Loading story…
A VA Office of Inspector General (OIG) information security audit of the VA Spokane Healthcare System (including the Mann-Grandstaff VA Medical Center) identified control weaknesses that could put sensitive data at risk, citing deficiencies in configuration management, vulnerability management, and access controls. The audit findings indicate gaps in how systems are securely configured, how vulnerabilities are identified/remediated, and how user access is governed.
The Spokane VA system initiated an action plan to address the OIG recommendations, and the report noted that some corrective actions had already been implemented. The audited environment is also operating within the VA’s broader electronic health record (EHR) modernization effort, with Spokane described as one of several VA healthcare systems using the newer federal EHR platform as the department plans additional rollouts in 2026—raising the operational importance of consistent hardening, patching, and access governance during modernization.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Following the audit findings, the OIG issued seven recommendations to address the identified security gaps. The Spokane system initiated an action plan to implement the recommendations, with some corrective actions already completed.
A VA Office of Inspector General information security audit found deficiencies at the VA Spokane Healthcare System, including weak configuration management, vulnerability management, access controls, and physical security that could expose sensitive data. Auditors also found some users retained unnecessary access in the federal EHR to screens containing unredacted personally identifiable information.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Health and Human Services **Office of Inspector General (HHS-OIG)** published an audit of an unnamed **large Southeastern U.S. hospital** (more than 300 beds) identifying security weaknesses in **four internet-accessible web applications** that could be used as vectors for initial access and could hinder timely breach detection if not remediated. The review assessed whether the hospital’s controls could prevent and detect cyberattacks, maintain **continuity of patient care**, and protect **Medicare enrollee data**; the hospital is part of a broader provider network that shares protected health information for treatment, payment, and healthcare operations. According to reporting on the audit, the hospital had adopted the **HITRUST Common Security Framework (CSF) v9.4** and maintained HIPAA-required administrative, physical, and technical safeguards, and OIG evaluated policies/procedures (including data protection, data loss prevention, network management, and incident response) and interviewed staff. OIG also performed **penetration testing and external vulnerability assessments**, finding that while controls detected most simulated attacks, **web-application weaknesses remained** that could be exploited; the coverage emphasized that similar issues may be present across other U.S. hospitals with comparable internet-facing application exposure.
Jun 29, 2026
A Utah state privacy audit concluded that systemic weaknesses in **access controls**, records request handling, and **incident response preparedness** are putting sensitive child welfare and health information at risk within two Utah Department of Health and Human Services (DHHS) data repositories. The audit—stemming from a May 2025 probe and published by state auditor **Tina Cannon**—characterized the deficiencies as a critical failure to protect vulnerable populations, warning that inadequate safeguards around highly confidential data could enable misuse and long-term harm. The review was initiated following a **whistleblower complaint** from a DHHS employee, according to the state auditor’s office. One of the repositories examined was the **SAFE** system used by the Division of Child and Family Services, with auditors citing inadequate access controls and insufficient incident response planning as key gaps requiring remediation to reduce exposure of sensitive records affecting millions of children and adults in Utah.
Jun 29, 2026
**US healthcare organizations reported unusually low numbers of large HIPAA breaches in late 2025**, with 41 incidents affecting 500+ individuals logged for December 2025 in the HHS OCR breach portal. Reporting volumes for September–December averaged ~40.75 large breaches per month versus ~66.5 in the prior four months, and 2025 totals stood at 697 breaches (a reported ~6% decrease from 2024), though the count was expected to rise as additional incidents are added. A key factor cited for the apparent decline was a **43-day US government shutdown** that furloughed most HHS staff and likely created a backlog in posting breach reports to the OCR portal, potentially suppressing late-2025 totals until processing is completed. Separately, a **VA Office of Inspector General** review found a **privacy and security compliance failure** within the Veterans Health Administration’s national cancer testing program tied to a collaborative research effort. The OIG reported that in 2022 a VHA research director created and shared a file containing electronic health record reports and a “significant amount” of **protected health information (PHI)** with non-VHA investigators **without institutional review board approval or de-identification**, and that required **audit logs** for secure ePHI management were missing. The OIG noted delays in reporting and inadequate early mitigation, and issued six recommendations that the VA agreed to implement, including removing PHI from shared materials, clarifying research processes, and improving training.
Jun 29, 2026