Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

The Post endorses April McClain Delaney and Tom Royals for Maryland’s 6th District

On Press Freedom Day, little to celebrate for Hong Kong’s journalists

Young Georgians want to be part of Europe. Their government is in the way.

Confident of victory over Ukraine, Russia exhibits Western war trophies

Two women are seeking Mexico’s presidency. But the race is about a man.

Hamas in Cairo for hostage talks as Israel briefs aid agencies on Rafah

The New York Times, alone in its outrage over access to Biden

The ‘Access Hollywood’ video cemented Trump’s air of invincibility

Stephen A. Smith would like even more of your attention

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

Biden confronts campus protests; Trump hedges on accepting election results

Kristi Noem just won’t stop talking about killing her dog

Noem’s dog-killing isn’t popular, though Trump supporters are divided

The new cure-all for vacation excess: the IV drip 

What’s the best bus to New York? We tested 5 for comfort and value.

Adaptive equipment is making national parks more inclusive

Ask Amy: My boyfriend just confessed he’s almost $20,000 in debt

Miss Manners: Is it inappropriate to reach out to old girlfriends?

Carolyn Hax: Longtime friend won’t forgive being last-minute canceled for a guy

In a pinch, the Nationals finally find some offense

Is Pastis as good as our food critic thought? He sent spies to find out.

The Capitals, a team in transition, know what they want this offseason

Trump Media auditor charged by SEC with ‘massive fraud’

Google’s empire is massive. A judge will soon rule if it’s a monopoly.

Five tech products we actually like

In photos: At least 39 dead as historic flooding hits southern Brazil

Sea level rise brings new era of dangerous flooding

Michael Cohen keeps broadcasting despite being a witness

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! Two developments of note in the coming days: First, we aren't publishing Friday and will return Monday. Second, I'm about to take my first real (albeit relatively short) vacation since the pandemic began, so look for some guests who will helm the ship while I'm away.

Below: The judicial system has been very busy on data breaches of late, and federal agencies survey the midterm <a href="https://www.washingtonpost.com/elections/" target="_blank" class="contextual_link">election</a> threat picture. But first:

An IT security incident hits a ‘massive’ hospital chain, a sector where the risks are grave

iStock

The second-largest nonprofit U.S. hospital chain is dealing with a cybersecurity incident this week that affected facilities across the country, forcing ambulance diversions, system shutdowns and patient appointment rescheduling.

CommonSpirit Health isn’t yet providing specifics about what happened. The chain says it has 140 hospitals and more than 1,000 care sites in 21 states. Facilities in Iowa, Nebraska, Tennessee and Washington were among those enduring disruptions.

One expert called the incident an extraordinary one for the United States. Cybersecurity risks in the health-care sector can mean a potential threat to lives.

“The scope is perhaps unprecedented in terms of the health-care sector,” Brett Callow, a threat analyst at the cybersecurity company Emsisoft, told me. CommonSpirit, he said, is “absolutely massive.”

CommonSpirit Health on Tuesday published a statement on the incident, which emerged into public view Monday and began to get wider attention Wednesday.

“CommonSpirit Health is managing an IT security issue that is impacting some of our facilities. As a precautionary step, we have taken certain IT systems offline, which may include electronic health record (EHR) and other systems,” the original online statement read. “Our facilities are following existing protocols for system outages and taking steps to minimize the disruption.”

<a href="https://www.commonspirit.org/news-and-perspectives/news/Statement-IT-Security-Issue">A revised statement</a> Wednesday excluded some of those details.

The chain declined to comment further, but signs point to a ransomware attack, during which hackers encrypt victim systems and demand payment to unlock them. Tweeted security researcher Kevin Beaumont, head of security operations at Arcadia Group (“IR” stands for “incident response”):

<a href="https://nymag.com/intelligencer/article/ransomware-hunting-team-book-excerpt.html">Some ransomware gangs swore off attacking hospitals</a> at the height of the pandemic, but Callow noted that ransomware affiliates who use their malware in exchange for handing over a share of profits haven’t shown such restraint.

Among the consequences of the CommonSpirit Health incident:

Besides taking some IT systems and records offline, CommonSpirit Health said “we have rescheduled some patient appointments.”

The Des Moines Register reported that MercyOne Des Moines Medical Center had <a href="https://www.desmoinesregister.com/story/news/health/2022/10/04/mercyone-online-systems-shut-down-cybersecurity-incident-des-moines-hospital/69538349007/">diverted ambulances for “a short time.”</a>

Multiple CHI Health facilities in Omaha <a href="https://omaha.com/news/local/chi-health-faces-it-security-incident-impacting-omaha-area-online-systems/article_d1aa8034-436f-11ed-97ae-dfa47a3e420c.html">were affected</a>, the Omaha World-Herald reported.

CHI Memorial hospital in Chattanooga, Tenn., <a href="https://www.chattanoogan.com/2022/10/3/456978/Some-Patient-Procedures-Moved-Some.aspx">reported problems</a> identical to the CommonSpirit Health statement, according to the Chattanoogan.

In Washington, St. Michael Medical Center <a href="https://www.kitsapsun.com/story/news/2022/10/04/hospital-st-michael-medical-center-washington-experiencing-online-outage-it-security-incident/8179089001/">delayed critical procedures</a> — including a CT scan to check on a brain bleed — patients and families told the Kitsap Sun. In other parts of the state, <a href="https://www.thenewstribune.com/news/local/article266804656.html">health-care workers told</a> the Tacoma News Tribune that “the disruption was having serious impact on normal functions such as charting, lab results reporting, history gathering, obtaining records on allergy information and more.”

“In general, these kinds of … attacks are happening at all different kinds of organizations in every different critical infrastructure sector,” Errol Weiss, chief security officer for the Health Information Sharing and Analysis Center, told me in an interview in which he was careful not to speak about CommonSpirit Health specifically. “But when they hit hospitals and impact patient care, it creates newsworthy events within the community, it starts to potentially impact people's lives and people take notice.”

There have been a couple reports that cyberattacks on hospitals have cost lives.

<a href="https://www.wsj.com/articles/ransomware-hackers-hospital-first-alleged-death-11633008116">A lawsuit that a woman filed</a> against an Alabama hospital last year alleges that a ransomware attack led to the death of a 9-month-old child because of equipment that wasn’t working.

In 2020, a German hospital under ransomware attack turned away a patient who later died. Prosecutors looked at filing charges against the hackers, but <a href="https://www.wired.co.uk/article/ransomware-hospital-death-germany">ultimately concluded it wasn’t the decisive factor</a>.

In perhaps the most sweeping hospital cyber incident outside the United States, the massive WannaCry ransomware attack that affected 150 countries <a href="https://www.nationalhealthexecutive.com/articles/wannacry-cyber-attack-cost-nhs-ps92m-after-19000-appointments-were-cancelled">hampered the U.K. health system</a>. The 2017 incident disrupted 80 hospitals, led to the cancellation of 19,000 appointments and cost it more than $100 million.

Weiss said that typically when there’s a big incident affecting the health-care sector, his organization snaps into action.

“We've got a terrific network of health-care organizations actively sharing information with each other, including indicators of compromise and TTPs (tactics, techniques and procedures) from this kind of attack,” he said. “The whole idea is to be able to learn what's happening from other organizations and use that information to better protect your information, or look to see if you'd be impacted by that attack.”

The American Hospital Association’s national adviser for cybersecurity and risk — who also took pains not to comment on CommonSpirit Health — said it’s important for hospitals to have a plan for when an attack happens.

“In general terms, what we advise our members, should they become victim of a cyberattack which disrupts hospital functions and/or clinical care: Their downtime procedures need to be in effect that would compensate for lack for access to electronic health records and other medical technology that may become unavailable,” John Riggi told me.&nbsp;

Outside of that, the health-care sector needs help from law enforcement to track down and punish culprits, &nbsp;something Riggi said the government in general and FBI specifically have committed to doing.

Former Uber security chief convicted over 2016 breach

Chris J. Ratcliffe

A federal jury on Wednesday found Uber’s former chief security officer, Joe Sullivan, guilty of obstructing justice and actively hiding a felony after authorizing payments to hackers behind a 2016 breach of the ride-sharing service.

“The verdict ended a dramatic case that pitted Sullivan, a prominent security expert who was an early prosecutor of cybercrimes for the San Francisco U.S. attorney’s office, against his former government office. In between prosecuting hackers and being prosecuted, Sullivan served as the top security executive at Facebook, Uber and Cloudflare,” <a href="https://www.washingtonpost.com/technology/2022/10/05/uber-obstruction-sullivan-hacking/">The Post’s Joseph Menn reports</a>.

It also came as a surprise to many security professionals. The judge didn’t set a date for Sullivan’s sentencing.

No prison for Seattle hacker behind historic Capital One data breach

Jeff Chiu

A former Seattle tech worker <a href="https://www.seattletimes.com/business/ex-amazon-worker-convicted-in-massive-capital-one-hack/">convicted of several charges</a> stemming from a massive attack of Capital One bank and more than 30 other companies <a href="https://www.seattletimes.com/business/no-prison-for-seattle-hacker-behind-capital-one-250m-data-breach/">was sentenced Wednesday</a> to time served and five years probation, Seattle Times’s Renata Geraldo reports.&nbsp;

Paige Thompson, who went by the handle “erratic” online, was arrested in July 2019 after she downloaded personal data from more than 100 million Capital One users, racking up more than $250 million in damages. She remained jailed until November of that year.

At the sentencing hearing, U.S. District Judge Robert Lasnik said additional time in prison <a href="https://www.justice.gov/usao-wdwa/pr/former-hacker-sentenced-stealing-computer-power-mine-cryptocurrency-and-stealing">would be particularly difficult</a> for Thompson because of her well-documented mental health issues and transgender status.&nbsp;

U.S. Attorney Nick Brown said he was “very disappointed” with the sentencing decision, adding that his office had asked the court to impose a seven-year sentence against the former Amazon software engineer behind one of the largest data breaches in U.S. history. “This is not what justice looks like,” <a href="https://www.justice.gov/usao-wdwa/pr/former-hacker-sentenced-stealing-computer-power-mine-cryptocurrency-and-stealing">Brown said in a statement</a>.&nbsp;

Thompson previously argued that she had never misused the data she had obtained. Rather, that she was attempting to collect a bounty for spotting vulnerabilities in the systems of the companies she hacked.&nbsp; In 2020, Capital One <a href="https://www.seattletimes.com/business/capital-one-fined-80-million-in-data-breach/">agreed to pay</a> $80 million to settle federal bank regulators’ claims that it lacked security measures it needed to protect customers’ information. The company also later reached a $190 million <a href="https://www.seattletimes.com/business/capital-one-to-pay-190m-settlement-in-data-breach-linked-to-seattle-woman/">settlement with affected customers</a>.&nbsp;

Authorities have arrested &nbsp;Eugene Yu, the founder of the Michigan election software company Konnech, &nbsp;on suspicion of stealing the personal information of hundreds of Los Angeles County poll workers, <a href="https://apnews.com/article/business-elections-los-angeles-michigan-government-and-politics-078e0b0beb6217dca48318542eec94ee">the Associated Press reports</a>.&nbsp;

Konnech stored data on servers in China, in violation of requirements to keep information collected under contract in the United States, prosecutors allege. The company denied the charges.

“We are continuing to ascertain the details of what we believe to be Mr. Yu’s wrongful detention by LA County authorities,” Konnech said in a statement. “Any LA County poll worker data that Konnech may have possessed was provided to it by LA County, and therefore could not have been ‘stolen’ as suggested.”

<a href="https://www.newsweek.com/eugene-yu-arrest-konnech-china-election-1749024">Election deniers who had besieged the company rejoiced</a>, but prosecutors said Yu’s actions didn’t affect election results.

Senior officials ‘confident’ U.S. voting systems could thwart malicious cyberattacks

Yuri Gripas

With less than a month to go before the midterm elections, the FBI and the Cybersecurity and Infrastructure Security Agency are confident that any attempts <a href="https://www.washingtonpost.com/politics/2022/10/05/election-workers-need-be-protected-sometimes-protected-against/">to manipulate votes</a> would be identified and stopped ahead of any large-scale disruptions.&nbsp;

“Given the extensive safeguards in place and distributed nature of election infrastructure, the FBI and CISA continue to assess that attempts to manipulate votes at scale would be difficult to conduct undetected,” <a href="https://www.cisa.gov/sites/default/files/publications/PSA_cyber-activity_508.pdf">the agencies said in a joint announcement</a> Wednesday.&nbsp;

The agencies added that, as far as they know, there’s never been a successful hack against any election in the United States that has prevented someone from casting a ballot or compromised the integrity of their vote.&nbsp;

While the agencies expressed confidence that U.S. voting systems are safe and secure, senior government officials warned earlier this week that there is, and has been, <a href="https://www.voanews.com/a/foreign-influence-campaigns-ramp-up-to-target-us-voters-/6774788.html">a concerted effort</a> by foreign adversaries from countries like China, Russia and Iran to seize on Americans’ doubts about the election system itself. “In particular, we are concerned malicious cyber actors could seek to spread or amplify false or exaggerated claims of compromise to election infrastructure,” an FBI official said at a briefing, per Voice of America’s Jeff Seldin.&nbsp;

<a href="https://www.nextgov.com/cxo-briefing/2022/10/white-house-seeks-advice-cyber-workforce-development/378053/ " target="_blank">White House seeks advice on cyber workforce development (Nextgov)</a>

<a href="https://www.cnn.com/2022/10/05/politics/russian-hackers-state-government-websites/index.html" target="_blank">Russian-speaking hackers knock US state government websites offline | CNN Politics (CNN)</a>

<a href="https://techcrunch.com/2022/10/05/china-censorship-vpn-ban-party-congress/" target="_blank">Popular censorship circumvention tools face fresh blockade by China (TechCrunch)</a>

<a href="https://www.cyberscoop.com/nafo-fellas-and-their-memes-ukraine/" target="_blank">How one group of 'fellas' is winning the meme war in support of Ukraine (CyberScoop)</a>

<a href="https://www.reuters.com/technology/lloyds-london-investigates-possible-cyber-attack-2022-10-05/" target="_blank">Lloyd's of London investigates possible cyber attack (Reuters)</a>

The FS-ISAC <a href="https://www.fsisac.com/events/2022-fincyber-today">holds</a> its FinCyber Today summit in Scottsdale, Ariz., from Oct. 10 through Oct. 12.

Thanks for reading. See you next week.

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

American University, BA in journalism

McKenzie Beard is a researcher for The Health 202, a morning newsletter and daily guide to Washington's health-care policy debate. She started at the Post as an American University practicum student on the investigative desk in 2021 and has previously reported for Voice of America and Teen Vogue.