https://blog.dansec.red/vendors/signature-healthcare/Recent content in Signature Healthcare on DanSec DailyHugoen-gbThu, 09 Apr 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-04-09-cybersecurity-news/Thu, 09 Apr 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-04-09-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li> <p><strong>Bitcoin Depot Hack</strong></p> <ul> <li>Bitcoin Depot, a major Bitcoin ATM operator, reported a breach in which attackers stole approximately $3.665 million from its crypto wallets. Attackers gained access to credentials and transferred over 50 bitcoins out of company wallets.</li> </ul> </li> <li> <p><strong>Massachusetts Hospital Cyberattack</strong></p> <ul> <li>Signature Healthcare in Massachusetts experienced a cyberattack that forced ambulance diversions, cancellation of some services, and disruption of pharmacy operations.</li> </ul> </li> <li> <p><strong>Zendesk Ticket Theft by UNC6783</strong></p> <ul> <li>Threat actor UNC6783 compromised business process outsourcing (BPO) providers to steal corporate Zendesk support tickets from high-value companies across multiple sectors.</li> </ul> </li> <li> <p><strong>Magento E-commerce Card Skimming Campaign</strong></p> <ul> <li>Nearly 100 online stores running the Magento platform were impacted by a campaign embedding credit card-stealing code within a pixel-sized SVG image.</li> </ul> </li> <li> <p><strong>TeamPCP Supply Chain Attack Update</strong></p> <ul> <li>TeamPCP supply chain campaign update reveals Cisco source code was stolen via a breach linked to the Trivy security scanner. Google GTIG tracks the group as UNC6780.</li> </ul> </li> </ul>https://blog.dansec.red/posts/2026-04-08-cybersecurity-news/Wed, 08 Apr 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-04-08-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li> <p><strong>Massachusetts Hospital Cyberattack</strong></p> <ul> <li>Signature Healthcare in Massachusetts experienced a cyberattack resulting in ambulance diversions, cancellation of some services, and pharmacy disruptions.</li> </ul> </li> <li> <p><strong>Snowflake SaaS Integrator Breach</strong></p> <ul> <li>Over a dozen companies suffered data theft attacks after a SaaS integration provider was breached, with attackers stealing authentication tokens.</li> </ul> </li> <li> <p><strong>Router Hijacking and Espionage by APT28</strong></p> <ul> <li>The Russia-linked APT28 (Forest Blizzard) compromised MikroTik and TP-Link routers globally, hijacking DNS settings to steal Microsoft 365 and Office authentication tokens.</li> <li>An international law enforcement operation disrupted the “FrostArmada” APT28 campaign.</li> </ul> </li> <li> <p><strong>Critical Infrastructure Attacks by Iran-Linked Actors</strong></p> <ul> <li>Iran-affiliated threat actors targeted internet-exposed programmable logic controllers (PLCs) and SCADA systems in US critical infrastructure sectors, causing operational disruptions.</li> </ul> </li> <li> <p><strong>Doxing, Spyware, and Nonconsensual Abuse</strong></p> <ul> <li>Widespread abuse in Telegram groups, where individuals are purchasing hacking tools, sharing nonconsensual images, and engaging in doxing and spyware deployment.</li> </ul> </li> </ul>