Innovativerenal cybersecurity incidents and threat signals

Feb 14, 2025Infostealer

Medium

Innovative Renal Care Discloses Data Breach Affecting Patient Information

Stay up to date with Pomerium news and announcements. You have successfully joined our subscriber list. The cyber threat landscape is becoming increasingly more complex thanks to advancements in technology, but many of our data breaches today can be traced back to a relatively simple cause: compromised credentials. The latest KELA state of cybercrime report has highlighted this threat, revealing “3.9 billion credentials shared in the form of credentials lists that appear to be sourced from infostealer logs” has been observed, indicating that credential theft, subsequent exploitation, and massive extortion campaigns can easily follow. Compiled on March 1, the following list of data breach headlines published during the month of February contains details behind the cause of the breach (if available). Source articles have been organized by industry (finance, government, healthcare, infrastructure, retail, tech, and miscellaneous) in reverse chronological order. Security Breaches Reported in February 2025 The Bybit Breach: How Hackers Exploited a SafeWallet Vulnerability to Steal $1.4 Billion | Coin Central Cryptocurrency exchange Bybit lost over $1.4 billion worth of liquid-staked Ether in a security breach on February 21, 2025, making it the largest crypto hack in history. According to forensic investigations, the attack was carried out by North Korea’s Lazarus Group, who exploited a vulnerability in SafeWallet’s infrastructure rather than Bybit’s systems. Multiple forensic teams, including cybersecurity firms Sygnia and Verichains, conducted investigations into the hack. Their findings revealed that the credentials of a SafeWallet developer were compromised, giving attackers unauthorized access to SafeWallet’s infrastructure Finastra Notifies Customers of Data Breach | Infosecurity Magazine British financial technology firm Finastra has notified customers of a data breach that occurred between October 31 and November 8, 2024 where an unauthorized third party accessed the company’s secure file transfer platform (SFTP), used to share files with customers. Although the breach was detected on November 7, and the company acknowledged it shortly after, Finastra only began reaching out to affected individuals on February 12, 2025. While the exact number of individuals affected remains undisclosed, filings with the Massachusetts Attorney General reveal that at least 65 residents in the state were impacted. Accounting Firm Blue & Co. Files Notice of Data Breach with Federal Regulators | JD Supra On February 7, 2025, Blue & Co., LLC (“Blue”) filed a notice of data breach with the U.S. Department of Health and Human Services Office for Civil Rights after discovering that information in the company’s possession was subject to unauthorized access, resulting in an unauthorized party being able to access consumers’ sensitive information. According to a source, the Blue & Co. data breach was the result of a “hacking / IT incident” involving a network server. While it’s possible that Blue’s systems were targeted in the attack, it’s also possible that Blue is reporting the breach on behalf of one of its third-party vendors or business partners. Cyber Investor Insight Partners Suffers Security Breach | Infosecurity Magazine New York-based venture capital firm Insight Partners has confirmed it was hit by a cyber-attack in January 2025. In a public statement published on February 18, the investment company said an unauthorized third party accessed some parts of its information systems through a “sophisticated social engineering attack,” and the intrusion was detected on January 16. The Pension Specialists Data Breach Affects Over 71k Consumers | JD Supra On February 14, 2025, The Pension Specialists Ltd. (“TPS”) filed a notice of data breach with the Attorney General of Maine after discovering that certain files on its network were accessed without authorization. An unauthorized party accessed certain files on its network between February 18, 2024 and February 20, 2024. It was later determined that some of these files contained confidential information belonging to certain individuals. Zacks Investment hit in data breach | 12 million users potentially at risk | TechRadarPro Zacks Investment Research, a financial data, stock research, and analysis company based in Chicago, allegedly suffered a cyberattack in which it lost sensitive data on millions of people. A report by BleepingComputer cites a thread posted on an underground hacking forum claiming to have breached Zacks in June 2024, gaining sensitive information on 12 million people, including names, usernames, email addresses, postal addresses, and phone numbers. Zacks is yet to comment on the claims of a data breach. Heartland Bank Sends Data Breach Letters Following Recent Email Data Security Incident On February 7, 2025, Heartland Bank filed a notice of data breach with the Attorney General of Massachusetts after discovering a recent data security incident involving the company’s email system where an unauthorized party being able to access consumers’ sensitive information.