UnHack with Drex DeFord

October 26, 2026: Bill Russell and Sarah Richardson, back from the CTO, CIO, and CISO summits at Lake Oconee.
At Lake Oconee, Bill Russell heard a lot of AI governance talk. Some of it sounded responsible. Some of it sounded like a shield held up by leaders who find AI overwhelming and want the pace slowed to one they are comfortable with. In his view, AI governance should speed up the adoption of technology.
His advice to CIOs is to start in IT and leave clinical for later. Put the network configs and security settings in one repository an AI can read, and in about 15 minutes it can list the holes and the certificates that have expired, before a server goes down. Sarah Richardson named the expired certificate tied to the service account of someone who no longer works there. Health systems have never trusted people with the medical record without controls. Bots get the same job.
Register for UST's Oct 29 webinar with J.D. Whitlock and Jason Buck: https://events.ust.com/Epic-on-Azure-IRE
Key Points:
0:00 Governance should speed adoption up

0:29 Lake Oconee: governance or a shield

4:41 Clearsense

6:30 AI finds what sits in plain sight

9:12 Censinet

9:52 300 projects and the right yes

13:57 UST

14:37 Rush, Elisity, Epic, UMass

22:37 Security, tech, and the bench

29:29 My admin is a bot

32:46 You're just flat-out wrong

35:36 See you next week

LinkedIn: 229Project
Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

A Florida ransomware "recovery" company promised victims they'd never have to pay the hackers. Prosecutors say it was quietly paying them all along, then billing clients two times or more the actual ransom: more than $19 million billed to hundreds of companies from 2018 to 2023, with more than $8 million paid to cybercriminals. Drex walks through the MonsterCloud story, from a 2016 researcher sting to an October 7 not-guilty plea in federal court in Brooklyn, and why it matters for healthcare. Who's your incident response firm, is it on retainer and coordinated with your cyber insurer, and does your contract say in writing that nobody pays a ransom on your behalf without your sign-off?
Thanks to Zscaler Healthcare for sponsoring today's show. Drop Drex a note at drex@229project.com.
Remember, Stay a Little Paranoid.

October 19, 2026: Bill Russell and Drex DeFord. Sarah Richardson was flying to Tampa.

Over the weekend, an agent logged into Delta as Bill Russell and moved him to seat 10F. He checked the browser and the IP address. Neither one showed a bot.

He can give the bot its own login and its own permissions. He cannot tell whether someone skipped that and handed over the password they already use. Drex DeFord named the job that has not been created yet: a vice president for non-human resources. Onboard the bot, train it, give it an identity that is not the person's, and be able to fire it. A bot trying to be helpful can download a pile of files under your login and send them on. The log will treat that as you.

Key Points:

0:00 The average is about $465,000

1:17 15 hospitals went live

5:14 Luma Health

5:51 14 systems, no CIO title

11:54 Censinet

15:52 Carahsoft

17:54 The 990 pull

23:05 A bot logged into Delta

34:02 See you this week

LinkedIn: 229Project

Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

You've seen it: a smart TV, a printer, or a conference-room screen gives you a short code and sends you to a Microsoft page on your phone. That handoff is called a device code sign-in, and for about six months this year it was the front door for one of the busiest criminal businesses on the internet. Steve Masada runs Microsoft's Digital Crimes Unit, the team that sues criminals and then, with a court order, takes down their infrastructure. They had done it 39 times before. Number 40 was Evil Tokens.
Evil Tokens launched in February on Telegram and ran like a software company: $1,500 to sign up, $500 a month after that, a help desk, management dashboards, and 44 kinds of phishing email to pick from. It also came with an AI bot. Once a customer was inside a company's email, the bot read the inboxes with preset prompts: find the wire transfer conversations, find the vendor invoices, figure out who the money movers are, who they trust, and who to pretend to be. Masada says AI was not simply helping attackers write more convincing messages. It was helping them decide who to target and who to impersonate. Drex says more than 12,000 inboxes across more than 10,000 organizations were involved, mostly in the US, Canada, the UK, Australia, India, and France, and investigators say a big chunk of the infrastructure had been vibe coded.
Microsoft tipped off London's Metropolitan Police in August. On September 11, officers arrested two men, aged 32 and 38, on suspicion of fraud and money laundering. They are out on bail while the investigation continues. On September 22, a US federal court let Microsoft seize 50 websites in more than 150 domains. The co-plaintiff on that lawsuit was Health ISAC, and healthcare was on the target list. Health systems pay vendors all day, and those payments live in somebody's inbox. The fake request to change a vendor's bank account can now come from the right person, about the right invoice, in the right tone, at the right time. Drex's rules: call back on a number you already know before any bank change, and get two people on every large wire transfer.
Remember, Stay a Little Paranoid.

In late September a giant picture of Umbreon, the black Pokemon with the yellow rings, showed up on the page where someone applies to be an FBI agent. Pepijn van der Stap, 24, from the Netherlands, used that name online a few years ago. He stole databases, sold them on hacker forums, and extorted the companies he hit. Drex DeFord puts the take somewhere between 1.5 million and 2.7 million euros. Van der Stap confessed in 2023, received a four-year sentence, and got out in late 2025. He worked as a software engineer at Hadrian, volunteered with a Dutch nonprofit that warns people about security holes, and most recently was the offensive security lead at Neo Security, a firm that breaks in on purpose and reports the holes. On September 9 he told Brian Krebs he was trying to turn his life around. About a week later he stopped answering messages. Dutch police arrested him in an investigation into ShinyHunters. The FBI called him a leader of that gang.

ShinyHunters claimed the FBI website hack. They claimed a PeopleSoft bug got them in, and they claimed data on thousands of agents, applicants, and families, including Social Security numbers. The FBI continues to investigate those claims. Brian Krebs's sources describe an ongoing fight between van der Stap and the group's current leader, a teenager in Amman, Jordan, who goes by Rey, over who controlled the ShinyHunters name and its stolen data. Those sources treat the oversized Umbreon as Rey's way of pinning the FBI hack on the Dutchman. Reuters reported on October 3 that Jordanian authorities detained Rey and that he is now helping the FBI find other members. Dutch police also reported evidence on van der Stap's laptop that he may have been planning a couple of murders. Drex keeps that separate from the ShinyHunters story. ShinyHunters has been hitting healthcare all year. Drex puts Medtronic at about 3.8 million people and AdaptHealth at about 4.1 million patients, and he names McKesson and One Medical. Health-ISAC put out a warning about the group in July. The move he flags is still a phone call: somebody who sounds right asks the help desk for a password reset. The people hired to test that desk have reached some of the most sensitive access a health system hands out. A second chance in this field needs a background check and a short leash. When a name shows up at the scene, painted in big yellow rings, the question is who put the clue there.

Remember, Stay a Little Paranoid.