The Week in Breach: 10/21/20-10/27/20 | CloudSmart IT

The Week in Breach: 10/21/20-10/27/20

This week Pharmaceutical companies have a tough week with hacking as manufacturing is disrupted at COVID-19 drug makers and huge patient databases are exposed, and why selling access for profit is on the rise.

The Week in Breach News: Dark Web ID’s Top Threats This Week


  • Top Source Hits: ID Theft Forum
  • Top Compromise Type: Domain
  • Top Industry: Education & Research
  • Top Employee Count: 1 – 10

The Week in Breach News – United States 


United States –  Maxex

https://www.inforisktoday.com/blogs/home-loan-trading-platform-exposes-mortgage-documentation-p-2959

Exploit: Unsecured Database

MAXEX: Loan Trading

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.772 = Severe

Georgia-based home loan trader MAXEX had a data disaster this week as an estimated 9GB of data leaked from a suspected insecure server. Some of the data is from backend software development for its loan-trading platform. But a substantial portion included confidential banking documents, system login credentials, emails, the company’s data breach incident response policy, and cybersecurity readiness reports. The breach also exposed complete mortgage documentation for at least 23 individuals in New Jersey and Pennsylvania. The incident investigation is ongoing.

cybersecurity news represented by agauge showing severe risk

Individual Risk: 2.011 = Severe

Financial information for clients was leaked, opening customers up to identity theft concerns. Some impacted clients had no idea that MAXEX currently had their loan, creating complications for informing customers who may be affected. Consumers should check to see who is servicing their mortgage and take precautions against identity theft and spear phishing if that provider is MAXEX.

Customers Impacted: Unknown

How it Could Affect Your Business: Sloppy security can mean that if you do have an incident like a data breach, you might not even know where to start looking for the cause, putting your business at risk for an expensive investigation in addition to a data disaster.


United States – Made in Oregon

https://www.infosecurity-magazine.com/news/oregon-retailer-suffers-sustained/

Exploit: Unauthorized Database Access

Made in Oregon: Specialty Gift Retailer

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.669 = Severe

Customers of gift retailer Made in Oregon got a little something extra when they purchased their treats – a side order of fraud. For more than 6 months, cybercriminals gained access to its e-commerce site, stealing payment information for transactions that occurred between the first week of February 2020 and the last week of August 2020.

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.669 = Severe

Customers who made an online purchase from Made in Oregon may have had their name, billing address, shipping address, email address, and credit card information compromised. The company has sent out notices to people who could be impacted, warning of identity theft and spear phishing dangers.

Customers Impacted: 7,800

How it Could Affect Your Business Information that is stolen in incidents like this often ends up on the Dark Web in a data dump or information market where it powers cybercrime for years to come.


United States – Pfizer

https://pharmafield.co.uk/pharma_news/pfizer-suffers-huge-data-breach-on-unsecured-cloud-storage/

Exploit: Unsecured Database

Pfizer: Drugmaker

cybersecurity news gauge indicating extreme risk

Risk to Business: 1.401 = Extreme

In a monster week for pharma hacking, Pfizer leads the pack with a substantial data breach that it brought on itself. In a huge blunder, unsecured and unencrypted data containing logs, transcripts, and details of patient helpline conversations was leaked from a misconfigured Google Cloud storage bucket. The exposed data included detailed information regarding hundreds of conversations between Pfizer’s automated customer support software and patients using drugs including Lyrica, Chantix, Viagra, Ibrance, and Aromasin.

cybersecurity news gauge indicating extreme risk

Individual Risk: 1.412 = Extreme

The exposed call or chat transcripts had extensive PII and medical data for patients including full names, addresses, phone numbers, and details of health and medical conditions. The transcripts also contained detailed information about treatments, patient experiences, and questions related to products manufactured and sold by Pfizer.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Leaving this kind of information laying around is a hacker’s dream, and a security nightmare for your business as not only the recovery costs but the regulatory penalties for exposing this kind of data adds up.

ID Agent to the Rescue: Maintaining compliance with many data privacy regulations requires multifactor authentication, just one of the suite of security boosting features that are included with Passly. LEARN MORE>>


United States – City of Shafter

https://bakersfieldnow.com/news/local/city-of-shafter-hit-by-ransomware-attack

Exploit: Ransomware

City of Shafter: Municipal Government

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.714 = Severe

Cyberattacks against city governments and municipal services have been climbing worldwide, and Shafter, CA just joined the list after a ransomware attack took it’s systems offline for several days. The attack impaired the operations and delivery of city services, a common hallmark of recent municipal cybercrime.

Individual Risk: No personal or consumer information was reported as impacted in this incident.

Customers Impacted: 20,000

How it Could Affect Your Business: Ransomware has been a menace to municipal governments large and small. Just last week, the Hackney Borough Council in London was rocked by ransomware, and the risk is growing for governments as incidents pile up.


The Week in Breach News – Canada


Canada –  The Société de transport de Montréal

https://www.tripwire.com/state-of-security/security-data-protection/montreal-public-transport-agency-discloses-ransomware-attack/

Exploit: Ransomware

The Société de transport de Montréal: Municipal Transportation Agency 

cybersecurity news represented by a gauge indicating moderate risk

Risk to Business: 2.502 = Moderate

Getting around Montréal got a bit more complicated at The Société de transport de Montréal (STM) fell victim to a ransomware attack last week. While métro and bus service were not disrupted, after-sales service was not available and reservations for paratransit services were impacted.

Individual Risk: No personal data has been reported as impacted in this incident.

Customers Impacted: Unknown

How it Could Affect Your Business: Ransomware attacks on municipal infrastructure and transportation sector targets have been growing more frequent, and businesses that service those industries are also at risk, creating a need for better ransomware protection.


The Week in Breach News – United Kingdom & European Union


UK – Foxtons

https://propertyindustryeye.com/foxtons-hit-by-cyber-attack/ 

Exploit: Malware

Foxtons: Property Management 

cybersecurity news represented by a gauge indicating moderate risk

Risk to Business: 2.671 = Moderate

UK estate agency Foxtons was hit with a malware attack that impacted agency services, including a temporary shutdown of its MyFoxtons customer portal. The company describes the incident as a limited malware incident that infected a small part of the business but did not cause the loss of any data about its clients.

Individual Risk: No individual information has been reported as compromised in this incident.

Customers Impacted: Unknown

How it Could Affect Your Business: Ransomware can steal data, but it can also just shut a business down. Even a partially successful attack that doesn’t exfiltrate data or infect the entire network is a headache.


France – Sopra Steria

https://www.theregister.com/2020/10/22/sopra_steria_ryuk_ransomware_reports/

Exploit: Ransomware

Sopra Steria: IT Services and Data Center Operator

cybersecurity news represented by agauge showing severe risk

Risk to Business: 2.009 = Severe

French tech services giant Sopra Steria was slammed with a potential new variant of Ryuk ransomware, causing a disaster that could take months to clean up. The company, a member of France’s Cyber Campus, operates data centers for Britain’s NHS as well as operating software development, fintech, and consulting services. The investigation and recovery are expected to take months, and some systems are still not fully operational.

Individual Risk: No personal or financial data is reported as stolen or compromised in this incident.

Customers Impacted: Unknown

How it Could Affect Your Business: Attacks on large IT services targets that operate data centers, especially if they have medical information, have been ramping up as the search for a vaccine for COVID-19 makes patient and research data a hot seller in Dark Web data markets.


Finland – Vastaamo

https://newsnowfinland.fi/crime/hackers-hold-patient-information-for-ransom-in-psychotherapy-data-breach

Exploit: Ransomware

Vastaamo: Mental Health Clinic Operator 

cybersecurity news represented by agauge showing severe risk New This Week in Cybersecurity News Breach News This Week

Risk to Business: 2.702 = Severe

In a bizarre incident, a ransomware gang has snatched up the patient records of a mental healthcare clinic chain in Finland and is demanding ransom payments from the patients instead of the business. Vastaamo had not initially publically disclosed the breach due to the sensitive nature of the information stolen but has been working with authorities to investigate the incident and mitigate the damage.

cybersecurity news gauge indicating extreme risk

Individual Risk: 1.327 = Extreme

The cybercriminals have been contacting the patients whose information they’ve obtained, demanding that recipients must pay 200 euros within 24 hours, or if they don’t meet that deadline, 500 euros within 48 hours, to prevent the public release of their therapy records.

Customers Impacted: 400,000

How it Could Affect Your Business: This is this company’s second major data breach – the CEO was just terminated for the first one a week ago. Failing to implement strict security awareness and data handling policies after an incident, especially when your company keeps sensitive information, is a recipe for disaster.


Germany – Scalable Capital

https://international-adviser.com/robo-advice-firm-suffers-data-breach/

Exploit: Malicious Insider

Scalable Capital: Online Financial Advice

cybersecurity news gauge indicating extreme risk

Risk to Business: 1.227 = Extreme

At least one malicious insider is to blame for a cybersecurity disaster at fintech firm Scalable Capital. The firm said in a statement that it had discovered the incident on October 16 and taken action to prevent further damage, but a large amount of sensitive client data including financial information was snatched. It also concluded that it was clear that the attack was the work of someone with extensive insider knowledge of their systems.

cybersecurity news gauge indicating extreme risk

Individual Risk: 1.411 = Extreme

Clients impacted in the breach had what the company characterizes as general information exposed including names, residential addresses, and email addresses.

Customers Impacted: 20,000

How it Could Affect Your Business: Insider incidents are incredibly devastating, but also preventable. Whether you’re dealing with a malicious insider like this case or just a careless employee, learning to spot and stop insider threats pays off.


The Week in Breach News – Asia Pacific


India – Dr. Reddy’s

https://www.infosecurity-magazine.com/news/covid19-vaccine-global/

Exploit: Hacking

Dr. Reddy’s: Drugmaker

cybersecurity news gauge indicating extreme risk

Risk to Business: 1.206 = Extreme

In yet another attack on a pharmaceutical industry giant, India’s Dr.Reddy’s was crippled by a nasty hacking incident. The producer of vital COVID-19 treatments like remdesivir and favipiravir and expected manufacturer of Russia’s future Sputnik-V COVID-19 vaccine, Dr.Reddy’s was forced to shut operations at several global facilities, just as it was granted permission to begin a second round of human trials for Sputnik-V.

Individual Impact: No personal data was exposed in this incident.

Customers Impacted: Unknown

How it Could Affect Your Business: Healthcare targets have been getting nailed with a blizzard of attacks recently. Increasing protection like security awareness training and adding secure identity and access management is a smart move.


Japan – Shionogi & Company Limited

https://www.japantimes.co.jp/news/2020/10/23/business/corporate-business/japan-shionogi-cyberattack-data-breach/

Exploit: Ransomware

Shionogi & Company Limited: Drugmaker 

cybersecurity news represented by agauge showing severe risk

Risk to Business: 2.211 = Severe

Healthcare and pharmaceutical targets were on every cybercriminal’s menu this week, including Japanese medical giant Shionogi & Company Limited. The company’s Taiwanese subsidiary experienced a data breach that included sensitive information but did not impact its COVID-19 vaccine development programs. Data including import licenses for medical equipment and employee residency permits was exposed on the Dark Web as proof of the attack by the hacking gang to support a ransom demand.

Individual Risk: No individual information was reported as impacted in this incident.

Customers Impacted: Unknown

How it Could Affect Your Business: Ransomware typically arrives as the nasty cargo of a phishing email. Phishing is today’s biggest cybersecurity risk, and this kind of damage is exactly what makes it every IT professional’s nightmare.


The Week in Breach – Africa


South Africa – Nando’s Peri-Peri

https://www.thehindu.com/sci-tech/technology/haldirams-crucial-data-stolen-hackers-demand-75-lakh-to-release-information/article32880074.ece

Exploit: Credential Stuffing

Nando’s Peri-Peri – Restaurant Chain

cybersecurity news represented by a gauge indicating moderate risk

Risk to Business: 2.775 = Moderate

A credential stuffing incident gave customers of this popular high street restaurant chain a little more than they bargained for after several customers discovered that huge orders had been placed using their online accounts. to comply with COVID-19 operating regulations, Nando’s customers who are getting takeout are required to scan a QR code with their phone to order their food online, which opened up a vulnerability that cybercriminals were more than happy to exploit.

cybersecurity news represented by a gauge indicating moderate risk

Individual Risk: 2.802 = Moderate

Some customers have had their accounts hijacked with large food orders places, but the company is working with them to restore any funds snatched from pre-paid carryout orders while encouraging customers to reset their account credentials if they suspect that they may have been impacted.

Customers Impacted: Unknown

How it Could Affect Your Business: Credential stuffing is a favorite because it’s easy and cheap. Huge repositories of passwords in Dark Web data dumps give cybercriminals plenty of ammunition and produce results with little investment.


The Week in Breach News Guide to Our Risk Scores


1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

 

Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.


The Week in Breach: Featured Briefing

Access for Sale & As-a-Service Cybercrime Scored Big Bonanzas for Cybercriminals in September 


Insider threats are a menace that every business faces daily. In a challenging economy, companies hope to see their teams pulling together to drive revenue and create new opportunities. But that’s not always the case – a flood of malicious insiders is opening pathways into businesses in every sector, and they’re making a pretty penny doing it.

According to a recent report, the number of ads selling “as-a-service” cybercrime including network and database access, data laundering, and similar services tripled in September 2020. What was the total estimated value of just network access listings on cybercrime forums last month? Around $505,000.

By far, the largest category of “service” provided by malicious insiders is network access. Compromised credentials that open the door to data and systems sell fast, especially for privileged or administrator accounts – one recent sale of a highly prized credential fetched more than $100K. The average reported price for network access on hacker forums is around $4,960, but credentials can be obtained for as little as $25.

Protecting credentials is crucial in this environment. Better security around business credentials can protect businesses from malicious insiders by delivering intelligence and protection from two vantage points to give companies exactly the edge that they need.

While everyone wants to believe that their staff is just as dedicated and hard-working as they are, every business is at risk of damage from a malicious insider. By putting protections in place that make it easy to spot and stop malicious insiders, avoiding that damage becomes a little bit easier.


The Week in Breach: Need to Know

Dark Web Data Powers Impersonation & Business Email Compromise Scams 


Dark Web danger doesn’t just come to your company’s doorstep from compromised passwords – it also comes from data dumps full of email addresses, employee information, website user logs, supplier records, medical data, and more that can provide cybercriminals with exactly what they need to lure your staffers into a nasty (and expensive) trap. 

Every kind of data about your employees that you can think of is available on the Dark Web – sometimes for free. As the 2020 US elections race to the finish, voting registration data and records from special interest groups have fueled extremely dangerous spear phishing attacks including impersonation scams.

General business email compromise attempts are landing in employee inboxes every day too. A recent survey reported that over 30% of respondents reported receiving one every day. Running the gamut of impersonations including scary vendor notices, fake unpaid invoices, spoofed supplier communications, and even fake emails from colleagues, cybercriminals are pulling out all the stops to trick your staffers into falling into a business email compromise scam.

The most efficient and effective way to put the brakes on business email compromise risks is to mitigate the foundation that they’re built on: phishing email. With a more than 600% increase in phishing attacks clocked in 2020, making sure that your staff is ready to defend against phishing attacks is crucial to protecting your business from cybercrime like business email compromise.

Follow us on social media to find out about breach news, new blog posts, product updates, and other important news!
View All News & Articles

Ready to customize an IT solution that fits YOUR business goals? Get free guidance from our CEO.

Ready to customize an IT solution that fits YOUR business goals?

Get free guidance from CloudSmart IT.

Book a call or call us at 615.610.3500 today for your no-cost, no-obligation consultation.