An anonymous reader writes:Three U.S. healthcare organisations are reportedly being held to ransom by a hacker who stole data on hundreds of thousands of patients. The hacker has also put the 650,000 records up for sale on dark web markets where stolen data is traded. Prices for the different databases range from $100,000 to $411,000. Buyers have already been found for some of the stolen data, the hacker behind the theft told news site Motherboard. No information about the size of the ransom payment sought by the data thief has emerged, although he did say it was "a modest amount compared to the damage that will be caused to the organisations when I decide to publicly leak the victims."

An anonymous reader writes: The Cyberspace Administration of China has imposed new regulation for the mobile app community, requiring that developers keep a close watch over users and keep a record of their activities. However, the proposed legislation would also prevent apps from requesting unnecessary access to users' contacts, camera, microphone and other spurious installation requests. The regulator introduced the new laws in the name of cracking down on illegal use of mobile platforms for the distribution of pornography, fraud and the spread of 'malicious' content.

Robert Mclean, reporting for CNN:Airbnb is taking its hometown to federal court. The company has filed a lawsuit against the city of San Francisco, objecting to short-term rental rule changes approved by its Board of Supervisors. A new ordinance set to take effect in late July would require all Airbnb hosts to register with the city. If they do not, Airbnb would be fined up to $1,000 a day for each listing, putting the burden on the company to make sure each listing is legal. But the city's $50 registration process is analog enough to turn off many hosts. It can't be completed online and requires submitting all the documents in person. Airbnb contends the new rule violates the Communications Decency Act, Stored Communications Act and the First Amendment.

In the aftermath of the United Kingdom voting to leave the European Union, UK's technology industry is reassessing its position, with many of them considering moving to a continental location. According to reports, Samsung, LG, and Acer have noted that the UK leaving the EU will affect their operations. From a BBC report:As news of Brexit broke, tech firms including BT, TalkTalk and software firm Sage reported share price falls. [...] "I have concerns that the local market might slow down," said Drew Benvie, founder of London-based digital agency Battenhall. From a report on The Guardian:Britain's financial technology sector is particularly hard-hit, with the prospect of losing access to European markets an unappealing one. "Fintech" has long been one of the UK's most promising growth areas, in part due to London's position as the financial capital of Europe. [...] Not one of the 14 billion-dollar tech firms based in the UK the Guardian asked said leaving the EU would be good for their business.Toby Coppel, the co-founder of venture capital firm Mosaic, said: "The next entrepreneur who's 22 years old, graduating from a technical university in Germany may, instead of moving to London to do their Fintech startup, decide to go to Berlin instead. I think that's one of the biggest concerns I have about the trajectory of the London technical ecosystem."

An anonymous Slashdot reader writes: Ecma International, the organization in charge of managing the ECMAScript standard, has published the most recent version of the JavaScript language. ECMAScript 2016 (ES7 or JavaScript 7th Edition in the old naming scheme) comes with very few new features. The most important is that JavaScript developers will finally get a "raise to the power" operator, which was mysteriously left out of the standard for 20 years. The operator is **...
It will also become much easier to search for data in a JavaScript array with Array.prototype.includes(), but support for async functions (initially announced for ES2016), has been deferred until next year's release. "From now on, expect smaller changelogs from the ECMAScript team," reports Softpedia, "since this was the plan set out last year. Fewer breaking changes means more time to migrate code, instead of having to rewrite entire applications, as developers did when the mammoth ES6 release came out last year."

Softpedia reports on the newest version of Peppermint OS, "a lightweight, stable, elegant, and fast computer operating system based on GNU/Linux and Open Source technologies." An anonymous Slashdot reader quotes their report: It's a bit earlier than expected, but the Peppermint OS 7 GNU/Linux distribution has been officially unveiled...based on the Ubuntu 16.04 LTS (Xenial Xerus) operating system [with] a lot of packages from the Ubuntu 16.04 LTS distro, which means that it will also be a long-term support release.... "Along with the shift to the 16.04 (Xenial) code base, Peppermint 7 continues our policy of choosing the best components from other desktop environments, wherever that may be, and integrating them into a cohesive whole with our own software," reads today's announcement.
"Team Peppermint" says they're switching to Firefox as their default browser for site-specific browser functionality (similar to Chrome's -app mode) after Google dropped their 32-bit version of Chrome and moved to PPAPI plugins "which effectively ends Flash support in 32-bit Chromium"... But you can also still choose Chrome or Chromium for site-specific browsing (and the OS comes in 32-bit and 64-bit editions).

Slashdot reader Orome1 shares an article by Bitdefender's senior "e-threat analyst," warning about an increasing number of attacks on healthcare providers: In general, the healthcare industry is proving lucrative for cybercriminals because medical data can be used in multiple ways, for example fraud or identity theft. This personal data often contains information regarding a patient's medical history, which could be used in targeted spear-phishing attacks...and hackers are able to access this data via network-connected medical devices, now standard in high-tech hospitals. This is opening up new possibilities for attackers to breach a hospital or a pharmaceutical company's perimeter defenses.

If a device is connected to the internet and left vulnerable to attack, an attacker could remotely connect to it and use it as gateways for attacking network security... The majority of healthcare organizations have often been shown to fail basic security practices, such as disabling concurrent login to multiple devices, enforcing strong authentication and even isolating critical devices and medical data storing servers from a direct internet connection.
The article suggests the possibility of attackers tampering with the equipment that dispenses prescription medications, in which case "it is likely that future cyber-attacks could lead to the loss of human life."

Long-time Slashdot reader itwbennett writes: Lenovo is advising users to upgrade to version 3.3.003 of Lenovo Solution Center (LSC), which includes fixes for two high-severity vulnerabilities in the tool. [The tool] allows users to check their system's virus and firewall status, update their Lenovo software, perform backups, check battery health, get registration and warranty information and run hardware tests.

The CVE-2016-5249 vulnerability allows an attacker who already has control of a limited account on a PC to execute malicious code via the privileged LocalSystem account. And the CVE-2016-5248 vulnerability allows any local user to send a command to LSC.Services.SystemService in order to kill any other process on the system, privileged or not.