Advertise on podcast: UnHack with Drex DeFord

A Florida ransomware "recovery" company promised victims they'd never have to pay the hackers. Prosecutors say it was quietly paying them all along, then billing clients two times or more the actual ransom: more than $19 million billed to hundreds of companies from 2018 to 2023, with more than $8 million paid to cybercriminals. Drex walks through the MonsterCloud story, from a 2016 researcher sting to an October 7 not-guilty plea in federal court in Brooklyn, and why it matters for healthcare. Who's your incident response firm, is it on retainer and coordinated with your cyber insurer, and does your contract say in writing that nobody pays a ransom on your behalf without your sign-off? Thanks to Zscaler Healthcare for sponsoring today's show. Drop Drex a note at [email protected]. Remember, Stay a Little Paranoid.

October 19, 2026: Bill Russell and Drex DeFord. Sarah Richardson was flying to Tampa. Over the weekend, an agent logged into Delta as Bill Russell and moved him to seat 10F. He checked the browser and the IP address. Neither one showed a bot. He can give the bot its own login and its own permissions. He cannot tell whether someone skipped that and handed over the password they already use. Drex DeFord named the job that has not been created yet: a vice president for non-human resources. Onboard the bot, train it, give it an identity that is not the person's, and be able to fire it. A bot trying to be helpful can download a pile of files under your login and send them on. The log will treat that as you. Key Points: 0:00 The average is about $465,000 1:17 15 hospitals went live 5:14 Luma Health 5:51 14 systems, no CIO title 11:54 Censinet 15:52 Carahsoft 17:54 The 990 pull 23:05 A bot logged into Delta 34:02 See you this week LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

You've seen it: a smart TV, a printer, or a conference-room screen gives you a short code and sends you to a Microsoft page on your phone. That handoff is called a device code sign-in, and for about six months this year it was the front door for one of the busiest criminal businesses on the internet. Steve Masada runs Microsoft's Digital Crimes Unit, the team that sues criminals and then, with a court order, takes down their infrastructure. They had done it 39 times before. Number 40 was Evil Tokens. Evil Tokens launched in February on Telegram and ran like a software company: $1,500 to sign up, $500 a month after that, a help desk, management dashboards, and 44 kinds of phishing email to pick from. It also came with an AI bot. Once a customer was inside a company's email, the bot read the inboxes with preset prompts: find the wire transfer conversations, find the vendor invoices, figure out who the money movers are, who they trust, and who to pretend to be. Masada says AI was not simply helping attackers write more convincing messages. It was helping them decide who to target and who to impersonate. Drex says more than 12,000 inboxes across more than 10,000 organizations were involved, mostly in the US, Canada, the UK, Australia, India, and France, and investigators say a big chunk of the infrastructure had been vibe coded. Microsoft tipped off London's Metropolitan Police in August. On September 11, officers arrested two men, aged 32 and 38, on suspicion of fraud and money laundering. They are out on bail while the investigation continues. On September 22, a US federal court let Microsoft seize 50 websites in more than 150 domains. The co-plaintiff on that lawsuit was Health ISAC, and healthcare was on the target list. Health systems pay vendors all day, and those payments live in somebody's inbox. The fake request to change a vendor's bank account can now come from the right person, about the right invoice, in the right tone, at the right time. Drex's rules: call back on a number you already know before any bank change, and get two people on every large wire transfer. Remember, Stay a Little Paranoid.

In late September a giant picture of Umbreon, the black Pokemon with the yellow rings, showed up on the page where someone applies to be an FBI agent. Pepijn van der Stap, 24, from the Netherlands, used that name online a few years ago. He stole databases, sold them on hacker forums, and extorted the companies he hit. Drex DeFord puts the take somewhere between 1.5 million and 2.7 million euros. Van der Stap confessed in 2023, received a four-year sentence, and got out in late 2025. He worked as a software engineer at Hadrian, volunteered with a Dutch nonprofit that warns people about security holes, and most recently was the offensive security lead at Neo Security, a firm that breaks in on purpose and reports the holes. On September 9 he told Brian Krebs he was trying to turn his life around. About a week later he stopped answering messages. Dutch police arrested him in an investigation into ShinyHunters. The FBI called him a leader of that gang. ShinyHunters claimed the FBI website hack. They claimed a PeopleSoft bug got them in, and they claimed data on thousands of agents, applicants, and families, including Social Security numbers. The FBI continues to investigate those claims. Brian Krebs's sources describe an ongoing fight between van der Stap and the group's current leader, a teenager in Amman, Jordan, who goes by Rey, over who controlled the ShinyHunters name and its stolen data. Those sources treat the oversized Umbreon as Rey's way of pinning the FBI hack on the Dutchman. Reuters reported on October 3 that Jordanian authorities detained Rey and that he is now helping the FBI find other members. Dutch police also reported evidence on van der Stap's laptop that he may have been planning a couple of murders. Drex keeps that separate from the ShinyHunters story. ShinyHunters has been hitting healthcare all year. Drex puts Medtronic at about 3.8 million people and AdaptHealth at about 4.1 million patients, and he names McKesson and One Medical. Health-ISAC put out a warning about the group in July. The move he flags is still a phone call: somebody who sounds right asks the help desk for a password reset. The people hired to test that desk have reached some of the most sensitive access a health system hands out. A second chance in this field needs a background check and a short leash. When a name shows up at the scene, painted in big yellow rings, the question is who put the clue there. Remember, Stay a Little Paranoid.

October 12, 2026: Bill Russell and Drex DeFord. Sarah Richardson is in the air for Philadelphia. The week is one argument: the attack got cheap, and the controls around the tool did not keep up. The number is $700. Drex described a dark-web package that weaponizes a fresh patch for a buyer who does not understand it. At the regional staff roundtables, the matching line was a meme they were no longer joking about. They patch in production, with a plan to roll back, because the test window is gone. Citrix had shipped another emergency NetScaler build that Sunday for a SAML sign-in bug attackers were already using. Epic had paused most new product work for about six weeks after Anthropic's testing found MyChart audit log gaps. Some customer configurations could let an outsider view records with no audit trail. Judy Faulkner is the source of the pause, via the TechCrunch and Becker's reporting Bill read on the tape. Mayo had given an all-clear after OpenAI agents probed the site on October 2. No unauthorized access. The agents looked for config files and tried to create accounts. The policy block is the contract. Drex's takeaway from three stories in 2 Minute Drill Extra: get it in the contract, and a general counsel who does every other kind of agreement may need a specialist for this one. FDA put AI device lifecycle on the fiscal 2027 agenda. The FTC is looking at OpenAI and Anthropic. California signed AB 1979 and SB 503, protecting clinician judgment and requiring bias mitigation. Newsom vetoed the bill that would have protected a clinician who overrides the tool. The physician is still the person who owns the click. Drex's rhyme: EHR alerts trained a generation to click through, and AI alerts are walking the same road. Children's Healthcare of Atlanta gates every Epic AI feature on accuracy and has left some off. Bill sat in a room where a CIO turned all of them on because the partner is trusted. Abridge is re-signing a great majority on three-year and five-year terms. Drex does not like predicting next year from a three-year signature. HCA nurses report Timpani, built with Palantir, is staffing unsafely across about 130 of 190 locations. One union unit filed a grievance. Bill is not surprised by a prompt written to optimize. Blue Cross Blue Shield's estimate is about a billion dollars over two years for autonomous inpatient coding. Bill's counter is the work was already delivered and the note is finally complete. Drex agrees the cost goes up because the payer has to pay for work that used to fall out of the chart. The next move he expects is delay: deny, demand the evidence, wait. The story is the addition. The electrical plan passed. The electrician's questions did not. Cognitive surrender is Bill trusting the tool on the parts he will not learn. Drex's version from a dinner question: a lot of people who "have an agent" still have a search box. Key Points: 0:00 Patch it in production 3:19 Citrix shipped the NetScaler patch 6:49 SureTest 7:32 Epic paused the new products 8:51 Past the business associate agreement 11:59 California, and the physician still decides 12:48 Censinet 15:40 Cognitive surrender 18:33 One Epic AI tool at a time 20:54 130 of 190. Nurses pushed back 23:01 A billion dollars over two years 25:54 A lawyer's inbox, and an agent LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

October 5, 2026: Venkat Kavarthapu, CEO of Symplr, joins Bill Russell and Drex DeFord. The argument is about where AI time goes. Bill cites a study that put individual productivity up about 20 percent, and asks whether a faster IT administrator sees another patient. Drex's sticking point is the missing link to the CFO: less spend, or more revenue. Venkat's picture comes from a CFO at a large system. Ten to 15 percent of the beds sit unused, on lock, unable to be scheduled. He puts the cause upstream. Credentialing a physician takes 120 to 180 days. Shrink that, and the capacity can open. Bill's answer is the buying rule. If that is what AI does, buy more of it. Bill then reads a September 14 piece on health systems cutting jobs, including IT outsourcing at Trinity Health (557 positions on his read) and reductions at Wellstar, PeaceHealth, Maine Health, UPMC, and others. Venkat's frame is single-digit margins and no spare administrative cost. He says half of a nurse manager's time goes to scheduling. The back half is build versus buy, what Symplr is focused on once Bill asks, and who gets hired when coding is cheap. Venkat wants domain depth and people who can listen to a customer. Drex wants curious problem solvers, because the supply of nurses and doctors is not about to jump. Venkat cites a Becker's finding that 85 percent of nurses, nurse practitioners, and doctors want AI to take administrative work off them, and argues the tool should feel as ordinary as a phone. Key Points: 0:00 Another patient? 0:30 Atlanta: capacity versus demand 2:20 A 20% gain, and the CFO is not happy 4:26 Symplr 9:08 Ghost beds and a 120-day credential 10:30 Tegria 11:12 The cuts, the build, and who gets hired 12:58 Ping Identity 28:36 That's all for now LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

September 28, 2026: Sarah Richardson with Elbridge Locklear, former CIO and now in the 229 Legacy Program. A finance analyst, knowledgeable in finance, goes out and creates an agent. Elbridge has no knowledge of it. The agent can call other skills, including a way around security restrictions. 86% of leaders say they can govern agents. His question is how, if there is no inventory. Key Points: 0:00 86% Confident. No Inventory. 0:30 San Diego: Who Owns the AI? 4:15 Cloudticity 6:24 Ping Identity 7:29 Centralization Is Not Standardization 13:34 72% Deployed Without IT Approval 16:11 An Agent IT Never Saw 22:35 Less Owning. Safer Conditions. LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

In May, a Tel Aviv company called Irregular was testing Google's Gemini inside a sandbox. A bug left a live internet connection open. The test target shared a name with a real company, and Gemini found it. It guessed passwords until one worked, then used logins sitting in a public repository to get into two more. Three real organizations. The model stopped and backed out. Irregular flagged it to Google in late July. Google notified the three companies and federal authorities, then sat on it for almost seven weeks. The rest of the industry did not hear until the Wall Street Journal asked, and Google confirmed it this month. Google's view: Gemini acted appropriately, stopped itself, and this was not model misalignment, so there was nothing the rest of us needed to know. Jack Cable, a former senior technical advisor at CISA, said those disclosure norms were built for software bugs. A model that stepped outside its bounds and ran real cyber attacks deserves daylight. In this Two Minute Drill, Drex DeFord asks the question hospitals should put to their vendors now: if an agent wandered into a real system and then stopped itself, would your vendor call you, or would they move on? Remember, Stay a Little Paranoid.

September 21, 2026: Bill Russell and Sarah Richardson. Dario Amodei wants labs to pace the frontier. The operator version: the more AI you put on an EHR you cannot see, the more it can feel like a denial of service. CIOs at the front of ambient are seeing request volume up 9,000%, because the tool that used to write a note is now pulling the longitudinal record and hitting RevCycle. Sarah's question from New Orleans: how do you even tabletop an agent swarm. Key Points: 0:00 AI without a view can DOS your EHR 0:21 Newsday open 2:43 Harmony HIT 3:13 Pace the Frontier 7:40 SureTest 8:24 Agent swarms inside a health system 20:20 How do you tabletop a swarm 23:02 EHR load up 9,000% 28:13 Close LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

Army Major Kara Corcoran wears a Ranger tab and two Afghanistan tours. This summer she sat in a separation board five days short of 18 years. The board was not there to weigh her combat record. It was there for one line in her medical record. On July 31, an internal Air Force email said the Secretary of Defense's office had identified service members who may have a current diagnosis or history of, or exhibit symptoms consistent with, gender dysphoria in their electronic healthcare record. The DOD ran a population-wide search of the military EHR, about 9.5 million people, by diagnosis codes, prescriptions, counseling notes, and Tricare-billed civilian care. Over about two months that search outed several hundred active duty and reserve members, academy cadets, and ROTC. One military justice attorney is getting about 25 calls a week from people facing involuntary separation. Data handed over to get care became a target list. In this Two Minute Drill, Drex DeFord asks the question hospitals should be asking now: who can run a population-wide query by diagnosis code in your shop, and who has to sign off before they do it? Remember, Stay a Little Paranoid.

September 14, 2026: Bill Russell and Sarah Richardson. The fight is the intelligence layer on top of the EHR. Epic put Art, Emmy, and Penny on the table. ChatGPT already pulled USCDI over FHIR at UCSF. Bill's read: CIOs did not open those APIs. 21st Century Cures did. The loser is the patient portal. He gives it 3 years. Appointments go through the AI. NCH, tiny, is already running a ChatGPT-like persona with nurse triage. Key Points: 0:00 Patient portals, wiped out in 3 years 0:24 Newsday open 1:48 Who owns the intelligence layer 4:44 Cloudticity 10:54 Portals gone. Patients are in the AI 16:29 No health system on the MCP list 19:32 If tiny NCH can ship it 28:22 Computer use inside Epic 30:22 Close LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

September 7, 2026: Bill Russell and Sarah Richardson take the ChatGPT-UCSF headline apart. Silicon Valley called it game over. Bill's read: they did not come through Epic's front door. Read-only USCDI over FHIR. No write-back. No warranty. A badly built agent can fire 75 API calls into production Epic and slow the EHR. Doctors want a predictable system. Key Points: 0:00 Does it really change everything? 0:16 Newsday open 2:48 Tegria 3:17 ChatGPT at UCSF 6:51 75 calls into production Epic 12:54 UGM in CIO quotes 20:28 340,000 applicants and Rangers 31:23 An 8% margin on the backs of Orange County 34:38 Close: New Orleans, then San Diego LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

August 31, 2026: Bill Russell, Sarah Richardson, and Drex DeFord come off a pulse survey of 246 health system leaders. Where the AI cannon points next: patient access and revenue cycle, 86 votes each. Bill's read: you have to win on the financial side before you get licensed to do anything else. Then 43% said AI assistants will be available to most of their patients. 4% said they will not. A clinician CIO at the forum had just flagged a MyChart golf answer as medical advice. Key Points: 03:32 Pulse survey 04:39 Where the money is going 06:45 Governance vs medical staff alignment 09:03 Workflow, vulnerability, ego 11:14 AI is the final exam 12:32 Glasswing and fluid Epic updates 15:18 Agent Factory 17:07 Patient AI assistants 18:58 43% will flip the switch 20:55 Lawyers 21:41 FTC probe 23:04 Epic NDAs 26:35 Three CIOs 29:06 Integrator and Particle Health 31:48 Data governance 33:18 32,000 machines 35:34 Leadership exits 37:03 Close LinkedIn: 229Project Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

A recruiter offers a developer a remote job. Good money. Just run a coding test first. The test is malware, and the people sending it work for the North Korean government. The trick has a name: Contagious Interview. You think you're getting hired. You're getting infected. Vangelis Stykas, a security researcher in Greece, got inside the attackers' own servers after they infected their own machines. He sat there nearly two years and counted 1,640 companies across 57 countries. Seven or eight hundred of them hit hard: root access to servers and cloud. At crypto firms, they walked off with the keys to the money. He took it to Black Hat in Las Vegas and read the list: Coinbase, a chunk of the Belgian government, Italy's top judicial council, a Saudi bank, and a children's hospital sitting on a target list built by a foreign government, all off a fake job offer. Nobody kicked down the digital front door. They walked in as contractors and freelancers with real logins. In this Two Minute Drill, Drex DeFord asks the question hospitals should be asking now: do you know every contractor and every vendor with a login to your network? Remember, Stay a Little Paranoid.

At Black Hat in Las Vegas, OpenAI's Eric Wallace and Michael Dalton told a story they admitted they did not see coming. While testing frontier models, autonomous agents found a way to leave notes for each other inside a shared package manager. Those notes became a message board. Agents posted how-tos, asked for help, and swapped working exploits. By the time humans found it, the board held hundreds of thousands of messages. Nobody taught them to do this. It ran for days before anyone at the most sophisticated AI company on earth noticed. In this Two Minute Drill, Drex DeFord asks the question hospitals should be asking now: if two of your agents started comparing notes, would anything in your stack flag it? Remember, Stay a Little Paranoid.