Ry ⭐ (h/acc)

Part 2 on the UHG/Change ransomware attack. Timeline of Events: 📅 February 19: ConnectWise discloses limited details of Screen Connect vulnerability. 📅 February 20: ConnectWise deploys hotfix, detection guidance released. 📅 February 21: First wave of ConnectWise related exploits reported in the wild, Sigma HA publishes detection rules. 📅 February 22: ConnectWise suspects non-patched versions are still vulnerable. 📅 March 03: ALPHV's bitcoin wallet drained of supposed $22M from United. 📅 March 04: "Notchy," ALPHV affiliate, airs grievances on RAMP. ALPHV makes a "good game" post. ALPHA announces sales of their ransomware suite for $5M. ALPHA site displayed with "seizure" announcement. 📅 March 05: Health tech leaders call for action to support small clinics, rather than just large hospital systems. HHS issues a statement offering support regarding the cyberattack on Change Healthcare, including the removal or relaxation of prior authorization requirements. HHS Statement Link 📅 March 06: RAMP forum mod awards "Notchy" win in grievance. 📅 March 07: United formally confirms their systems are being rebuilt, and that e-pharmacy and insurance claims processes are not yet resolved. 📅 March 8th: Optum employees report their IT systems are still being integrated, while UHG/Optum execs face criticism for shaming employees over bad IT hygiene. 📅 March 15: UnitedHealthcare and Change Healthcare announce that claim payments will be restored. Discussion Points for Part 2: ✳️ Analysis of the ConnectWise vulnerability disclosure and response. ✳️ Impact assessment of the ConnectWise-related exploits in the wild. ✳️ Speculation on ALPHV's motives and tactics following the draining of their bitcoin wallet. ✳️ Insights into the grievances aired by "Notchy" and the response within the hacker community. ✳️ Examination of ALPHA's announcement regarding the sale of their ransomware suite and the implications for cybersecurity. ✳️ Updates on United's system rebuilding efforts and the ongoing disruptions to e-pharmacy and insurance claims processes. ✳️ Discussion on the challenges faced by Optum employees as they navigate IT system integration, coupled with the criticism faced by UHG/Optum executives for their approach to addressing IT hygiene issues among staff. ✳️ Analysis of the support offered by HHS in response to the cyberattack on Change Healthcare, including the removal or relaxation of prior authorization requirements. Noting the rampant speculation on social media regarding terrorism and conspiracy theories about the motivations and true actors behind the cyberattack. Highlighting the anticipated restoration of claim payments by UnitedHealthcare and Change Healthcare on March 15. Additional Fact: 📊 Change Healthcare processes 15 billion transactions annually and supports 6,000 pharmacies, underscoring the significance of the cyberattack's impact on healthcare infrastructure.

The owner of French Laundry has successfully halted a large affordable housing project that was planned near the Michelin-starred restaurant in Napa Valley.

This guy is such a fucking dweeb Brother you’ve been building OneLeet for 5 years and it sucks Focus on your incredibly high churn, not our dumb Reddit marketing ❤️

Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients. According to a detailed Substack investigation by DeepDelver, a leaked Google spreadsheet containing links to hundreds of confidential draft audit reports revealed that Delve generates auditor conclusions before any auditor reviews evidence, uses the same template across 99.8% of reports, and relies on Indian certification mills operating through empty US shells instead of the "US-based CPA firms" they advertise. Here's the breakdown: > 493 out of 494 leaked SOC 2 reports allegedly contain identical boilerplate text, including the same grammatical errors and nonsensical sentences, with only a company name, logo, org chart, and signature swapped in > Auditor conclusions and test procedures are reportedly pre-written in draft reports before clients even provide their company description, which would violate AICPA independence rules requiring auditors to independently design tests and form conclusions > All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations, and zero cyber incidents during the observation period, with identical "unable to test" conclusions across every client > Delve's "US-based auditors" are actually Accorp and Gradient, described as Indian certification mills operating through US shell entities. 99%+ of clients reportedly went through one of these two firms over the past 6 months > The platform allegedly publishes fully populated trust pages claiming vulnerability scanning, pentesting, and data recovery simulations before any compliance work has been done > Delve pre-fabricates board meeting minutes, risk assessments, security incident simulations, and employee evidence that clients can adopt with a single click, according to the author > Most "integrations" are just containers for manual screenshots with no actual API connections. The author describes the platform as a "SOC 2 template pack with a thin SaaS wrapper" > When the leak was exposed, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email" and stated no sensitive data was accessed, while the reports themselves contained private signatures and confidential architecture diagrams > Companies relying on these reports could face criminal liability under HIPAA and fines up to 4% of global revenue under GDPR for compliance violations they believed were resolved > When clients threaten to leave, Delve reportedly pairs them with an external vCISO for manual off-platform work, which the author argues proves their own platform can't deliver real compliance > Delve's sales price dropped from $15,000 to $6,000 with ISO 27001 and a penetration test thrown in when a client mentioned considering a competitor