Cylera

Why IT/OT convergence is becoming a cyber-security challenge. For years, operational technology (OT) and information technology (IT) existed largely in separate worlds. Industrial control systems, manufacturing equipment and critical infrastructure were often isolated from corporate networks, limiting their exposure to cyber-threats. Driven by digital transformation initiatives, organisations are increasingly connecting OT environments to IT systems to enable remote monitoring, predictive maintenance, real-time analytics and greater operational efficiency. While the benefits are significant, the convergence of IT and OT is creating new cyber-security challenges that many organisations are still struggling to address. According to IoT Analytics, IT/OT convergence is one of the most important trends shaping OT security strategies in 2026, but it is also expanding the attack surface available to attackers.   The challenge is that OT systems were never designed with modern cyber-threats in mind. Many industrial environments continue to rely on legacy equipment that prioritises availability and safety over security. Once connected to wider networks, those systems can become accessible through attack paths that did not previously exist.   The growing threat is reflected in recent attack data. Research cited by NCC Group found that industrial organisations experienced more than 2,000 ransomware incidents between April 2025 and March 2026, making them one of the most targeted sectors globally. Security experts warn that organisations often focus heavily on IT security while leaving OT environments comparatively exposed. https://lnkd.in/gxdZ3nqm

276 million patient records were stolen in 2024. That's 81% of the US population. Most breach coverage focuses on operational disruption. The hidden story is what happens to patient data after it leaves the network. A stolen medical record sells for $310 on the dark web. It cannot be cancelled. For patients, the harm lasts years. We wrote about what hospitals need to understand about healthcare data breach prevention, and what they owe their communities. https://lnkd.in/ecV45Vc4

A cardiac monitoring firm that helps millions of patients diagnose and track cardiac arrhythmias says hackers stole proprietary data and patient health information and demanded a ransom. The company didn't say whether it paid. San Francisco-based iRhythm Technologies, Inc. told the U.S. Securities and Exchange Commission that hackers stole the data from "certain" third-party-hosted business applications. An SEC filing on Monday said the company discovered "unauthorized activity" on the hosted systems on June 8. The following day, iRhythm received demands from a threat actor for an undisclosed payment in exchange for not publicly releasing the stolen data, including proprietary data, patient protected health information and other personal information, the company said. https://lnkd.in/gBSjnFDC

More than 18 months after a ransomware attack disrupted care at hospitals in South East London, internal documents show at least one NHS trust is still working without fully restored systems and managing large backlogs of delayed test results. The delays mean results may not be available when clinicians need them, increasing the risk they are missed or acted on late. The June 2024 attack on #Synnovis impaired blood testing across South East London, forcing hospitals to cancel operations and delay treatment. It also affected blood supplies, leaving stocks in what officials described as a “very fragile position” and prompting warnings that only the most critical transfusions might be prioritized. The attack by the #Qilin ransomware group also involved the theft and publication of sensitive patient data. Reporting indicated that information relating to nearly one million NHS patients may have been exposed, including individuals with conditions such as cancer and sexually transmitted infections. Many patients were not notified until late 2025. NHS England said 10,152 acute outpatient appointments and 1,710 elective procedures were postponed because of the attack, and that by the end of 2024 services had been restored. However, freedom of information responses from affected organizations indicate that at least one trust has not fully returned to normal. NHS England did not respond to a request for comment. At South London and Maudsley NHS Foundation Trust (SLaM), pathology systems have not been restored as of publication, with the trust still operating in business continuity without electronic requesting or reporting and relying on paper processes and manual uploads. https://lnkd.in/eayB6aQX

Mark Your Calendars 📅 | Cylera + Cisco Webinar Series When: May 27th 2026 - 13:00 GMT 👉 Register: https://lnkd.in/egtDGBpC Excited to host an upcoming event series with Cisco focused on the future of healthcare cybersecurity and connected device intelligence. Join Cylera and Cisco to explore how network-driven visibility and IoMT security are enabling real-time risk reduction and scalable, Zero Trust environments. 🔹 Strengthening compliance and audit assurance across connected assets 🔹 Best practices for network segmentation in complex IT, IoT, and IoMT environments 🔹 Best-in-class identity management for every device on the network 🔹 Unified, high-fidelity data layer powering observability, AI, and LLM-driven security insights across all assets 👉 Learn more: https://lnkd.in/eycQM8ta #HealthcareCybersecurity #IoMT #ZeroTrust #Cisco #Cylera

Cyberattack campaigns have increased against critical infrastructure like power grids, healthcare, and energy. Cyber warfare and global threat. The global threat landscape has shifted from data theft to threats against human lives. The convergence of Operational Technology (OT) and Information Technology (IT) has increased the attack surface, exposing sectors like public utilities, aviation, and transport to outsider risks. According to Gaurav Shukla, cybersecurity expert at Deloitte South Asia, “For the past two years, we observed that cyber threats were not limited only to the IT systems. They were pervading beyond IT systems, and the perpetrators were targeting more of the critical infrastructure.” Change in digital landscape Digital transformation in recent years has increased the attack surface, providing more opportunities for threat actors to compromise critical infrastructure. “ "If you are driving a connected car on a highway at 120 km/h and suddenly find the steering is no longer in your control, you are not going to be worried about how much money is in your bank account. You are worried about the danger to your life,” Shukla added. How dangerous can it be? For instance, an attack on a medical device compromising patient information can be dangerous, whereas a cyber attack on power grids and the transmission sector can result in countrywide blackouts. Rise in connected devices. The world population of eight billion is currently surrounded by more than 30 billion IoT sensors. This means that, on average, a person is surrounded by more than 3.5 sensors. https://lnkd.in/gcX9iHMP

The U.S. federal government is warning of a high severity in an open-source library commonly used for medical imaging products that could allow an attacker to crash hospital imaging systems. There is no patch. DICOM - Digital Imaging and Communications in Medicine - is an international standard implemented most radiology, cardiology imaging, and radiotherapy devices for storing and retrieving medical image information. The DICOM standard is a widely used, said Himaja Motheram, security researcher at security firm Censys. "It’s been around forever, since the early 2000s and has significant GitHub activity and academic citations. The Grassroots DICOM library - the subject of the U.S. alert - ships by default with a number of other popular image processing tools. Many organizations probably use it through another tool and don’t even realize it," she said. The DICOM standard itself is a legacy protocol from the 1980s that is insecure by default in many ways. "The format admits executable code, no authentication or encryption, no integrity checking of the file contents by default," she said. "It was designed for maximum reliability and interoperability in clinical environments, not maximum data security," Motheram said. An advisory published Tuesday by the U.S. Cybersecurity Infrastructure and Security Agency identified the Grassroots DICOM library flaw as a "missing release of memory after effective lifetime" vulnerability. The problem affects GDCM version 3.2.2. The flaw is exploitable remotely, requires no authentication and has high availability impact, said Mykyta Mudryi, co-founder of ARIMLABS, the security firm that identified and reported the vulnerability to CISA. https://lnkd.in/gf2CwV2w

Last night was a special one. Cylera was proud to attend the Scottish Cyber Awards 2026 at the EICC in Edinburgh, where we were honoured to win the Cyber Innovation Award alongside our partners at Cisco and the Abertay cyberQuarter at Abertay University in #Dundee. The Scottish Cyber Awards celebrate the very best in Scottish cybersecurity: the people, the organisations, and the innovations that are making a real difference. Being recognised in that room means a lot. But this award is really the story of a partnership, and it has been a while in the making. Over the past year, Cylera, Cisco and the cyberQuarter have been building something genuinely unique at Abertay University in Dundee: a Healthcare Innovation Lab designed specifically to help NHS and healthcare organisations tackle one of the biggest and most under appreciated risks in healthcare today, the security of connected clinical devices. The Lab brings together Cisco's world-class network infrastructure with Cylera's IoMT and IoT security platform to create a real-world, hands-on environment. It's a place where healthcare IT and security teams can see exactly what's connected to their networks, understand the risks those devices carry, and explore how to take meaningful, practical steps to protect patients and clinical operations. We're also grateful to our partner Core to Cloud, who have been a fantastic ally in bringing Cylera's capabilities to #NHSScotland customers. Their expertise and commitment to the healthcare sector has been a real part of this journey. Healthcare cybersecurity isn't abstract. Unmanaged connected devices, infusion pumps, imaging equipment, building systems, are among the most targeted and least visible assets in any NHS trust. The work we're doing at the cyberQuarter is about changing that. None of this happens without great people. A huge thank you to Cheryl Torano and the entire cyberQuarter team at Abertay University for not only nominating us, but for being such fantastic partners in building something we're all genuinely proud of. And to the Cisco team, this is as much yours as ours. Scotland has a remarkable cybersecurity ecosystem. Last night was a reminder of just how much talent, ambition and collaboration exists here. We're proud to be part of it. 🏆 Scottish Cyber Awards 2026 | Cyber Innovation Award #CyberSecurity #HealthcareSecurity #IoMT #NHS #ScottishCyberAwards #Cisco #Cylera #CyberQuarter #AbertayUniversity #CoreToCloud Cheryl Torano Fróði Sveinsson David O'Neill Eleni Tatsi Stuart Traynor Steve McKee Ross Boyd Scott Tovey Michael Tickle Joe O'Gorman John Monaghan Gordon Thomson Adele Every Sarah Walker Timur Ozekcin Sean Abraham Sean McCue Chad Waters Jaye Freymann Scott Barnett

DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks. The U.S. Department of Justice (DoJ) on Thursday announced the disruption of command-and-control (C2) infrastructure used by several Internet of Things (IoT) botnets like AISURU, Kimwolf, JackSkid, and Mossad as part of a court-authorized law enforcement operation. The effort also saw authorities from Canada and Germany targeting the operators behind these botnets, with a number of private sector firms, including Akamai, Amazon Web Services, Cloudflare, DigitalOcean, Google, Lumen, Nokia, Okta, Oracle, PayPal, SpyCloud, Synthient, Team Cymru, Unit 221B, and QiAnXin XLab assisting in the investigation efforts. "The four botnets launched distributed denial-of-service (DDoS) attacks targeting victims around the world," the DoJ said. "Some of these attacks measured approximately 30 Terabits per second, which were record-breaking attacks." In a report last month, Cloudflare attributed AISURU/Kimwolf to a massive 31.4 Tbps DDoS attack that occurred in November 2025 and lasted only 35 seconds. Towards the end of last year, the botnet was also responsible for a series of hyper-volumetric DDoS attacks that had an average size of 3 billion packets per second (Bpps), 4 Tbps, and 54 million requests per second (Mrps). https://lnkd.in/gZKJUY2x

Honored for our Chief Security Strategist Richard Staynings to share the stage with the legendary Robert Herjavec at the HIMSS Cybersecurity Forum where they discussed cybersecurity and growing AI concerns impacting patient safety and security.