Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Ransomware and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an law enforcement notified with yes, and and third party assistance with u.s. treasury’s office of foreign assets control (ofac), third party assistance with u.k. foreign, commonwealth & development office, third party assistance with australian department of foreign affairs, and and containment measures with asset freezes, containment measures with travel bans, containment measures with business transaction prohibitions, and remediation measures with disruption of bulletproof hosting infrastructure, remediation measures with increased operational costs for ransomware actors, and communication strategy with public attribution of sanctioned entities, communication strategy with diplomatic messaging to encourage global coordination, and enhanced monitoring with persistent monitoring of bulletproof hosting providers, enhanced monitoring with collaboration with infrastructure providers and domain registrars..

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Bulletproof hosting services (PVServers and LumoHost).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Data, Personal Data, Health Claims Data, , Name, Date Of Birth, Mailing Address, Phone Number, Email Address, Customer Ids, Credit Card Ids and .

Third-Party Assistance: The company involves third-party assistance in incident response through U.S. Treasury’s Office of Foreign Assets Control (OFAC), U.K. Foreign, Commonwealth & Development Office, Australian Department of Foreign Affairs, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Disruption of bulletproof hosting infrastructure, Increased operational costs for ransomware actors, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by asset freezes, travel bans, business transaction prohibitions and .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Asset freezes, Travel bans, Business prohibitions, .

Key Lessons Learned: The key lessons learned from past incidents are Targeting cybercrime infrastructure (e.g., bulletproof hosting) can disrupt ransomware operations at the supply chain level.,International collaboration is critical for effective enforcement against globally distributed threat actors.,Bulletproof hosting providers frequently rebrand and change jurisdictions to evade scrutiny, requiring persistent monitoring.,Sanctions against enablers (not just direct attackers) increase operational risks for cybercriminals and deter infrastructure providers.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: U.S. Treasury’s Office of Foreign Assets Control (OFAC), and Source: U.K. Foreign, Commonwealth & Development Office, and Source: Australian Department of Foreign Affairs and Trade, and Source: Statement by Jaishankar Venkatesan, Director of the U.K. Foreign Sanctions Office.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Attribution Of Sanctioned Entities and Diplomatic Messaging To Encourage Global Coordination.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Organizations Are Warned Against Transacting With Sanctioned Entities To Avoid Secondary Penalties., Infrastructure Providers (E.G., Hosting Services, Domain Registrars) Are Advised To Enhance Abuse Detection And Reporting Mechanisms. and Financial Institutions Are Urged To Monitor Transactions Linked To Bulletproof Hosting Operators..

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as U.S. Treasury’S Office Of Foreign Assets Control (Ofac), U.K. Foreign, Commonwealth & Development Office, Australian Department Of Foreign Affairs, , Persistent Monitoring Of Bulletproof Hosting Providers, Collaboration With Infrastructure Providers And Domain Registrars, .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Expand Sanctions To Cover The Full Ransomware Supply Chain (Infrastructure, Access Brokers, Monetization)., Strengthen International Frameworks For Sharing Threat Intelligence And Enforcement Actions., Develop Technological Tools To Track Infrastructure Reuse And Attribute Malicious Activity., Impose Stricter Regulatory Requirements On Hosting Providers To Prevent Abuse., .

Ransom Payment History: The company has Paid ransoms in the past.

Last Attacking Group: The attacking group in the last incident were an Name: Aleksandr ErmakovRole: Bulletproof Hosting ProviderNationality: RussianAssociated Attacks: Medibank ransomware attack (Australia) and Name: Aleksandr RakitinRole: Bulletproof Hosting OperatorNationality: RussianName: PVServers (DataImpulse)Role: Hosting Outfit for Threat ActorsType: EntityName: LumoHostRole: Ransomware Infrastructure ConcealmentType: EntityOperator: Aleksandr Rakitin.

Most Recent Incident Detected: The most recent incident detected was on Wednesday.

Most Significant Data Compromised: The most significant data compromised in an incident were Customer Data, Personal Data, Health Claims Data, , name, date of birth, mailing address, phone number, email address, customer IDs, credit card IDs and .

Most Significant System Affected: The most significant system affected in an incident was customer-facing systems.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was u.s. treasury’s office of foreign assets control (ofac), u.k. foreign, commonwealth & development office, australian department of foreign affairs, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Asset freezesTravel bansBusiness transaction prohibitions.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were date of birth, Health Claims Data, name, mailing address, credit card IDs, Personal Data, Customer Data, customer IDs, email address and phone number.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 1.9K.

Highest Ransom Paid: The highest ransom paid in a ransomware incident was No.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Asset freezes, Travel bans, Business prohibitions, .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Sanctions against enablers (not just direct attackers) increase operational risks for cybercriminals and deter infrastructure providers.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Encourage domain registrars and infrastructure providers to proactively monitor and report suspicious activity., Expand sanctions to include other layers of the ransomware economy (e.g., access brokers, cryptocurrency mixers)., Implement stricter due diligence for hosting services to prevent abuse by cybercriminals., Enhance cross-border cooperation to track and disrupt bulletproof hosting providers. and Invest in technological solutions to detect and attribute malicious infrastructure reuse..

Most Recent Source: The most recent source of information about an incident are Australian Department of Foreign Affairs and Trade, U.S. Treasury’s Office of Foreign Assets Control (OFAC), Statement by Jaishankar Venkatesan, Director of the U.K. Foreign Sanctions Office, U.K. Foreign and Commonwealth & Development Office.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Investigated.

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Organizations are warned against transacting with sanctioned entities to avoid secondary penalties., Infrastructure providers (e.g., hosting services, domain registrars) are advised to enhance abuse detection and reporting mechanisms., Financial institutions are urged to monitor transactions linked to bulletproof hosting operators., .