◆ The Department of Justice (DOJ) seized around $500,000 in Bitcoin ransom paid by two health care organizations in Kansas and Colorado to North Korean ransomware actors and their conspirators.^[1] The seizure of the two ransoms resulted from “rapid reporting and cooperation from a victim” and disrupted activities of a North Korean state-sponsored group known as “Maui,” Deputy Attorney General Lisa Monaco told attendees July 19 at the International Conference on Cyber Security. The reporting also allowed investigators to identify a previously unknown strain of ransomware, Monaco said. According to court documents, hackers used Maui in May 2021 to encrypt the files and servers of a Kansas medical center. After more than a week of being unable to access encrypted servers, the Kansas hospital paid approximately $100,000 in Bitcoin to regain the use of their computers and equipment. Because the medical center notified the FBI and cooperated with law enforcement, the FBI was able to identify the ransomware and trace the cryptocurrency to China-based money launderers, the DOJ said. Then, in April 2022, the FBI observed an approximately $120,000 Bitcoin payment move into one of the identified cryptocurrency accounts. The investigation confirmed that a medical provider in Colorado had just paid a ransom after being hacked by actors using the same Maui ransomware strain. In May, the FBI seized the contents of two cryptocurrency accounts that had received funds from the Kansas and Colorado health care providers and began proceedings to return the funds to the victims.

◆ A sweeping bipartisan federal privacy bill that already has been approved by a key House subcommittee is facing headwinds in the form of massive corporate lobbying aimed at derailing it.^[2] The American Data Privacy and Protection Act, which would restrict the types of data companies can collect from online users and how they can use that data, is the result of years of negotiations between Democratic and Republican lawmakers. Its provisions would impact companies in every consumer-centric industry that compiles massive amounts of user data and relies on targeted ads to attract customers. It would tremendously impact entities that currently collect, process and transmit health information but are not subject to HIPAA. The proposed legislation would override most state privacy laws, as Republicans have sought, in exchange for granting consumers a right to bring lawsuits against violators, which Democrats have called for.^[3] However, several key senators have expressed concerns about the legislation’s provisions. Some California-based representatives have said they will not support the bill if it overrides California’s extensive privacy protections. In addition, the proposal has become one of the most lobbied bills in Congress, drawing attention from more than 180 corporate clients, including Amazon, the Walt Disney Corporation and Target, according to data from research group OpenSecrets.