Saturday , February 15 2025

Bangladeshi health institution hacked, leaked sensitive data

Staff reporter:

International media reported that the information of a Bangladeshi health care institution has been leaked. Where it is said, a hacker group named “Siegeed Sec” has gained access to the network of the organization called Telerad Bangladesh. As a result, the company’s important information, databases are under threat.

Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Xploit_Cr3w and Blind_Virus are the two champion teams categorically for BCS ICT Fest 2025 arranged jointly by BCS and BUET....
Read More
Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

Between December 2024 and January 2025, Recorded Future's Insikt Group discovered a campaign targeting unpatched Cisco devices used by major...
Read More
Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

CISA Releases Advisories For 20 Industrial Control Systems (ICS)

On February 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued 20 advisories about serious vulnerabilities in Industrial Control...
Read More
CISA Releases Advisories For 20 Industrial Control Systems (ICS)

“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses...
Read More
“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

CVE-2023-38831
Malware campaign target Bangladeshi Government Entities: Report

A sophisticated malware campaign is targeting military and government entities in Bangladesh. It uses social engineering to deliver malicious files...
Read More
CVE-2023-38831  Malware campaign target Bangladeshi Government Entities: Report

(CVE-2025-1146
CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CrowdStrike has issued a security advisory for a serious TLS vulnerability, CVE-2025-1146, in its Falcon Sensor for Linux, Falcon Kubernetes...
Read More
(CVE-2025-1146  CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CVE-2025-0108 & CVE-2025-0110
Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Palo Alto Networks has issued advisories for two critical vulnerabilities in its PAN-OS. The vulnerabilities, CVE-2025-0108 and CVE-2025-0110, may enable...
Read More
CVE-2025-0108 & CVE-2025-0110  Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Update Now
Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC)...
Read More
Update Now  Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

This Adtech Company is Powering Surveillance of U.S. Military Personnel

Last year, a joint investigation revealed that a Florida-based data broker, Datastream Group, was selling highly sensitive location data that...
Read More
This Adtech Company is Powering Surveillance of U.S. Military Personnel

Intel Patched 374 Vulnerabilities in multiple products

In 2024, Intel addressed a remarkable 374 vulnerabilities across its software, firmware, and hardware products, distributing bug bounty rewards for...
Read More
Intel Patched 374 Vulnerabilities in multiple products
                      Hackers post on their forum

According to news sources, more than twenty gigabytes of the company’s data are available through various media. These documents contain various information including institutional documents, accounts, bills, patient reports, licenses etc.

leaked data screenshot

Managing Director of that company Mirza Sanowar Hossain initially avoided the issue. Later, after analyzing and cross-matching the various data, he admitted that the information is ok.

He said, we store our information on three servers. Among them, one server containing some local documents may have been hacked.

                         Mirza Sanower hosen, Managing Director, Telerad Bangladesh

He said that even though these documents were seized by the hackers, the server which contains the patient’s information was not affected.

He also said that the patient’s information is stored using a specific extension. Therefore, there is no opportunity to disclose patient information.

Later after showing images that are stored in patients server he admitted that this was the exact image of the file stored on that server.

This admission by the managing director means that the hackers also accessed the server where the patient database was stored. As a result, all patient information stored in this institution can be said to be at risk.

Telerad Bangladesh authorities say that Telerad Bangladesh Ltd. works with more than 1000 hospitals/diagnostic centers/health care institutions across the country.

                                                Staff working at the institution

The organization prepares reports by inputting and processing about 3,000 patient data every day. An average of 60 doctors work daily in the outsourcing system. Besides, the company provides various types of medical equipment.

No such activity was observed in the organization in cyber security. As for security, only antivirus appears to be used.

In this regard, the team leader of Cyber Threat Intelligence Unit of CERT, Maksudul Alam told that cyber attacks targeting the country’s hospitals, diagnostic centers, health-care institutions and equipment suppliers have increased in recent times.

                                  Medical equipment stored at Telerad Bangladesh

It is for this reason that CERT has strengthened its monitoring activities by taking the country’s health sector seriously. The data of a healthcare organization named Telerad Bangladesh has been found on various dark forums, which will be analyzed and verified for accuracy.

In this regard, cyber expert Suman Ahmed Sabir told that to say, we have not developed the sense that we need to save data for security. It can be said that organizations are not active in saving their own data. We have a lot of work to do in the area of awareness.

As we do not yet have a Data Protection Act, we may have a data privacy guideline. It will tell you how to protect or control which data.

In addition, it will be said that those who save the information will be subject to any punishment if the information is exposed.

ICT Secretary Samsul Arefin told that the country is moving towards building Smart Bangladesh from Digital Bangladesh. So the government is determined to protect information and data security.

He said that the government is already working on the Data Protection Act for the security of information. Once this is finalized, ensuring data security will be much easier.

The secretary said that the government is working to create a common health data for all the people of the country. Where every hospital/ diagnosis center/ health care institution will input the patient information under a central database. Accordingly all the medical history of a person will be stored in one server.

As a result, it will be possible to provide services including diagnosis in a very short time by knowing the details of the patient with access from any place.

In this case, a separate health ID card will be created for each person, through which detailed information can be known by logging in from any place.

“The Tier-iv data center can be used for the security of this huge information repository, and maximum security will be ensured so that the information is not exposed in any way,” added the secretary.

Besides, this database will be useful in the field of health insurance. It will also be easy to determine the amount of health coverage a person should get based on the type of disease.

Samsul Arefin said, if this system is introduced, the issue of information leakage will be reduced to a large extent. In addition, every organization must have proper measures in place to protect their own data.

Experts say, if an organization is a victim of a cyber attack, the network should be scanned to see if there are any suspicious artifacts or software? Also server, system reset, IT audit, vulnerability assessment and Penetration Testing (VAPT), checking the file system is a must.

Last year there was a cyber attack on the health sector of the country. Aristopharma is infected by Lockbit3 ransomware. DDOS attacks are carried out on security platforms.

Besides, it is reported that Beximco has been a victim of cyber attack in the ‘Ransomware Landscape Bangladesh-2022’ report.

Recently cyber attack on health sector is not only in Bangladesh. KD Hospital, Sun Pharmaceuticals, All India Institutions of Medical Sciences (AIIMS) in neighboring India were the victims of cyber attacks.

Renowned think tank Cyber Peace Foundation and Autobot Infosec Pvt. According to its published data, there were 1.9 million cyber attacks on India’s health sector in 2022.

According to the “State of Ransomware in the US Report” published by the MCSoft Malware Lab, there were 25 significant cyber attacks in the US healthcare sector in 2022 that put 290 hospital patients at risk.

According to some unconfirmed sources, many other institutions in the health sector are affected in one way or another. But they do not report the matter to the proper authorities for various reasons including keeping their business reputation intact.

Again, many organizations are affected and they themselves do not know. As a result, experts are not ruling out the possibility of a major attack in this sector.

Many organizations do not have a separate department looking after cyber security, cyber and IT work is done by the IT team. Therefore, to keep the business reputation intact, to protect the information from the hands of fraudsters, it is recommended to appoint a separate team for cyber security in every organization.

Check Also

January 2025

TRACKING RANSOMWARE
Akira Topped January 2025 as the Most Active Ransomware Threat

In January 2025, there were 510 global ransomware incidents, with Akira as the leading group …

Leave a Reply

Your email address will not be published. Required fields are marked *