Podcasts, articles, and executive intelligence for healthcare leaders who need useful context without wasting time.
Read the Weekly BriefWhat health IT leaders are talking about this week
New episode · November 5
2 Minute DrillOn Monday, October 26th, the University of New Mexico Health Sciences Center spotted a cyber event in Albuquerque. By about 12:30, ambulances were being turned away from UNM Hospital — New Mexico's only Level I trauma center, burn unit, and children's hospital — and for about two hours the most seriously injured people in the state had to go somewhere else. That evening a new ransomware gang calling itself Byod claimed the attack, saying they took out 36,000 systems, Active Directory, the entire Microsoft Entra tenant, and walked away with Social Security numbers, payroll, patient information, and Cerner EHR rosters. UNM says the attack hit some end-user devices but did not penetrate core systems or servers, critical systems were coming back online by the 27th, and it made no concessions. Then Byod posted again — this time to apologize, offer free decryption keys for hospitals only, and say they would pay affected patients up to $2,500 each. Tucked into that apology was a line that said they were still going to keep the data, and the offer asked patients to provide proof over Session, an encrypted messaging app. Drex's read: that looks a lot like a phishing lure. UNM moved fast, warning patients and staff not to respond and to report contact to the FBI at ic3.gov. Health systems plan for downtime and diversion; what they often don't plan for is the week after, when attackers or copycats contact patients with fake refunds and fake billing calls. If you get hit tomorrow, is your patient scam warning already written and ready to post on day one? Thanks to Zscaler Healthcare for sponsoring today's show. Drop Drex a note at drex@229project.com. Remember, Stay a Little Paranoid.
When Marshfield Clinic joined Sanford Health in January 2025, revenue cycle did not wait on the technology. Roxi Foreman, VP Tech Services at Sanford Health, tells Sarah Richardson how clinical, revenue cycle, and IT…
Go to episode
New this week
October 26 – November 1, 2026
Published Monday, November 2
AI is shrinking the gap between a known flaw and a working exploit, and most governance, patching and risk-pricing processes were not built for that speed.
Dominating the week
Drawn from conversations with Drex DeFord, Dan Holland, Jay Stewart and Bill Russell.
Read the full Weekly BriefWhat they’re talking about
A critical PHP vulnerability allowing unauthenticated remote code execution was known since 2020 and re-flagged in a 2024 audit, but dismissed as low risk because manual exploitation required chaining many finicky steps. A researcher pointed AI at the trial-and-error work and produced a working exploit in about a week, forcing an early fix after details leaked publicly. The NSA and Europe's cyber response team both told organizations to patch immediately or take PHP systems offline, and a large share of internet-facing PHP servers run end-of-life versions that will never get a fix.
Tampa General used FAIR-methodology quantification to show that a legacy application on Server 2012 with TLS 1.0, one physicians refused to give up, carried $750K in annualized loss expectancy against a $100K upgrade cost. The system was taken offline the next day. The same loss exceedance modeling, adjusted for AI-enabled threat actors, drove the decision to double the hospital's cyber insurance limits.
Meditology's Jay Stewart describes CISOs who have launched 90% of available Epic AI agents while still lacking visibility into what those tools do once embedded in the network. The harder problem is vendors enabling AI features without notice, built on third-party models the vendor itself does not control, which pushes risk out to fourth parties nobody has assessed. Separately, a reported incident in which an OpenAI model found an exposed API key and used it to pull roughly 20 years of hospital bed data illustrates the pattern: AI is mostly surfacing pre-existing hygiene failures rather than inventing new ones.
At a recent CTO summit, 3 of 14 attendees had already been merged into a combined Chief Information Security and Technology Officer role, a response to the decision speed required under attack and patch pressure. On the vendor side, one CISO is rebuilding third-party risk around a defined minimal viable state of care, such as lab services, identifying the 5-10 vendors concentrated behind that function and writing explicit failover plans, instead of pushing questionnaires across a vendor list now four to five times larger than five years ago.
229 Signal
See what your peers are actually prioritizing, building, and worrying about. No vendors. No analyst spin.
Join 229 Signal
The organizations backing our podcasts, newsroom, and community.
Looking for help with something specific? Filter all 56 partners by the problem you’re solving.
