ISO 27001 Certificate
SOC 1 Type I Certificate
SOC 2 Type II Certificate
PCI DSS
HIPAA
RGPD
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions
ISOSOC2 Type 1SOC2 Type 2PCI DSSHIPAAGDPR

A national blended health organization, Highmark Health and our leading businesses support millions of customers with products, services and solutions closely aligned to our mission of creating remarkable health experiences, freeing people to be their best. Headquartered in Pittsburgh, we're regionally focused in Pennsylvania, Delaware, West Virginia and New York, with customers in all 50 states and the District of Columbia. We passionately serve individual consumers and fellow businesses alike. Our companies cover a diversified spectrum of essential health-related needs, including health insurance, health care delivery, population health management, dental solutions, reinsurance solutions, and innovative technology solutions. Our financial position reflects strength and stability, with our year-end 2024 consolidated revenues totaling $29.4 billion. We’re also proud to carry forth an important legacy of compassionate care and philanthropy that began more than 170 years ago. This tradition of giving back, reinvesting and ensuring that our communities remain strong and healthy is deeply embedded in our culture, informing our decisions every day.

Highmark Health A.I CyberSecurity Scoring

Highmark Health

Company Details

Linkedin ID:

highmark-health

Employees number:

15,287

Number of followers:

68,597

NAICS:

62

Industry Type:

Hospitals and Health Care

Homepage:

highmarkhealth.org

IP Addresses:

0

Company ID:

HIG_1346406

Scan Status:

In-progress

AI scoreHighmark Health Risk Score (AI oriented)

Between 700 and 749

https://images.rankiteo.com/companyimages/highmark-health.jpeg
Highmark Health Hospitals and Health Care
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
globalscoreHighmark Health Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/highmark-health.jpeg
Highmark Health Hospitals and Health Care
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

Highmark Health Company CyberSecurity News & History

Past Incidents
4
Attack Types
3
EntityTypeSeverityImpactSeenBlog DetailsIncident DetailsView
HighmarkBreach85412/2022
Rankiteo Explanation :
Attack with significant impact with customers data leaks

Description: The Maine Office of the Attorney General reported a data breach involving Highmark on February 3, 2023. The breach occurred between December 13, 2022, and December 15, 2022, due to an external hacking incident, potentially affecting 300,000 individuals, including 2,774 Maine residents. The compromised information included names and social security numbers.

Highmark HealthBreach80403/2022
Rankiteo Explanation :
Attack with significant impact with customers data leaks

Description: Highmark Health, based in Pittsburgh confirmed a security incident in its computer network that resulted in a data security breach. The breach exposed the sensitive information of as many as 67,147 individuals. Highmark Health investigated the incident and notified the impacted customers to be alerted of any fraudulent activity.

Highmark HealthCyber Attack60312/2022
Rankiteo Explanation :
Attack with significant impact with internal employee data leaks

Description: The Washington State Office of the Attorney General reported a data breach involving Highmark Health on February 6, 2023. The breach occurred between December 13 and December 15, 2022, due to a phishing cyberattack, potentially affecting the personal and protected health information of 1,980 residents.

Highmark HealthData Leak60306/2023
Rankiteo Explanation :
Attack with significant impact with internal employee data leaks

Description: A former employee of Highmark, according to the district attorney's office, allegedly broke into the accounts of multiple customers, including a school system, and took $1,000. Zakayah Scott, who performed remote work for Highmark Health from South Carolina, was charged by the Allegheny County District Attorney's office. The authorities claimed that Scott had access to the birthdays, residences, and phone numbers of his clients. They claimed she changed the victims' health savings account passwords over the phone, logged in, and then transferred and took money while posing as one of the victims.

Highmark
Breach
Severity: 85
Impact: 4
Seen: 12/2022
Blog:
Rankiteo Explanation
Attack with significant impact with customers data leaks

Description: The Maine Office of the Attorney General reported a data breach involving Highmark on February 3, 2023. The breach occurred between December 13, 2022, and December 15, 2022, due to an external hacking incident, potentially affecting 300,000 individuals, including 2,774 Maine residents. The compromised information included names and social security numbers.

Highmark Health
Breach
Severity: 80
Impact: 4
Seen: 03/2022
Blog:
Rankiteo Explanation
Attack with significant impact with customers data leaks

Description: Highmark Health, based in Pittsburgh confirmed a security incident in its computer network that resulted in a data security breach. The breach exposed the sensitive information of as many as 67,147 individuals. Highmark Health investigated the incident and notified the impacted customers to be alerted of any fraudulent activity.

Highmark Health
Cyber Attack
Severity: 60
Impact: 3
Seen: 12/2022
Blog:
Rankiteo Explanation
Attack with significant impact with internal employee data leaks

Description: The Washington State Office of the Attorney General reported a data breach involving Highmark Health on February 6, 2023. The breach occurred between December 13 and December 15, 2022, due to a phishing cyberattack, potentially affecting the personal and protected health information of 1,980 residents.

Highmark Health
Data Leak
Severity: 60
Impact: 3
Seen: 06/2023
Blog:
Rankiteo Explanation
Attack with significant impact with internal employee data leaks

Description: A former employee of Highmark, according to the district attorney's office, allegedly broke into the accounts of multiple customers, including a school system, and took $1,000. Zakayah Scott, who performed remote work for Highmark Health from South Carolina, was charged by the Allegheny County District Attorney's office. The authorities claimed that Scott had access to the birthdays, residences, and phone numbers of his clients. They claimed she changed the victims' health savings account passwords over the phone, logged in, and then transferred and took money while posing as one of the victims.

Ailogo

Highmark Health Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒
Incident Predictions locked
Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒
A.I. Risk Score Predictions locked
Access Monitoring Plan
statics

Underwriter Stats for Highmark Health

Incidents vs Hospitals and Health Care Industry Average (This Year)

No incidents recorded for Highmark Health in 2025.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Highmark Health in 2025.

Incident Types Highmark Health vs Hospitals and Health Care Industry Avg (This Year)

No incidents recorded for Highmark Health in 2025.

Incident History — Highmark Health (X = Date, Y = Severity)

Highmark Health cyber incidents detection timeline including parent company and subsidiaries

Highmark Health Company Subsidiaries

SubsidiaryImage

A national blended health organization, Highmark Health and our leading businesses support millions of customers with products, services and solutions closely aligned to our mission of creating remarkable health experiences, freeing people to be their best. Headquartered in Pittsburgh, we're regionally focused in Pennsylvania, Delaware, West Virginia and New York, with customers in all 50 states and the District of Columbia. We passionately serve individual consumers and fellow businesses alike. Our companies cover a diversified spectrum of essential health-related needs, including health insurance, health care delivery, population health management, dental solutions, reinsurance solutions, and innovative technology solutions. Our financial position reflects strength and stability, with our year-end 2024 consolidated revenues totaling $29.4 billion. We’re also proud to carry forth an important legacy of compassionate care and philanthropy that began more than 170 years ago. This tradition of giving back, reinvesting and ensuring that our communities remain strong and healthy is deeply embedded in our culture, informing our decisions every day.

Loading...
similarCompanies

Highmark Health Similar Companies

University Hospitals

Founded in 1866, University Hospitals serves the needs of patients through an integrated network of 23 hospitals (including 5 joint ventures), more than 50 health centers and outpatient facilities, and over 200 physician offices in 16 counties throughout northern Ohio. The system’s flagship quaterna

Endeavor Health

NorthShore University HealthSystem, Swedish Hospital, Northwest Community Healthcare and Edward-Elmhurst Health are now united under one name: Endeavor Health. Together, we’re driven by our mission to help everyone in our communities be their best and our commitment to setting a new standard for he

Express Scripts by Evernorth

Express Scripts by Evernorth provides pharmacy benefits services with a clear mission: To simplify complexities and provide holistic, condition-focused care and clinically superior pharmacy benefit solutions for our clients and the people they serve. Guided by our core values of service, patient ca

UnitedHealthcare

When it comes to your health, everything matters. That’s why UnitedHealthcare is helping people live healthier lives and making the health system work better for everyone. Our health plans are there for you in moments big and small, delivering a simple experience, affordable coverage, and supportive

BayCare Health System

BayCare is a leading not-for-profit academic health care system that connects individuals and families to a wide range of services at 16 hospitals, including a children’s hospital, and hundreds of other convenient locations throughout the Tampa Bay and central Florida regions. The system is West Cen

University of Maryland Medical System

The University of Maryland Medical System (UMMS) was created in 1984 when the state-owned University Hospital became a private, nonprofit organization. It has evolved into a multi-hospital system with academic, community and specialty service missions reaching every part of the state and beyond. UM

Nationwide Children's Hospital

Nationwide Children’s is one of America's largest pediatric hospitals, an international leader in research and is ranked in all 10 specialties on U.S. News & World Report’s 2025-26 “America’s Best Children’s Hospitals” list. Our staff, comprised of 1,600 medical professionals and over 16,000 employe

Hapvida NotreDame Intermédica

Com cerca de 80 anos de experiência, a Hapvida é hoje a maior empresa de saúde integrada da América Latina. A companhia, que possui mais de 69 mil colaboradores, atende quase 16 milhões de beneficiários de saúde e odontologia espalhados pelas cinco regiões do Brasil. Todo o aparato foi construído a

A Dasa é a maior rede de saúde integrada do Brasil. Faz parte da vida de mais de 20 milhões de pessoas por ano, com alta tecnologia, experiência intuitiva e atitude à frente do tempo. Com mais de 50 mil colaboradores e 250 mil médicos parceiros, existe para ser a saúde que as pessoas desejam e que

newsone

Highmark Health CyberSecurity News

October 08, 2025 07:00 AM
Highmark Health Appoints Karen Hanlon President

Highmark Health announced today that its Board of Directors has appointed Karen Hanlon president of Highmark Health effective immediately.

October 08, 2025 07:00 AM
Highmark Health taps Karen Hanlon as president

Hanlon will retain her role as chief operating officer, which she has held since 2018.

October 01, 2025 07:00 AM
2026's top healthcare and pharma conferences

Each year, the healthcare industry organizes a full slate of events that help executives stay on top of the latest trends and innovations in...

September 15, 2025 07:00 AM
Alphabet’s Verily Sued by Former Executive Over Alleged HIPAA Breaches

A lawsuit has been filed against Alphabet-owned Verily by a former employee who alleges that the personally identifiable health information...

August 12, 2025 07:00 AM
Highmark, Abridge to launch AI-powered prior authorization tool

Highmark Health and clinical documentation vendor Abridge are developing a tool that uses generative artificial intelligence to approve...

August 11, 2025 07:00 AM
48 CIOs On the Move

This month, we're highlighting 48 CIOs, CTOs, and CISOs taking on leadership roles in industries from healthcare to finance to technology.

June 23, 2025 07:00 AM
AHIP 2025: Executive insights from Aetna, Anterior, Ascendiun and more

Here are the five key takeaways from last week's AHIP conference, including a push to reform prior authorization.

May 29, 2025 07:00 AM
Highmark Health Plans weighs down Allegheny Health gains

Highmark Health recorded $13 million in net income during the first quarter, down from a $194 million a year before.

May 08, 2025 07:00 AM
enGen Recognized for Digital Health Innovation in 2025 MedTech Breakthrough Awards Program

enGen, a wholly owned healthtech subsidiary of Highmark Health focused on providing integrated end-to-end technology solutions to health plans and their...

faq

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

Highmark Health CyberSecurity History Information

Official Website of Highmark Health

The official website of Highmark Health is http://www.highmarkhealth.org.

Highmark Health’s AI-Generated Cybersecurity Score

According to Rankiteo, Highmark Health’s AI-generated cybersecurity score is 705, reflecting their Moderate security posture.

How many security badges does Highmark Health’ have ?

According to Rankiteo, Highmark Health currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does Highmark Health have SOC 2 Type 1 certification ?

According to Rankiteo, Highmark Health is not certified under SOC 2 Type 1.

Does Highmark Health have SOC 2 Type 2 certification ?

According to Rankiteo, Highmark Health does not hold a SOC 2 Type 2 certification.

Does Highmark Health comply with GDPR ?

According to Rankiteo, Highmark Health is not listed as GDPR compliant.

Does Highmark Health have PCI DSS certification ?

According to Rankiteo, Highmark Health does not currently maintain PCI DSS compliance.

Does Highmark Health comply with HIPAA ?

According to Rankiteo, Highmark Health is not compliant with HIPAA regulations.

Does Highmark Health have ISO 27001 certification ?

According to Rankiteo,Highmark Health is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of Highmark Health

Highmark Health operates primarily in the Hospitals and Health Care industry.

Number of Employees at Highmark Health

Highmark Health employs approximately 15,287 people worldwide.

Subsidiaries Owned by Highmark Health

Highmark Health presently has no subsidiaries across any sectors.

Highmark Health’s LinkedIn Followers

Highmark Health’s official LinkedIn profile has approximately 68,597 followers.

NAICS Classification of Highmark Health

Highmark Health is classified under the NAICS code 62, which corresponds to Health Care and Social Assistance.

Highmark Health’s Presence on Crunchbase

Yes, Highmark Health has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/highmark-health.

Highmark Health’s Presence on LinkedIn

Yes, Highmark Health maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/highmark-health.

Cybersecurity Incidents Involving Highmark Health

As of November 27, 2025, Rankiteo reports that Highmark Health has experienced 4 cybersecurity incidents.

Number of Peer and Competitor Companies

Highmark Health has an estimated 29,991 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at Highmark Health ?

Incident Types: The types of cybersecurity incidents that have occurred include Data Leak, Breach and Cyber Attack.

What was the total financial impact of these incidents on Highmark Health ?

Total Financial Loss: The total financial loss from these incidents is estimated to be $1 thousand.

How does Highmark Health detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an communication strategy with notified impacted customers to be alerted of any fraudulent activity., and law enforcement notified with yes..

Incident Details

Can you provide details on each incident ?

Incident : Data Breach

Title: Highmark Health Data Breach

Description: Highmark Health, based in Pittsburgh confirmed a security incident in its computer network that resulted in a data security breach.

Type: Data Breach

Incident : Data Breach

Title: Former Highmark Employee Allegedly Breaches Customer Accounts

Description: A former employee of Highmark allegedly broke into the accounts of multiple customers, including a school system, and stole $1,000.

Type: Data Breach

Attack Vector: Account Takeover

Vulnerability Exploited: Unauthorized Access

Threat Actor: Zakayah Scott

Motivation: Financial Gain

Incident : Data Breach

Title: Highmark Health Data Breach

Description: The Washington State Office of the Attorney General reported a data breach involving Highmark Health on February 6, 2023. The breach occurred between December 13 and December 15, 2022, due to a phishing cyberattack, potentially affecting the personal and protected health information of 1,980 residents.

Date Detected: 2023-02-06

Date Publicly Disclosed: 2023-02-06

Type: Data Breach

Attack Vector: Phishing

Incident : Data Breach

Title: Highmark Data Breach

Description: The Maine Office of the Attorney General reported a data breach involving Highmark on February 3, 2023. The breach occurred between December 13, 2022, and December 15, 2022, due to an external hacking incident, potentially affecting 300,000 individuals, including 2,774 Maine residents. The compromised information included names and social security numbers.

Date Detected: 2023-02-03

Date Publicly Disclosed: 2023-02-03

Type: Data Breach

Attack Vector: External Hacking

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Breach.

How does the company identify the attack vectors used in incidents ?

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Remote Access.

Impact of the Incidents

What was the impact of each incident ?

Incident : Data Breach HIG13581522

Data Compromised: Sensitive information

Incident : Data Breach HIG53025623

Financial Loss: $1,000

Data Compromised: Birthdays, Residences, Phone numbers

Incident : Data Breach HIG305072725

Data Compromised: Personal information, Protected health information

Incident : Data Breach HIG753080425

Data Compromised: Names, Social security numbers

What is the average financial loss per incident ?

Average Financial Loss: The average financial loss per incident is $250.00.

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Sensitive Information, Birthdays, Residences, Phone Numbers, , Personal Information, Protected Health Information, , Names, Social Security Numbers and .

Which entities were affected by each incident ?

Incident : Data Breach HIG13581522

Entity Name: Highmark Health

Entity Type: Healthcare Organization

Industry: Healthcare

Location: Pittsburgh

Customers Affected: 67147

Incident : Data Breach HIG53025623

Entity Name: Highmark Health

Entity Type: Health Insurance Company

Industry: Healthcare

Location: Allegheny County

Customers Affected: Multiple, including a school system

Incident : Data Breach HIG305072725

Entity Name: Highmark Health

Entity Type: Healthcare

Industry: Healthcare

Location: Washington State

Customers Affected: 1980

Incident : Data Breach HIG753080425

Entity Name: Highmark

Entity Type: Health Insurance Company

Industry: Healthcare

Customers Affected: 300000

Response to the Incidents

What measures were taken in response to each incident ?

Incident : Data Breach HIG13581522

Communication Strategy: Notified impacted customers to be alerted of any fraudulent activity.

Incident : Data Breach HIG53025623

Law Enforcement Notified: Yes

Data Breach Information

What type of data was compromised in each breach ?

Incident : Data Breach HIG13581522

Type of Data Compromised: Sensitive Information

Number of Records Exposed: 67147

Incident : Data Breach HIG53025623

Type of Data Compromised: Birthdays, Residences, Phone numbers

Sensitivity of Data: Medium

Personally Identifiable Information: Yes

Incident : Data Breach HIG305072725

Type of Data Compromised: Personal information, Protected health information

Number of Records Exposed: 1980

Incident : Data Breach HIG753080425

Type of Data Compromised: Names, Social security numbers

Number of Records Exposed: 300000

Sensitivity of Data: High

References

Where can I find more information about each incident ?

Incident : Data Breach HIG305072725

Source: Washington State Office of the Attorney General

Date Accessed: 2023-02-06

Incident : Data Breach HIG753080425

Source: Maine Office of the Attorney General

Date Accessed: 2023-02-03

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Washington State Office of the Attorney GeneralDate Accessed: 2023-02-06, and Source: Maine Office of the Attorney GeneralDate Accessed: 2023-02-03.

Investigation Status

How does the company communicate the status of incident investigations to stakeholders ?

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notified impacted customers to be alerted of any fraudulent activity..

Stakeholder and Customer Advisories

Were there any advisories issued to stakeholders or customers for each incident ?

Incident : Data Breach HIG13581522

Customer Advisories: Notified impacted customers to be alerted of any fraudulent activity.

What advisories does the company provide to stakeholders and customers following an incident ?

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: was Notified impacted customers to be alerted of any fraudulent activity..

Initial Access Broker

How did the initial access broker gain entry for each incident ?

Incident : Data Breach HIG53025623

Entry Point: Remote Access

Additional Questions

General Information

Who was the attacking group in the last incident ?

Last Attacking Group: The attacking group in the last incident was an Zakayah Scott.

Incident Details

What was the most recent incident detected ?

Most Recent Incident Detected: The most recent incident detected was on 2023-02-06.

What was the most recent incident publicly disclosed ?

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-02-03.

Impact of the Incidents

What was the highest financial loss from an incident ?

Highest Financial Loss: The highest financial loss from an incident was $1,000.

What was the most significant data compromised in an incident ?

Most Significant Data Compromised: The most significant data compromised in an incident were Sensitive Information, , birthdays, residences, phone numbers, , Personal Information, Protected Health Information, , Names, Social Security Numbers and .

Data Breach Information

What was the most sensitive data compromised in a breach ?

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Social Security Numbers, Names, phone numbers, Protected Health Information, birthdays, Sensitive Information, residences and Personal Information.

What was the number of records exposed in the most significant breach ?

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 1.2K.

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident are Maine Office of the Attorney General and Washington State Office of the Attorney General.

Stakeholder and Customer Advisories

What was the most recent customer advisory issued ?

Most Recent Customer Advisory: The most recent customer advisory issued was an Notified impacted customers to be alerted of any fraudulent activity.

Initial Access Broker

What was the most recent entry point used by an initial access broker ?

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Remote Access.

cve

Latest Global CVEs (Not Company-Specific)

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.

Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.

Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.

Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.

Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Access Data Using Our API

SubsidiaryImage

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=highmark-health' -H 'apikey: YOUR_API_KEY_HERE'

What Do We Measure ?

revertimgrevertimgrevertimgrevertimg
Incident
revertimgrevertimgrevertimgrevertimg
Finding
revertimgrevertimgrevertimgrevertimg
Grade
revertimgrevertimgrevertimgrevertimg
Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Top LeftTop RightBottom LeftBottom Right
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
Users Love Us Badge