Fortinet finally weighs in on FortiBleed - it&#x27;s not a bug. Plus a healthcare AI firm loses 1.4 million people&#x27;s data to a single phishing email, a trading bot built to prey on others gets played for $15 million, and LastPass lands back on a breach list it didn&#x27;t cause.<br><br>00:00 Headlines 00:28 Xsolis Phishing Fallout 01:47 Texas License Vendor Hack 02:59 MEV Bot Gets Robbed 05:26 FortiBleed Fortinet Response 06:42 LastPass Caught in Clue 08:40 Wrap Up and Sign Off

FortiBleed: Fortinet Says It's Not a Bug

Cybersecurity Today

# Full Transcript

**Podcast:** Cybersecurity Today

## Participants

- **David Shipley** (Cybersecurity Today)

## Transcript

A phishing attack in a health tech firm nets the data of nearly 1.4 million people. Cybercriminals bag 3 million Texans' personal information. A cryptobot built to pounce on opportunity, gets fed a fake one, and pays dearly for it. Fortinet comes out on FortiBleed. It's not a bug. This is Cybersecurity Today, and I'm your host, David Shipley. Let's get started.

A phishing attack has cost a U.S. healthcare technology firm the personal data of nearly 1.4 million people. The company is called Axalis, and it built AI-powered software used by more than 600 hospitals and health insurers. Its platform, Dragonfly, reads clinical data in real time to guide decisions on patient care and insurance coverage.

That includes medical necessity reviews, patient status, discharge planning, and reimbursement. According to Bleeping Computer, the trouble started on January 20th. A targeted phishing attack gave intruders their foothold in the Axalis network. The company caught the unauthorized activity two days later. On January 22nd, contained it and brought in outside experts.

The investigation found the attackers reached files holding customer information. The list is the kind of data that does real damage. Names, addresses, dates of birth, health insurance details, social security numbers, and most painfully of all, medical treatment information. We're all lost in the breach. Axalis isn't the only organization explaining a breach this week.

Three million people who just wanted to hunt or fish in Texas have had their personal data exposed. The Texas Parks and Wildlife Department has disclosed a breach. And like a lot of breaches lately, it didn't happen on their own system. According to Security Week, the department learned from the Texas Cyber Command that a third-party vendor, the company that sells hunting and fishing licenses, had been hacked.

The data taken is enough to do harm. Email addresses, physical addresses, phone numbers, driver's license information, and in some cases, passport numbers. More than three million license holders may be caught up in the breach. There is some good news. The department says social security numbers, dates of birth, and financial information were not taken. And there's no evidence anyone under 18 was caught up in the breach.

Who the vendor is, and who the criminal group is behind the attack, are both still unknown. Those two breaches had real victims. People who landed over their data and trusted someone to guard it. This next one may be a little bit harder to feel sorry for. An Ethereum trading bot called Jared from Subway has lost 15 million dollars. It lost it the same way it made it. Automatically.

Except this time, the bot got played. Jared from Subway is what's known as a maximal extractable value bot, or an MEV. It's one of Ethereum's most aggressive sandwich bots. What's a sandwich bot...

FortiBleed: Fortinet Says It's Not a Bug

Transcript

Built for investment professionals

Every day you wait, your competitors are finding
edge in conversations you're not hearing.

FortiBleed: Fortinet Says It's Not a Bug

Transcript

Built for investment professionals

Every day you wait, your competitors are findingedge in conversations you're not hearing.

Every day you wait, your competitors are finding
edge in conversations you're not hearing.