Evergreen Cyber Security

[Evergreen Cyber Security @EvergreenCS117]

Myth: "HIPAA bans emailing patients." HHS says providers may email patients with reasonable safeguards: verify the address, limit what goes in unencrypted email, and meet Security Rule requirements. If a patient objects, offer another channel. #HIPAA https://t.co/GbRniYAgY6

[Evergreen Cyber Security @EvergreenCS117]

QR code tip: treat a code in an email or text like any other link. If it claims a payment failed or a login needs attention, go to the site yourself. Check the URL after scanning, and look for stickers over the QR codes on your own signs. https://t.co/MWW4J1cDlw

[Evergreen Cyber Security @EvergreenCS117]

Google fixed an exploited Chrome zero-day (CVE-2026-125350). Update to 157.0.8103.50 or later, then fully restart the browser so the fix applies. CISA notes Edge and other Chromium-based browsers may be affected, so check those too. https://t.co/FjnqUEGLCm

[Evergreen Cyber Security @EvergreenCS117]

Myth: "Law firms only notify clients of a breach if state law requires it." ABA Formal Opinion 483 says lawyers must tell current clients when material client info is, or is reasonably suspected to be, accessed, lost or disclosed. Check state rules. https://t.co/7c6wgiRUlI

[Evergreen Cyber Security @EvergreenCS117]

Microsoft 365 tip: keep at least two emergency "break-glass" admin accounts so a lost phone or bad policy can't lock you out. Microsoft advises cloud-only .onmicrosoft.com accounts, phishing-resistant sign-in like a FIDO2 key, and alerts on every use. https://t.co/DbyZwZ5Tzu

[Evergreen Cyber Security @EvergreenCS117]

Microsoft's November Patch Tuesday fixes an exploited Outlook zero-day (CVE-2026-124194). Opening a crafted message file can leak a user's NTLMv2 hash, letting attackers authenticate as that user. Update Outlook and Microsoft 365 Apps now. https://t.co/AKhCd41YNz

[Evergreen Cyber Security @EvergreenCS117]

Myth: "Our cloud vendor is HIPAA compliant, so we're covered." HHS doesn't certify products. A vendor that stores or processes ePHI for you needs a signed business associate agreement, even if the data is encrypted. #HIPAA https://t.co/9Yfi9Jsp0m

[Evergreen Cyber Security @EvergreenCS117]

Payment fraud tip: ask your bank to turn on dual approval, so one person creates an ACH or wire and a second person releases it, ideally from a different computer. Add alerts for unusual transfers and reconcile accounts daily. https://t.co/RgOgDwuD54

[Evergreen Cyber Security @EvergreenCS117]

Android's November bulletin fixes a critical flaw (CVE-2026-58868) that could allow remote code execution without user interaction. Check phones for patch level 2026-11-05 or later once the maker ships it, and replace ones that no longer get updates. https://t.co/G1HJ6WVdge

[Evergreen Cyber Security @EvergreenCS117]

Vendor finished fixing your system? Close their remote-access session and disable temporary access. Give support accounts an owner and an expiration date. Access for a one-time repair shouldn't become a permanent way into your business. #CyberSecurity

[Evergreen Cyber Security @EvergreenCS117]

Shared office printer? Use PIN-protected print release for sensitive documents if your printer supports it. Collect pages immediately, and check the output tray before leaving. Client privacy doesn't stop at the computer screen. #SmallBusiness

[Evergreen Cyber Security @EvergreenCS117]

Stepping away from the front desk? Lock the screen, even for a minute. Set automatic screen locks on office PCs, too. Patient records, tax returns, and client files shouldn't stay visible to the next person who walks by. #CyberSecurity

[Evergreen Cyber Security @EvergreenCS117]

Myth: "the padlock means the site is safe."

HTTPS only encrypts the connection. Phishing sites can show a lock too. Read the exact domain before you log in or pay—don't trust the icon alone.

FBI IC3: https://t.co/0QikvWYZFz
#phishing

[Evergreen Cyber Security @EvergreenCS117]

Synology warns C3RB3R ransomware is hitting unpatched NAS devices. Update DSM now, enable auto-updates, and keep the management UI off the public internet.
BleepingComputer
#CyberSecurity

[Evergreen Cyber Security @EvergreenCS117]

Your business phone number is a login key. If it gets texted codes or takes customer calls, ask your carrier to turn on SIM swap and port-out protection and set an account PIN. Then move key accounts from text codes to an authenticator app or passkey. #SMB #CyberSecurity

[Evergreen Cyber Security @EvergreenCS117]

CISA added Apple flaw CVE-2024-27834 to its actively exploited list on Nov 4. It hits iOS, iPadOS, macOS and Safari, and was patched back in 2024. If any company iPhones or Macs are still behind on updates, today's the day to catch them up. https://t.co/5bnpp1OZoS #PatchManagement

[Evergreen Cyber Security @EvergreenCS117]

Quick win: don't read email or browse the web from an admin account. Give everyone, IT included, a standard daily account and a separate admin login used only when needed. One bad click then can't hand an attacker the keys to everything.
#SMB #CyberSecurity

[Evergreen Cyber Security @EvergreenCS117]

Low CVSS score, real attacks. VMware ESXi CVE-2026-41709 (2.7) is on CISA's exploited list: it lets an ESXi admin act without being logged. CrowdStrike says Warp Panda used it at US orgs, incl. law firms. Patch, and send logs off-host.

#infosec https://t.co/L75GJo4uc3

[Evergreen Cyber Security @EvergreenCS117]

Holiday shipping season brings a wave of fake "delivery problem" texts and emails. Easy team rule: never tap the link. Check status on the carrier's site you type in yourself, or from the original order. Forward scam texts to 7726 (SPAM) to report them. #SmallBusiness

[Evergreen Cyber Security @EvergreenCS117]

WordPress 7.1.4 (Oct 28) fixes a core-update flaw that can let an unauthenticated attacker run code on your server. Wordfence already sees exploit attempts. Confirm every site is on 7.1.4 or its branch's patch, and check for unknown admins. #WordPress
https://t.co/COatGK7Mqi