Jefferson Health - Einstein serves the greater Philadelphia area, including Montgomery County. http://www.einstein.edu
UPMC is a world-renowned, nonprofit health care provider and insurer committed to delivering exceptional, people-centered care and community services. Headquartered in Pittsburgh and affiliated with the University of Pittsburgh Schools of the Health Sciences, UPMC is shaping the future of health through clinical and technological innovation, research, and education. Dedicated to advancing the well-being of our diverse communities, we provide nearly $2 billion annually in community benefits, more than any other health system in Pennsylvania. Our 100,000 employees — including more than 5,000 physicians — care for patients across more than 40 hospitals and 800 outpatient sites in Pennsylvania, New York, and Maryland, as well as overseas. UPMC Insurance Services covers more than 4 million members, providing the highest-quality care at the most affordable price. To learn more, visit UPMC.com.
Security & Compliance Standards Overview
No incidents recorded for Einstein Healthcare Network in 2026.
No incidents recorded for UPMC in 2026.
Einstein Healthcare Network cyber incidents detection timeline including parent company and subsidiaries
UPMC cyber incidents detection timeline including parent company and subsidiaries
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
Azure Entra ID Elevation of Privilege Vulnerability
Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.
Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManager fails to sanitize the filenames of uploaded backups. The system persists user-uploaded files directly to the host filesystem using the raw originalname provided in the request. This allows an attacker to stage a file containing shell metacharacters (e.g., $(id).tar.gz) at a predictable path, which is later referenced during the restore process. The successful storage of the file is what allows the subsequent restore command to reference and execute it. This issue has been fixed in version 4.7.0.
