United States – Washington State Auditor
Exploit: Third Party Data Breach
Washington State Auditor: Regional Government Regulator
Risk to Business: 1.379 = Severe
The unemployment claims data of more than 1 million people in Washington State has been reported as stolen in a hack of software used by the state auditor’s office. The State announced the breach after receiving notice that it was involved through a third party service provider, Accellion, a software provider the auditor’s office uses to transfer large computer files. the breach affects the personal information of people who filed for unemployment claims with the Washington Employment Security Department (ESD) between Jan. 1, 2020, and Dec. 10, 2020, and included a total of 1.6 million claims. Those claims represent at least 1.47 million individuals, according to data from the ESD website.
Individual Risk: 1.379 = Severe
The data breach involved claimants’ names, Social Security numbers and/or driver’s license or state identification number, bank information, and place of employment. The state auditor has set up a web page for people who think their personal information could have been exposed in the data breach. See https://sao.wa.gov/breach2021/.
Customers Impacted: 1.40 million or more people
How it Could Affect Your Customers’ Business: Data like this is sought-after by cybercriminals to power phishing operations. Unfortunately for these folks, it often hangs around for years on the Dark Web, acting as fuel for future cybercrime.
United States – DriveSure
Exploit: Hacking
DriveSure: Customer Retention Platform
Risk to Business: 2.211 = Severe
Hackers dropped data on 3.2 million DriveSure users on the Raidforums hacking boards late in January. One leaked folder totaled 22 gigabytes and included the company’s MySQL databases, exposing 91 sensitive databases. The databases range from detailed dealership and inventory information, revenue data, reports, claims and client data. A second compromised folder contained 11,474 files in 105 folders and totals 5.93 GB, likely a repository of backup data.
Individual Risk: 2.325 = Severe
The information exposed included names, addresses, phone numbers, email addresses, IP addresses, car makes and models, VIN numbers, car service records and dealership records, damage claims and 93,063 bcrypt hashed passwords.
Customers Impacted: 3.2 million
How it Could Affect Your Customers’ Business Data isn’t always stolen via ransomware – sometimes it’s just old-fashioned hacking. That’s one reason why it’s essential to use a secure identity and access management solution to keep hackers locked out.
United States – WestRock
https://www.securityweek.com/packaging-giant-westrock-says-ransomware-attack-impacted-ot-systems
Exploit: Ransomware
WestRock: Packaging Manufacturer
Risk to Business: 2.779 = Extreme
Packaging giant WestRock has experienced a ransomware attack that has impacted both its manufacturing and IT environments, severely impacting production. The company has noted in an announcement to shareholders that it expects that continued delays during the recovery and cleanup process are expected.
Individual Impact: No sensitive personal or financial information was announced as part of this incident, but the investigation is ongoing.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Ransomware can be especially devastating to manufacturing companies by not just impacting office business but halting production, leading to a cascade effect.
United States – SN Servicing Company
Exploit: Ransomware
SN Servicing Company: Mortgage Loan Services
Risk to Business: 2.022 = Severe
SN Servicing, the California-based servicing arm of Security National Master Holding Company, disclosed a data breach impacting clients in Vermont and California. The incident was also reported by the Egregor ransomware gang. SN Servicing says that it has engaged a third party team of investigators to determine the scope of the incident.
Individual Impact: 2.171 = Severe
The stolen data appears to be related to billing statements and fee notices to customers from 2018, including names, addresses, loan numbers, balance information, and billing information such as charges assessed, owed, or paid. Clients should be aware of potential spear phishing and identity theft risks.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Ransomware is around every corner these days, and just one misclick on a phishing email can spell disaster.
United States – Spotify
https://threatpost.com/spotify-credential-stuffing-cyberattack/163672/
Exploit: Credential Stuffing
Spotify: Streaming Music Service
Risk to Business: 1.668 = Severe
Spotify has returned for another appearance with a credential stuffing disaster eerily similar. This time, data for approximately 100k users appeared in an Elasticsearch instance spotted by researchers. This is distinctly different data than the load that researchers discovered in November 2020.
Risk to Business: 1.802 = Severe
No specifics were listed about the stolen data, but Spotify users should reset their account passwords and be on the lookout for spear phishing attempts.
Customers Impacted: 100K+
How it Could Affect Your Customers’ Business: Protection against credential stuffing isn’t something that a company like Spotify should struggle with, and suffering two credential stuffing incidents in one quarter shows a sloppy attitude toward security.
France – StormShield
https://www.zdnet.com/article/security-firm-stormshield-discloses-data-breach-theft-of-source-code/
Exploit: Hacking
StormShield: Cybersecurity Firm
Risk to Business: 1.711 = Severe
French government contracting cybersecurity firm StormShield has confirmed that cybercriminals were able to gain access to one of its customer support portals and stole information on some of its clients. The hackers also gained access to some source code for StormShield Network Security (SNS) firewall, an upcoming tool designed for government use. The intruders may have also accessed personal and technical data for some of its customers, its tech support portal and the Stormshield Institute customer training portal.
Individual Impact: No sensitive personal or financial information was announced as part of this incident, but the investigation is ongoing.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Even cybersecurity experts can get tripped up by hackers. Taking extra precautions to update security awareness training and bolster access point security is always a good idea.
Luxembourg – European Volleyball Confederation
Exploit: Unsecured Database
European Volleyball Confederation: Sports League
Risk to Business: 2.625 = Moderate
A publically accessible Microsoft Azure blob belonging to the European Volleyball Confederation led to the exposure of hundreds of passports and identity documents belonging to journalists and volleyball players from around the world. The blob also contained thousands of headshots of volleyball players from Europe, Russia, and other countries in both the ‘backup‘ directory and an ‘AccreditationPhotos‘ subfolder.
Individual Risk: 2.601 = Moderate
Members of the league and journalists who cover it should be vigilant for identity theft and spear phishing attempts that use this data.
Customers Impacted: 21,000
How it Could Affect Your Customers’ Business: Failure to secure a database, especially one that contains sensitive data, is a rookie mistake that can cost you a fortune.
Australia – Oxfam Australia
Exploit: Hacking
Oxfam Australia: Charitable Organization
Risk to Business: 2.006 = Severe
A donor database for Oxfam Australia was discovered by cybersecurity researchers. Oxfam Australia is a charity focused on alleviating poverty within the indigenous Australian people. A threat actor was attempting to sell the Oxfam Australia contact and donor information for 1.7 million people. The incident is under investigation.
Individual Risk: 2.719 = Moderate
The exposed information appears to be limited to donor names, email addresses, addresses, phone numbers, and donation amounts. No financial information was exposed.
Customers Impacted: 1.7 million donors
How it Could Affect Your Customers’ Business: Hacking is an ever-present menace, and organizations that have a strong security plan coupled with high cyber resilience are more likely to make it through an incident with minimal damage.
Australia – SitePoint
https://www.zdnet.com/article/webdev-tutorials-site-sitepoint-discloses-data-breach/
Exploit: Third Party Data Breach
SitePoint: Web Development Education Resources
Risk to Business: 1.616 = Severe
Web developer education platform SitePoint has disclosed a security breach this week in emails sent to some of its users after a threat actor listed a collection of one million SitePoint user details for sale on a cybercrime forum. SitePoint has now initiated a password reset on all accounts and is asking users to choose new ones that are at least ten characters long.
Individual Risk: 1.711 = Moderate
The stolen passwords were hashed with the bcrypt algorithm and salted, but SitePoint encourages users who may be recycling their password elsewhere to reset those accounts too.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Password reuse and recycling is endemic, and it can lead to a world of cybersecurity trouble.Add protections that blunt the impact of a reused (and compromised) password.
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.
Extended Remote Work is Changing the Calculus on Risk
The rapid transition to remote work was a fundamental shock for many companies. Getting used to a new out-of-the-office culture, new technology and new stressors was hard enough, but the fact that this state of affairs is fated to continue for a long time with no real end in sight has caused companies to need to thoroughly rethink their approach to cybersecurity.
An estimated 90 percent of companies experienced a sharp increase in cyberattacks during the global pandemic. In the UK, 65 percent of organizations noted they have either been breached or exposed to an attack during the lockdown. Plus, 73 percent of security and IT executives are concerned about new vulnerabilities and risks that have been created or extended by supporting a remote workforce.
Some of those risks were exacerbated by both a lack of preparation to be ready to go fully remote and a lack of essential upkeep because of pandemic chaos after going remote – 98 percent of IT professionals in an international survey said they experienced security challenges within the first two months of the pandemic. Only 42 percent of survey respondents felt that their organization was “well prepared” for moving to remote work, compared to 45 percent that considered their companies “somewhat prepared” and 13 percent who stated that their businesses were were not prepared at all.
Extended Remote Work Means Extended Risk
Companies suddenly discovered a lot more challenges that threw them off their game as they made the transition to remote operations, as well as unexpected stumbling blocks. In the same survey, 93 percent of respondents said they had to delay key security projects in order to work on the transition to remote work forced by the pandemic. Over 30 percent of security executives said that software updates and BYOD policy considerations were deprioritized during the switch, and 42 percent said that routine reporting had been neglected since the start of the pandemic.
The cascade effect of those choices coincided with a huge global increase in cybercrime, as businesses were often forced to take on more cybersecurity risk in order to keep operating if they were unprepared for the transition. Like allowing workers to use personal devices until business devices could be obtained for workers who had never been remote – 43 percent experienced difficulties patching remote workers’ personal devices, exposing their organization to risk and more than 90 percent reported that their companies were forced to make rapid decisions about cybersecurity policy just to keep the lights on.
The Time for Excuses is Over
While the start of the global pandemic was extremely chaotic and disruptive throughout the world, that was almost a year ago. Companies have had time to solve these complex security issues, but many haven’t. Researchers note that only about half of the surveyed companies had adopted simple security tools like multifactor authentication to combat the increased risk of remote work.
The numbers are in for 2020, and it was a record-breaking year for new vulnerabilities, with a 30 percent year over year increase. That’s not even counting attacks like phishing that have skyrocketed by more than 660 percent. That leaves huge gaps for security teams to handle – only 11 percent confirmed they could confidently maintain a holistic view of their organizations’ attack surfaces.
Remote working isn’t going anywhere either, and that continues to be problematic for companies that have failed to adjust. Some companies have chosen to remain fully remote as both a cost-cutting measure and an employee convenience aid. Many companies also intend to return to their offices as soon as they’re safely able, but that doesn’t mean anytime soon. More than 70 percent of respondents projected that at least one-third of their employees will remain remote 18 months from now.
Why Don’t Employees Comply with Cybersecurity Rules?
You’ve set policies, sent out emails and had meetings – and some of your employees still aren’t compliant with your cybersecurity policies. Why won’t they listen, and what will it take to get through to them?
Is the policy that you’ve chosen antithetical to the functions of some of your teams? Organization-wide choices that make sense from one department’s perspective may be strange and disrup[tive to another division’s workflow. Researchers in a recent study on the subject determined that each subculture within an organization will interpret and implement new security policies differently based on that subculture’s focus.
You might want to consider taking a wider approach. Instead of starting from the top when making choices about information security and technology policies, start from the bottom in every team. Non-IT staff may ignore or subvert security policies that directly make their job more difficult if they fail to understand the “why” of them – especially when they’re working remotely.
That’s one reason why security awareness training and secure identity and access management are essential for companies that are striving to build their cyber resilience in a tumultuous world. This power pair adds to both your long-term and short-term security to deter employees from playing fast and loose with security policies and make sure everyone’s on the same page about cybersecurity dangers.
By taking the time to consider the impact of security policies on the work that each of your teams does, educating your staffers about cybersecurity dangers, and adding essential protections that guard against cybercrime automatically, you can transform your employees’ approach to cybersecurity, taking them from being your biggest security risk to your biggest security asset.