Security Roundup: Mississippi Clinics Close After Ransomware, ICS Advisories Hit Record
Summary
This roundup covers ransomware disruption at Mississippi clinics, exposed identity and Elasticsearch data, Interpol arrests in Africa, record 2025 ICS advisories, AI-data protections and Google Play defenses.
Key points
- Ransomware disrupted University of Mississippi Medical Center IT, including access to Epic; clinics closed and outpatient services were canceled, while hospital and emergency services continued using manual procedures.
- The European Parliament disabled built-in AI features on work devices because some capabilities send data to external cloud services, raising cybersecurity and data-protection concerns.
- SOCRadar found three unauthenticated public Elasticsearch instances exposing more than 43 million records, including credentials, payment details and personal information; some data was later removed or restricted.
- More than 700 passport scans and state identity documents from Abu Dhabi Finance Week were publicly accessible on an unprotected cloud server; organizers attributed the exposure to a third-party vendor, and it was secured.
- Forescout reported that CISA issued a record 508 ICS advisories in 2025, covering 2,155 vulnerabilities; many vendor-published vulnerabilities lacked corresponding CISA advisories.
- An Interpol-coordinated operation across African countries led to 651 arrests of people suspected of involvement in online scams and recovery of about $4.3 million in assets.
- Google said it blocked more than 1.75 million policy-violating apps from Google Play in 2025 and expanded Play Protect scanning to more than 350 billion Android apps daily.
Article Details
- Event Type
- Multiple cybersecurity developments, including ransomware disruption at the University of Mississippi Medical Center, exposed personal and financial data, a multinational cybercrime crackdown, and security policy and protection updates.
- Impact
- The ransomware attack disrupted UMMC IT systems, including access to Epic, and led to clinic closures and canceled outpatient services; hospital and emergency services continued using manual procedures, with no reported impact on inpatient care or equipment. Separately, exposed cloud storage and misconfigured Elasticsearch instances made passport and identity documents, credentials, payment-card details, and other personal records publicly accessible. Authorities arrested 651 people in a multinational operation targeting online scams. The article also reports restrictions on AI features on European Parliament devices over data-protection concerns and Google's efforts to block harmful apps and accounts.
People
Threat Actors
Vendors
ForescoutForescout research shows that 2025 recorded a high of 508 ICS advisories from CISA, covering 2,155 vulnerabilities across various products and vendors, marking the first year exceeding 500 advisories.GoogleGoogle strengthens protections across Play Store and Android ecosystemHackerOneHackerOne revises policy language following concerns over data usage for AISOCRadarSOCRadar’s monitoring service discovered three publicly accessible Elasticsearch instances that lacked proper authentication, exposing over 43 million records in total.
Products
Agentic PTaaSvulnerability reports to train AI models, particularly in connection with the company’s recent Agentic PTaaS platform and its AI system called Hai.AndroidGoogle strengthens protections across Play Store and Android ecosystemElasticsearchMisconfigured Elasticsearch databases leak tens of millions of sensitive records onlineEpicThe University of Mississippi Medical Center (UMMC) experienced a ransomware attack that disrupted many of its IT systems, including blocking access to the Epic electronic medical records system.Google PlayGoogle prevented more than 1.75 million policy-violating apps from being published on Google Play and banned over 80,000 developer accounts attempting to distribute harmful applications during 2025.Google Play ProtectGoogle Play Protect last year expanded its scanning to over 350 billion Android apps daily, and identified more than 27 million new malicious apps from outside sources.Haiparticularly in connection with the company’s recent Agentic PTaaS platform and its AI system called Hai.
Countries
MexicoAkande, who was living in Mexico, was sentenced to eight years in prison in the US for his involvement in a multi-year operation that involved unauthorized access to the computer networks of tax preparation firms inUnited KingdomHe was extradited to the United States after his arrest in the United Kingdom.United StatesAkande, who was living in Mexico, was sentenced to eight years in prison in the US for his involvement in a multi-year operation that involved unauthorized access to the computer networks of tax preparation firms in
Industries
financeA data leak linked to Abu Dhabi Finance Week, held in December, resulted in more than 700 passport scans and state identity card documents being left publicly accessible on an unprotected cloud storage server.GovernmentHe and co-conspirators used stolen personally identifiable information to file over 1,000 fraudulent tax returns, resulting in more than $1.3 million in fraudulent refunds obtained from the US government.Tax preparationinvolvement in a multi-year operation that involved unauthorized access to the computer networks of tax preparation firms in Massachusetts.