Most young people aren’t getting latest Covid-19 booster, but they’re not filling hospital beds at three large health care systems



CNN
 — 

As the US mulls over its future Covid-19 vaccination plan, data from three large health care systems indicate that even though a small percentage of people under age 65 have gotten the new Covid-19 booster, people this age are not becoming severely ill and overwhelming hospitals.

“Even if they’re not getting boosted, young, healthy people are not getting super sick from this,” said Dr. Mangala Narasimhan, a senior vice president at Northwell Health, the largest health care provider in New York state. “We’re not seeing it. It’s not happening.”

The US Food and Drug Administration has proposed a framework for annual Covid vaccinations for all Americans over the age of 6 months, but at a meeting with its vaccine advisers last month, it did not come up with a concrete plan. Vaccine advisers to the US Centers for Disease Control and Prevention are scheduled to meet February 24 to discuss the future of the US Covid-19 vaccination program.

Uptake of the bivalent booster, which has been available since September, has been low. Nationally, only about 16{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} of the population has gotten it, and the rates are especially low for people under 65, according to CDC data.

Narasimhan and doctors at Montefiore Medical Center in New York City and Clalit Health Services, Israel’s largest health care organization, say the relative mildness of current Covid strains, along with a degree of immunity from previous vaccinations and infections, are going a long way toward protecting healthy young people, even if they don’t get the booster.

Dr. Ran Balicer, director of the Clalit Research Institute and chairman of Israel’s Covid-19 National Expert Advisory Panel, noted that at earlier points in the pandemic – for example, when the virulent Delta variant was raging – it was “not responsible” to opt out of the vaccine.

“I don’t think that’s the case anymore,” he said. “I think when you’re under 65 and healthy, it’s a much more complex question, and I think that’s where individual risk assessment and personal preferences come into play.”

Since the new booster became available, about 12{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} of all Covid deaths in the US have been among people younger than 65, according to CDC data.

A report released by the CDC on Thursday analyzed death rates and vaccination status from September through December. It showed that people who were vaccinated – either with only the original vaccine or with an updated booster in addition – were better protected than those who were unvaccinated.

The updated booster helps protect against both the original strain of the coronavirus and more recent Omicron strains. It was particularly effective at reducing death rates in older people and less effective for younger people. For adults younger than 65, the bivalent booster offered at least three times better protection from death than just the original vaccine – but the difference in death rates was less than one in a million.

The CDC recommends the updated booster to everyone over age 6 months, but a government advertising campaign focuses on the importance of the shot for people over 50.

“We’re not surprised, and we’re grateful [and] happy to see that hospitals aren’t filling up” with people under age 65, said Dr. Ruth Link-Gelles, a CDC senior epidemiologist and lead author of several studies on the booster’s effectiveness. “But we still see occasionally healthy younger adults end up in the hospital. And to me, it’s a no-brainer if I can take five minutes, pop into my local pharmacy and get a shot.”

“There are people under 65 that are still dying of Covid, (and) any death in an unvaccinated or under-vaccinated person is potentially preventable had that person gotten the booster,” she added.

Link-Gelles said the CDC wants to avoid overly complicated guidelines for the new booster, with different suggestions for different age groups.

“We generally across the board see higher uptake of vaccination with simpler vaccine recommendations,” she said. “That’s one of the things we’re trying to accomplish here.”

In October, as President Joe Biden rolled up his sleeve to get the new booster, he urged other Americans to do the same.

For people who are fully vaccinated, “our nation’s health experts recommend that they get the updated Covid vaccine once a year,” Biden said at a White House briefing. “Nearly every death is preventable [so] get your updated Covid shot.”

By and large, Americans haven’t listened. While 41{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} of those over age 65 have received the booster, only 12{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} of those ages 5 to 64 have opted to get it, according to CDC data.

Data from the three large health care systems in New York and Israel since September 1 indicate that the low booster uptake for people under 65 has not led to high Covid hospitalization rates for this group.

At Northwell, about 1,224 patients under the age of 65 have been admitted with severe Covid-19 in that time period.

“This is a large hospital system with [21] hospitals, so this is a small number in the big picture of Northwell,” Narasimhan said.

Of the patients under 65 hospitalized with Covid, half had never received a Covid-19 vaccine shot of any kind, 42{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} had had one or two shots, and 7{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} had had three shots; 72{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} also had underlying health conditions such as high blood pressure, diabetes or heart disease, according to an analysis done by Northwell for CNN.

At Montefiore Medical Center, about 300 patients under age 65 were hospitalized for Covid-19. Among those, 32{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} were unvaccinated, 10{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} were partially vaccinated, and 58{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} were fully vaccinated; 82{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} also had underlying conditions, according to Dr. Inessa Gendlina, an infectious disease expert and assistant professor at Einstein Montefiore Department of Medicine.

At Clalit, 1.2{bf0515afdcaddba073662ceb89fbb62b6b1bf123143c0e06b788e1946e8c353f} of 4.5 million members under the age of 65 have opted to get the updated booster, according to Balicer. Covid hospitalization rates for that age group have been “low” since September: less than 5 per 100,000 people per month.

In the US, Covid hospitalization rates are trending down, with an average of about 3,800 new admissions each day for people of all ages, less than 1,000 of which have been among people under age 60, as of the last week of January, according to the CDC. That data includes patients who were hospitalized for reasons unrelated to the virus but who tested positive while hospitalized, according to the agency.

The strength of the Northwell, Montefiore and Clalit data is that they’re large systems that make a distinction between patients who were hospitalized specifically because of Covid and those who incidentally tested positive for Covid while in the hospital for a different reason.

When the bivalent booster came out in September, Balicer, the chairman of Israel’s Covid-19 National Expert Advisory Panel, did not get it.

“I am not in any risk group, and I’m below 65, so I did not hurry to take my bivalent,” said Balicer, who is in his late 40s and does not provide direct care to patients.

His reasoning was that if he didn’t get the booster and came down with Covid, he probably would not get very sick given the relative mildness of the prevailing strain, some immunity from his three previous vaccinations and a bout with Covid last year. Also, he figured that if he did get the booster, it probably would not provide long-term protection from infection.

“Because I was vaccinated before, I know my risk of severe morbidity is very low” even without the booster, he said. “And I know that the protection from infection that I will get from the additional booster will be short-term – a few months.”

But in late November, Balicer decided to get the shot because he had to travel abroad to attend “long and important” meetings, which involved several 12-hour flights and sitting with large groups of people in small rooms with little ventilation.

“I did not want to risk becoming ill with Covid during that stay. I made a personal risk assessment” to get the vaccine, even though he knew he might feel a bit sick the day after getting it, he said.

Some experts interviewed by CNN say that although the booster is important for elderly and for immune-compromised people, the decision whether to get it is somewhat murky for younger, healthy people.

Narasimhan, 51 and a pulmonary and critical care specialist at Northwell, said although there’s data showing that the shot protects people over age 65 and those who are immune-compromised from dying or ending up in the hospital, “young, healthy people don’t necessarily need to get boosted.”

She said she and her young adult children got the booster because they live with a frail, elderly relative, and they want to do everything they can to decrease their chances of getting infected and passing it to him. But she said people in different situations might not make the same decision.

Dr. Nadav Davidovitch, 53, head of the School of Public Health at Ben-Gurion University of the Negev in Israel, said he got the booster and urged his family members to get it.

“I told them it’s a good idea. But when I’m talking to someone over 50 or who has chronic conditions, I’m pushing it more,” he said. “For young people, it’s a matter of choice. There are different personalities and risk perceptions. I won’t say it’s a major mistake for a person who’s 20-something not to get the booster.”

For young, healthy people, personal circumstances matter, he said.

“It’s the context of who you’re living with and visiting, so for example, maybe for health workers, it would be more important to get it,” said Davidovitch, who chairs the Covid-19 Task Force at the Association of Public Health Schools in the European Region.

Data shows that the booster provides “a modest degree of protection” against symptomatic Covid compared to those who’d been previously vaccinated, and “it’s likely that increased vaccination among all or most people helps slow the spread of disease and reduce the chances they infect someone at high risk of severe disease,” according to a statement from CDC spokesperson Kristen Nordlund.

However, experts interviewed by CNN questioned whether the protection conferred by the booster is sufficient to prevent transmission of the virus.

Dr. Michael Osterholm, director of the Center for Infectious Disease Research and Policy at the University of Minnesota, said that although it’s “noble” to think that getting the booster will help protect others, the shot is much less effective at preventing transmission compared with the original vaccine at earlier points in the pandemic.

“Your chances of getting infected are altered very little with the [booster], so you can’t say with any scientific integrity that protecting others is why you should get it,” said Osterholm, who in a recent podcast emphasized the importance of getting boosted if you’re at higher risk for serious illness.

“My focus is on people who are 65 and older and those who are immune-compromised. That’s who I think really should get” the booster, Osterholm told CNN, noting that more people in those groups need to go out and get the shot.

On one end of the spectrum of debate over the booster, Dr. Paul Offit, a member of the FDA’s Vaccines and Related Biological Products Advisory Committee, has argued against campaigns to convince healthy young people to get the shot.

“Booster dosing is probably best reserved for the people most likely to need protection against severe disease – specifically, older adults, people with multiple coexisting conditions that put them at high risk for serious illness, and those who are immunocompromised,” Offit, a pediatric infectious disease specialist at the University of Pennsylvania, wrote last month in the New England Journal of Medicine.

“In the meantime, I believe we should stop trying to prevent all symptomatic infections in healthy, young people by boosting them with vaccines containing mRNA from strains that might disappear a few months later,” he added.

Offit, who notes that he’s 71 and has no underlying health issues, did not get the new booster. He has had three doses of the original vaccine and contracted Covid once and he says he would have considered himself protected against severe disease with either three doses of the original vaccine or two doses plus an infection.

On the other end of the spectrum, some experts do think it’s important for young, healthy people to get the new booster.

“I strongly encourage those under 65 to get the booster, especially those in the 40 to 64 range,” said Dr. Peter Hotez, a vaccinologist whose team at Texas Children’s Hospital developed a Covid-19 vaccine used in India and Indonesia. “You can still see a lot of severe Covid, and long Covid can occur with any infection.”

Gendlina, the infectious disease doctor at Montefiore, who is in her mid-40s, said she got the booster as soon as it came out and recommended it to her family, including her teenage son.

“As we’re stepping away from masking, it’s more and more important to get vaccinated,” she said.

Link-Gelles, the CDC epidemiologist, is 38, and she says she got the booster for several reasons, including that her husband is immune-compromised, they have a daughter in day care and they visit elderly relatives.

“Vaccination to me seems like a slam dunk,” she said. “It’s very easy to get, [and] you don’t have to worry again for a while. It’s not going to be perfect, but it is going to provide you some degree of protection and therefore protection against infecting someone else.”

The latest cyberattack on health care shows how vulnerable the sector is

Comment

Welcome to The Cybersecurity 202! Aubrey Plaza is a national treasure.

Reading this online? Sign up for The Cybersecurity 202 to get scoops and sharp analysis in your inbox each morning. 

Below: Cybercriminals stole more than $500,000 from a senator’s campaign committee, and T-Mobile is again hacked. First:

Apparent BlackCat ransomware attack demonstrates risks to health-care sector, vendors

An apparent ransomware attack on a major electronic health records company demonstrates the vulnerability of the health-care sector to potentially disastrous cyberattacks.

The cyber incident impacted NextGen Healthcare last week. It apparently took place at the hands of a ransomware group that the Department of Health and Human Services warned about earlier this month.

The company says it doesn’t look like the hackers obtained any client data, although it didn’t say anything about patient or employee data. The suspected Russian ransomware group that claimed responsibility, BlackCat, put an alleged sample of NextGen information on its extortion site — typically used to compel victims to pay or risk further exposure — but later took down the NextGen listing.

However the NextGen incident plays out in the end, it highlights trends of attacks on major vendors and the health-care system.

What happened (according to those involved)

Founded in 1974, the Atlanta-based NextGen Healthcare claims 2,800 employees and reported revenue of nearly $600 million in 2022. It says it provides software and technology services in “ambulatory” settings, a term that ranges from physician offices to outpatient clinics, and has helped more than 2,500 health-care organizations across the world. 

Here’s what NextGen told media outlets happened in response to inquiries about the BlackCat extortion site listing:

  • “NextGen Healthcare is aware of this claim and we have been working with leading cybersecurity experts to investigate and remediate. We immediately contained the threat, secured our network, and have returned to normal operations. Our forensic review is ongoing and, to date, we have not uncovered any evidence of access to or exfiltration of client data. The privacy and security of our client information is of the utmost importance to us.”

The statement is silent on whether any patient or employee data was affected, Databreaches.net pointed out. Spokespeople for the company didn’t answer questions about those elements of the incident on Sunday. And a purported spokesperson for BlackCat (also known as ALPHV) refused to provide further proof of obtaining client data.

It’s not uncommon for companies to learn later that a breach was more extensive than originally believed. It’s also not uncommon for cybercriminals to lie about what kind of data they’ve stolen, or boast that they’ve stolen something they never did.

BlackCat is “a relatively new but highly-capable ransomware threat to the health sector,” according to an HHS threat briefing dated Jan. 12. It’s not the first time U.S. authorities have issued warnings about the group.

  • HHS dubbed it a “triple-extortion” group, marked by ransomware attacks that accompany threats to leak data and conducted distributed denial-of-service attacks intended to knock websites offline.
  • It has ties to older, infamous Russian ransomware gangs, such as Darkside/Black Matter and REvil.
  • The group has said it doesn’t “attack state medical institutions, ambulances, hospitals,” but that the “rule does not apply to pharmaceutical companies, private clinics.” HHS notes that ransomware gangs have frequently broken these promises.
  • BlackCat favors U.S. targets, according to HHS, which is not uncommon for ransomware gangs, many of which are believed to be based in Eastern Europe.

The ransomware risks for health-care organizations are severe, including potentially causing patient death. North Korean and Iranian hackers have demonstrated particular interest in pursuing attacks on the sector.

Companies that are vendors for other firms are a prominent way for ransomware gangs and other cybercriminals to expand their reach. Notable incidents include:

  • In 2021, REvil got into a software system developed by Kaseya, which in turn affected what Kaseya estimated to be 800 to 1,500 businesses.
  • Suspected Russian hackers accessed SolarWinds software as a means of obtaining access to U.S. government agencies, government organizations around the world and major tech companies.
  • Specifically in the health-care sector, a ransomware incident in the United Kingdom last summer affecting a service provider caused issues for the country’s National Health Service.

Regardless of how the NextGen incident turns out, it’s one episode in an eventful start to 2023 for ransomware. This year has seen the usual array of attacks and disclosures mixed in with some unusual reversals.

  • Restaurants in the U.K., including KFC, Pizza Hut and Taco Bell, had to shut down after a ransomware attack on parent company Yum!, the company said Wednesday.
  • The Los Angeles Unified School District earlier this month acknowledged that ransomware hackers last year stole employee Social Security numbers.
  • On New Year’s Eve, the LockBit gang apologized for what it said was an affiliate hacking a children’s hospital in Canada, and offered the hospital a decryptor to unlock its systems.
  • A study by blockchain analytics company Chainalysis released over the weekend suggested that ransomware payments were down in 2022, as more victims appeared to refuse forking over ransoms to crooks holding their networks hostage. But ransomware criminals continue to use cryptocurrency, contributing to illicit crypto activity reaching an all-time high last year, the firm concluded in another report this year.

Cybercriminals steal more than $500,000 from GOP senator’s campaign committee

They stole the money after sending phony invoices to Moran for Congress, the campaign committee for Sen. Jerry Moran (R-Kan.), Raw Story’s Dave Levinthal reports. The committee has recovered around a quarter of the stolen funds, which amounted to $690,000, it said in a Federal Election Commission filing.

“Cybercriminals targeted the accounting firm employed by Moran For Kansas and money was wired to fraudulent bank accounts,” Moran for Kansas spokesman Tom Brandt told Raw Story in an email. “As soon as a discrepancy was realized, it was reported to law enforcement. We are currently pursuing all avenues available to recover the money and there is an ongoing investigation with the FBI. The campaign also consulted with the FEC on how to transparently report the unauthorized expenditures.”

Cybercriminals have targeted other political campaigns as well. “Joining Moran among the federal-level politicians to experience thefts from their campaign accounts in recent years is President Joe Biden, whose 2020 Democratic presidential campaign committee lost at least $71,000,” Levinthal writes. “The Republican National Committee, Rep. Diana Harshbarger (R-TN), former Democratic presidential candidate and congresswoman Tulsi Gabbard and rapper-turned-2020 presidential candidate Ye, formerly Kanye West, are among others who reported money stolen from their political accounts.”

T-Mobile got hacked — again

T-Mobile said the hacker stole information like names, addresses, emails, phone numbers, birth dates and account numbers on as many as 37 million customers, TechCrunch’s Lorenzo Franceschi-Bicchierai reports. It’s the eighth time the phone carrier — which has 110 million customers — has been hacked since 2018.

“Our investigation is still ongoing, but the malicious activity appears to be fully contained at this time, and there is currently no evidence that the bad actor was able to breach or compromise our systems or our network,” the company said in a Securities and Exchange Commission filing.

A spokesperson for the company didn’t respond to TechCrunch’s request for comment.

A hacker found the sensitive U.S. no-fly list on an open server

Swiss hacker maia arson crimew found the list — which includes people not allowed to fly in or to the United States — on a server run by a regional U.S. airline, the Daily Dot’s Mikael Thalen and David Covucci report.

“The server contained data from a 2019 version of the federal no-fly list that included first and last names and dates of birth,” CommuteAir spokesman Erik Kane told the Daily Dot. “In addition, certain CommuteAir employee and flight information was accessible. We have submitted notification to the Cybersecurity and Infrastructure Security Agency and we are continuing with a full investigation.”

The Transportation Security Administration told the Daily Dot that it’s “aware of a potential cybersecurity incident with CommuteAir, and we are investigating in coordination with our federal partners.” 

U.S. law enforcement has noticed the hacker, crimew, before. In 2021, a grand jury indicted crimew, accusing the hacker of breaching “dozens of companies and government agencies.” Crimew was also a member of a group of hackers who breached security camera firm Verkada.

Hackers penetrated LAUSD computers much earlier than previously known, district probe finds (Los Angeles Times)

Riot Games hacked, delays game patches after security breach (Bleeping Computer)

A hack at ODIN Intelligence exposes a huge trove of police raid files (TechCrunch)

Majority of GAO’s cyber recommendations since 2010 have gone unresolved (NextGov)

  • Jack Cable and Lauren Zabierek have joined the Cybersecurity and Infrastructure Security Agency as senior technical adviser and senior policy adviser.
  • CIA deputy director for analysis Linda Weissgold speaks at an event hosted by the Intelligence and National Security Alliance on Tuesday at 9 a.m.

Thanks for reading. See you tomorrow.