Data Breach, Cyber Alert Monday: Last week, a U.S healthcare insurer discovers data breach after almost a decade..
LAST WEEK’S HACKS, ATTACKS, DATA BREACHES AND MORE…
Borough of Westwood: Local government organization serving Bergen County, New Jersey
Exploit: Malware attack
Risk to Small Business: 2.222= Severe: Unusual network activity in December 2018 alerted county officials that hackers gained access to the county’s network. These bad actors introduced malware into their system, which placed the personal data of residents at risk. Although the county is confident that information on the network hasn’t been viewed, accessed, or downloaded by hackers, they obtained third-party cyber-security services to assess the damage and remove the malware from their system. However, it’s unclear why county officials waited six months to notify the public of the incident.
Individual Risk: 2.222= Severe: Authorities are confident that personal information has not been viewed in this attack. However, the network did store personally identifiable information, including names, social security numbers, driver’s license numbers, and bank account details. The county is in the process of notifying people who could be impacted by the breach, but anyone who provided data to the county’s website should be vigilant about monitoring and reviewing their account statements for suspicious activity.
Customers Impacted: Unknown
How it Could Affect Your Business: As news headlines continually demonstrate, local governments are becoming a top target for hackers and cybercriminals. Therefore, it’s critical that these institutions make every effort to secure their IT infrastructure before a cybersecurity incident occurs. In this case, a six-month delay in reporting the data breach would make it difficult for victims to identify data misuse, meaning that the lack of damages resembles more of a stroke of luck than an intentional strategy. Instead of relying on good will, organizations must establish a strong defensive posture that prevents a data breach from occurring in the first place.
Franciscan Health: Healthcare system offering services in Indiana and Illinois
Exploit: Unauthorized network access attack
Risk to Small Business: 1.777 = Severe:A rogue employee accessed extensive medical records pertaining to physicians, diagnosis, lab results, medications, and other treatment-related information. Although the employee worked in the company’s quality research department, he had no business-related reason for accessing this private health data. Fortunately, the company quickly identified the privacy breach and took action against the employee. However, they will now have to contend with the cost of providing identity theft protection services to those impacted by the breach, along with the less quantifiable reputational losses that accompany a data breach.
Individual Risk: 1.8571 = Severe: Currently, there is no indication that the rogue employee downloaded or shared any personally identifiable information. However, the employee did have access to sensitive data, including patients’ names, email addresses, dates of birth, phone numbers, gender, race, partial social security numbers, and medical record numbers. Those impacted by the breach should review and monitor their financial accounts and their benefits statements for suspicious activity.
Customers Impacted: 2,200
How it Could Affect Your Business: A company’s workforce can be one of the most significant sources of cyber-security risk, but any organization has the ability to transform their staff into the strong defense against a data breach. With the right awareness training, employees can learn to spot cyber-security threats proactively by learning industry-wide best practices. As the costs associated with data breaches continue to grow incredibly steep, such training is becoming a relative bargain.
City Of Sun Prairie: Local government municipality serving Sun Prairie, Wisconsin
Exploit: Employee email account breach
Risk to Small Business: 2 = Severe: When hackers gained access to employee accounts for nearly three months, they were able to view personal information about the city’s residents. Even though the city hired a third-party forensics firm to investigate the matter, they were unable to determine what information was captured in the breach. The lengthy communications delay and uncertainty surrounding the data accessed reveals that the government agency was fundamentally unprepared for a cyber attack. Although the city is now taking steps to update their cybersecurity protocols in the wake of this data breach, a clear opportunity was missed to secure their network before it was infiltrated by bad actors.
Individual Risk: 1.857 = Severe: Since The compromised email accounts contained personally identifiable information for residents of Sun Prairie, including social security numbers, account login ID and passwords, driver’s license and state identification numbers, bank account numbers, medical information, and payment card information. City officials are unable to identify specific accounts that were accessed, which means that anyone doing business with Sun Prairie should obtain credit and identity monitoring services to ensure that their personal information is safe.
Customers Impacted: Unknown
How it Could Affect Your Business: Hackers have many ways to access employee email accounts, but organizations can take steps to prevent some of these methods from being successful. For instance, proper training about phishing attacks can stop many bad actors in their tracks. At the same time, knowing if your employees’ email accounts are compromised can help sidestep breaches from happening in the first place.
Marin Community Clinics: Multi-clinic network providing primary and specialty care services 
Exploit: Ransomware
Risk to Small Business: 1.777 = Severe: A ransomware virus encrypted the healthcare provider’s computer systems, significantly curtailing their operations. Based on the advice of their software provider, the company paid the ransom to recover their files. The organization is continuing to restore files from backups, and they expect to lose some patient data in the process. In the meantime, Marin Community Clinics are using paper records to continue providing care until the network can be restored.
Individual Risk: No personal information was compromised in the breach.
Customers Impacted: Unknown
How it Could Affect Your Business: In today’s digital environment, every organization must have a ransomware preparedness plan that considers the current and future state of the company’s IT infrastructure. In the case of Marin County Clinics, an associated healthcare provider was also victimized by ransomware, and they also paid to recover their files. Considering the ongoing debate among cyber-security experts about the efficacy of paying a ransomware, it could make the company more vulnerable to additional attacks. Of course, the first step to any ransomware preparedness plan is a strong defensive position. Since malware is often delivered through phishing emails, robust employee training can position any organization or agency to repel at attack.
PCM: Direct marketing company offering technology products and services
Exploit: Unauthorized email and network access
Risk to Small Business: 1.888 = Severe: Using stolen administrative credentials for PCM’s Office 365 client accounts, hackers gained access to client data. It’s speculated that hackers intended to use this information to conduct gift card fraud. Upon discovering the breach, PCM closed off access to these accounts, limiting the reach of the intrusion. Despite the relatively minor scope of the data breach, recovering from a cyber-security incident is no small matter. The company will now need to bear the cost of auditing their IT infrastructure as they work to repair the reputational damage that accompanies such an event.
Individual Risk: 2 = Severe: It’s believed that hackers were pursuing information usable to perpetrate gift card scams, which could include stealing personal information. The company has notified those impacted by the breach, and these individuals should be especially vigilant about monitoring their accounts for unusual activity.
Customers Impacted: Unknown
How it Could Affect Your Business: In many ways, PCM got lucky. Although hackers were mostly unsuccessful at obtaining client data, they were able to access systems with a trove of valuable information. Additionally, they were able to accomplish this by simply obtaining administrator credentials, which can be widely available on the Dark Web or through phishing scams. Knowing if this information is available is a critical and often overlooked component of any company’s security posture.
Summa Health: Non-profit healthcare system serving Northeast Ohio
Exploit: Phishing scam
Risk to Small Business: 1.667 = Severe: When employees opened a phishing email and entered credentials into a false form, hackers gained access to protected health information. The healthcare provider disclosed two breaches, one occurring in August 2018 and another in March 2019. It’s unclear why the company didn’t become aware of the breach until May 1st, or why it took almost a month to notify victims of the breach. Their slow response could make it more difficult for victims to identify instances of identity or financial fraud, and also shines a spotlight on the healthcare provider’s data security standards.
Individual Risk: 1.857 = Severe: Hackers accessed significant amounts of personally identifiable information in the breach, including names, dates of birth, medical records, patient account numbers, treatment information, health insurance information, social security numbers, and driver’s license numbers. Those impacted by the breach are encouraged to enroll in credit and identity monitoring services. In addition, they should carefully and continually review their account information, reporting any unusual activity and unauthorized changes as soon as possible.
Customers Impacted: 500
How it Could Affect Your Business: Phishing scams are entirely preventable, and any organization handling personally identifiable information needs to ensure that their employees are equipped to identify and report these increasingly prevalent threats. Exposed personal details usually find their way to the Dark Web, where bad actors can leverage them for a variety of nefarious purposes. It’s critical that companies are prepared with cyber-security awareness and identity protection.
Dominion National: Health insurer providing dental and vision benefits 
Exploit: Unauthorized network access
Risk to Small Business: 1.333 = Extreme: An internal notification alerted company officials of a data breach that occurred in 2010. When hackers breached the insurance provider’s network, they gained access to the sensitive information of beneficiaries. In response, the company cleaned its servers to eradicate any unauthorized users from the platform. While it’s common for data breaches to go undetected, ten years is certainly a long time to recognize a vulnerability. As a result, Dominion National will face increased media scrutiny over its cybersecurity capabilities, along with the high cost of updating their security standards and helping their customers recover from the incident.
Individual Risk: 1.857 = Severe: Although the company hasn’t released specifics on the scope of the incident, the unusual exposure length makes it possible for the damage to be extensive. Those impacted may have had their names, addresses, dates of birth, email addresses, social security numbers, taxpayer IDs, bank details, and other insurance-related details compromised. Dominion National has offered identity monitoring and recovery services to those impacted by the breach.
Customers Impacted: Unknown
How it Could Affect Your Business: A data breach is an embarrassing and costly episode for any company, especially when it takes nearly a decade to discover the incident. The first step to recovery is supporting those impacted by the breach, which certainly includes helping them verify the integrity of their information. By addressing their customers first, organizations begin rebuilding their tarnished reputation at a time when they will already incur ancillary expenses that stem from a cyber-security incident.
In Other News:
Internet Scams Have Cost Australians Millions..
Just halfway through 2019, Australians have already lost more than $6 million to internet scams, marking a 33% year-over-year increase.
The report by Scamwatch, an agency run by the Australian Competition and Consumer Commission, reveals that scams intending to attain people’s personal information are becoming more effective and more lucrative.
Australians have lost $2.3 million more in 2019 compared to last year, and the number of reported scams remained relatively steady. What’s more, 4.1% of reported scams resulted in financial loss.
Although phishing scams received the most complaints – nearly 10,000 – they resulted in the lowest amount of loss among the various scam iterations, which reflects both the rapid rate of phishing scams and peoples’ ability to defend themselves against these attacks.
At the same time, it’s evident that more training is required in order to effectively ward off these adaptive and continual threats.
A Note From Kobargo..
UK organizations are well-aware of their cyber-security threat landscape. Unfortunately, that has not enhanced their ability to improve their defensive posture. According to a recent survey, only 42% of organizations are confident in their data security, 10% fewer than companies in other countries.
While 90% of survey respondents indicated that adopting cyber-security best practices is more important than increasing profits, less than 60% of these companies have a formal security policy, a number that has not changed since last year.
Indifference may not be the only factor in their lack of preparation. Many companies cite budgetary and personnel constraints as a significant barrier to improving cyber-security posture.
Even so, the cost of a data breach is more expensive than ever before. The survey found that organizations will dedicate 12% of their revenue to recovering from a data breach, an all-time high. With companies like ours equipped to fortify your cyber-security defenses, now is the perfect time to prepare your company for today’s evolving threat landscape.
For More Info, Check Out Our Latest Video On Security Awareness Training, Available Today!
Contact Kobargo Technology Partners to schedule a free consultation today!
The best online JS tools can be found at HTML-CSS-JS.com: script beautifier, compressor, cheat sheet or just read the blog.
