Week in Breach 7/5-7/11/2023

Risk to Business: 1.886 = Severe

A ransomware attack on a California law firm that provides free services to those in need has resulted in data exposure for an estimated 42,000 people. The Law Foundation of Silicon Valley notified regulators in California and Maine this week that the February ransomware attack on their offices resulted in a data breach. That impacted both clients and staff members. Exposed information includes Social Security numbers, medical records, immigration numbers, financial data, driver’s license numbers, financial account/payment card information, passport/government identification, taxpayer numbers, dates of birth and digital signatures. The AlphV/Black Cat ransomware group has claimed the attack. 

Risk to Business: 1.876 = Severe

The National Institutes of Health Federal Credit Union (NIHFCU) filed a notice of data breach with the Attorney General of Maine on July 5. NIHFCU said that it had discovered that bad actors had gained access to an employee email account, which resulted in those bad actors gaining access to consumers’ sensitive information, including their names and Social Security numbers.

Risk to Business: 1.669 = Severe

Advanced Medical Management has disclosed a data breach that impacted 319,485 people. The company discovered that portions of the company’s IT network that were designed and maintained by third-party vendors were accessible to an unauthorized party. Advanced Medical Management explained in a data breach notice that the incident resulted in an unauthorized party being able to access consumers’ sensitive information between May 10, 2023, and May 13, 2023. The data exposed includes names, Social Security numbers, addresses, email addresses, phone numbers, dates of birth, driver’s license numbers, protected health information, and health insurance information.

Risk to Business: 2.149 = Severe

Pepsi Bottling Ventures has admitted that it suffered a data breach between December 23, 2022, and January 19, 2023, that resulted in the personal, financial, and health information of the company’s employees being accessed by an unauthorized party. The breach was discovered on January 10.  The compromised data belongs to current and former employees and to contractors. That data is comprised of names, addresses, email addresses, financial account information, ID numbers, driver’s license numbers, Social Security numbers, digital signatures, medical history details and health insurance information.  

Risk to Business: 2.637 = Severe

Sun Life, one of Canada’s leading insurance providers, says the personal data of some of its U.S. customers has been compromised after one of its vendors was caught up in the MOVEit exploit attack spree. Sun Life made it clear that while it doesn’t use MOVEit, one of its vendors, Pension Benefit Information (PBI) did use it and some members’ personal information was accessed by an unauthorized third party using the exploit. Bad actors may have gained access to information including a client’s name, Social Security ‎Number, policy and account number, and/or date of birth. However, no financial information like account values or medical claims was exposed.

Risk to Business: 2.766 = Moderate

The University of the West of Scotland is experiencing an ongoing cyber incident that is affecting a number of its digital systems. The university’s website is currently down and other digital systems at the university have reportedly been down for days. The university is working with experts from Police Scotland, the National Cyber Security Centre and the Scottish government in the investigation. University officials were quick to reassure the public that graduations are continuing as planned this week with no interruption.

Risk to Business: 1.707 = Severe

Ventia, a Sydney-based company that provides long-term management, maintenance and operations services for critical infrastructure organizations has announced that it is taking some systems offline due to a weekend cyberattack. While the company has not confirmed the nature of the attack, experts are pointing to ransomware. The company says that it has engaged with external experts and law enforcement to investigate the incident, and all operations are expected to return to normal within the following days. 

Risk to Business: 1.443 = Extreme

The largest seaport in Japan and the central shipping hub for Toyota, the Port of Nagoya, experienced a ransomware attack last Tuesday that led to a total shutdown. The port’s operator, Nagoya Harbor Transportation, disclosed that it received a ransom demand from LockBit 3.0 immediately following the beginning of systems failure in the early morning. All cargo operations, including the loading and unloading of containers onto trailers, were suspended as of July 4 but port officials expected to resume operations within a few days.