On Monday, October 19, five published releases of OVHcloud’s command-line tool went bad on GitHub. A hijacked contributor account swapped the download archives for a build that steals secrets off disk. The files sat in public for 94 minutes, from 12:47 to 14:21 UTC. That window is now a cybersecurity problem for every shop that automates CLI installs.

The same week, Paradigm Healthcare Services began notifying about 970,000 Medi-Cal members after an intrusion spotted in October 2025. Nearly a year elapsed between detection and those letters. You can run a mature cyber security program and still be living on the slower of those two clocks.

Ninety-Four Minutes Is a Full Incident

The OVHcloud CLI is the kind of tool you forget you trust. Cloud operators install it to talk to infrastructure. CI jobs fetch it because a README said to. A contributor account is supposed to be a human with a reputation. Once that account is hijacked, GitHub becomes a clean distribution channel. HTTPS to github.com looks like ordinary work to your firewall. The binary looks like the same product your runbooks already bless.

OVHcloud says the swapped archives were built to steal secrets stored on disk of any machine that ran them. You know what lives on those disks: API tokens, kubeconfigs, SSH keys, env files, browser stores. One jump box, one GitHub Action runner, one laptop that still has yesterday’s credentials in a home directory, and the attacker is reading production before your lunch order arrives. Ninety-four minutes is enough time for a scheduled job to pull a release and execute it with no human in the loop.

Treat that interval as a completed incident, even if you think nobody clicked. Release assets on GitHub are a production path. If your threat detection only lights up on malware hashes, you will miss the hour when a trusted publisher’s files change. Hash-pinning and release-diff alerts are the controls that fit this clock. Waiting for a vendor advisory is how 94 minutes becomes a quiet week of stolen tokens.

Patients Heard After Eleven Quiet Months

Paradigm Healthcare Services sits in the Medi-Cal billing world, which means member data flows through it because a health program needs claims processed. The company detected an intrusion in October 2025. Notification to about 970,000 Medi-Cal members started nearly a year later. If you buy or oversee a plan, that lag is now a conversation you will have with people who never signed a contract with Paradigm. They will remember the wait, not your processor map.

Delay has a cost that dashboards never plot. Fraud gets a head start. Patients freeze credit after the sale, if they freeze it at all. Legal and forensics can spend months arguing over the population while the incident response letter sits in draft. Pull your notification exhibit and see when the clock starts. If it starts at “we finished the spreadsheet,” you have built a year-shaped hole into a process you call mature.

Defense in depth looks thin when the missing layer is a calendar. Encryption, access reviews, and a polished tabletop still leave members exposed if the only control they receive arrives on a government-mail cadence. For 970,000 Medi-Cal households, the letter was the control that mattered. It showed up after the attacker had a long, quiet season.

Vendors spent the week talking about AI agents as insiders and containment that moves when an agent strays. Fair point. Apply it to CLI tools, member-data processors, and helpdesks that trust a brand on a screen.

You Need Cybersecurity That Fits in 94 Minutes

Researchers who infiltrated a large Microsoft tech support scam this week watched a Russian-run traffic distribution system bounce victims through thousands of Cloudflare links. The lure stays one hop ahead of anyone still pasting indicators into a weekly threat-protection list. That desk is already doing brute-force work against human patience. Your users are in a 94-minute problem even when they never touch a CLI.

If a host in your environment could have fetched the OVHcloud CLI from GitHub between 12:47 and 14:21 UTC on October 19, treat it as a secret-theft case today. Rotate cloud keys, Git tokens, and SSH identities that lived on disk. Rebuild the box. Killing the process leaves whatever the binary already shipped.

Pin every CLI and SDK you install in CI to a hash you recorded yourself. Stop pulling “latest” from GitHub. Require phishing-resistant MFA and a hardware key for anyone who can publish a release in your orgs, then alert when release assets change after publish. Those are security hardening steps you can finish this week without buying a platform.

On the processor side, pre-approve notification language so counsel is editing hours, not seasons. Start the member clock at detection. Put a call-back number for real support in a place your staff already look, and tell them a Microsoft badge on a browser page is a hostile channel. Egress after a new binary runs should be a ticket, not a curiosity.

Keep two numbers on a page your leadership already reads: time from a malicious publish to a blocked install path, and time from detection to people notified. Review them monthly. A cyber security program that cannot describe both is guessing. Tabletop a 90-minute supply-chain event beside an 11-month notice drill.

Sources

• Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
• 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
• Researchers Infiltrate Microsoft Tech Support Scam Operation
• Agents are your newest insiders. Security must move at their speed.