In part one of this two-part conversation, John Riggi, the AHA's national advisor for cybersecurity and risk, talks with the FBI's Brett Leatherman, assistant director, Cyber Division, and Gretchen Burrier, assistant director, Office of Private Sector, about the FBI's new campaign against cyberthreats, the surge of cyberattacks in U.S. health care, and what hospitals and health systems can do right now to defend themselves.
View Transcript
00;00;00;04 - 00;00;16;07
Tom Haederle
Welcome to Advancing Health. Coming up in part one of this special two part conversation with FBI leaders, we learn about Operation Winter Shield, the FBI's new 60 day nationwide effort to protect against cybercrime.
00;00;16;10 - 00;00;43;24
John Riggi
Hello, everybody. I'm John Riggi, your national advisor for Cybersecurity and Risk at the American Hospital Association. What a great conversation we have lined up for you today. So proud and privileged to have two of my very good friends from the FBI here with me today to talk about the latest cyber threats and what we can do to help defend against the threats and how we share information with the FBI for the greater good.
00;00;43;27 - 00;01;03;26
John Riggi
So here with me today is my good friend, longtime friend, FBI Assistant Director Brett Leatherman, who leads the FBI's cyber division. We also have my longtime and good friend, FBI Assistant Director Gretchen Burrier who leads the Office of Private Sector. Thank you both for being here today.
00;01;03;28 - 00;01;05;15
Brett Leatherman
Thanks, John. Happy to be here.
00;01;05;18 - 00;01;09;16
Gretchen Burrier
Yeah. John, thank you so much for having us. It's really great to be here today.
00;01;09;18 - 00;01;19;23
John Riggi
Great to have you, Gretchen and Brett. Brett and I actually worked together in cyber division over ten years ago. Seems like a lifetime ago, right, Brett? So much has changed. Yeah.
00;01;19;26 - 00;01;22;01
Brett Leatherman
A lot changes in cyber in ten years.
00;01;22;03 - 00;01;45;00
John Riggi
Right! Sometimes it seems like in ten minutes, it changes. Brett, if I could start off with you - again, thank you for being here. And, coincidentally, at the time of this recording, you and the FBI have announced the launch of Operation Winter shield. Could you tell us a little bit about that and why it's relevant for the nation's hospitals?
00;01;45;02 - 00;02;15;06
Brett Leatherman
Thanks, John, and thanks for the invite to participate in the podcast. Operation Winter shield launched February 1st and it's a 60 day campaign to defend the homeland against malicious cyber activity. What's unique about Operation Winter shield is most FBI enforcement action or operations involves federal, state and local partners in support of, you know, reducing violent crime or some sort of enforcement action that the FBI has jurisdiction in.
00;02;15;08 - 00;02;55;21
Brett Leatherman
Operation Winter Shield is different in that it requires all of us, everybody listening to this podcast, to come together and work together to reduce risks to critical infrastructure, to health care and to the homeland from both state and criminal cyber actors. So what it does is it distills the FBI's visibility in this space, pursuant to our law enforcement and intelligence community mission, into the top ten controls that we recommend organizations apply to their environments. Based on that work that we do, today 95% of the breaches continue to exploit one of these controls, at least one of these controls.
00;02;55;23 - 00;03;26;23
Brett Leatherman
And so we believe that really spending the next 60 days firming up the ability to defend against these attacks by advertising these controls to Fortune 100 organizations, down to small mom and pop businesses, and especially in health care, can measurably move the needle and increasing resilience against these cyber attacks. The one thing I would add is that we know that nation states in general who target us now use a whole of society approach to target the homeland through these cyber operations.
00;03;26;23 - 00;03;37;14
Brett Leatherman
And this requires a whole of society approach to defending it. And this is meant to pull all of us together in support of that national defense and national security mission.
00;03;37;17 - 00;03;59;21
John Riggi
You and I have chatted many, many times - and Gretchen, over the years - of the value of private sector cooperation. I love this expression whole of society. We used to talk about a whole of government approach. But you're absolutely right. Private sector must be a partner with the government on these task forces to help defend the nation. Whole of nation, whole of society approach.
00;03;59;23 - 00;04;10;07
John Riggi
Brett, getting back to Operation Winter shield just briefly, could you give us a sampling of let's say, maybe the top five controls that you think all critical infrastructure should implement?
00;04;10;10 - 00;04;39;23
Brett Leatherman
Yeah. And none of these are going to come to a surprise to many folks, right? The issue is we continue to see the actors exploiting these. So things like adopting phish resistant authentication - incredibly important. Implementing a risk based vulnerability management program. Incredibly important. We continue to see nation state actors targeting end of life edge devices. So one of the controls is understanding how to track and retire end of life technology on a defined schedule.
00;04;39;23 - 00;05;03;22
Brett Leatherman
And for health care, that's incredibly important. Health care continues to be, you know, according to a lot of reporting out there, the number one targeted entity within critical infrastructure, I saw one report that showed the average cost of a data breach within health care is $7.42 million. And so there's a low tolerance for downtime because there is patient and life safety implications.
00;05;03;22 - 00;05;21;02
Brett Leatherman
So, for example, control number six within Winter Shield is maintain offline in immutable backups. That is incredibly important for health care when it comes to resiliency in being able to get, you know, health and safety data in systems back online during a breach.
00;05;21;04 - 00;05;46;00
John Riggi
Totally agreed, Brett. In fact, when the AHA, myself worked with the previous administration to help develop the cybersecurity performance goals version 1.0, what we did is we looked at the threat reporting coming from the FBI. And so as I said, let's look at how we are getting beat. And it's the same controls that, that you just described as the best mitigating practices. Challenge for us in health care for all our listeners,
00;05;46;00 - 00;06;10;05
John Riggi
you all know this better than I, is the financial constraints that we are faced with as well. We know what to do. This reinforcement from the FBI really gives validation to that, but within an operating environment under severe financial pressure. Brett, you just mentioned the nation-states. Talk to us a little bit about China and their typhoon campaigns targeting critical infrastructure.
00;06;10;07 - 00;06;30;16
Brett Leatherman
Yeah, we talked about these end of life devices. And if you look at Vault Typhoon, Flax Typhoon, both campaigns between 2024 and 2025 that are PRC sponsored campaigns, they target those end of life devices. The reason they do that is those devices sit here in the United States. They're global botnets, but the ones that are have real impact
00;06;30;16 - 00;06;57;25
Brett Leatherman
here are devices that sit here in the US. They sit on trusted IP space within the United States, meaning the actors can quickly pivot from that space to target other organizations like health care. So the PRC understands that the path of least resistance is the way to go. They don't want to deploy their most sophisticated capabilities when they can start to target things that these controls are meant to address.
00;06;58;01 - 00;07;10;18
Brett Leatherman
You know, it's incredibly important that we come together and really understand how we plug those gaps in our exposed infrastructure to reduce the likelihood of compromise.
00;07;10;20 - 00;07;31;06
John Riggi
Really key point you made. China and Russia around North Korea as sophisticated as they may be, they're not using highly sophisticated zero days to attack us. That's why these basic controls are so important to help mitigate the threat. Getting back to nation-states a little bit, we talked about China. What about Russia, Iran and North Korea?
00;07;31;09 - 00;07;57;14
Brett Leatherman
Yeah. Critical infrastructure is a target for each of those entities for a variety of different reasons. Number one, for organizations who want to pre-place capability in the United States, health care is a key area to do that, right. And so the electric grid, the financial services sector, health care, all of those areas would have real impact should a nation-state decide to launch some sort of cyber attack against the homeland.
00;07;57;14 - 00;08;23;09
Brett Leatherman
And so each of these nation-states possess different capabilities in this space, but each of them will also follow the model of that path of least resistance. And it doesn't matter if these are actors sitting in Iran, if they're actors sitting in North Korea, in Russia or China, they're going to continue to target credentials, stolen credentials, for example, to get into environments where there's no multi-factor authentication.
00;08;23;09 - 00;08;41;03
Brett Leatherman
So if there is remote access to your environment, every one of these state actors on top of criminal actors are going to target that. Same with the end of life devices. They're going to target those because they're easy to get into. And so each of these actors are sophisticated, but often they won't take the sophisticated way
00;08;41;03 - 00;08;43;09
Brett Leatherman
in if they can target one of these controls.
00;08;43;11 - 00;09;10;14
John Riggi
Great points. And again, pointing out to everyone at this time of the really increased geopolitical tensions, with all of these nations China, Russia, Iran, North Korea. Understanding that they do possess first world, highly sophisticated cyber capabilities. And the question is, will they use that against us or some proxy at their direction to launch some type of un-attributable attack, things we're all concerned about.
00;09;10;21 - 00;09;44;28
John Riggi
But I appreciated your advisory in early December, talking about pro-Russian hacktivists being directed by the Russian military intelligence service, the GRU. We in health care and hospitals need to understand the geopolitical risk environment because it directly translates to cyber risk. Brett, last question for you at this moment. We talked about the disruption to health care delivery by particularly these Russian-based or Russian speaking ransomware groups that disrupt and delay healthcare delivery, posing a direct risk to patient and community safety.
00;09;45;01 - 00;09;53;08
John Riggi
Can you talk to us a little bit about the most significant Russian groups or ransomware groups that the FBI's tracking at the moment?
00;09;53;10 - 00;10;19;06
Brett Leatherman
I appreciate that question because the, ransomware groups operating globally, continue to target the underlying ecosystem of health care. Meaning, where they can identify points of targeting that is not just one hospital, but has cascading impact across health care, hospitals, pharmaceuticals, they'll target that. And so we've seen attacks in the past. Change Healthcare as an example.
00;10;19;12 - 00;10;41;26
Brett Leatherman
So these supply chain breaches are incredibly important. And that goes back to one of our Winter Shield advisory statements, which is to analyze third party risk, to understand the third party's web access to your data in your systems and your networks and work with them to build resilience there. It's incredibly important that we also assess detection capability.
00;10;41;26 - 00;11;05;28
Brett Leatherman
We're so focused sometimes on prevention, and we do want to prevent cyber attacks from happening. But we've also got to detect the adversary when they get in. We can't stop them 100% of the time. And these groups are very good at in some cases, for example, scattered spider socially engineering their way into our helpdesk, getting legitimate credentials and getting into our environments.
00;11;06;00 - 00;11;26;18
Brett Leatherman
So if we can focus on detecting them earlier, it's incredibly impactful to reducing that blast radius. In health care, I think it's over 270 days on average it takes right now to detect an actor in a health care environment. And so we've got to reduce that dwell time significantly.
00;11;26;21 - 00;11;51;22
John Riggi
Totally agreed, Brett. And this again, the continuing threats that we face wholesale here, third party risk is a major area of risk exposure we talk about constantly. We can do the best we can to defend our own systems and networks. Then we get exposed to these third party technology and service providers and supply chain. Gretchen, turning to you, given all these threats that Brett just described,
00;11;51;23 - 00;12;00;16
John Riggi
can you tell us about your division's extremely important mission in helping carry these threats and the value of information sharing with the private sector?
00;12;00;18 - 00;12;24;23
Gretchen Burrier
Absolutely. And first, John, it's a privilege to be on your podcast. I love listening to it regularly. So to be on your show, it's very exciting. But to answer your question, you know, the reality today is that the front lines of national security, they're increasingly running through the private sector, whether it's cyber intrusions, ransomware, intellectual property or, you know, foreign malign influence.
00;12;24;25 - 00;12;51;17
Gretchen Burrier
U.S. companies are often the first to see these threats and sometimes the first to feel the impact. So the mission and focus of my team and the FBI's Office of Private Sector is to make sure these companies don't face those threats alone. We serve as the connecting bridge between the FBI's operational divisions and the businesses that own and operate, you know, the systems, the data and infrastructure our country relies on.
00;12;51;19 - 00;13;11;20
Gretchen Burrier
And if you don't know who to connect within the FBI, you can reach out to our team and we'll make sure you get the help you need. We also have in the FBI private sector coordinators, at least one in every field office across the country. You can pick up the phone, call the field office and ask to speak to the private sector coordinator for help and assistance.
00;13;11;23 - 00;13;43;28
Gretchen Burrier
They're the best at what they do, and they fully believe in partnering with industry. And just to touch on your comments about, you know, information sharing. It's at the heart of what we do and it's at the heart of our work. When companies share what they're seeing with the FBI, whether that's a suspicious cyber incident or unusual activity on their networks, Brett's team can connect the dots across sectors and across investigations, and that allows the FBI to provide contacts to warn others, disrupt adversaries, and in many cases, prevent the next victim.
00;13;44;00 - 00;14;11;19
Gretchen Burrier
And at the same time, you know, OPS is dedicated to giving value back through threat briefings, various engagements, webinars, other tailored information so that companies can make better risk decisions in real time. And we do this, of course, in coordination with our operational divisions. Just to give a quick plug too, we have two key partnership programs to the Office of Private Sector, the Domestic Security Alliance Council and Infoguard.
00;14;11;22 - 00;14;32;10
Gretchen Burrier
And those wishing to learn more can visit dsac.gov and info guard.org. Brett and I really do see this is a two way partnership. And John, I know you do as well. And when the private sector and the FBI work together, we're faster, we're more resilient, and we make it harder for criminals and foreign adversaries to succeed.
00;14;32;12 - 00;14;57;21
John Riggi
Thank you Gretchen. Appreciate your continued support. And for all of the private sector coordinators in the field, everywhere we go and we go a lot of places to help hospitals, we invite the FBI, we invite CISA, we invite Secret Service. The Office of Private Sector coordinators have been outstanding. Just recently, I did a four hour exercise for the leadership of one of the largest health systems in the country.
00;14;57;21 - 00;15;22;11
John Riggi
Over 100 C-suite executives there. Two FBI agents from the local field office stayed the entire time and really contributed significantly. So you talk about the partnership. It is real world, side-by-side. And the reality is a lot of the expertise and experience and evidence and Intel lies with the private sector on our networks. So it really is a tremendous partnership.
00;15;22;13 - 00;15;45;04
John Riggi
Brett and Gretchen, thanks for an amazing conversation. We have so much more to discuss. I think what we're going to do is part two of this amazing conversation. So for our listeners, stay tuned for part two. Until then, Brett and Gretchen, thank you and all the men and women of the FBI for what you do every day to secure our nation and health care. And to all our frontline health care heroes
00;15;45;04 - 00;15;54;03
John Riggi
thank you for what you do every day to defend our networks, care for our patients, and serve our communities. Stay safe everyone.
00;15;54;05 - 00;16;02;17
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.



