Two ransomware gangs listed the same home healthcare franchise this week, eleven days apart, with no sign either one knew the other had gotten there first. A Bavarian municipal utility had its back-office systems encrypted overnight while its water pumps and power grid kept running without anyone touching them. A Bitcoin sidechain lost $316 million to a caching bug that never came near a private key, and the attackers gave most of it back with instructions on how to patch their own exploit. And a passport and flight database covering nine years of travel through Vietnam sat exposed online, reachable through a side door left on default credentials after the front door correctly turned people away.

This week: four incidents where the control everyone expected to matter held, and the compromise happened somewhere else instead, in the layer nobody was watching.

---

Interim HealthCare / Dual Ransomware Extortion Claims

What happened: Two separate ransomware groups added Interim HealthCare, a home health and hospice provider operating across roughly 40 US states, to their leak sites within an eleven day span this August: GENESIS on August 10, targeting the Oklahoma City and Tulsa franchise operations, and Anubis on August 21. Neither claim had been independently confirmed by Interim HealthCare as of a September 9 HIPAA Journal report that brought both postings together publicly for the first time. A related entity, Interim HealthCare of Oklahoma City, separately reported a network server hacking incident to HHS on July 31 using a placeholder estimate of 500 affected individuals, a filing that predates and may or may not connect to either group’s claim.

Technical details that matter:

• GENESIS claims roughly 1 TB exfiltrated, including medical records, patient lists, clinical data, and company records, and posted a file list to its leak site without publishing the underlying data, consistent with an active ransom negotiation
• Anubis claims 530 GB exfiltrated and has already published sample data described as franchisee financial information, internal and external audit material, and day-to-day operational memoranda, an indicator the ransom was not paid
• Interim HealthCare runs as a franchise network of locally operated offices under one national brand, so a confirmed breach at one office does not establish that other locations share infrastructure or exposure
• Neither claim has produced a corresponding public filing on the HHS Office for Civil Rights breach portal as of this writing, and the only confirmed OCR filing in the timeline predates both leak-site postings

Why critical institutions should care: Two extortion groups reaching the same franchise brand within eleven days, apparently independently, points toward an entry vector that was either widely known or trivially discoverable rather than one group’s exclusive foothold. For a franchise model, that is a structural problem, not an isolated incident: brand-level reputational and regulatory exposure is centralized, but security posture is set office by office, and neither the parent company nor the roughly 40 states of patients it serves currently have a reliable way to know how many locations share the same weakness.

Key sources:

• Two Ransomware Groups Claim Attacks on Nationwide Home Healthcare Provider (HIPAA Journal)
• Interim HealthCare Hit by 2 Ransomware Gangs (Tech Insider)
• Two different groups have recently attacked Interim HealthCare entities (DataBreaches.net)

---

Update: Stadtwerke Landsberg Ransomware Attack

What happened: Stadtwerke Landsberg, a municipal utility serving one Bavarian town with electricity, water, wastewater treatment, district heating, fiber, EV charging, and municipal recreational infrastructure, had its central corporate IT systems encrypted in a ransomware attack detected the morning of September 1. The utility disconnected its internet connections, shut down affected systems, and activated its crisis response plan. It issued a formal breach notification to customers on September 7, six days after the encryption, warning that personal data including names, addresses, phone numbers, and bank details may have been accessed. No ransomware group has publicly claimed responsibility as of this writing.

Technical details that matter:

• Encrypted systems included central file servers, administrative and ERP databases, corporate email, and VoIP telephony; customer-facing phone and email access was severely degraded for a week, though the company website and contract processing stayed reachable
• Electricity distribution, drinking water extraction and treatment, wastewater treatment, district heating, fiber distribution, EV charging, and municipal recreational systems all continued operating without any reported physical disruption throughout
• The initial access vector, whether phishing, stolen VPN credentials, or exploitation of internet-facing infrastructure, has not been publicly disclosed, and investigators have not stated whether the intrusion reached the identity infrastructure (Active Directory or equivalent) underlying the corporate network
• No leak-site posting or confirmed data publication tied to Landsberg had surfaced as of this writing; the utility itself has stated it cannot rule out exfiltration, and the absence of a public leak does not establish that none occurred, since double-extortion investigations routinely take weeks to resolve

Why critical institutions should care: This is a clean example of IT/OT segmentation doing its job: corporate IT went down hard, and the physical services residents actually depend on, water pressure, electricity, heat, never stopped. But the same incident is a reminder that segmentation only protects the operational side; the utility’s administrative systems, and potentially its customers’ personal and financial data, took the full hit regardless. Regional and municipal utilities running electricity, water, and heating under one corporate roof carry a household-level data profile on every resident who has no alternative provider to switch to, which raises the stakes of the administrative-side compromise even when the taps keep running.

Key sources:

• Cyberattack encrypts systems at Bavarian municipal utility (The Record)
• Critical Infrastructure Cyberattack Encrypts Central IT Structures (Security Magazine)
• Stadtwerke Landsberg Cyberattack: What Happened, What Was Disrupted and Why Critical Services Stayed Online (Shieldworkz)

---

Liquid Network Elements Bug Exploit

What happened: On September 6, an attacker exploited a bug in Elements, the open-source software underlying Blockstream’s Liquid Network Bitcoin sidechain, to mint roughly 3,996 unbacked L-BTC tokens (about $316 million at the time) and convert them into real bitcoin through a federation member’s peg-out mechanism. The Liquid Federation paused the network and disabled new transactions. Within about a day, the party responsible for the theft returned roughly 3,400 BTC, but only after publicly instructing Blockstream through on-chain messages and a Signal contact to patch the underlying bug across every node first, an unusual negotiation carried out without the attacker ever identifying themselves.

Technical details that matter:

• The flaw sat in how Elements nodes cache the verification of range proofs, a cryptographic check meant to confirm transaction amounts are valid without revealing them; the caching bug allowed previously verified proofs to be reused in a way that let newly minted L-BTC appear legitimate despite having no bitcoin backing it
• Blockstream had publicly committed a fix for the underlying bug to the Elements GitHub repository on September 1, five days before the exploit occurred, with a commit message that described exactly where in the codebase the vulnerability sat
• The theft never touched the network’s 11-of-15 multisignature federation keys; the multisig faithfully signed off on withdrawals its own software considered valid, because the corruption happened one layer above the keys, in the logic deciding which peg-out requests were legitimate in the first place
• The minted tokens were converted to bitcoin through SideSwap’s peg-out authorization key (PAK), a single federation member’s mechanism for redeeming L-BTC, and the resulting bitcoin addresses were emptied to new destinations within roughly 20 minutes
• Blockstream released Elements v23.3.4 on September 9 to close the flaw; as of reporting, about 598.5 BTC remained outstanding against the attacker’s stated intent to return “most” of the funds

Why critical institutions should care: Financial institutions increasingly treat multisignature custody and threshold signing as the security boundary that matters most, but Liquid’s federation kept its cryptographic promises perfectly while still losing 95 percent of its reserves, because the software layer that decides what signers are even shown was compromised instead of the keys. Any institution relying on a federated, permissioned, or multisig-secured system, custody arrangements included, should treat a five-day gap between a public bug-fix commit and active exploitation as a realistic attack window rather than a theoretical one, and should confirm whether its signing infrastructure independently verifies state rather than trusting an upstream validation or caching layer an attacker could manipulate without ever touching a key.

Key sources:

• Liquid Network Exploit Drained $316M Via Software Bug, Not Stolen Keys (Tech Times)
• Hackers Return $263 Million Stolen From Liquid Network (SecurityWeek)
• Liquid Network Bitcoin Hack: Hacker Return 3400 BTC, Demand 10% Bounty (CoinGabbar)

---

Vietnam-Linked APIS Database Exposure

What happened: Security researchers at Kinryū Labs disclosed on September 8 that they had discovered an exposed Advance Passenger Information System (APIS) database holding more than 220 million passenger and crew records tied to nearly a decade of international air travel through Vietnam. The exposure was actually found on June 3 and secured within days, by June 8, but researchers held public disclosure for three months while notifying Vietnamese authorities, affected airlines, and national CERTs, a standard coordinated-disclosure timeline that nonetheless means this data sat reachable, potentially to others, for an unknown period before June 3.

Technical details that matter:

• The exposed Elasticsearch cluster, named “pax-info,” held 29 indices totaling roughly 107 GB, with two primary indices containing 210,318,069 passenger records and 10,465,631 crew records spanning January 2017 through April 2026
• Reaching the data required chaining two separate misconfigurations: a direct request to the cluster correctly returned an HTTP 401 Unauthorized response, but a secondary cloud-based access path accepted default credentials
• Exposed fields included names, dates of birth, sex, nationalities, passport or travel document numbers, document expiration dates and issuing countries, plus flight numbers, airlines, departure and destination airports, seat assignments, baggage references, and scheduled and actual flight times
• The cluster was traced to Viettel-assigned IP space in Hanoi, though no airline or government agency has been publicly confirmed as the system’s operator as of this writing, and researchers found no evidence of prior malicious access before their own discovery, an absence of evidence that does not amount to confirmation

Why critical institutions should care: APIS data exists specifically so border and aviation security authorities can screen travelers before arrival, which makes a nine-year archive of this material a high-value target for large-scale travel-pattern reconstruction, document fraud, and targeted social engineering against any of the 220 million people in it, well beyond ordinary identity theft risk. The fact that a national telecom’s IP space hosted a system with this level of sensitivity behind default credentials, on a secondary access path nobody had bothered to harden even after the primary path was configured correctly, says something uncomfortable about vendor and subcontractor oversight in the government-adjacent data pipelines that critical institutions rely on for identity verification.

Key sources:

• 220 million traveler records exposed in Vietnam-linked APIS leak (OODA Loop)
• Could Your Passport and Flight Details Be in This APIS Data Breach? (Cloaked)
• 220M Traveler Records Exposed in Airline Data Leak (Tech Insider)

---

The Pattern This Week

Every one of these incidents involved a control that held exactly where it was supposed to, while the actual compromise happened one layer over. Landsberg’s IT/OT segmentation kept water and power running through a full week of encrypted back-office systems, but nobody had planned for what happens to customer service and phone lines when that segmentation is the only thing that works. Liquid’s multisignature federation authorized every withdrawal correctly, according to its own rules, because the rules themselves had been corrupted one layer upstream. The APIS database’s primary access point correctly rejected unauthenticated requests, and a side door on default credentials made that rejection meaningless. Interim HealthCare’s franchise brand centralizes reputational risk while leaving security posture to be set independently by each office.

None of these institutions were careless about the thing they were watching. The problem in each case was a boundary drawn one layer away from where the actual trust decision got made.

See you next week.

---

What Your Business Can Do This Week

1. If your organization operates as a franchise, chain, or federated brand, assume that a security gap is shared across locations until proven otherwise, not isolated until proven shared. Two independent ransomware groups reaching Interim HealthCare within eleven days, apparently without coordinating, suggests a widely reachable entry point rather than one group’s private foothold. Confirm whether your franchise or subsidiary security baseline is centrally enforced or left up to each individual office, and make sure you would learn about a compromise anywhere in your network within days, not months.
2. If your organization runs administrative IT and physical operational systems under one roof, confirm your IT/OT segmentation would survive a full corporate IT compromise in practice, not just on a network diagram. Landsberg’s water, power, and heating ran for a full week through encrypted back-office systems specifically because operational technology could run autonomously. Test whether your own field operations, dispatch, and customer service could survive a week without email, phone, and administrative systems, and build the out-of-band communication plan before you need it, not during the incident.
3. If your organization relies on multisignature custody, threshold signing, or any federated approval workflow, remember that the signature threshold only protects against stolen keys, not against corrupted software feeding false approvals to otherwise honest signers. Confirm whether your signing infrastructure independently verifies the state it is approving rather than trusting an upstream caching or validation layer, and treat the five-day gap between Liquid’s public bug-fix commit and its exploitation as a realistic patch window for your own systems, not a comfortable buffer.
4. If your organization collects identity or travel documentation on behalf of a government function, such as border screening, visa processing, or passenger manifests, audit every access path into that data, not just the one you built on purpose. The APIS database was only reachable because a secondary cloud-based access path accepted default credentials after the primary access point correctly turned people away. A hardened front door does not help if a side door was never touched.