Incident Score: Analysis & Impact (LAB1790325079)

In this Rankiteo incident briefing, we review the Labcorp breach identified under incident ID LAB1790325079.

The analysis begins with a detailed overview of Labcorp's information like the linkedin page: https://www.linkedin.com/company/labcorp, the number of followers: 807344, the industry type: Hospitals and Health Care and the number of employees: 42956 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 730 and after the incident was 597 with a difference of -133 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on Labcorp and their customers.

Labcorp recently reported "Labcorp Settles $2.3M Over 2019 Data Breach Affecting 27.5 Million Patients", a noteworthy cybersecurity incident.

A bipartisan coalition of 44 state attorneys general secured a $2.3 million settlement with Labcorp over a 2019 data breach that exposed the personal and medical information of over 27.5 million people, including 10.2 million Labcorp patients.

The disruption is felt across the environment, affecting AMCA’s systems (third-party debt collector), and exposing Personal and medical information, Social Security numbers, payment card details, medical test information, with nearly 27.5 million records at risk, plus an estimated financial loss of $2,287,455 (settlement amount).

In response, and began remediation that includes Strengthening information security program and incident response plan, minimizing data shared with vendors, expanding vendor risk management, enforcing stricter cybersecurity standards in vendor contracts, engaging a third-party assessor to evaluate security practices.

The case underscores how Settled, teams are taking away lessons such as Third-party vendor risk management is critical; failure to detect intrusions can lead to massive breaches; regulatory enforcement is increasing for data protection failures, and recommending next steps like Strengthen information security programs and incident response plans, Minimize data shared with vendors and ensure compliance with legal obligations and Expand vendor risk management with dedicated oversight and compliance verification.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.