Ernest Oporto

The state of Rhode Island publicly released the results of a third-party analysis of the 2024 RIBridges cyberattack and data breach at a press conference with Rhode Island Governor Dan McKee and Chief Digital Officer Brian Tardiff. Cybersecurity company CrowdStrike conducted the analysis, which revealed the five-month timeline of the breach and a more accurate number of impacted individuals -- approximately 644,401 people. RIBridges is a system run by Deloitte that the state of Rhode Island uses to administer important social services benefits like health insurance, food stamps and the Child Care Assistance Program. As previously reported, Deloitte informed the state of a potential security threat to RIBridges on Dec. 5, 2024, stating that there was a high probability that a cyberthreat actor had obtained files containing sensitive information. The Brain Cipher cyberthreat group later took responsibility for the hack. The state took RIBridges temporarily offline and later sent notification letters to nearly 650,000 individuals. The newly released third-party analysis provided clarity on how the cyberthreat actor gained access to the RIBridges environment and how it performed data access, staging and exfiltration activities on 28 RIBridges systems. Reviewing post-incident analyses of healthcare data breaches can help defenders bolster security efforts. https://lnkd.in/gBJR5kBh

7

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

Excellent new contribution to Claroty Nexus from Providence CISO Mike Ratliff on the #healthcare system's teardown of traditional #GRC. Providence's approach: GRAC — Governance, Risk, Attack Surface Management, and Compliance — is a risk-centric, threat-aligned function built for outcomes, not reporting, Ratliff writes. https://hubs.li/Q03yc3pB0

2

US charges former Accenture employee with misleading feds on cloud platform’s security. Danielle Hillmer, most recently employed with SentinelOne, allegedly concealed a cloud product’s noncompliance with federal security regulations. Source: https://lnkd.in/gXu8eNM3

11

4 Comments

Shawn Murphy and Jeff Cassidy, CISSP explain how threat hunting fits into the “Left of Bang” strategy and mindset, a driving principle of WEI’s deep cybersecurity practice. @CyberTrust Massachusetts 💡 Listen to the full #podcast episode here: https://lnkd.in/eYGXQfmz

4

Good morning! Here is this week's ICS Advisory, Other CERT, and Vendor vulnerability advisories weekly summary for 23 - 27 February 2026. This past week, CISA released 12 new CISA ICS Advisories for the following vendors: Copeland, InSAT, CloudCharge, EV Energy, Chargemap, SWITCH EV, Mobility46, EV2GO, Gardyn, Johnson Controls, Inc. Pelco, Inc. and Schneider Electric. One update was released this past week for Honeywell Schneider Electric, Mitsubishi Electric, Hitachi Energy, ICONICS and Mitsubishi Electric. Based on the new CISA advisory, #Energy, #TransportationSystems, #Commercial #Facilities, #Healthcare and #PublicHealth, #Defense #Industrial Base, #Food and #Agriculture, Critical #Manufacturing, #Government #Facilities, #Financial #Services, #InformationTechnology, #Water and #WastewaterSystem are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 16 new ICS Advisories for Festo, ARC Informatique, Moxa, Phoenix Contact, ABB, Bosch Rexroth, Hitachi Energy, Ubiquiti Networks, Trumpf, PDUexperts, Socomec and one update for Hitachi Energy. View the summary details of other CERT & Vendor product advisories identified last week (23 - 27 February 2026) at: https://lnkd.in/efKiMsxs This past week, CISA added 3 new Known Exploited Vulnerability (KEV) Catalog. None added this week correlated to a CISA ICS Advisory. ICS Advisory Project identified one CVE: CVE-2020-11023 – JQuery Cross-Site Scripting (XSS) Vulnerability listed in the Festo advisory for CODESYS vulnerabilities in Festo Automation Suite [VDE-2025-108]. This week, ICS Advisory Project, powered by Industrial Data Works LLC, in collaboration with EmberOT, released our 2024–2025 ICS/OT Vulnerability Intelligence Report. Check it out at: https://lnkd.in/ehG4DNPs Thank you all at EmberOT for your amazing support in getting this report out this year. Acknowledgement: Thank you Mikael Vingaard at the ICSRange for sharing with ICS[AP] the new ICS Advisory for PDUexperts. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides & Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week!  #CISA #ot #ics #otsecurity #icssecurity  #cybersecurity #cybersecurityawareness #industrialautomation #buildingautomation #oilandgas #maritime #vulnerabilitymanagement Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

29

CMMC compliance isn't a checkbox exercise—it's a strategic imperative for every DoD contractor. Many organizations delay action, waiting for final deadlines or clearer guidance. But NIST SP 800-171 requirements have been contractually mandated for years. Waiting only increases your risk exposure. At TXAZ Consulting Services, we provide a phased, engineering-led approach: • Conduct comprehensive readiness assessments to identify gaps. • Develop tailored remediation plans that align with your operational realities. • Implement technical controls and continuous monitoring solutions. • Prepare you thoroughly for certification audits with mock assessments and evidence documentation. Our certified cybersecurity experts bring decades of DoD and industry experience to ensure your compliance efforts are defensible and sustainable. Start reducing risk today. Don't wait for shifting timelines—build a compliance roadmap that protects your contracts and your reputation. How far along is your company on its CMMC path? #CMMCCompliance #CybersecurityServices #DoDContractors #CUIProtection #CyberAwareness

4

CISA just released updated guidance for its Software Bill of Materials (SBOM) Minimum Elements, and they're looking for public comment! ✍️ This is a great opportunity to help shape the future of cybersecurity. An SBOM is a critical tool for identifying vulnerabilities and managing risks in software. Key Details: What: Updated guidance on SBOM Minimum Elements. Why: To reflect advancements in tooling and implementation since 2021. What's new: Refined data fields, automation support, and operational practices. How to contribute: Provide your feedback via the Federal Register or CISA's anonymous survey by October 3, 2025. https://lnkd.in/d58ts98t Sharing your expertise can help make SBOMs more scalable, interoperable, and comprehensive for everyone. Let's contribute to a more secure digital world! 🌎 #cybersecurity #CISA #SBOM #infosec #riskmanagement

1