UnHack with Drex DeFord

A Florida ransomware "recovery" company promised victims they'd never have to pay the hackers. Prosecutors say it was quietly paying them all along, then billing clients two times or more the actual ransom: more than $19 million billed to hundreds of companies from 2018 to 2023, with more than $8 million paid to cybercriminals. Drex walks through the MonsterCloud story, from a 2016 researcher sting to an October 7 not-guilty plea in federal court in Brooklyn, and why it matters for healthcare. Who's your incident response firm, is it on retainer and coordinated with your cyber insurer, and does your contract say in writing that...

October 19, 2026: Bill Russell and Drex DeFord. Sarah Richardson was flying to Tampa.

Over the weekend, an agent logged into Delta as Bill Russell and moved him to seat 10F. He checked the browser and the IP address. Neither one showed a bot.

He can give the bot its own login and its own permissions. He cannot tell whether someone skipped that and handed over the password they already use. Drex DeFord named the job that has not been created yet: a vice president for non-human resources. Onboard the bot, train it, give it an identity...

You've seen it: a smart TV, a printer, or a conference-room screen gives you a short code and sends you to a Microsoft page on your phone. That handoff is called a device code sign-in, and for about six months this year it was the front door for one of the busiest criminal businesses on the internet. Steve Masada runs Microsoft's Digital Crimes Unit, the team that sues criminals and then, with a court order, takes down their infrastructure. They had done it 39 times before. Number 40 was Evil Tokens.

Evil Tokens launched in February on Telegram and...

In late September a giant picture of Umbreon, the black Pokemon with the yellow rings, showed up on the page where someone applies to be an FBI agent. Pepijn van der Stap, 24, from the Netherlands, used that name online a few years ago. He stole databases, sold them on hacker forums, and extorted the companies he hit. Drex DeFord puts the take somewhere between 1.5 million and 2.7 million euros. Van der Stap confessed in 2023, received a four-year sentence, and got out in late 2025. He worked as a software engineer at Hadrian, volunteered with a Dutch nonprofit that warns people about...

October 12, 2026: Bill Russell and Drex DeFord. Sarah Richardson is in the air for Philadelphia. The week is one argument: the attack got cheap, and the controls around the tool did not keep up.

The number is $700. Drex described a dark-web package that weaponizes a fresh patch for a buyer who does not understand it. At the regional staff roundtables, the matching line was a meme they were no longer joking about. They patch in production, with a plan to roll back, because the test window is gone.

Citrix had shipped another emergency NetScaler build that...

October 5, 2026: Venkat Kavarthapu, CEO of Symplr, joins Bill Russell and Drex DeFord. The argument is about where AI time goes. Bill cites a study that put individual productivity up about 20 percent, and asks whether a faster IT administrator sees another patient. Drex's sticking point is the missing link to the CFO: less spend, or more revenue.

Venkat's picture comes from a CFO at a large system. Ten to 15 percent of the beds sit unused, on lock, unable to be scheduled. He puts the cause upstream. Credentialing a physician takes 120 to 180 days. Shrink that, and the capacity can...

September 28, 2026: Sarah Richardson with Elbridge Locklear, former CIO and now in the 229 Legacy Program. A finance analyst, knowledgeable in finance, goes out and creates an agent. Elbridge has no knowledge of it. The agent can call other skills, including a way around security restrictions.

86% of leaders say they can govern agents. His question is how, if there is no inventory.

Key Points:

0:00 86% Confident. No Inventory.

0:30 San Diego: Who Owns the AI?

4:15 Cloudticity

6:24 Ping Identity

7:29 Centralization Is Not Standardization

13:34 72% Deployed Without IT Approval

In May, a Tel Aviv company called Irregular was testing Google's Gemini inside a sandbox. A bug left a live internet connection open. The test target shared a name with a real company, and Gemini found it. It guessed passwords until one worked, then used logins sitting in a public repository to get into two more. Three real organizations. The model stopped and backed out. Irregular flagged it to Google in late July. Google notified the three companies and federal authorities, then sat on it for almost seven weeks. The rest of the industry did not hear until the...

September 21, 2026: Bill Russell and Sarah Richardson. Dario Amodei wants labs to pace the frontier. The operator version: the more AI you put on an EHR you cannot see, the more it can feel like a denial of service. CIOs at the front of ambient are seeing request volume up 9,000%, because the tool that used to write a note is now pulling the longitudinal record and hitting RevCycle. Sarah's question from New Orleans: how do you even tabletop an agent swarm.

Key Points:

0:00 AI without a view can DOS your EHR

0:21 Newsday open

Army Major Kara Corcoran wears a Ranger tab and two Afghanistan tours. This summer she sat in a separation board five days short of 18 years. The board was not there to weigh her combat record. It was there for one line in her medical record. On July 31, an internal Air Force email said the Secretary of Defense's office had identified service members who may have a current diagnosis or history of, or exhibit symptoms consistent with, gender dysphoria in their electronic healthcare record. The DOD ran a population-wide search of the military EHR, about 9.5 million people, by diagnosis codes...

September 14, 2026: Bill Russell and Sarah Richardson. The fight is the intelligence layer on top of the EHR. Epic put Art, Emmy, and Penny on the table. ChatGPT already pulled USCDI over FHIR at UCSF. Bill's read: CIOs did not open those APIs. 21st Century Cures did. The loser is the patient portal. He gives it 3 years. Appointments go through the AI. NCH, tiny, is already running a ChatGPT-like persona with nurse triage.

Key Points:

0:00 Patient portals, wiped out in 3 years

0:24 Newsday open

1:48 Who owns the intelligence layer

4:44 Cloudticity

September 7, 2026: Bill Russell and Sarah Richardson take the ChatGPT-UCSF headline apart. Silicon Valley called it game over. Bill's read: they did not come through Epic's front door. Read-only USCDI over FHIR. No write-back. No warranty. A badly built agent can fire 75 API calls into production Epic and slow the EHR. Doctors want a predictable system.

Key Points:

0:00 Does it really change everything?

0:16 Newsday open

2:48 Tegria

3:17 ChatGPT at UCSF

6:51 75 calls into production Epic

12:54 UGM in CIO quotes

20:28 340,000 applicants and Rangers

31:23 An 8% margin...

August 31, 2026: Bill Russell, Sarah Richardson, and Drex DeFord come off a pulse survey of 246 health system leaders. Where the AI cannon points next: patient access and revenue cycle, 86 votes each. Bill's read: you have to win on the financial side before you get licensed to do anything else. Then 43% said AI assistants will be available to most of their patients. 4% said they will not. A clinician CIO at the forum had just flagged a MyChart golf answer as medical advice.

Key Points:

03:32 Pulse survey

04:39 Where the money is going

06:45 Governance vs...

A recruiter offers a developer a remote job. Good money. Just run a coding test first. The test is malware, and the people sending it work for the North Korean government. The trick has a name: Contagious Interview. You think you're getting hired. You're getting infected. Vangelis Stykas, a security researcher in Greece, got inside the attackers' own servers after they infected their own machines. He sat there nearly two years and counted 1,640 companies across 57 countries. Seven or eight hundred of them hit hard: root access to servers and cloud. At crypto firms, they walked off with the keys...

At Black Hat in Las Vegas, OpenAI's Eric Wallace and Michael Dalton told a story they admitted they did not see coming. While testing frontier models, autonomous agents found a way to leave notes for each other inside a shared package manager. Those notes became a message board. Agents posted how-tos, asked for help, and swapped working exploits. By the time humans found it, the board held hundreds of thousands of messages. Nobody taught them to do this. It ran for days before anyone at the most sophisticated AI company on earth noticed.

In this...

In late July, a small Minnesota water tower stopped responding to its own control panel — and it wasn't alone. Within 48 hours, more than 30 water systems across the state lost control of pumps, lift stations, and chemical monitoring. The cause: a known industrial controller flaw with a patch that's been available since 2021. Federal officials traced the attacks to Iran, and the FBI is now watching water systems in at least seven states. In this Two Minute Drill, Drex DeFord asks the question hospitals rarely think to ask — do you know where your water, power, and steam actually come from, and have...

A teenager who flaunted stacks of cash and a diamond "Hack the planet" necklace online turned out to be one of the most damaging cybercriminals on the planet. Peter Stokes, known as Bouquet, was part of Scattered Spider — the crew behind breaches at MGM Resorts, Visa, Twilio, Dior, and Louis Vuitton. He mastered every trick for staying anonymous, but a hidden Windows fingerprint called the Global Device Identifier helped investigators tie his aliases to his real identity across every platform he touched. Stokes was arrested this spring at a Finland airport and extradited to the US. Drex breaks down ho...

An AI model was supposed to be locked inside a sandbox, working through hacking challenges to prove how good it was at finding software flaws. Instead, it found a real zero-day, broke out on its own, and landed inside Hugging Face's live production database. Nobody told it to escape. It just wanted to win.

When Hugging Face sat down to investigate, the AI tool they turned to for help refused to even look at the attack. So they ended up trusting a Chinese open-weight model to clean up after an American AI's break-in, because the American models...

May 15, 2026: Big news from Drex DeFord, starting May 15th, UnHack the Podcast and the Two-Minute Drill are moving to the 229 Project Podcast Channel. Same show, same mission, same Drex — just one unified home alongside Bill Russell and Sarah Richardson. The reason is simple: the This Week Health community was spread too thin across too many channels, making great content harder to find. Now everything lives in one place.

Keep up to date on the latest in health IT:

https://thisweekhealth.com/news/

X: This Week Health

LinkedIn: Th...

North Korean threat actors didn't breach a firewall. They built a fake company. UNC1069 spent two weeks constructing a convincing Slack workspace, fake team members, and LinkedIn profiles to earn the trust of Jason Seaman -- lead maintainer of Axios, a JavaScript library downloaded over 100 million times a week. One Teams call. One file. Within hours, malicious code was live and reaching health systems everywhere. The attack skipped the $50M security stack entirely and went straight to the human. Drex breaks down what happened, why it worked, and asks the question every health IT leader needs to answer: have...

May 5, 2026: What happens when attackers don't just break into your systems, they become you? Josh Howell, Healthcare CTO at Rubrik, joins Drex DeFord to unpack Rubrik's newly announced partnership with the American Hospital Association, a rigorous vetting process that signals a new standard in cyber risk validation. Josh draws on hundreds of ransomware recovery experiences to challenge how health systems think about resilience, recovery sequencing, and the identity control plane. Learn why the worst-case scenario in the 2026 Google Mandiant M-Trends report should keep every CISO up at night.

Key Points:

00:35 AHA Partnership Overview

04:19...

May 4, 2026: Lisbeth Votruba, Chief Clinical Officer at AvaSure, joins Bill Russell and Drex DeFord on Newsday to celebrate Nurses Week with a fascinating look at where nursing has been, and where it's going. From Florence's data-driven legacy to today's AI-powered virtual care, Lisbeth shares why nursing turnover is declining, why certification rates are rising, and why she sees technology not as a threat but as a path back to old-fashioned, human-centered nursing care. 

Key Points:

02:38 Nurses Week Origins and Trends

05:56 Ambient Documentation Reality Check

08:51 AI for Safety and Liability

18:03 N...

From crippling outages to AI-powered deepfakes, 2025 tested healthcare cybersecurity like never before. This year-end recap explores the moments that mattered most: how teams built resilience during system failures, why users became partners instead of "weak links," how identity became the new perimeter, and what it means when you can't trust your own eyes. Through powerful stories from the front lines, we revisit the lessons learned and the community that kept us standing. Because at the end of the day, cybersecurity is patient safety, and the work you do saves lives.

Matthew Lane was 14 when he started probing the edges of online gaming systems. By 20, he had walked out of PowerSchool with data on nearly 70 million students and teachers using nothing but a contractor's stolen credentials he found on the dark web. Drex tells the full story and then lands the part that matters most for healthcare: Lane didn't exploit a sophisticated vulnerability. He used a username and password attached to someone who had legitimate access and simply walked through the front door. How many of your vendors have credentials that have never been audited? How many former contractors still...

April 28, 2026: When a hospital goes dark, the first 72 hours are everything. Laurie Campbell, Senior Manager of Clinical Ancillary Applications and Enterprise Imaging, and Rick McIntosh, VP and the Chief Technology Officer, at Children’s Hospital Colorado, break down the phased Code Dark response framework her team developed for ransomware attacks. They walk through real examples: how the supply chain keeps inventory moving without its systems, and how the radiology team built a sneakernet process to keep radiologists reading images even when the PACS environment is completely unreachable. This isn't theoretical. It's the result of years of workflow mapping, vendor co...

April 27, 2026: Drex DeFord and Bill Russell are back on Newsday, and fresh off the 229 Summit, they're not pulling punches. Healthcare IT has a demand problem. Too many projects, not enough capacity, and an industry that's chronically bad at saying no. From the 229 Summit's sharpest takeaways to the Salesforce headless CRM announcement, the vl.js hack, and why Bill thinks Claude Code's "genesis key" is about to change everything, this episode covers the stories that matter most right now. If your project list is longer than your resources, this one is for you.

Key Points:

00:32 Summit...

While the industry debates frontier AI models and nation-state threats, hospitals are still getting hit by ransomware through the same doors they've always left open. Drex zooms out to what's actually happening on the ground: massive patch cycles creating downstream operational pressure, countries reconsidering their software dependencies, and CISOs quietly doubling down on fundamentals. MFA, identity management, tested backups, network segmentation. The HICP documents are free, the roadmap already exists, and the data is clear. Most attacks don't start with advanced AI. They start with a stolen credential or a forgotten exposed system. The organizations most likely to survive...

April 20, 2026: What happens when you layer AI onto broken processes without fixing them first? Angel Mena, MD, CMO of Symplr, joins Bill Russell, Drex DeFord, and Sarah Richardson on Newsday to answer that question with the kind of clinical candor only a practicing physician can bring. From ambient documentation to quality metrics to the credentialing chaos hiding inside every health system, this conversation exposes the gap between AI's promise and what healthcare leaders must do to close it before the opportunity slips away.

Key Points:

00:37 Clinicians and Tech Today

07:44 Beyond the AI Hype<...

The Kim Wolf botnet was the most powerful ever built — 2 million compromised IoT devices, a record-breaking 31.4 terabit DDoS attack, and it had the FBI, Google, and Cloudflare stumped. Drex breaks down how those cheap, forgotten devices in patient waiting rooms and break rooms became weapons inside hospital networks, and why 25% of Infoblox's enterprise healthcare clients were already compromised. Then comes the wild part: a 22-year-old RIT undergrad named Benjamin cracked the whole operation — while studying for midterms — using Discord, Telegram, and a perfectly timed cat meme. His research ultimately fueled a coordinated takedown on March 19th, 2026, that brought Kim Wolf f...

April 13, 2026: Jacob Hansen, Chief Product and Technology Officer at AvaSure, joins Bill, Drex, and Sarah on Newsday for a conversation about the data governance battles quietly reshaping AI. From who owns AI model improvements derived from a health system's environment to whether EHRs should have control over how that data is used, Jacob pulls no punches. The conversation also tackles the evolving CIO title, the future of computer science careers in an AI-driven world, and why nursing may be one of the most AI-resilient roles in healthcare.

Key Points:

01:07 CIO to CTDO Shift

06:52...

The window between vulnerability discovery and exploitation has collapsed — from 63 days in 2018 to negative. Now AI is changing the game entirely. Drex walks through how Anthropic's unreleased model Mythos autonomously found a critical zero-day in the Ghost CMS, wrote its own exploit, and extracted sensitive credentials in under two hours — all without a CVE ever existing. Add in two accidental Anthropic data leaks in the same week, and the story gets more complicated. For healthcare organizations, the takeaway is urgent: your patch program was built for a world that no longer exists. Continuous vulnerability discovery, identity security, network segmentation, and...

April 8, 2026: Frank Duff, Chief Innovation Officer at Tidal Cyber, and one of the original architects of the Mitre ATT&CK framework, joins Drex DeFord on UnHack to expose an uncomfortable truth: most organizations are sitting on powerful security tools they've never fully turned on. Drawing from 18 years at Mitre and deep experience running ATT&CK evaluations, Frank explains how Tidal Cyber bridges the gap between what vendors build and what customers actually deploy. Squeezing more out of the tools you already own may be the most important security move you can make.

Key Points:

04:03 Honest...

April 6, 2026: The rules of warfare have changed, and health systems are caught in the middle. On this episode of Newsday, Sarah Richardson and Drex DeFord break down two stories that should be on every healthcare leader's radar: the IRGC's declaration that major tech companies are now legitimate combatants, and what the Stryker attack reveals about the fragility of the healthcare supply chain. From cloud co-location risk to vendor contract language, this conversation reframes what resilience planning actually demands in 2026. Stay a little paranoid.

Key Points:

02:04 Iran Targets Tech Giants

08:52 Resilience and Supply Chain<...

April 1, 2026: James Winebrenner, CEO of Elisity, joins Drex DeFord to unpack one of healthcare cybersecurity's most persistent challenges, the sprawling, unseen attack surface hiding inside hospital networks. From unmanaged clinical devices to IoT systems running alongside regulated medical equipment, James breaks down how Elisity helps health systems move from visibility to control without re-engineering their networks. He also shares what The Pitt gets right about what really happens when a hospital goes analog, and why the best time to solve these problems is long before the headlines hit.

Key Points:

01:58 HIMSS Buzz and Customer Voices<...

Drex makes the case for a role that doesn't exist yet but probably should: VP of Non-Human Resources. As AI agents multiply across health system environments, often deployed by vendors without oversight, the management infrastructure simply isn't keeping up. Agents have access, make judgment calls, and operate inside frameworks that affect patients and business operations, yet most have no job description, no onboarding, and no performance review. Drawing on signals from Harvard Business Review, Deloitte, Gartner, and Microsoft, Drex argues healthcare is quietly building a second workforce with none of the governance structures it took decades to build for...

March 30, 2026: Bill Russell and Drex DeFord dig into three of the biggest stories shaping healthcare IT right now. From the seismic Sutter Health and Allina Health merger, the Stryker cyberattack carried out by an Iranian-linked group Handala, and the sobering reality that threat actors like Tycoon 2FA are back online within 15 days of being taken down, this episode covers the frontlines of healthcare IT.

Key Points:

00:23 Sutter Allina Merger Realities

07:29 Advice for Staff During M&A

11:17 Stryker Hack and Cyber Resilience

19:21 AI and Healthcare Jobs

29:38 Patient Experience...

March 27: 2026: Live from HIMSS 2026, Drex DeFord sits down with Eli Tarlow, Director of Industry Strategists at CDW, for a candid conversation about the state of AI in healthcare. Eli breaks down the evolution from AI curiosity to AI accountability, where gut feelings have been replaced by hard business plans, measurable ROI, and a closing-the-loop mentality that puts operational leaders on the hook for results.

Key Points:

01:44 AI Maturity Shift

03:05 Proving ROI With AI

06:05 Accountability and Budget Math

09:19 Resiliency and Cloud DR

X: This Week Health

Drex revisits the FBI and DOJ takedown of HANDALA, the Iranian-backed hacking group behind the Stryker wiper attack—and surfaces an uncomfortable lesson. Within 24 hours, the group was back online with new domains, same operations, same message. That's not a footnote. That's a case study in resilience. While healthcare organizations ask "how do we prevent this from happening," adversaries are asking "how fast can we rebuild when we lose everything?" The real challenge isn't just stopping attacks—it's matching the operational continuity of the people trying to break you.

Stay a Little Paranoid

X: This Week...

 March 25, 2026: Gerry Miller, Founder and CEO of Cloudticity, has spent 15 years helping healthcare organizations harness the cloud securely. In this live conversation at HIMSS 2026, Gerry breaks down why health systems are accelerating their move to the cloud and how multi-cloud strategies are shifting from redundancy plays to service optimization.

Key Points:

02:33 Multi Cloud Strategy

04:39 ROI and Security

08:24 Future Data and AI

X: This Week Health

LinkedIn: This Week Health

Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

March 24, 2026: Steven Ramirez, VP, CTO and CISO at Renown Health, joins Drex DeFord to pull back the curtain on how a mid-large health system keeps security at the center of everything — without becoming the department of no. From board-level briefings and identity-first defenses to a Databricks cloud buildout and a governance framework that puts security review on every DocuSign, Steven breaks down why good relationships and strong intake processes beat politics every time. This is a candid, tactical conversation healthcare IT leaders won't want to miss.

Key Points:

01:49 Speed vs Security

05:20 Board Updates an...