between April 13 and April 30, Huntress identified 533 authentication events tied to BL Networks from a single address, 113 of them successful logins inside one 48-hour window on April 20 and 21. Between July 3 and July 27 it recorded 26 critical-severity incidents across 23 identities. The part that changes your exposure is the service model: when a kit packages the lure, the hosting, and the token handling for paying customers, the operator no longer needs to understand OAuth to run the attack, and several unrelated buyers can point it at the same tenant at once.

Microsoft's research on a parallel campaign fills in the lures: invoices, RFPs, shared documents, electronic signing requests, and voicemail notifications, with one observed subject theme of "Action Required: Password Expiration." It also found the attackers checking whether a mailbox existed and was active 10 to 15 days before the phishing attempt, which is usually longer than short log retention keeps. For your firm the teachable moment is narrower than it sounds: a message supplies a code and asks someone to enter it on a Microsoft page. Legitimate device sign-ins run the opposite direction — the code is displayed by the device sitting in front of you, and nobody emails it. Full detection and containment guidance: Device Code Phishing Evolves as EvilTokens PhaaS Kit and Kali365 Emerge, and the campaign Microsoft documented: AI-Enabled Device Code Phishing Campaign Abuses Device Code Sign-In Flow.

The Login Window That Is Not a Window

CTM360 has documented more than 3,000 phishing URLs in a campaign it tracks as RecruitTrap, impersonating recruiters at more than 50 organizations across 14 sectors. It opens with an unsolicited email or meeting invitation that appears to come from a recruiter at a company the recipient would recognize, references their actual professional background, and offers an interview slot. The landing page is a counterfeit Calendly-style scheduler or a branded careers portal, reusing the names, photographs, and job titles of genuine recruiters pulled from public profiles.

The technique doing the work is Browser-in-the-Browser. The target clicks "Continue with Google," and a login window opens on top of the page, address bar and padlock included. It is not a window. It is HTML and CSS drawn inside the page already open, and the address bar is a picture of a trustworthy URL rather than the real one. Checking the address bar is the single habit most security awareness training teaches, and in this campaign the address bar is a drawing of one.

In the more capable versions the operators relay the second factor in real time. The attacker signs in to the genuine service with the submitted password, the fake window mirrors whatever challenge the real service returns, and the victim's one-time code goes straight back to the operator. The kit also screens its own visitors: CAPTCHA gates and reload checks filter out automated traffic, and personal email domains are rejected so only corporate accounts advance, which means a security tool that visits one of these URLs with a consumer address is shown a harmless page.

Marketing staff made up the majority of observed targets, which in a practice means whoever runs the website, the ad account, and the social profiles — often the same person who handles the client list. But the qualifying condition is just a public professional profile and a reason to take a recruiter's call, and that covers most of an office. Note how it ends: the attacker holds an authenticated session, and the victim is redirected to a genuine Calendly page so the whole thing reads as a scheduling hiccup. Nobody reports a scheduling hiccup. Full analysis and hunting indicators: RecruitTrap Phishing Uses Browser-in-the-Browser Popups to Steal Logins.

Malware That Never Signs In to Your Tenant

Ontinue's Cyber Defense Center found a Python malware framework in July that runs most of its command-and-control traffic through Microsoft services your network already permits. Researchers track it as TWINLOOT. Routine tasking runs over SharePoint Online as a file-based dead drop, polling roughly every 15 seconds for new commands and writing results back the same way. Interactive access runs separately, through a reverse SOCKS5 tunnel over Microsoft Teams TURN infrastructure. A third path launches Microsoft Edge in headless mode and issues Graph API calls from inside the browser process, so the network telemetry reads as a legitimate Edge session talking to Microsoft. There is no attacker-owned domain anywhere in the chain, which is the entire design goal: blocklists and domain reputation feeds assume malicious traffic goes somewhere suspicious.

Two details decide how an investigation goes. The implant authenticates to an attacker-controlled Azure tenant rather than yours, so no sign-in event, no consent grant, and no audit record appears in your Entra ID logs — the identity trail an investigator normally starts from is simply absent, and the work falls back to endpoint and network artifacts. And for persistence it creates an NTUSER.MAN mandatory-profile hive offline, which needs no administrator privileges and generates no registry modification event. Alongside that, the malware displays a convincing Windows lock screen filled with the user's real account details, captures the password they type, returns the familiar incorrect-password message, and lets them in. The employee experiences a typo. The help desk never hears about it.

This is the case that survives the standard reflex. If the response to a suspected compromise is to reset the password and run an endpoint scan, the ticket gets closed while the foothold is still there, and there is no registry audit entry to say otherwise. Ontinue reports this as only the second observed case of Teams TURN abuse in the wild and the first to use actual WebRTC DataChannels, so it is early rather than widespread — the reason to read it now is that it shows where the traffic is going to hide. Full breakdown: TWINLOOT Malware Turns Microsoft Cloud Services Into Its Control Channel.

Also on Our Radar This Week

MacSync Stealer is taking credentials off Macs through pasted Terminal commands — the victim is talked into copying a command from a web page or chat window and running it themselves, so there is no exploit and no installer to inspect. It collects Keychain material, saved browser credentials, cookies and session data, SSH keys, and cloud access keys. The Mac in the office is not the exception people assume it is, and what leaves it includes live sessions.

A Mirai-based botnet is turning consumer routers into traffic relays — Fortinet has tracked Evooo1Bot since July hitting NETGEAR, D-Link, Tenda, Alcatel and other gateway devices, using both unpatched flaws and an SSH scanner that works through 150 username and password combinations. Default or shared admin credentials are enough on their own. The devices most likely to qualify are not in your office; they are the home routers your staff connect through.

Experian's 2026 identity and fraud report puts AI-generated deception at the center of account takeover — forged documents, cloned voices, and synthetic identities are now cheap enough to use at volume, and the report names account recovery and high-value payment authorization as the pressure points. The front-office version: a familiar voice on the phone asking to change where a payment goes is not verification, and has not been for a while.

Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.

Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.

Weekly Briefing • August 15, 2026

Three of the incidents we tracked this week have the same shape: the systems involved did exactly what they were built to do, and nobody got an alert. Ransomware ran on a server whose endpoint protection was installed, licensed, and correctly configured — Windows simply never started it. Hundreds of thousands of automated emails carrying credentials and personal details were delivered perfectly, to a stranger, because the sending domain belonged to somebody else. And a healthcare practice that spotted an intrusion in March finished telling its patients at the end of June.

None of these required a clever exploit. Here's what happened, and what each one is asking of your firm.

The Server Rebooted, and the Endpoint Protection Never Came Back

Huntress investigated an Akira ransomware intrusion that began with credential spraying against an internet-facing SonicWall SSL VPN. About seven minutes passed between the first failed login attempts and a successful sign-in — to an account that did not have multi-factor authentication enabled. Two hours later the operator was on the domain controller over RDP. Files from mapped shares were archived with WinRAR and copied out to attacker-controlled cloud storage, all of it finished before any encryption was attempted.

Then came the part worth understanding. The operator installed AnyDesk for persistent access, added AnyDesk to the Windows Safe Boot registry configuration so their own tool would still run, forced the server to reboot into Safe Mode with Networking, and launched the ransomware there. Safe Mode loads only essential drivers and services, and third-party security products are excluded from that set by design. Huntress's own agent and Microsoft Defender's real-time protection were not switched off or tampered with. They were never started. Defender did later identify the ransomware binary sitting on disk, but could not act on it until the machine was booted back into normal Windows.

Two unglamorous things would have changed this story. The first is MFA on that VPN account: no SonicWall vulnerability was involved and no CVE was exploited — seven minutes of guessing found an account where a password alone was enough. The second is an alert when a server boots into Safe Mode without a change ticket behind it. Servers do not reboot into Safe Mode during normal operations, which makes it one of the cleaner alarms you can set. One footnote worth keeping straight: the encryption in this case actually failed, on virtual memory errors. Huntress is explicit that this was a coincidence of resource limits, not a defense. Full chain and detection guidance: Akira Ransomware Reboots Windows Into Safe Mode to Knock EDR Offline.

The "No Reply" Address in Your Software May Belong to a Stranger

Researcher Cory Solovewicz owns noreply.net and noreply.us — addresses that look like throwaway placeholders but are real, registrable domains that somebody can simply buy. Since December 2024, one of them has taken in 401,796 messages, by his own count around 700 a day, from more than 14,000 distinct sending addresses across roughly 6,200 root domains. Of the noreply.net messages, 28,365 arrived with attachments. What lands there is ordinary business mail: account-setup messages from a school platform, injury reports from a city government, Zoom invitations from a UK government agency, credentials from test and QA systems.

A second researcher, Mike Sheward, registered deleteduser.com for about fifteen dollars. Three organizations emailed it within the first hour, and he has since received unintended mail from at least a hundred of them. The cause sits in application code rather than in anyone's mail server. A developer needs a sender address, picks something that looks obviously fake, and happens to choose a domain that is real and available. Or a system replaces a departed employee's address with a placeholder instead of removing the record, and every workflow attached to that account keeps firing. Nothing in email checks that the domain in a From or Reply-To field is one the sender actually owns, so delivery succeeds and no alert is generated on either end. We made the point in the last briefing that a real email isn't automatically a safe email; this is the same lesson pointed the other direction, at the mail your own systems send.

For a practice, the systems worth checking are the obvious ones: practice management, your EHR, appointment reminders, the client or patient portal, e-signature and intake tools. If any of them is configured to send from a domain you don't own, then every activation link, temporary password, and appointment detail it has mailed went somewhere you can't see. Details and the full checklist: Researcher Buys noreply.net and Companies Start Emailing Him Secrets.

Three Months Between Finding It and Telling Anyone

Texas Hearing Institute, a pediatric audiology provider operating as The Center for Hearing and Speech, notified 29,744 patients after the Interlock ransomware group took files from its network. Interlock claims 540 GB. The data included names, Social Security numbers, diagnosis and treatment information, and financial account information. Interlock runs as a ransomware-as-a-service operation and works by double extortion: copy the files first, encrypt second, and charge separately for the decryption key and for not publishing what was taken. The ransom went unpaid, so the data was published.

The ransomware isn't the instructive part. The calendar is. Suspicious network activity was spotted on March 20, 2026. Forensic work confirmed the scope on or around April 22. The list of affected individuals was finalized on June 19, and notification letters went out on June 26 — roughly three months from "something is wrong on our network" to patients learning their records were involved. Most of that time goes into answering one question: whose data was actually in those 540 GB.

That answer is only as fast as your logging. If you can't show what was accessed and when, it has to be reconstructed from whatever evidence survived, and the clock runs the entire time. HIPAA's Breach Notification Rule allows 60 days from discovery for breaches affecting 500 or more people, which also pulls in HHS's Office for Civil Rights and, above that threshold, the media. When "discovery" legally occurred is exactly the kind of question that gets argued afterward, which is a good reason not to be in a position to argue it. The question worth putting to your own team: if this happened here on a Friday, how many days until we could produce a defensible list of exactly whose records were touched? Full breakdown: Interlock Ransomware Attack on Texas Hearing Institute Hits 30,000 Patients.

Also on Our Radar This Week

Microsoft patched 398 vulnerabilities this month, 42 of them critical — managed environments absorb this through the normal patch cycle without anyone thinking about it. The machines worth worrying about are the ones nobody manages: the personal laptop somebody uses for remote work, the old workstation in the back office that never got replaced.

Fake CCleaner downloads deliver the GhostDesk trojan — it hijacks Chrome to steal session cookies along with credentials and screenshots. Stolen session cookies matter because they hand over an already-authenticated session; nobody gets prompted for a second factor on a session that is already signed in.

A banned AI Sidebar Chrome extension is back in the Web Store carrying an affiliate-fraud payload — a browser extension can read every page the person using it opens, which includes your practice management system. Removal from the store isn't permanent, and a familiar name in the listing isn't a safety check.

Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.

Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.