The Week in Breach: 04/22/20 - 04/28/20

The Week In Breach 4/22/20 to 4/28/20

DTS InfoTech is a hard-working Trusted Advisor for any business that has questions about computers, computer networks, and technology. One way to earn the title of Trusted Advisor is to provide FREE practical education in the technology field for visitors to our website.

Cybersecurity has become a matter of business life and death for computer and technology users of all types. With your security in mind, we are sharing Data Breach Examples in weekly posts entitled “The Week In Breach” from our friends at ID Agent.

ID Agent provides a comprehensive set of threat intelligence and identity monitoring solutions to private and public sector organizations and millions of individuals impacted by cyber incidents.

Read this short article and learn about cybersecurity and Data Breach examples from the experts in the field. The life of your business may depend upon it.

April 29th, 2020 by Kevin Lancaster

This week, phishing scams continue to inundate healthcare providers, malware steals SMB customer data at checkout, and thousands of companies send employees home with compromised devices. 

Dark Web ID Trends:

  • Top Source Hits: ID Theft Forums
  • Top Compromise Type: Domain
  • Top Industry: Manufacturing
  • Top Employee Count: 51-100

United States – Beaumont Health 

https://www.cyberscoop.com/beaumont-health-data-breach/

Exploit: Phishing scam  

Beaumont Health: Healthcare provider  

Severity Meter

Risk to Small Business: 1.537 = Severe
A phishing scam gave hackers access to IT infrastructure containing patients’ protected health information. The breach was identified on March 29, 2020, but data was exfiltrated between May 23, 2019, and June 2, 2019, leaving patient data exposed for nearly a year. This incident has come to light as healthcare providers face cybersecurity threats while battling the COVID-19 crisis, and Beaumont Health will undoubtedly face both regulatory troubles and financial woes on a long road to recovery.

Severity Meter

Individual Risk: 1.509 = Severe
Hackers accessed patients’ personally identifiable information and protected health information, including names, birth dates, Social Security numbers, and medical conditions. In some cases, hackers also accessed bank accounts and driver’s license information. Those impacted by the breach should immediately contact their financial service providers to notify them of the incident. In addition, they will need to closely monitor their accounts for suspicious or unusual activity. They should be especially critical of incoming messages, as hackers often use information from one breach to craft authentic-looking spear phishing campaigns that can compromise additional data.  

Customers Impacted: 112,000

How it Could Affect Your Customers’ Business: Phishing scams are a significant risk to every company’s data. Especially during the COVID-19 pandemic, healthcare companies have seen a precipitous increase in these attacks, as hackers look to capitalize on the urgency and unease of the situation to trick employees into compromising critical data.  

ID Agent to the Rescue: BullPhish ID simulates phishing attacks and conducts security awareness training campaigns to educate your employees, making them the best defense against cybercrime – now with COVID-19 scam awareness kits. Click the link to get started: https://www.idagent.com/bullphish-id

United States – Small Business Administration  

https://www.zdnet.com/article/sba-reveals-potential-data-breach-impacting-8000-emergency-business-loan-applicants/

Exploit: Unauthorized database access

Small Business Administration: Government agency overseeing small business affairs

Severity Meter

Risk to Small Business: 2.177 = Severe
A cybersecurity vulnerability in the portal processing small business owners applying for an emergency loan under the Economic Injury Disaster Loan Program experienced a data breach. The breach, which was detected on March 25th, impacts a vital program for small businesses, and it could harm small business owners who are already grappling with an especially challenging time. Additionally, this oversight has caught the attention of news media, legislatures, and small business owners, weakening its credibility at a critical time. 

Severity Meter

Individual Risk: 2.230 = Severe
The breach exposed applicants’ names, addresses, email addresses, dates of birth, citizen status, and insurance information. This data can quickly circulate on the Dark Web, and bad actors will frequently reuse the information in phishing scams and other fraud attempts. The Small Business Administration is offering victims a year of free identity monitoring services, and victims should enroll in this program to receive a notification if their information is misused.     

Customers Impacted: 8,000

How it Could Affect Your Customers’ Business: Now, more than ever, the consequences of a data breach are traumatic for victims. Organizations collecting and storing personal data can support their users during the COVID-19 pandemic by taking extra care to ensure that personal data remains private. It’s a priority that always matters, but that is especially amplified during the pandemic.

ID Agent to the Rescue: With Passly, you can protect your employees’ digital identities, data, and business continuity. We offer integrated multi-factor authentication, single sign-on, and password management solutions to protect your credentials and your data. Find out more at https://www.idagent.com/passly

Canada – MNP

https://www.bleepingcomputer.com/news/security/leading-accounting-firm-mnp-hit-with-cyberattack/

Exploit: Ransomware

MNP: Accounting firm 

Severity Meter

Risk to Small Business: 1.619 = Severe
MNP identified a ransomware attack that forced the company to shut down all systems, preventing employees from working for nearly a week. The company is deducting banked overtime for the affected employees, which could come with severe backlash. Similarly, many are being asked to bring their computers back to the company for a cybersecurity analysis, likely placing them in harm’s way as social distancing guidelines are intended to keep people apart to stop the spread of COVID-19. 

Individual Risk: At this time, no personal information was compromised in the breach.  

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: In many cases, ransomware attacks double as data breaches when cybercriminals steal company data before encrypting critical technology. In this case, the consequences of a ransomware attack are amplified, increasing both the cost and practical implications of these increasingly common attacks. 

Canada – Webkinz  

https://ciso.economictimes.indiatimes.com/news/personal-data-of-23-million-players-of-webkinz-childrens-game-hacked/75239025

Exploit: Unauthorized database access 

Webkinz: Online children’s game  

Severity Meter

Risk to Small Business: 2.727 = Moderate
Hackers compromised a database containing customer information and subsequently posted the information on the Dark Web. The breach includes more than 22 million usernames and passwords. Although the company has patched the vulnerability, this information could give bad actors access to the personally identifiable information of minors. In addition to being a veritable PR disaster for a company marketing its products to children, the breach has safety implications as well.   

Severity Meter

Individual Risk: 2.603 = Moderate
Those impacted by the breach should immediately update their Webkinz account passwords and their login credentials for any other accounts using the same information. Since this data has already been posted on the Dark Web, users should act quickly to update their credentials, and they need to monitor their accounts for suspicious or unusual activity.   

Customers Impacted: 23,000,000

How it Could Affect Your Customers’ Business: In recent years, the consumer privacy pendulum has swung towards conservative vigilance, and they are increasingly unwilling to do business with companies that can’t protect their data. This is especially true when it comes to companies marketing products to minors. Parents have to feel confident in a company’s data security practices if they are going to support their children’s involvement with your platform.

ID Agent to the Rescue: Dark Web ID monitors the Dark Web to find out if your employee or customer data has been compromised. We work with you to strengthen your security suite by offering industry-leading detection. Discover more at https://www.idagent.com/dark-web/.   

Portugal – Aptoide 

https://www.androidauthority.com/aptoide-data-breach-1108919/

Exploit: Unauthorized database access

Aptoide: Alternative Android App Store

Severity Meter

Risk to Small Business: 1.637 = Severe
Hackers posted a trove of user data on a Dark Web hacking forum, forcing Antoide to temporarily disable new account registrations, logins, reviews, and comments. It’s unclear if those responsible are seeking a ransom payment, but the cache of 20 million accounts is part of a larger, 34 million account collection that hackers have yet to release. This breach is particularly problematic for the alternative app store because the service has lauded itself as a more secure and credible alternative to the more popular Google Play store.

Severity Meter

Individual Risk: 2.217 = Severe
According to Aptoide, the breach affects users who registered for an account between July 21, 2016, and January 28, 2018. The compromised information includes names, email addresses, hashed passwords, registration dates, IP addresses, device details, and dates of birth. Those impacted by the breach should immediately update their account passwords and enroll in credit and identity monitoring services to ensure that this information isn’t being misused.  

Customers Impacted: 20,000,000

How it Could Affect Your Customers’ Business: This incident is a damaging blow to Aptoide’s reputation. Notably, the breach resulted from a third-party data center, serving as a reminder to all companies that, even when they do everything right to protect customer information, third-party data breaches can still compromise this highly-valued data. Therefore, companies committed to data security need to put the right measures in place to ensure that accounts remain secure, even when third-parties are compromised.  

ID Agent to the Rescue: Passly is the remote-ready secure identity and access management solution that SMBs need to protect employees’ digital identities, data, and business continuity through multi-factor authentication, single sign-on, and easy remote management. Learn more at https://www.idagent.com/passly.

Netherlands – COVID19 Alert  

https://www.zdnet.com/article/proposed-government-coronavirus-app-falls-at-the-first-hurdle-due-to-data-breach/

Exploit: Accidental data exposure

COVID19 Alert: Mobile application

Severity Meter

Risk to Small Business: 1.315 = Extreme
Developers for the mobile app, COVID19 Alert, which was pitched to the government as a way to track COVID-19 cases, compromised user data in its source code. Before the breach, the app was on the shortlist for government adoption, which could have provided a lucrative contract for developers. Instead, the company has experienced public backlash, and it seems unlikely that they will progress further in the selection process.      

Severity Meter

Individual Risk: 2.380 = Severe
The source code, which was released for public scrutiny ahead of the selection process, contained the names, email addresses, and hashed passwords from another project by the developers. This information can quickly make its way to the Dark Web where bad actors can redeploy it in a variety of cybercrimes. Those impacted by the breach should update their account credentials and carefully monitor their accounts and communications for suspicious or unusual activity.  

Customers Impacted: 200

How it Could Affect Your Customers’ Business: Developers cited their rapid development schedule and their desire to quickly make the service available as the reason for the oversight. However, companies looking to bring a new digital product to market must ensure that user data is secure. Otherwise, the project is likely to stall out before it ever even gets started. 

ID Agent to the Rescue: Compliance Manager automates data privacy standards, eliminating guesswork and ensuring efficiency at every stage. Learn more at https://www.idagent.com/compliance-manager.      

United Kingdom – Robert Dyas   

https://www.zdnet.com/article/stuck-at-home-uk-lockdown-diy-fans-slammed-by-robert-dyas-data-breach/

Exploit: Malware attack

Robert Dyas: Hardware store  

Severity Meter

Risk to Small Business: 1.554 = Severe
Payment card skimming malware was injected into the company’s online store and remained active for 23 days. The company, which provides DIY and home improvement products, hosts an online store as a critical component of its business while COVID-19 social distancing guidelines are in place. Before the breach was reported, the company was enjoying a significant boost in online sales, and this incident could encourage shoppers to take their business elsewhere. In addition to consumer backlash, the company will face regulatory scrutiny that could result in financial penalties.

Severity Meter

Individual Risk: 1.416 = Extreme
This breach applies to shoppers who used the online store between March 7, 2020, and March 30, 2020. The payment card skimming malware captured customers’ personal and financial data, including their names, addresses, payment card numbers, expiration dates, and CVV numbers. Those impacted should immediately notify their financial services providers. In addition, they should enroll in credit and identity monitoring services to ensure that this highly sensitive information isn’t misused in other ways.

Customers Impacted: 20,000

How it Could Affect Your Customers’ Business: As COVID-19 keeps many people out of stores, providing a compelling online retail experience is a critical component of any businesses’ ability to remain competitive during this time. However, companies that can’t provide a secure buying experience are unlikely to keep up with the competition, making cybersecurity a bottom-line issue for companies both now and well into the future. 

ID Agent to the Rescue: Dark Web ID can find out how payment data is being used on the Dark Web, even in the case of a malware attack. We work with you to strengthen your security suite by offering industry-leading detection. Find out more here: https://www.idagent.com/dark-web/.     

Australia – Cognizant 

https://www.crn.com/news/security/cognizant-and-its-customers-hit-by-maze-ransomware

Exploit: Ransomware 

Cognizant: IT Service provider  

Severity Meter

Risk to Small Business: 1.557 = Severe
Maze ransomware, a prominent form of the damaging malware, has encrypted Cognizant’s internal systems and caused disruptions for the company’s clients. Maze ransomware can be especially damaging because it exfiltrates company data before encrypting networks, doubling the damage of an attack by requiring companies to both restore network services while grappling with the impact of a data breach. The company, which has offices around the world, including in Australia, will now have to navigate productivity declines, data security concerns, and recovery costs as it grapples with a COVID-19-related downturn.

Individual Risk: At this time, no personal information was compromised in the breach. However, Maze ransomware is known for its ability to exfiltrate company data. As a result, anyone affiliated with the company should diligently monitor their accounts and communications for signs of fraud.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Especially in the challenging business environment posed by COVID-19, ransomware is an expensive malady that every company needs to actively defend against. Although these attacks can feel random and inevitable, there are active steps that companies can take to bolster their defensive stance against the costly scourge of ransomware attacks.

Risk Levels:

1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk

Risk scores are calculated using a formula that considers a wide range of factors related to the assessed breach.

In Other News

Hackers Use Stolen Credentials to Attack Hospitals with Ransomware 

Since the onset of the COVID-19 pandemic, hospitals, and healthcare facilities have dealt with a deluge of cyberattacks, and ransomware has been especially pernicious. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), hackers infiltrated many of these organizations using stolen credentials obtained from a known vulnerability in their Pulse Secure VPN servers.  

This threat was first identified in October 2019, with the CISA and the US Federal Bureau of Investigation both issuing subsequent alerts in January and April of 2020. Unfortunately, even after repairing the vulnerability, the agencies have seen examples of cybercriminals using compromised credentials to access company networks.

The incident is a reminder of the importance of acting swiftly to address cybersecurity vulnerabilities but also of maintaining insights into the Dark Web, where stolen login information can quickly circulate and create chaos for your IT infrastructure.  

COVID-19 is creating a more perilous digital environment for companies, making now the right time to double-down on cybersecurity initiatives that can prevent a breach.  

https://www.bleepingcomputer.com/news/security/us-govt-hacker-used-stolen-ad-credentials-to-ransom-hospitals/?&web_view=true

A Note for Your Customers

50,000 Companies Send Employees Home with Infected Devices  

In a rush to enable employees to work remotely, many companies unknowingly sent staffers home with compromised devices. A recent study found that as many as 50,000 companies issued already-compromised devices that were protected at the office by company firewalls and other in-house defensive measures but not outside of it.  

These compromised devices are now operating on lightly-secured home or public Wi-Fi networks in an unmoderated environment, and that brings a deluge of cybersecurity risks. At ID Agent, we’ve compiled several resources to help mitigate risks like this for your remote workforce including a guide for addressing remote work vulnerabilities

Adding an extra layer of protection for access to your data and systems is crucial. That’s why we’re excited to be able to provide you with a cutting-edge secure identity and access management solution that was designed with remote workers in mind – at an excellent value.

Passly is perfect for securing company data when workers and administrators are away from the office. Scalable and quick to deploy, Passly provides a single sign-on Launchpad tailored for each user and integrates seamlessly with the applications that your staffers use every day. Multifactor authentication means that even if passwords are compromised, an extra credential is needed to access your data and systems.

We’re here to help as your company adjusts its cybersecurity strategy to meet the new challenges of our changed world and shifting threat landscape. If we can support your efforts during this tumultuous time, please contact us today.

https://www.darkreading.com/endpoint/work-from-home-exposes-already-infected-machines-in-50k-us-organizations-/d/d-id/1337606?&web_view=true

DTS is very good at cybersecurity solutions for small businesses.

Seriously, we are, and we can prove it. We like being heroes!

We also know how intimidating technology can be, we make a living helping business owners and managers just like you who have questions about all things technology, and that includes cybersecurity.

Most small businesses do not have the technical resources or time to understand all this geek stuff. If this describes you, let us help you.

If you would like more information about cybersecurity as a service give us a call, we’re always happy to chat, and the call is free, every time you call!

Return to the Learning Center

Dedicated to your success,

Wally Moore

Business Development Manager

dts|infotech . . . secure computer networks that work

503.359.1275

www.dtsinfotech.com

 

GET HELP NOW