Internal Audit Newswire - November 08, 2026

MYRIAD GENETICS, INC. - Current Report (Form 8-K) (mygn-20261102)

Source: U.S. Securities and Exchange Commission (EDGAR)

Summary: Myriad Genetics reported in a Form 8-K that it detected unauthorized access to its IT network on November 2, 2026. The company initiated incident response, paused testing operations and order-management systems, reset credentials, and engaged external experts; most systems have since returned to normal. The scope and any access to patient records remain under investigation, and the company does not currently expect a material adverse effect. For internal audit, the event touches operational continuity, access governance, and potential ICFR implications where laboratory testing and order processing interface with financial reporting.

Internal Audit Implications: This incident intersects operational continuity and ICFR. Internal audit should validate that incident response playbooks were executed and governed: who authorized suspensions, when triage began, what evidence preserved, and how stakeholders were informed. Evaluate access control hygiene post-incident—evidence of forced credential resets, MFA enforcement, emergency privileged access procedures, and approvals to re-enable accounts and services. ICFR scope: when testing and order-management systems paused, what manual workarounds or backlog reprocessing occurred? Test reconciliations ensuring completeness and accuracy of orders, results, and billing during the affected window. Review key IPE controls over order-to-cash interfaces, exception queues, and job monitoring. Inspect emergency changes for retrospective approvals and segregation-of-duties conflicts. Confirm backup integrity and restore testing proved data consistency. Controls to test this quarter: - Incident response governance, SIEM/EDR alerting, log retention and review - Privileged access management, password/credential reset attestations, MFA - Business continuity/RTO performance vs plan; evidence of formal service restoration criteria - Order-management and lab system reconciliations; cut-off and revenue deferral reviews - Data governance over patient records: access logging, segmentation, and breach assessment workflows Expect audit committee questions: Did outages create revenue recognition or disclosure risk? What evidence supports system and data integrity before financial close? What was the root cause and containment timeline? Are there control design gaps that rise to significant deficiency material to SOX compliance? What additional hardening and monitoring are now in place to reduce IT risk?

RevSpring data breach investigation (healthcare bill pay support tool, 2026)

Source: Class Action Pulse

Summary: Class Action Pulse reports RevSpring filed state breach notices beginning November 4, 2026 after unauthorized use of an internal support tool between May 15 and June 1 accessed patient information. RevSpring says it discovered the issue on August 17, involved outside cybersecurity experts and law enforcement, and is offering identity monitoring via Kroll. Notices cite affected residents in Vermont and Rhode Island. Exposed data may include contact details, dates of birth, Social Security numbers, and locations of service; diagnosis/treatment details and payment card numbers were not involved.

Internal Audit Implications: This is a vendor-access and data-governance failure with clear operational risk. Internal audit should review third‑party risk governance for patient billing vendors: scope of data shared (is SSN necessary?), least‑privilege access to internal support tools, MFA requirements, and audit logging of vendor activity. The timeline matters—unauthorized use (May 15–June 1), discovery (Aug 17), notices (from Nov 4). Test whether contractual notification SLAs and internal escalation requirements were met and evidenced. Controls to test this quarter: - Vendor access provisioning/recertification for support tools, session monitoring, and log reviews - Data minimization and field‑level controls over extracts sent to billing vendors; retention and secure transfer - Incident response handoffs with vendors: root‑cause analysis, corrective action plans, and evidence of containment - Customer communications governance (templates, approvals, tracking of identity monitoring offers) - Email and customer-contact protections to counter post-breach phishing using names and service locations Governance actions: update the risk register with third‑party data‑exposure scenarios; reassess inherent and residual risk ratings for billing vendors; and require management to track vendor remediation to closure with dated milestones. Expect audit committee questions: Which of our patients or customers were in the affected datasets? Did notification timing align with contracts and policy? What compensating controls reduce risk when SSNs are processed by vendors? What assurance do we have that the vendor’s corrective actions prevent recurrence, and how are we validating progress under risk governance?

WorkOS says attacker used ARTEX AI to breach internal sales app

Source: BleepingComputer

Summary: BleepingComputer reports WorkOS identified unauthorized access on October 30, 2026 to an internal sales-team application, exposing business contact details, account histories, product-usage metadata, and excerpts of sales calls, support discussions, and customer Slack conversations. WorkOS said no production services or app data were accessed. The company disabled external access, retained an independent forensic firm, and will notify affected customers. Founder Michael Grinich said the attacker used an AI offensive framework called ARTEX, with user agents including “artex-enrich/1.0” and “norma/0.4.”

Internal Audit Implications: Exposure of CRM records and customer communications at a vendor elevates phishing and social‑engineering risk. Internal audit should assess third‑party IT risk controls for vendors handling customer contact data and support interactions: data classification, scope minimization, monitoring of exports/API pulls, and restrictions on internal tools accessible from the internet. Require management to obtain from the vendor a clear inventory of data elements affected for your organization and indicators of compromise to tune detections. Controls to test this quarter: - Vendor due diligence and ongoing monitoring for CRM/support platforms; incident notification SLAs and evidence of compliance - API and integration governance: OAuth scopes, token hygiene, rate‑limiting, and anomaly detection for unusual user‑agent patterns - Data loss prevention for CRM notes, call summaries, and chat integrations; export/download approvals and logging - Spearphishing defenses tied to compromised contact data: targeted simulations, escalation paths, and customer advisories - Internal “sales ops” tool governance to prevent similar exposure in your environment (access model, code promotion, logging) Risk assessment updates: treat AI‑enabled attack frameworks as emerging risks; incorporate scenarios where conversation snippets and metadata fuel convincing fraud. Coordinate with customer‑facing teams on messaging and verification callbacks. Expect audit committee questions: What of our data, if any, resided in the affected app? How are we reducing immediate phishing exposure? Do vendor contracts and controls adequately address AI‑driven threats, and what evidence supports that conclusion?

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.