The Week in Breach December 13, 2018

 

This week, Quora was breached, and common breach mistakes are discussed.

Dark Web ID Trends:
Top Source Hits: ID Theft Forums (55%)
Top Compromise Type: Domains
Top Industry: High- Tech & IT
Top Employee Count: 11-50 employees (32%)


United States – Quora 

https://www.nytimes.com/2018/12/04/technology/quora-hack-data-breach.html
https://blog.quora.com/Quora-Security-Update

Exploit: Unclear at this time.
Quora: A popular question and answer site that boasts 300 million monthly active users.

correct severe gauge Risk to Small Business: 2.333 = Severe: People are not soon to forget that the question and answer site was unable to keep their data safe. This could cause a migration from any site to another similar one, something that is common among social media sites in particular.
correct moderate gauge Individual Risk: 2.857 = Moderate: Those affected by this breach are at an increased risk of phishing attacks

Customers Impacted: Unclear at this time.
How it Could Affect Your Business: Quora handled the breach very well, with the CEO releasing a blog post detailing what they know and apologizing to their users. The amount of time it will take for the organization to regain their users’ trust is unclear. The transparency by the organization’s leadership will greatly help it bounce back sooner than if they hadn’t responded as such.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach of this type. Learn more: https://www.idagent.com/identity-monitoring-programs

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.

United States – Humble Bundle
https://www.scmagazine.com/home/security-news/humble-bundle-breach-could-be-first-step-in-wider-attack/

Exploit: Credential Stuffing.
Humble Bundle: Humble Bundle, Inc. is a digital storefront for video games, which grew out of its original offering of Humble Bundles, collections of games sold at a price determined by the purchaser and with a portion of the price going towards charity and the rest split between the game developers.

correct severe gauge Risk to Small Business: 2.333 = Severe: The breach only contained user’s subscription status, but it is believed that this could be the first part of a more extreme breach. Because the bad actor knows if user’s subscriptions are active, inactive, or paused, they could send out spear-phishing emails about the subscriptions that would trick users into clicking.
correct moderate gauge Individual Risk: 3 = Moderate: No information directly related to the individual has been compromised other than the subscription status of users.

Customers Impacted: A “very limited” number of people.
How it Could Affect Your Business: This breach is a good lesson in how it is important to report any breach, as this seemingly minor breach is most likely the first step in a spear phishing campaign.
ID Agent to the Rescue: ID Agent offers Dark Web ID™ which discovers compromised credentials that could be used to implement a crypto jacking script. Make sure your credentials are safe; for more information go to https://www.idagent.com/dark-web/

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.


In Other News:

DNA For Pay
The Leaders of Genomics England has revealed that foreign hackers have attempted to access the DNA data the organization is collecting. The reality that hackers could steal DNA data if they successfully access a network is a scary thought. As the general population becomes more aware that their data is valuable, it should also become apparent that handing over data and in this case, DNA, could result with it ending up on the Dark Web or in the hands of a nation state. While no breach occurred to this organization, the fact that they are regularly under attack should be a wake-up call.

https://www.telegraph.co.uk/news/2018/12/05/nhs-storing-patients-genetic-data-high-security-army-base-due/

What We’re Listening To

Know Tech Talks
The Continuum Podcast
Security Now
Defensive Security Podcast 
Small Business, Big Marketing – Australia’s #1 Marketing Show!
TubbTalk – The Podcast for IT Consultants
Risky Business
Frankly MSP
CHANNELe2e


A Note for You:

Be Ready for The Breach
Since Marriot International was breached, it has been hit with two lawsuits that claim the organization delayed the breach disclosure and weren’t transparent. How an organization handles a breach makes a significant impact on public opinion and customers trust. An organization that is seen to be forthcoming, transparent, and honest to their customers is much less likely to see a serious migration of customers.

Here are some common mistakes made when reporting breaches:

  • Not having a plan – Not being prepared for a breach can lead to a panicked, unorganized response that is half-baked. Just like every organization should have a fire response plan, every organization should have response procedures in place for a breach.
  • Downplaying the incident – Your customers deserve to know if they are at risk. Also downplaying the incident is likely illegal.
  • Delaying disclosure – Delaying disclosure can compromise the trust of your customers and may be illegal.
  • Oversharing / Under sharing – Sharing too much information can lead to bad actors taking note of the vulnerability and can put other organizations at risk. Sharing too little information can leave your customers at risk.
  • Not contacting the authorities – Involving law enforcement is free and can help significantly with the investigation.

https://www.darkreading.com/attacks-breaches/7-common-breach-disclosure-mistakes/d/d-id/1333401?image_number=1

https://www.proofpoint.com/us/resources/threat-reports/quarterly-threat-analysis

Advertisements

The Week in Breach December 6 2018

This week we report on Marriott’s massive breach, the indictment of those responsible for many SamSam attacks across the U.S., and hackers switching targets.

Dark Web ID Trends:
Top Source Hits: ID Theft Forums (98%)
Top Compromise Type: Domains
Top Industry: Finance and Insurance (13%)
Top Employee Count: 11-50 employees (45%)


Global Breach – Marriott
https://www.nbcnews.com/tech/security/marriott-says-data-breach-compromised-info-500-million-guests-n942041
https://www.cnbc.com/2016/09/23/marriott-buys-starwood-becoming-worlds-largest-hotel-chain.html
https://answers.kroll.com/us/index.html
https://www.msspalert.com/cybersecurity-breaches-and-attacks/marriott-starwood-data-breach-pressures-stock/
utm_medium=email&utm_source=sendpress&utm_campaign

Exploit: Supply chain breach.
Marriott: The largest hotel chain in the world, “30 hotel brands now fall under the Marriott umbrella to create the largest hotel chain in the world with more than 5,800 properties and 1.1 million rooms in more than 110 countries. That’s more than 1 out of every 15 hotel rooms around the globe.”

correct severe gauge Risk to Small Business: 1.444 = Extreme: Considering how damaging this breach will be to Marriott, the largest hotel chain in the world, it is safe to say that the ramifications of a breach as severe as this one has the potential to cripple a small business. One of the most damaging parts of this breach is that there has been unauthorized access to the Starwood network since 2014, meaning a bad actor, or group of bad actors, has been siphoning off data for years without being detected.
correct moderate gauge Individual Risk: 2.285 = Severe: Those affected by this breach are at an increased risk of phishing attacks. Identity theft is also a very real possibility due to the amount of information accessed, including passport numbers. The passport numbers alone could fetch a good price on the Dark Web.

Customers Impacted: Approximately 500 million.
How it Could Affect Your Business: The length of time information was being accessed is one of the most damaging parts of this breach, as well as the massive scope. The largest hotel chain in the world has been compromised since 2016 (although Starwood, the compromised subsidiary has been compromised since 2014, Marriott purchased the brand in 2016). Those who were affected by the breach are likely to avoid the chain in the future and those who are not will certainly be more hesitant.
ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach of this type.
Learn more: https://www.idagent.com/identity-monitoring-program

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.

United Kingdom – Just Urban

https://techcrunch.com/2018/11/27/urban-massage-data-exposed-customers-creepy-clients/

Exploit: Exposed database.
Just Urban: A London-based startup, used for booking massages.

correct severe gauge Risk to Small Business: 2 = Severe: The damage dealt by this breach to a small or new business could stunt the growth of the company and even cause a loss of clients. Some of the data exposed included complaints about clients. While it is important for the employees of a massage company, especially one that goes to a person’s home, to share if a certain client is inappropriate – most organizations could face severe backlash from their customer base if complaints about them surfaced.
correct moderate gauge Individual Risk: 2.714 = Moderate: In some cases, the individuals affected by this breach had complaints about them recorded by the massage therapist. These complaints can be embarrassing, but often times the complaints were in reference to the client’s actions towards the massage therapist. Some of the complaints included: requesting “sexual services from therapist”, with some clients even being marked as dangerous. These complaints were tied to the client’s full name, phone number, postcode and address.

Customers Impacted: 309,000.
How it Could Affect Your Business:  In any organization, the exposure of complaints against customers is highly embarrassing in addition to being bad for business. The reasons why the complaints exist make sense in the context of the organizations operations but is still a damaging blow to the standing of the company with its clients. Most organizations would not have the justification for keeping such complaints on file, and NO organization can justify leaving a database exposed with sensitive business and client information. It could take years for an organization that experiences a breach such as this to recover and regain trust.
ID Agent to the Rescue: ID Agent offers Dark Web ID™ which discovers compromised credentials that could be used to implement a crypto jacking script. Make sure your credentials are safe; for more information go tohttps://www.idagent.com/dark-web/

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.


In Other News:

IranIran SamSam Goes ByeBye
Two Iranian men living in New Jersey were indicted for using the infamous SamSam ransomware to collect over $6million USD (7,981,320.00 CAD, 8,205,990.00 AUD, 5,278,320.00 EUR) and causing over $30 million USD ($39,906,600.00 CAD, $41,029,950.00 AUD, 26,391,600.00 EUR) in damages. SamSam is well known for its targeting of infrastructure, including hospitals. Here is a list of some of the targets during their spree:

City of Atlanta, Georgia; the City of Newark, New Jersey; the Port of San Diego, California; the Colorado Department of Transportation; the University of Calgary in Calgary, Alberta, Canada; and six health care-related entities: Hollywood Presbyterian Medical Center in Los Angeles, California; Kansas Heart Hospital in Wichita, Kansas; Laboratory Corporation of America Holdings, more commonly known as LabCorp, headquartered in Burlington, North Carolina; MedStar Health, headquartered in Columbia, Maryland; Nebraska Orthopedic Hospital now known as OrthoNebraska Hospital, in Omaha, Nebraska and Allscripts Healthcare Solutions Inc., headquartered in Chicago, Illinois.

https://www.justice.gov/opa/pr/two-iranian-men-indicted-deploying-ransomware-extort-hospitals-municipalities-and-public?fbclid=IwAR2B58dKjoDQT48LK7EEQwD_Y1TqbGQCqAC9K1YzzO7WYmmor7l8QPj5tZ8

What We’re Listening To

Know Tech Talks
The Continuum Podcast
Security Now
Defensive Security Podcast 
Small Business, Big Marketing – Australia’s #1 Marketing Show!
TubbTalk – The Podcast for IT Consultants
Risky Business
Frankly MSP
CHANNELe2e



The Evolution of a Phish
A new report has shed light on the fact that not only are email-based attacks on the rise, but they are spreading at an alarming rate. Cyber criminals have been shuffling their decks of targets, as 99% of the most heavily targeted email addresses this quarter are different than those targeted in Q3. The phishing emails now are more likely to show up in the inbox of your marketing, public relations, and human resources departments. The reasoning behind this shift is that these teams have access to information about earnings and employee records. It is important to stay agile in cybersecurity, as cyber criminals are always adapting to find new ways to compromise credentials and hack into organizations.

https://www.proofpoint.com/us/resources/threat-reports/quarterly-threat-analysis

This Last Week in Breach

 

This week, Amazon experienced technical issues, and cybersecurity culture isn’t where it needs to be in 95% of organizations.

Dark Web ID Trends:
Top Source Hits: ID Theft Forums (98%)
Top Compromise Type: Domains
Top Industry: Manufacturing
Top Employee Count: 11-50 employees (36%)


Global Breach – Amazon
https://www.theregister.co.uk/2018/11/21/amazon_data_breach/

Exploit: Technical error.
Amazon: Online shopping behemoth. Amazon is based out of Washington in the United States.

correct severe gauge Business Risk: 2.333 = Severe: Customers get concerned when they receive an email that informs them that their data has been disclosed, and despite the problem being a technical issue rather than an external actor hacking into the network, the image of the organization is still tarnished.
correct moderate gauge Individual Risk: 2.857 = Moderate: Those affected by this breach are at an increased risk of phishing attacks. When people are addressed by their name or if there is any personal info in a phishing email, it is more likely to opened.

Customers Impacted: Unclear at this time.
How it Could Affect Your Business: The severity of this breach is not the most damaging part, contrary to most breaches. In fact, the most damaging part of this breach has been Amazon’s poor transparency which causes speculation and paints the organization in a very negative light. The behavior of the company indicates that if a seriously damaging breach were ever to occur, they would not be transparent to their customers.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach of this type. Learn more: https://www.idagent.com/identity-monitoring-programs

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.

United States – Make-A-Wish Foundation

https://threatpost.com/cryptojacking-attack-targets-make-a-wish-foundation-website/139194/

Exploit: Crypto jacking.
Make-A-Wish Foundation: Non-profit that arranges for children with critical illnesses to have experiences they would not be able to otherwise.

correct severe gauge Business Risk: 2.333 = Severe: The negative public image associated with being breached does not give a break to even the most just of causes, non-profit or for profit. Those who have visited the Make-A-Wish foundation international site have been lending CPU power to mine for cryptocurrency which will deter visitors in the future.
correct moderate gauge Individual Risk: 3 = Moderate: No information related to the individual has been compromised.

Customers Impacted: Unclear at this time.
How it Could Affect Your Business: While the personal data of customers was not accessed or breached, the site itself has been stealing CPU power from those visiting the site in order to mine cryptocurrency. This would affect how many customers would use a site, and also is a prime example that non-profit organizations are not immune to being targeted by hackers.

ID Agent to the Rescue: ID Agent offers Dark Web ID™ which discovers compromised credentials that could be used to implement a crypto jacking script. Make sure your credentials are safe; for more information go to https://www.idagent.com/dark-web/

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.


In Other News:

Dark Web Down 

One of the largest hosting services for Dark Web sites has been hacked, with devastating results to the sites that used the service. 100% of the accounts hosted by Daniel’s Hosting were deleted, including the root account. Over 6,500 Dark Web sites were hosted by the service and it is unlikely they will see their data again.
https://www.zdnet.com/article/popular-dark-web-hosting-provider-got-hacked-6500-sites-down/

What We’re Listening To

Know Tech Talks
The Continuum Podcast
Security Now
Defensive Security Podcast 
Small Business, Big Marketing – Australia’s #1 Marketing Show!
TubbTalk – The Podcast for IT Consultants
Risky Business
Frankly MSP
CHANNELe2e

National Computer Security Day is Upon Us 

Friday the 30th of November is National Computer Security Day, and the perfect chance for you to convey what it means for your clients to have good cyber hygiene! Offering tips makes both of your jobs easier. Starting this conversation not only shows your expertise as their MSP but it gives clients real examples of how your other security services will protect their network and pair well in their current security stack.



Do It for The Culture
According to a report by ISACA, 95% of organizations find there is a gap between their desired culture surrounding cybersecurity and what their culture actually looks like. This is concerning, especially because 87% of those surveyed said that their organization would be more profitable if their cybersecurity culture improved.

What is causing this gap? A variety of factors come into play, including a lack of understanding on the part of leadership, lack of funding, and a lack of employees respecting the cybersecurity procedures.

With the holidays approaching and employees shopping across the web, now is the perfect time to reinforce cybersecurity culture at your organization. A breach on a popular retail site could lead to a breach within your organization if employees use the same passwords at work and home.

http://www.isaca.org/SiteCollectionDocuments/Cybersecurity-Culture-INFOGRAPHIC.pdf

The Week in Breach: 10/20/18 – 10/26/18

Halloween Breaches

Germany and Hong Kong get highlighted in this edition of The Week in Breach.

Dark Web ID Trends:

  • Total Compromises: 37,290
  • Top Source Hits: Website (36,618)
    • Disqus.com (36,618)
  • Top PIIs compromised: Domains (37,253)
    • Hashed/Cleartext Passwords (36,617)
  • Top Company Size: 11-50
  • Top Industry: High-Tech & IT

Hong Kong – Cathay Pacific Airways
https://www.reuters.com/article/us-cathay-pacific-cyber/cathay-pacific-flags-data-breach-affecting-94-million-passengers-idUSKCN1MY26L
Exploit: Unclear at this time.
Cathay Pacific Airways: Hong Kong-based international airline.
Risk to Small Business: 1.666 = Severe: Customers are not soon to forget the company that failed to secure their data and waited several months to acknowledge their breach.
Individual Risk: 2.285 = Severe: Individuals affected by this breach are at a higher risk of credit card fraud and should contact their card issuer, cancel their cards immediately, and enroll in a credit monitoring service, if provided.
Customers Impacted: 9.4 million.

How it Could Affect Your Business
For any organization, a breach where the hacker obtained payment information is a customer relations disaster. A breach where almost 9.5 million customers were affected would scale this disaster up to match.

ID Agent to the Rescue:
  Spotlight ID by ID Agent offers comprehensive identity monitoring that is vital for those affected by a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.

Germany – Wolf Intelligence
https://motherboard.vice.com/en_us/article/vbka8b/wolf-intelligence-leak-customer-victim-data-online
Exploit: Exposed database.
Wolf Intelligence: German-based spyware startup.
Risk to Small Business: 1.666 = Severe: A breach caused by negligence is hard to explain to a customer, which would affect the amount of time it would take to regain trust.
Individual Risk: 2.142 = Severe: Because the data exposed was highly personal, including phone conversations and texts, those affected by this breach are at a higher risk of identity theft.
Customers Impacted: 20 gigabytes of data exposed, it is unclear how many customer’s data existed within that.

How it Could Affect Your Business: An organization in the spyware industry will obviously take a SEVERE hit to their reputation, but any company would suffer the embarrassment of the founder leaving scans of his credit cards exposed on the internet.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.


In Other News:
Repair Your Phone Yourself:
It is now legal to break Digital Rights Management in order to repair your phone, following a ruling at the US Copyright Office. This is big news for third-party phone repair shops, as well as the repair businesses of many other products such as cars, tablets, refrigerators and even tractors. Go ahead and crack that old broken iPhone open to fix it yourself! Well… try to fix it at your own risk, but now you have the option.

https://www.zdnet.com/article/need-to-fix-an-iphone-or-android-device-you-can-now-break-drm-under-new-us-rules/

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!



Ransomscare.
There was an article that came out this week written by the previous CIO of the New York City Law Department (which is also the world’s largest public sector law firm, fun fact), discussing the best ways to avoid ransomware. In the article he discussed 3 key points:

1.Cyber Hygiene: This is an obvious one but cannot be underrated! Passwords must be changed regularly, and everyone must remain diligent while browsing their inbox.

2. Best practices: Best practices in this context covers updating existing tech, using preventative technologies, and communication. To have the best practice for updating existing tech, put a priority on pushing out patches, use cloud web application firewalls and credential monitoring to stay a step ahead with preventative tech, and communicate with your security team and employees about what they should be doing as individuals and as a team.

3. Testing disaster recovery plans: This point is self-explanatory, you need a test to see if your backup plans work. You wouldn’t leave the fire alarms untested!

With ransomware being seen all over the world from Atlanta to Moscow to Sydney, it is something every business should take into account.
https://www.darkreading.com/cloud/3-keys-to-reducing-the-threat-of-ransomware/a/d-id/1333113

 

Would you like a free report on your corporate domain credentials exposed on the Dark Web?

The Week in Breach

Data Breach October 25

 

This week Tumblr was breached and we explore Dark Web job postings.

Dark Web ID Trends:

Total Compromises: 3,767
Top Source Hits: ID Theft Forum (1,429)
Top PIIs compromised: Domains (3,761)
Clear Text Passwords (876)
Top Company Size: 11-50
Top Industry: Business & Professional Services and Finance & Insurance

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Disqus
https://thehackernews.com/2017/10/disqus-comment-system-hacked.html
Exploit: Exposed Database
Disqus: A network community platform that allows users to blog or comment on other company’s websites. It can be installed as a plug-in or drop-in code. Disqus collects user data on the back end and allows companies to use this information for customer analytics, etc…
Risk to Small Business: 2.4444 = Severe: Although roughly 1/3 of the 17.5 million records compromised involved passwords, they happened to be salted/hashed. The company also discovered and announced the breach in a quick manner and notified the affected customers.
Individual Risk: 2.4286 = Severe: Those affected by this breach will be at a high risk of identity theft.
Customers Impacted: 5.8 million
How it Could Affect Your Customers’ Business: The breach involved a large number of customers; however, the database was from 2012 and most credentials could have already been changed. While this is damaging to Disqus’ reputation, they followed protocol and demonstrated how to do breach disclosure the proper way.
ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that is vital for those affected by a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs

United States – Tumblr
https://www.bleepingcomputer.com/news/security/tumblr-fixes-security-bug-that-leaked-private-account-info/
Exploit: Bug.
Tumblr: A popular blogging website.
Risk to Small Business: 2 = Severe: While Tumblr deserves some credit for 1. Having a bug bounty program that resulted in catching this bug, and 2. Fixing the bug in less than 12 hours after it was discovered, many customers will not appreciate their personal information being leaked and will react accordingly. Tumblr’s timely response, disclosure of the breach, and its bug bounty program will likely reduce the impact on the business significantly.
Individual Risk: 2.714 = Moderate: Email addresses were leaked so those affected by the breach are at a higher risk of spam.
Customers Impacted: All of the ‘recommend blogs’ shown on Tumblr.
How it Could Affect Your Business: A breach that exposes user information is always going to have a negative effect on business, but every organization should take a page out of Tumblr’s book here regarding their response to the event and how they discovered it. Customers lose trust in businesses that mishandle their information, but they also respect when a company is making a serious effort to locate vulnerabilities and can handle a problem when it arises with swift action.

In other news:
When the Dating App Stands You Up
A dating app called Donald Daters was discovered to be exposing all user information on the open internet… including personal messages. The app’s goal is to help single Donald Trump supporters connect with one another, but instead exposed all that used it. The hacker that accessed the database was able to “collect profile data, including names, photos, personal messages, and the digital access tokens to log into their accounts.” The hacker also can delete the app’s data. Watch out where you put your personal information, people!
https://in.pcmag.com/news/126298/trump-themed-dating-app-found-leaking-users-private-chats

The Dark Web Monster
When looking for a job, usually you would check one of the many job hunting sites you see in commercials or circle ads in newspapers (at least at one point you did). Some people do something very similar… but on the Dark Web searching for an illicit job. Many job postings on the Dark Web seem like normal job ads. But when you look closer you will notice that advert for a driver not only needs the person to drive but also transport drugs. The driver would make $1,000 for a week of work, not including the living expense compensation. One of the more lucrative opportunities on the Dark Web job market is the corporate insider. The most common target is financial employees who, in one example, are offered $3,150 to get a loan or increase cash withdrawal limits on a card. Postal workers are also targeted to steal packages.

The Dark Web is lucrative for those willing to risk their job and possibly their freedom for money. Be careful of both insiders and the wide array of illicit software sold there.
https://www.darkreading.com/threat-intelligence/inside-the-dark-webs-help-wanted-ads/d/d-id/1333066

The week in BREACH!!

Success Rate of Phishing by Day

 

This week you’ll hear how a supply chain attack could snatch your customers’ credit card information right from underneath you and why Google+ goes bye-bye.

Dark Web ID Trends:

  • Total Compromises: 974
  • Top Source Hits: ID Theft Forum (501)
  • Top PIIs compromised: Domains (973)
    • Clear Text Passwords (498)
  • Top Company Size: 11-50
  • Top Industry: High-Tech & IT

United States – Shopper Approved
https://www.zdnet.com/article/new-magecart-hack-detected-at-shopper-approved/
Exploit: Malicious code.
Shopper Approved: Utah-based company that provides a review widget for other companies’ websites, that allows customers to post reviews.
Risk to Small Business: 2.111 = Severe: This is another attack conducted by one (or more) of the several groups who operate under a similar style, given the term Magecart as a general identifier. Magecart is also responsible for the hacking of Ticketmaster and British Airways.

If your business uses Shopper Approved, you should remove the code from your website immediately.

Individual Risk: 2.428 = Severe: Those affected by this breach should cancel their credit cards and enroll in a credit monitoring service.
Customers Impacted: Unclear how many customers were affected by this breach, but only sites with the widget code on their checkout pages had credit card information compromised. The incident only lasted 2 days before being discovered, a much shorter span than many of the other Magecart breaches.
How it Could Affect Your  Business: A breach of this kind can often go unknown for a long period of time while the hackers collect valuable user data and credit card information. Even though it is a third party who was breached, it will be your business that takes the PR damage.
ID Agent to the Rescue: Spotlight ID™ by ID Agent offers comprehensive identity monitoring that also includes credit monitoring. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Rebound Orthopedics and Neurosurgery
https://cyware.com/news/hackers-hit-rebound-orthopedics-neurosurgery-2800-patient-records-compromised-026125d8
Exploit: Compromised employee credentials.
Rebound Orthopedics and Neurosurgery: Vancouver-based orthopedics and neurosurgery practice.
Risk to Small Business: 1.555 = Severe: This breach would have a long-lasting effect on customer trust for any business, and in many countries the government will fine an organization heavily for failing to secure health data.
Individual Risk: 2.142 = Severe: Health information is valuable data for hackers and useful for identity theft. Those affected by this breach are at a severe risk for insurance fraud and identity theft.
Customers Impacted: 2800.
How it Could Affect Your Business: Organizations that store health information are held to a higher standard for securing data due to the sensitive nature of the information and HIPAA laws. When an organization fails to keep the data secure, it reflects very poorly on the company and usually results in a fine from the government.
ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.


In Other News:

Google –
Google+ will be shutting down, and yes Google+ is (or at least was) still around. After exposing more than 500,000 users’ data to external developers, the tech giant has decided the best course of action is to close down the failed social network. This move makes sense given the recent outrage against Facebook after the social media site exposed 50 million people’s data. An unfortunately fitting ending to the continuously failing website.
https://www.yahoo.com/news/google-exposed-user-data-feared-repercussions-disclosing-public-170304936–finance.html?soc_src=newsroom&soc_trk=com.apple.UIKit.activity.CopyToPasteboard&.tsrc=newsroom

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


A note for you:
e-mail….ware
New research has revealed that a whopping 90% of all malware is delivered via email. The team also discovered that the average employee will not go 48 hours without seeing a phishing message.  In addition, over half of the phishing messages examined used the word “invoice” in the subject line. A little under a quarter (21%) of the flagged emails also had malicious attachments sent with the phishing message.

Watch out for suspicious emails! All it takes is one employee to fall for a phishing email and an entire organization can be compromised.

https://www.darkreading.com/attacks-breaches/most-malware-arrives-via-email/d/d-id/1333023

 

Need to learn more about your Dark Web exposure? Click Here!

Want some free tools to combat phishing? Click Here

The Week In Breach October 1 2018

 

 

Cyber awareness Match

 

This week Medical Data is on our minds, due to a new study on the healthcare industry and cyber security. Facebook and the United Nations were also breached this week, and both were very large datasets, impacting tens of millions of people.

Dark Web ID Weekly Trends:

  • Total Compromises: 861
  • Top Source Hits: ID Theft Forum
  • Top PIIs compromised: Domains
    • Clear Text Passwords: 501
  • Top Company Size: 11-50
  • Top Industry: High-Tech & IT

United States – Facebook

https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html

Exploit: Web vulnerability.
Facebook: Facebook is a social media platform that is one of the Internet’s most popular websites.
Risk to Small Business: 2.333 = Severe: The loss of trust any organization would feel after a breach of this magnitude would greatly harm the organization’s ability to retain or obtain customers.
Individual Risk: 2.571 = Moderate: The data accessed puts those affected by this breach at an increased risk for identity theft, spam and targeted phishing campaigns.
Customers Impacted: 50 million.

How it Could Affect Your Business: Facebook being such a large and widely-used social media platform means that it has data on a large amount of the population that uses the Internet. If employees post information to this site, they could now be open to targeted phishing campaigns and spam.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk

*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Aspire Health

https://www.usatoday.com/story/money/nation-now/2018/09/26/aspire-health-hacked-phishing-scheme-patient-health-data/1430262002/

Exploit: Compromised email account hacked through a phishing scheme.
Aspire Health: According to Aspire health website, “Aspire Health specializes in providing an extra layer of support and relief from stress, pain and symptoms to patients facing a serious illness.”
Risk to Small Business: 2.333 = Severe: The risk to small business is severe due to medical data as well as confidential information being accessed.
Individual Risk: 2.571 = Moderate: The data accessed puts those affected by this breach at an increased risk for identity theft.
Customers Impacted: This information has not been released as the investigation is ongoing.

How it Could Affect Your Business: Breaches that involve medical data can have serious long-lasting effects on the reputation of a business, due to the sensitive nature of the data.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: http://downloads.primetelecommunications.com/Dark-WeB

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk

*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United Nations

https://cyware.com/news/united-nation-wordpress-site-publicly-exposes-thousands-of-resumes-2f2a8cf1

Exploit: WordPress Vulnerability.
United Nation: An intergovernmental organization tasked to promote international cooperation and to create and maintain international order.
Risk to Small Business: 2.333 = Severe: While the United Nations is unlikely to see any repercussions for this breach, a small business would face serious PR consequences if they experienced a breach such as this.
Individual Risk: 2.714 = Moderate Risk: Resumes contain a significant amount of personal information and job history, which can be used for spear phishing attacks and identity theft.
Customers Impacted: Resumes that have been submitted to the UN since 2016.

How it Could Affect Your Customer’s Business:  The exposure of resumes for 2 years would deal a serious blow to an organization of any size: the amount of time the data was exposed, and the type of data included in resumes makes this breach score severe on our risk score scale.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk

*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.


In Other News:

No Fly Zone
The Dark Web is known to have all things illegal for sale, from medical information to illicit drugs. A new trend has been discovered by researchers where frequent flyer miles are being sold for significantly less than what legitimate buyers would pay. The average rate that a batch of frequent flyer miles sells for is $31, although the price depends on the airline and number of miles.
https://www.hackread.com/stolen-frequent-flyer-miles-of-top-airlines-sold-on-dark-web/

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


A note for you:

The Cost of Healthcare on The Dark Web.
We all know that compromised health records and other medical information is highly valuable and sought after on the Dark Web. A new study by JAMA helps us conceptualize the volume of medical information for sale, and how much your health records go for on the Dark Web.

The annual data breach tally has increased every year since 2010 (except for 2015). The median number of records accessed per breach: 2,300. The mean number of records accessed per breach: 84,456. With patient records selling on the Dark Web for $300 – $500, hackers could make close to $700,000 ($690,000) by breaching an organization that stores medical information.

Who in the healthcare sector was hit the hardest?

  • Healthcare providers: 1,503 data breaches or 37.1 million records
  • Health plans: 278 data breaches or 110.4 million records

Be careful where you allow your medical records to be stored!
https://www.hcanews.com/news/yes-healthcares-data-breach-problem-really-is-that-bad

This Week in Breach September 18 2018

This week an Australian Mint was breached, as well as an airline from the UK. While searching for user credentials on the Dark Web, our team collects statistics on a wide variety of variables related to the data we unearth. The trends we see have been kept in house…until now. Introducing the newest addition to This Week in Breach:

Trends in data found on the Dark Web this week:

  • Top Source Hits: ID Theft Forums (8,534)
  • Top PIIs Compromised: Clear Text Passwords (8,460)

Australia – The Perth Mint
http://www.abc.net.au/news/2018-09-08/perth-mint-data-breach/10217258
Exploit: Under investigation.
The Perth Mint: The Online Depository of The Perth Mint that was breached allows users to buy and sell precious metals.
Risk to Small Business: Severe: A breach with sensitive data such as account information can deal a significant blow to customer trust.
Individual Risk: Severe: The victims of this breach are at risk of identity theft.
Customers Impacted: 13.

How it Could Affect Your Customers’ Business: The Mint was breached via a third – party provider. The breach was contained to customers of their online depository, and the organization has confirmed that all investments held at the mint are secure.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs

Average: 2.22 = Severe*
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk

*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.

United Kingdom – British Airways
https://www.wired.com/story/british-airways-hack-details/
Exploit: cross-site scripting.
British Airways: A UK based airline.
Risk to Small Business: Severe: This was a targeted breach by a group that is linked to the Ticketmaster breach, the extent and type of data accessed could erode customer trust
Individual Risk: Severe: Those affected by this breach have a much higher risk of identity theft.
Customers Impacted: 380,000 payment cards.

How it Could Affect Your Customers’ Business: This was a targeted breach by a group that is linked to the Ticketmaster breach, dubbed ‘Magecart’ by researchers that is known for credit card skimming on the web. The attack was tailored specifically to British Airways infrastructure and shows a level of sophistication to the attack group and leads researchers to believe the group is increasing their efforts.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that is vital for those affected by a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs

Average: 2 = Severe*
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk

*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.


In Other News:
Bluetooth Bite  Millions of mobile devices  are vulnerable to Bluetooth exploits, with a almost half of the devices being Android phones running older versions of the operating system. This vulnerability can be used to facilitate  ‘Airborne’ attacks, which allow Bluetooth devices to broadcasts malware to other devices in close proximity. This is significant because BlueBorne, a malware exploiting this vulnerability, does not need to pair with a device to infect it… in fact the target device does not even need to be in discoverable mode.

https://www.darkreading.com/attacks-breaches/2-billion-bluetooth-devices-remain-exposed-to-airborne-attack-vulnerabilities/d/d-id/1332815

Search and Destroy
Researchers have noticed an increased presence of malware that assesses the target device before delivering the full payload. This is useful for the attacker because they can now target specific computers. . Customizing the payload delivered by the malware can lead to some very tailored and hard-to-detect exploits. As of now these ‘scouting’ tactics are far from the standard, but it is likely we will continue to see these methods increase in popularity.

https://www.scmagazine.com/home/news/uptick-in-malware-designed-to-size-up-targets-before-launching-full-payload/

Podcasts:

Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show


 

Your Best Bet Is to Vet.
Two thirds of organizations sampled across sectors experienced a software supply chain attack in the last 12 months (Crowdstrike).  The increase in supply chain attacks can be linked to many things, but one of the most significant factors is the fact that cyber security is becoming a priority for organizations across the board. This pushes bad actors to try and find new ways to infiltrate their target.

These attacks often utilize compromised credentials and are widespread, attacking an organization with legitimate software packages to make the attack difficult to detect. One way that businesses can prevent supply chain attacks is better supplier vetting. If an organization can effectively vet their suppliers and hold them to the same cybersecurity standards that they hold themselves, then the chance of an attacker being able to infiltrate the network is significantly reduced. With the right tools and knowledge, supply chain attacks can be made less dangerous or avoided entirely.

https://www.darkreading.com/risk/the-increasingly-vulnerable-software-supply-chain/a/d-id/1332756

 

 

The Week In Breach: August 22 to August 29 2018

A slow, but troubling week to say the least!  Phishing and compromised databases still rule the day. This Week in Breach highlights incidents involving a New York-based gaming developer, medical data held by a University, and the disclosure of sensitive data held by a popular babysitter application.

Is Breaking Bad?
A German company by the name of Breaking Security has been up in arms about the use of their legitimate software named Remcos (Remote Control and Surveillance). Remcos is used for managing Windows systems remotely and is increasingly being used by hackers for malicious attacks known as Remote Access Trojan (RAT). The question is, however… are they telling the truth? Researchers have uncovered that the product sold by the company is widely advertised on Dark Web hacking forums and it seems that not only does the organization know that this is happening, they are encouraging it. Breaking Security has strongly stated that any license linked to malicious hacking campaigns are revoked, yet still, many hacking campaigns continue to use the service.
https://www.darkreading.com/attacks-breaches/attackers-using-legitimate-remote-admin-tool-in-multiple-threat-campaigns/d/d-id/1332631

Not So Private Messages
In May, the popular live streaming service, Twitch, exposed user’s private messages because of a bug in their code. The Amazon subsidiary disabled the service, which allowed users to download an archive of past messages. When a user requested this archive, the game streaming company accidentally intertwined messages from other users. Twitch has come out and said that this only affected a limited number of users and has provided a link for customers to visit so they can find out if any of their messages were exposed and what the messages were.
https://www.bleepingcomputer.com/news/security/twitch-glitch-exposed-some-users-private-messages/

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
IT Provider Network – The Podcast for Growing IT Service
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Small Business, Big Marketing – Australia’s #1 Marketing Show!


United States – Augusta University
Exploit: Email compromise by phishing attacks.
Risk to Small Business: High: This is a significant breach in scale and severity, and due to the sensitive nature of the data compromised the organization will likely face heavy fines.
Individual Risk: Extreme: Individuals affected by this breach are at high risk for identity theft, as well as their medical information being sold on the Dark Web.
Augusta University: Georgia based healthcare network.
Date Occurred/Discovered: September 10, 2017 – July 11, 2018
Date Disclosed: August 20, 2018
Data Compromised:

  • Medical record numbers
  • Treatment information
  • Surgical details
  • Demographic information
  • Medical data
  • Diagnoses
  • Medications
  • Dates of services
  • Insurance information
  • Social Security numbers
  • Driver’s license numbers

Customers Impacted: 417,000
https://cyware.com/news/augusta-university-health-breach-exposes-personal-records-of-over-400k-patients-432de74e

https://www.augusta.edu/notice/message.php

United States – Animoto
Exploit: Undisclosed.
Risk to Small Business: High: A breach of customer trust, especially involving geolocation data, can be highly damaging to a company’s image.
Individual Risk: Moderate: Users affected by this breach are at a higher risk of spam and phishing.
Animoto: New York-based company that provides a cloud-based video-making service for social media sites.
Date Occurred/Discovered: July 10, 2018
Date Disclosed: August 2018
Data Compromised:  

  • Names
  • Dates of birth
  • User email addresses
  • Salted and hashed passwords
  • Geolocation

Customers Impacted: Unclear.
https://techcrunch.com/2018/08/20/animoto-hack-exposes-personal-information-geolocation-data/

United States – Sitter
Exploit: Exposed MongoDB database.
Risk to Small Business: High: Most customers would be uncomfortable with a company leaking data about their kids and when they are left alone with someone who doesn’t live there.
Individual Risk: High: A lot of sensitive personal information was exposed in this breach, much of it unsettling.
Sitter: An app that connects babysitters and parents.
Date Occurred/Discovered: August 14, 2018
Date Disclosed: August 14, 2018
Data Compromised:

  • Encrypted passwords
  • Number of children per family
  • User home addresses
  • Phone numbers
  • Users address book contacts
  • Partial payment card numbers
  • Past in-app chats
  • Details about sitting sessions
    • Locations
    • Times

Customers Impacted: 93,000.

https://www.linkedin.com/pulse/incident-report-no1-babysitter-application-exposure-bob-diachenko/

https://www.bleepingcomputer.com/news/security/mongodb-server-exposes-babysitting-apps-database/

Australia – Melbourne High School

Exploit: Negligence.
Risk to Small Business: Extreme: This is a major exposure of sensitive and potentially embarrassing information that could irreparably damage a company’s reputation.
Individual Risk: High: Those affected by the data breach have sensitive information about their personal medical information that is considered highly private and could leave them exposed to identity theft.
Melbourne High School: School in Melbourne.
Date Occurred/Discovered: August 20-22, 2018
Date Disclosed: August 22, 2018
Data Compromised:

  • Medical information
  • Mental health conditions
  • Learning behavioral difficulties

Customers Impacted: 300 students.
https://www.theguardian.com/australia-news/2018/aug/22/melbourne-student-health-records-posted-online-in-appalling-privacy-breach


 


Tick Tock.
The cost of cybercrime is no joke. This is easy to say from the perspective of someone whose business it is to know all about cybercrime trends, attack vectors, and yada, yada, yada.  But to really quantify how big of a problem cybercrime is in the world of business, it is often easier to compare it to day to day things… like a doctor explaining a complicated procedure or a mechanic telling you why your car is making that noise. So today I would like to compare the cost of cybercrime to the most universal understanding that there is… time.

The cost of cybercrime each minute globally: $1,138,888

The number of cybercrime victims each minute globally: 1,861

Number of records leaked globally each minute (from publicly disclosed incidents): 5,518

The number of new phishing domains each minute.21

As you can see, cybercrime buids by the minute.
https://www.darkreading.com/application-security/how-threats-increase-in-internet-time/d/d-id/1332629


This Week in Data Breaches 7/27 to 08/1 2018

Phishing

This week there were a few troubling breaches that stood out, especially the identity theft company LifeLock. When a company deals with sensitive information like the data LifeLock stores, customer trust is paramount…. so, when a breach occurs it really makes one reevaluate the effectiveness of the organization. A U.S. bank was also breached, with customer accounts drained at hundreds of ATMs across the country: a clear sign of a highly organized and effective attack. Bad actors are becoming smarter and getting better at attacking organizations, and the barrier to entry into this career of crime is getting lower and easier.

Thanks to our friends at ID Adgent!

 

Highlights from The Week in Breach:
– Banking Trojan.
– Life-UnLocked!
– Cyber Bank Heist.
– Huge Supply Chain Breach!

In Other News:

This Trojan is Galloping
The increasing popularity of ‘malware as a service,’ which is pre-packaged malware, developed by authors with technical skill and leased to less advanced cybercriminals, has made it easier for cybercriminals to launch advanced attacks on victims across the globe. A top-shelf malware as a service known as Exobot has had its code leaked after the author of the malware sold the banking trojan’s source code to interested parties. Once the source code is sold to enough people, eventually someone posts it publicly or it leaks in other ways. Authors of these ‘service’ malware rarely sell off the source code, that is unless they are finished with the project and moving on to other things. This is concerning in multiple ways, first being that a new more powerful malware may be in the works by the same author, second being that the sophisticated Android banking trojan is now becoming more available to bad actors. Researchers fear that the availability of the source code on underground hacking forums and its inevitable spread across the web will trigger a surge of malicious Android applications. History lends to this conclusion, as the leak of Android banking trojan ‘BankBot’ on the web lowered the barrier of entry into the world of malware and resulted in an explosion of the use of the trojan.
https://www.bleepingcomputer.com/news/security/source-code-for-exobot-android-banking-trojan-leaked-online/

The Best Test to Fail
Penetration testers are useful for assessing the strength and weaknesses in the cybersecurity of an organization, and according to new research these testers are mostly successful. Penetration testers can gain control over the network in question 67% of the time. The study in question was conducted by Rapid7 and examined organizations across industries and sizes, providing a supple sample size for finding two main points of vulnerabilities. The main vulnerabilities proved to be software and credentials. Software has increasingly been used to infiltrate networked resources, and credentials have always been a route of entry for bad actors. Only 16% of the organizations examined did not have a vulnerability, which is less than last year’s study, where 32% were vulnerability-free.
https://www.darkreading.com/threat-intelligence/new-report-shows-pen-testers-usually-win/d/d-id/1332368

I Ain’t Afraid of No PowerGhost
There is a new cryptocurrency mining malware out in the wild, and instead of using an individual’s devices, this malware has been targeting business PCs and servers. The cryptojacker is fileless, utilizing PowerShell and EternalBlue to spread through a business like a disease. PowerGhost is what researchers have begun calling the malware, and it can start on a single system and then spread to other organizations. As of the writing of This Week in Breach, South America is mainly affected by the cryptojacker, but PowerGhost also has a presence in North America and Europe.
https://www.zdnet.com/article/this-new-cryptomining-malware-targets-business-pcs-and-servers/

Podcasts:
IT Provider Network – The Podcast for Growing IT Service
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


Canada – GM, Toyota, Tesla, More – Exposed by Level One Robotics

Exploit: Unprotected server/supply chain vulnerability.
Risk to Small Business: Extreme: A breach of this magnitude and depth would more than likely end a small business due to the extremely sensitive information that was leaked. Most companies would not choose to do business with an organization that leaked their trade secrets.
Individual Risk: Extreme: Passport photos and driver’s license scans of some employees were leaked, which puts them at extreme risk for identity theft.
Level One Robotics: Ontario-based business that provides industrial automation services for automotive suppliers.
Date Occurred/Discovered: July 10, 2018
Date Disclosed: July 23, 2018
Data Compromised:

  • Blueprints
  • Factory schematics
  • Robotic configurations
  • Non-disclosure agreements
  • Employee data
    • Names
    • ID numbers
    • Driver’s license scans
    • Passport scans
    • ID photos
  • Invoices
  • Contracts
  • Price negotiations
  • Insurance policies
  • Customer agreements
  • Banking information for the company
    • Account
    • Routing numbers
    • SWIFT codes

Customers Impacted: Over 100 manufacturing companies.
https://cyware.com/news/trade-secrets-of-gm-toyota-tesla-and-others-from-last-10-years-exposed-in-major-data-leak-d707fe02

United States – LifeLock

Exploit: Lack of website authentication and security.
Risk to Small Business: High: Email addresses were exposed, which allows bad actors to target customers. The exploit also allowed a hacker to unsubscribe from all communication with the company, which could be devastating to small businesses.
Individual Risk: Low: Due diligence with opening phishy emails and being suspect of unexpected emails will go a long way to combat this breach.
LifeLock: Identity theft protection company.
Date Occurred/Discovered: July 2018
Date Disclosed: July 25, 2018
Data Compromised:

  • Email addresses

Customers Impacted: 4.5 Million.
https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/ 

United States – The National Bank of Blacksburg

Exploit: Phishing.
Risk to Small Business: High: The cybercriminals got away with a great deal of money in this hack. Most small businesses would not be able to stay afloat after a hit like the one detailed here.
Individual Risk: Extreme: The money taken was from customer accounts.
The National Bank of Blacksburg: A banking organization located in Virginia.
Date Occurred/Discovered: May 2016 and January 2017
Date Disclosed: Not disclosed, but discovered when a lawsuit was filed June 28, 2018
Data Compromised:  

  • Was able to disable anti-theft systems
  • $1,833,984 USD

Customers Impacted: Hundreds of customers’ accounts were used to steal money from the bank.
https://krebsonsecurity.com/2018/07/hackers-breached-virginia-bank-twice-in-eight-months-stole-2-4m/

United States – COSCO
Exploit: Ransomware.
Risk to Small Business: High: The Company’s email is down, forcing employees to use Yahoo mail to communicate with customers as well as internally.
Individual Risk: Low: Customers of the shipping company are not affected due to the continuing operation of the company, but it may be more difficult to coordinate with them.
COSCO: COSCO is an acronym for China Ocean Shipping Company and is a Chinese state-owned shipping services company. It is the 4th largest shipping company in the world.
Date Occurred/Discovered: July 24, 2018
Date Disclosed: July 25, 2018
Data Compromised: A ransomware attack has taken down their American network. The organization is keeping the breach under wraps, for now, so most details are not disclosed.
Customers Impacted: All the organization’s customers are affected by this attack. The difficulty in contacting the company could disrupt its customers’ business.
https://www.bleepingcomputer.com/news/security/ransomware-infection-cripples-shipping-giant-coscos-american-network/

http://lines.coscoshipping.com/home/News/detail/15325081261286611042/50000000000000231?id=50000000000000231

United States – Blue Spring Family Care

Exploit: Ransomware.
Risk to Small Business: High: Ransomware would be highly disruptive to any sized business.
Individual Risk: Moderate: There is no indication that any customer’s data was exfiltrated.
Blue Spring Family Care: Family healthcare provider.
Date Occurred/Discovered: May 12, 2018
Date Disclosed: July 26, 2018
Data Compromised: Ransomware attack encrypted the organization’s data. The extent of the attack is not clearly defined.
Customers Impacted: 44,979
https://www.databreaches.net/mo-blue-springs-family-care-notifies-44979-patients-after-ransomware-attack/



Supply Pain.
Supply chain attacks are extremely prevalent and costly, and most organizations are not prepared for them. A recent study found that less than 40% of organizations in the US, UK and Singapore have properly vetted their suppliers in the last year. Two-thirds of organizations have suffered a supply chain breach within the same time-frame, and almost three quarters (71%) don’t require the same level of security from their suppliers as they do internally. With the global average cost of a supply chain breach at $1.1 million, do you want to take those odds?https://www.darkreading.com/attacks-breaches/two-thirds-of-organizations-hit-in-supply-chain-attacks-/d/d-id/1332352

 

Want to see if you are compromised? Get a free Live Search Dark Web Scan for your business domain!