MCS Tech Services, LLC

09/10/2026

The FBI put out an advisory September 1 about an attack that does not care about your MFA.

It is called OAuth consent phishing. The attacker registers an app with Microsoft or Google, sends a link, and asks you to approve permissions. You sign in on the genuine Microsoft page. You approve. That app can now read your mail and your files.

Two details make it dangerous. MFA never comes into it, because you authenticated correctly. And a password reset does not fix it, since the token survives until someone revokes it by hand.

The good news is that the primary defense is a setting, not a training slide. Here is what we do for the clients we support.

We turn off user consent for unverified third party apps in Entra ID and route requests through admin approval. That stops it at the click.

We review authorized enterprise applications in the tenant on a schedule, so a token that should not be there gets found early.

Inky filters the message before anyone sees it, and Duo and Defender cover the login itself.

Want a second set of eyes on what is connected to your tenant? Reach out.

09/07/2026

Today, we celebrate and extend our heartfelt gratitude to the hardworking people whose dedication keeps our businesses and communities thriving. Thank you for all that you do, and wishing everyone a joyful, safe, and relaxing Labor Day!i

07/30/2026

Over 30 water utilities. One coordinated attack.

This week, hackers hit 30+ community water systems across Minnesota, targeting the computerized systems that actually run the plants. One plant went completely offline — others had to switch to manual operations just to keep water flowing.

The takeaway? These weren't big-city targets. They were small, local utilities — the kind that often assume they're "too small" for hackers to bother with.

If your organization runs on connected systems — whether you're a municipality, manufacturer, or medical office — now is the time to find your gaps, not after an incident.

We help Hudson Valley organizations do exactly that. www.mcstechinc.com

Full story: https://www.bleepingcomputer.com/news/security/hackers-target-over-30-minnesota-water-utilities-in-coordinated-ot-attack/

07/30/2026

The newest healthcare cyberattack starts with a phone call, not malware.

Health-ISAC is warning healthcare organizations about the ShinyHunters group — attackers who call your staff pretending to be coworkers and talk their way into password and MFA resets. One convincing call can expose patient data across Microsoft 365, file shares, and more.

The fix starts with simple policies: verify every reset request by calling back on a known number, and never approve a reset on the same call that requested it.

Want to know how your practice would hold up? We’re happy to talk.

07/23/2026

🚨 Voluntary Cybersecurity Guidance for Hospitals Is Over

Healthcare cybersecurity is entering a new era.

The White House's National Security Memorandum 22 (NSM-22) is replacing voluntary cybersecurity guidance with mandatory standards for critical infrastructure sectors—including healthcare. The U.S. Department of Health & Human Services (HHS) is now developing hospital-specific cybersecurity requirements.

What does this mean for healthcare organizations?

If your practice, clinic, hospital, or healthcare business handles patient data, the expectation is shifting from "recommended" to "required." Organizations that prepare now will be in a much stronger position when new regulations take effect.

At MCS Tech Services, we're already helping healthcare organizations throughout the Hudson Valley build toward these types of security and compliance frameworks with:

✅ HIPAA-aligned cybersecurity practices
✅ Documented compliance support
✅ 24/7 security monitoring
✅ Managed backups & disaster recovery
✅ Risk assessments and security planning

The best time to prepare for mandatory compliance is before it's required.

📞 If you work in healthcare and want to understand where your organization stands, contact MCS Tech Services for a cybersecurity assessment today.

Don't wait until compliance becomes a deadline. Get ahead of it now.

07/21/2026

🚨 Microsoft's July Patch Tuesday Is Here — and Attackers Are Already Taking Advantage

Microsoft has released its July security updates, and two vulnerabilities are already being actively exploited in the wild — including a serious Active Directory privilege escalation vulnerability.

What does that mean?
Cybercriminals aren't waiting. They're using these security holes right now to target unpatched systems.

At MCS Tech Services, we take the guesswork out of patch management. We proactively deploy Microsoft security updates on a managed schedule, helping keep your systems protected before attackers have a chance to take advantage.

✅ Managed Patch Management
✅ Proactive Security Monitoring
✅ Business Continuity & Disaster Recovery
✅ Trusted IT Support for Businesses, Municipalities & Healthcare

Do you know when your systems were last patched? If you're not sure, it's time to ask.

📞 Contact MCS Tech Services today for a security review and make sure your business isn't the next target.

07/20/2026

Ransomware attacks on healthcare have surged nearly 14% in the first half of 2026, averaging over two attacks per day. This increase is not limited to hospitals; attackers are now targeting medical billing firms and other healthcare vendors as well.

If your practice or business handles patient data, it's crucial to have the right protections in place. MCS Tech Services offers HIPAA-aligned monitoring and backup/disaster recovery services specifically designed to address these risks. Remember, being a "small" entity does not shield you from these threats; in fact, it may make you a priority target. We are here to help ensure your data remains secure.

07/03/2026

Happy 250th America!!!!! Hope everyone has a happy and Safe 4th of July!

06/22/2026

Congrats Chief!

A Commitment to Leadership: Chief Hank Graduates FBI National Academy

The Town of Montgomery is proud to announce that Chief John Hank has successfully graduated from the FBI National Academy—one of the most prestigious professional training programs for law enforcement leaders.
During his time at Quantico, Chief Hank trained alongside officers from across the country and around the world, focusing on leadership, advanced investigative techniques, and building strong partnerships to enhance public safety. The program is known for its rigorous curriculum… and its hills, which have a reputation of their own and may or may not have been tougher than some of the coursework.
“This experience challenged me both professionally and personally,” said Chief Hank. “The training pushed us to think differently about leadership, accountability, and service. I’m bringing back new ideas, stronger partnerships, and a renewed commitment to doing the job the right way for our officers and the community.”
This achievement reflects Chief Hank’s dedication to professional growth, his commitment to excellence, and his continued focus on serving the community with integrity and transparency. He returns with valuable knowledge, strengthened relationships, and a renewed energy to lead.
Please join us in congratulating Chief Hank on this outstanding accomplishment.

06/22/2026

A ransomware crew called "The Gentlemen" is hitting small and mid-sized businesses hard — and they're good at it. They slip in quietly, shut off your security software, steal your files, and lock up everything they can touch. Then they demand a ransom to give it back.

The old approach — a firewall at the edge and hoping nothing gets through — doesn't stop this anymore.

At MCS Tech, we take a different approach called Zero Trust. The idea is simple: nothing on your network is automatically trusted. Every person, device, and connection has to prove it belongs there, and even then it only gets access to what it actually needs.

Here's what that means for your business:

Unauthorized programs can't run — including the tools attackers use to switch off your security.

A stolen password isn't enough — getting in takes more than one cracked login.

One hacked account can't reach everything — it's boxed into a small corner, not your whole network.

Your systems are separated — so an attack in one place can't spread to your servers, files, and backups all at once.

We watch for trouble around the clock — if security tools get shut off or files start encrypting, we get alerted and contain it fast.

Your backups are protected — so even in a worst case, you get back to work without paying a dime.

Zero Trust isn't a product you buy off a shelf. It's a strategy we build and manage for you — which means less risk, easier compliance, and a lot fewer sleepless nights.

If you run a business in the Hudson Valley and want to see what this would look like for you, comment "Zero Trust" or send us a message. We'll set up a short, no-pressure look at where you stand.