Second attack on McLaren Health Care in a year affects 743k people

McLaren Health Care is in the process of writing to 743,131 individuals now that it fully understands the impact of its July 2024 cyberattack. The attack was carried out on Karmanos Cancer Institute, an independent organization that's part of McLaren's network, on July 17, 2024, but was not detected until August 5, according …

[Alan Mackenzie]

What was this information doing, being accessible from the Internet?

This is surely negligence. Why does it seem natural and justifiable to put such sensitive information on the Internet, which experience shows is impossible to secure?

Surely all this info should have been on a private network, air gapped from the Internet? With controlled access. And if that means copying information over on USB sticks (encrypted, of course), so what?

Heck, even if it means people having to use pen and paper, so what? It might seem more expensive, at first, but it would keep people's private information secure, which is one of the foremost requirements of a medical establishment.

When are we going to start seeing directors going to prison for being so casual with private personal information?