100+ Websites Hacked, Sensitive Records Exposed, and Three Critical Flaws Rated 9.9

Visitors to more than 100 compromised websites encountered what appeared to be a routine Cloudflare security check. Following its instructions installed malware designed to steal passwords and access files.

The latest ColorTokens Threat Advisory also covers breaches involving healthcare and military personnel records, a cyberattack that disrupted hospital services, and seven serious software vulnerabilities.

When a Security Check Installs Malware

Attackers compromised over 100 websites and displayed fake Cloudflare verification pages to Windows users arriving from search engines.

The pages instructed visitors to run commands that installed LunexStealer malware. Once installed, it could steal browser credentials, collect information, and access files. It also installed a malicious browser extension to support credential theft.

People thought they were completing a routine security check. Instead, they were installing malware that could expose information on their computers and potentially compromise business systems.

Sensitive Records Exposed Through Accounts and Third Parties

Several healthcare breaches involved contractors, employee accounts, and systems holding sensitive patient and employee information.

• Paylogix: Attackers accessed and copied personal and health information belonging to 41,739 people. The records included Social Security numbers and benefits information. Some also contained financial details, medical information, and access credentials.
• Blossom Health: A phishing attack on a contractor exposed electronic patient records. Attackers downloaded a limited number of medical records and a patient spreadsheet. At least 2,103 Texas residents were affected.
• El Camino Health: An attacker accessed four Microsoft 365 accounts and copied or downloaded documents containing diagnoses, prescriptions, Social Security numbers, and insurance information. Some patients also had financial details exposed.
• HCA Healthcare: Unauthorized access exposed patient and employee records, affecting at least 15,096 Texas residents. The compromised information included medical and insurance records, along with employment and immigration details relating to medical residents.

Military Records Raise Concerns Beyond Identity Theft

At the Pentagon’s Defense Manpower Data Center, unauthorized users reportedly accessed a vulnerable server containing Social Security numbers and military personnel records.

The number of people affected has not been disclosed.

Beyond financial fraud, exposed information could potentially help foreign adversaries identify or profile military personnel with access to sensitive information.

It remains unclear whether records linked to active security clearances were involved.

A Contained Attack Still Disrupted Hospital Services

At the University of New Mexico Health System, a cyberattack disrupted access to critical electronic systems. Ambulances were diverted for two hours, appointments and outpatient surgeries were canceled, and new patient admissions were temporarily restricted.

UNM Hospital is New Mexico’s only Level 1 trauma center. Nearby hospitals helped accommodate patients during the disruption.

Although some employee devices were affected, containment efforts prevented attackers from reaching core systems and servers. Critical systems were restored, and ambulance traffic returned to normal.

The extent of any patient data exposure remains unknown. Even with the attack contained, the temporary loss of essential systems had already interrupted patient care.

Three Critical Vulnerabilities Could Give Attackers Different Levels of Access

The advisory identifies seven serious software vulnerabilities, including three rated 9.9.

• Windows Internet Key Exchange: An unauthorized attacker could exploit the flaw to run code remotely over a network.
• VMware vCenter: Attackers with network access could exploit a flaw in the Syslog server to execute malicious code.
• VeloCloud Orchestrator: An authenticated user could exploit the vulnerability to gain superuser operator privileges and access restricted functions.

Another flaw, rated 9.3, affects PHP and could allow remote code execution. The report also covers vulnerabilities in Windows Active Directory Domain Services, Microsoft Exchange Server, and Windows Shell.

The access needed to exploit these flaws varies. Security teams can review affected versions, configurations, and vendor guidance to determine which systems require attention.

Where Security Teams Can Focus

The findings highlight several areas for security teams to review:

• Check employee and contractor access to sensitive records and applications.
• Review third-party systems that store personal and benefits information.
• Investigate credential theft risks from compromised websites and fake security checks.
• Prioritize software updates based on affected versions and vendor guidance.
• Use microsegmentation to restrict unauthorized access and limit attacker movement.
• Test containment and recovery plans for disruptions to essential services.

Access the full ColorTokens Threat Advisory for incident details, affected software versions, and security guidance.

Connect with our advisors to discuss how restricting access and containing threats can help your organization stay breach ready.