Data Breach, Cyber Alert Monday 12-30-2019

Last week, online stores can’t protect their customers, phishing attack impacts personal health data, and CCPA prepares to go into effect.

United States – Rooster Teeth Productions

Exploit: Malware attack
Rooster Teeth Productions: Entertainment production company

Risk to Small Business: 2 = Severe: Hackers injected malware into the company’s online store that siphoned off customers’ payment details at checkout. The breach was first detected on December 2nd, and the company claims that the malware was removed on the same day. However, it’s unclear why they waited several weeks before notifying customers of the breach. Rooster Teeth Productions has sent breach notification letters to those impacted by the incident, but the episode will certainly have a negative impact on the brand’s reputation at a critical time of year for sales.

Individual Risk: 2.285 = Severe: Those impacted by the breach had their names, email addresses, telephone numbers, physical addresses, and payment card information stolen in the breach. As a result, they should immediately contact their financial institutions to report the breach. Rooster Teeth Productions is offering a free year of identity monitoring services and enrolling in this service can offer long-term oversight of personal data.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: The timing of this data breach couldn’t be worse. Customers continually demonstrate that they aren’t willing to make purchases from platforms that can’t secure data, so Rooster Teeth Productions will almost certainly lose business during the busy holiday shopping season. Any company relying on e-commerce sales needs to understand cybersecurity risks and take necessary steps to ensure their revenue centers do not become liabilities.

United States – Conway Medical Center

Exploit: Phishing attack
Conway Medical Center: Healthcare provider

Risk to Small Business: 1.555 = Severe: Several employees fell for a phishing scam that provided hackers access to patients’ personal data. Although the healthcare provider quickly identified the intrusion and cut off access to those accounts, they can’t recover information already accessed by cybercriminals. As a result, Conway Medical Center will face regulatory scrutiny, which often results in fines and other penalties that can damage their reputation and profitability.

Individual Risk: 2 = Severe: Hackers had access to patients’ personally identifiable information, including their names, dates of birth, Social Security numbers, phone numbers, dates of admission, account numbers, and account balances. Conway Medical Center is providing free identify and credit monitoring services to those impacted by the breach, and those affected should enroll in these services. In addition, they should be vigilant about monitoring their accounts for unusual or suspicious activity.

Customers Impacted: 2,250

How it Could Affect Your Customers’ Business: This major cybersecurity incident was entirely avoidable since phishing scams are only effective if employees engage with malicious emails. Unfortunately, Conway Medical Center will now bear the cost of credit and identity monitoring services for thousands of patients, as well as the fines and penalties that often accompany a breach. In contrast, comprehensive employee awareness training is a bargain, protecting your company against the phishing attacks that will inevitably make their way to employee inboxes.

Canada – Life Labs

Exploit: Ransomware
Life Labs: Laboratory diagnostics and testing service

Risk to Small Business: 2.222 = Severe: Hackers accessed Life Labs’ IT, stealing copious amounts of customer information and demanding a ransom for the data’s return. In a notice to customers, Life Labs notes that it identified the breach in October, but waited until December to notify customers, a concerning timeframe that will make it more difficult for victims to protect their credentials against misuse. According to the company, they paid the ransom and their data was returned. Now they are declaring the incident a “low risk” to customers”, but given their poor communication so far, this is unlikely to assuage anyone’s concerns anytime soon.

Individual Risk: 2.285 = Severe: Hackers stole customers’ personally identifiable information, including their names, home addresses, email addresses, usernames, passwords, and health card numbers. Those impacted by the breach should monitor their accounts for unusual or suspicious activity, while being mindful that this information is often reused to commit other cybercrimes, including phishing attacks, that attempt to extract even more sensitive personal information.

Customers Impacted: 15,000,000

How it Could Affect Your Customers’ Business: Life Labs had a number of missteps in their handling of this data breach. However, the company did deploy Dark Web monitoring to ensure that their customers’ information wasn’t for sale to the highest bidder. These services can provide peace-of-mind to customers while also helping companies mitigate the often cascading consequences of a data breach.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

In Other News:

New Ransomware Strain Targets Healthcare Sector 

Each week, our newsletter has examples of companies devastated by ransomware attacks that carry an incredible cost and inflict reputational damage. Unfortunately, these attacks have become more pervasive this year, and hackers are not content to rest on their laurels. 

Instead, a new variant of ransomware called Zeppelin is being deployed throughout the US, Canada, and Europe to target healthcare companies and IT organizations. In addition, the ransomware is using MSPs to further infect companies via their management software. Notably, the ransomware is being deployed through remote desktop servers that are publicly exposed to the internet.

The incident is a reminder that SMBs can’t afford to leave cybersecurity up to chance. These attacks can have devastating financial consequences for any organization, which means that a robust defensive posture is a bottom-line issue that will continue to become more critical in the year ahead.

A Note From Kobargo

CCPA Goes Into Effect on January 1st 

While many people are counting down the days to their new year’s celebrations, another countdown is underway that will have significant implications for companies around the world. California’s new data privacy law, the California Consumer Privacy Act, officially goes into effect on January 1, 2020. 

The law gives consumers new rights to their personal data, and, like Europe’s General Data Protection Regulation that came before it, CCPA promises financial penalties for companies that can’t comply with its standards. For companies of all sizes, it’s evident that the next year will be marked by new compliance measures both in the US and abroad. Fortunately, nobody has to tackle this issue alone. ID Agent is ready to provide a comprehensive assessment of your cybersecurity posture. Our products, like phishing scam awareness training and account security protocols, can help ensure that cybersecurity incidents don’t impede your 2020 goals and aspirations.

Contact Kobargo Technology Partners to schedule a free consultation today!

 
Read more
Data Breach, Cyber Alert Monday 12-23-2019

Last week, hackers gain front door access to company IT infrastructure, ransomware cripples social services, and lax employee password security continues to present a severe financial risk.

United States – Academy Sports + Outdoors 

Exploit: Credential stuffing attack
Academy Sports + Outdoors: Sporting goods retailer

Risk to Small Business: : Hackers used previously stolen, legitimate login credentials to access customer accounts. The company noticed the breach after unusual activity was detected on certain user logins. In response, Academy Sports + Outdoors is encouraging customers to reset their passwords. Unfortunately, the breach occurred during the busy holiday shopping season, and customers have increasingly shown that they are less willing to engage with platforms that have a track record of cybersecurity lapses. This could harm the company’s sales at a critical time for gaining traction.

Individual Risk: 2.428 = Severe: Academy Sports + Outdoors noted that customers’ financial data wasn’t compromised in the breach, but account information, including usernames and passwords, was impacted. Every Academy Sports + Outdoors customer should reset their login credentials while carefully scrutinizing their accounts for suspicious or unusual activity.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Customers are fed up with data breaches, and they are taking out their anger on companies that can’t secure their information. Therefore, a data breach is more than just a cyber incident. It’s a collapse in customer service of the highest magnitude, and a priority that retailers looking to succeed in today’s digital environment must immediately address.

United States – Complete Technology Solutions

Exploit: Ransomware
Complete Technology Solutions: IT service provider

Risk to Small Business: 1.888 = Severe: A ransomware attack on Complete Technology Solutions, an IT service provider for dentistry practices, disrupted operations at more than 100 practices. When a company server was compromised, it allowed hackers to infect client computers with ransomware that disabled network security, data backups, and phone services. The attack began on November 25th and has continued to disrupt services more than two weeks later. Complete Technology Solutions declined to pay a $700,000 ransom to release the information, and decryption keys later provided by the hackers only unlocked some of the affected computers. As a result, the recovery process is incredibly complicated, and it will certainly have long-term repercussions for the company.

Individual Risk: No personal data was compromised in the breach.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Ransomware attacks always extract an expense from their victims, but the opportunity cost and reputational damage associated with a cybersecurity incident can be the most devastating. In this case, Complete Technology Solutions will almost certainly lose customers because of this incident, and their long-term business prospects are likely to be diminished. It underscores the importance of cybersecurity for any company that wants to remain competitive amidst an ominous threat landscape.

United States – Prison Rehabilitative Industries & Diversified Enterprises 

Exploit: Ransomware
Prison Rehabilitative Industries & Diversified Enterprises (PRIDE): Private, non-profit social services organization

Risk to Small Business: 2.111 = Severe: PRIDE was struck by a ransomware attack that crippled its website and brought its services offline. The attack, which first occurred on December 7th, continues to disrupt services nearly a week later. As a non-profit organization, PRIDE will have a difficult time procuring the resources to remove the malware, and the service outages are making it difficult or impossible to fulfill their mission and provide critical services to a client base in need.

Individual Risk: No personal data was compromised in the breach.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Ransomware attacks can feel ominous and inevitable. However, organizations can protect against these common, increasingly expensive malware attacks by ensuring that their IT infrastructure doesn’t provide a foothold for infiltration. For instance, securing employee accounts, guarding against phishing scams, and updating firewall protections can all ensure that ransomware doesn’t compromise your company’s mission or bottom line.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

In Other News:

Third-Party Breaches Present a Serious Risk 

While everyone is well aware of the comprehensive threat landscape facing today’s companies, many forget that this threat is amplified when third-party partnerships are involved. As this week’s newsletter reminds us, these often necessary associations can place your company’s data at risk in a major way, and it’s a risk factor that every business should consider when exploring new collaborative opportunities. 

For instance, many vendors are so overwhelmed by data breaches that they struggle to bring their services back online if they survive at all. In either case, your company’s data may not be their top priority, which puts your business at risk.

Naturally, third-parties have a vested interest in pursuing what’s best for themselves, an inherent liability that every business should evaluate when making decisions. In today’s regulatory environment, organizations face intense scrutiny when a data breach occurs, even if it doesn’t originate at your company. That threat should give every company working with third parties a reason to carefully consider cybersecurity implications before signing the contract.

A Note From Kobargo

Too Many Employees Don’t Change Their Passwords 

Data breaches are a constant threat for any company, and a new survey by YouGov research found that many employees aren’t taking even the most basic steps to secure their accounts. According to the survey, which was specific to Ireland but likely represents a globally commonplace approach to password security, 39% of employees haven’t updated their passwords in more than a year. In part, the study found that convenience is a significant factor when determining standards, as many respondents expressed annoyances with security features like Captcha random image or one-time passcodes sent via text or email. 

However, with the number of compromised email accounts growing every day, strong password standards coupled with additional security features like two-factor authentication can significantly decrease the risk of a data breach. It’s an obvious and proactive step that everyone can take to protect their personal and professional data from falling into the wrong hands.

Contact Kobargo Technology Partners to schedule a free consultation today!

 
Read more
Data Breach, Cyber Alert Monday 12-16-2019

Last week, phishing scams compromise patient data, a music service gets notified by the media of their hacked database, and more than half of organizations acknowledge that they are not ready for a cyberattack. 

United States – McLaren Health Plan 

Exploit: Phishing scam
McLaren Health Plan: Health maintenance organization

Risk to Small Business: 1.666 = Severe: A successful phishing attack on one of the company’s third-party vendors compromised patient data at McLaren Health Plan. The hackers used a compromised email account to send spam emails, putting patient data at risk. The exposure will inevitably lead to reputational damage, and the sensitive nature of the information breached will invite scrutiny from healthcare regulators along with the prospect of financial penalties.

Individual Risk: 2.571 = Moderate: The breach exposed patients’ personally identifiable information, including names, dates of birth, identification numbers, health plan information, providers, diagnosis, drug information, and authorization information. Notably, this information has been available since October, so those impacted by the breach should quickly examine their accounts for unusual activity and take precautions to ensure that their personal information remains secure.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Third-party partnerships represent an opportunity to expand your company’s capabilities but can also manifest themselves as cybersecurity risks. Given the increasingly onerous consequences of a data breach, cybersecurity standards should be a top consideration when establishing such relationships. Better product or service offerings can be a boon, but not if they come at the expense of data security.

United States – On The Border

Exploit: Malware attack
On The Border: Casual restaurant chain

Risk to Small Business: 1.888 = Severe: Hackers installed malware on the restaurant’s payment processing platform, which provided access to customers’ payment information from locations across 27 states. The attack occurred between April 10th and August 10th, and it did not include franchised restaurants or catering orders. Unfortunately, the breach wasn’t discovered until November 14th, giving hackers ample time to misuse customers’ personal information and financial data. Moreover, it’s unclear why the company waited several weeks to notify customers of the breach, a misstep that will certainly slow the recovery process.

Individual Risk: 2.571 = Moderate: Customers at certain restaurant locations had their personal and financial information stolen, including their names, credit card numbers, credit card expiration dates, and security codes printed on the back of the cards. This information not only has a ready market on the Dark Web, but it can be used directly by hackers to commit financial crimes. Therefore, those impacted by the breach should immediately notify their financial institutions and enroll in identity and credit monitoring services to ensure that their information isn’t misused now or in the future.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Recovering from a data breach is a challenging process, as companies are tasked with demonstrating their data security improvements while also wooing back customers that inevitably abandon them after a breach. While the best option is to prevent a data security incident from occurring in the first place, companies can expedite the recovery process by supporting their customers at every turn. In this case, understanding what happened to payment data after it was stolen can go a long way toward mitigating the damage and restoring customer confidence.

United Kingdom – Mixcloud 

Exploit: Exposed database
Mixcloud: Audio streaming platform

Risk to Small Business: 1.777 = Severe: The music streaming platform failed to secure a database containing customer data, and that information was quickly shared on the Dark Web. Embarrassingly, the company was notified of the error by the media who were contacted by the hackers who stole the information in early November. Now, Mixcloud has to contend with a deluge of public criticism as well as a cadre of angry customers who are upset that their personal information is available for purchase on the Dark Web.

Individual Risk: 2.714 = Moderate: The stolen data includes usernames, email addresses, and encrypted passwords. In addition, the breach included sign-in data, including IP addresses and links to profile photos. This information can be used in identity crimes or to execute other cybercrimes, such as phishing scams. Those impacted by the breach should be especially critical of unusual digital correspondence while monitoring their accounts for unusual or suspicious activity.

Customers Impacted: 20,000,000

How it Could Affect Your Customers’ Business: The cost of a data breach is enormous, and it’s continually climbing. Given that reality, an unforced error, like an exposed database, is an especially egregious way to diminish your business prospects. Indeed, companies that don’t adequately account for their data security will face harsh technical, consumer, and regulatory costs now and in the years ahead.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

In Other News:

More Than Half of All Organizations Admit They Aren’t Ready for Cyberattack

Data security incidents continue to make headlines every week. Even so, a recent survey found that most organizations still aren’t prepared for the veritable inevitability of a data breach. 

Indeed, more than 800 CISOs from three continents expressed similar sentiments about their data security standards. Notably, 51% do not believe that they are ready to respond to a data breach, while nearly a third have untested response plans in place.

Meanwhile, the vast majority believe that the cybersecurity landscape will worsen or stay the same in the year ahead. Perhaps that’s why 76% plan to increase their cybersecurity budgets in 2020. When establishing their priorities, CISOs identified security software and employee awareness training as their top priority. As it stands, too many companies aren’t responding to the real and escalating threat of a data loss event.

A Note From Kobargo

60% of Digital Businesses Will Suffer Service Interruption by 2020 

For many businesses, an online presence is a vital part of their competitive strategy. Unfortunately, it’s also creating their most prescient vulnerability. According to a recent study by Gartner, by next year, more than half of all digital businesses will incur one or more cyber threats that will significantly disrupt their business. 

The report notes that cybercriminals are aware of the increasingly critical and valuable data sets that companies are bringing online, and they are targeting that information to turn a profit. It also found that products for perpetuating cybercrime such as pre-packaged ransomware and phishing capabilities have never been more prevalent, with an underground marketplace fueled by the Dark Web.

In response, companies with a digital agenda have a responsibility to audit their defensive posture, ensuring that they are prepared to meet the moment by identifying and addressing the latest cyber trends. Notably, most cyber threats can be addressed in-house by ensuring that employees are able to identify risks and implement best practices, like strong unique passwords, and two-factor authentication across all their accounts.

Contact Kobargo Technology Partners to schedule a free consultation today!

 
Read more
Data Breach, Cyber Alert Monday 12-09-2019

Last week, ransomware costs companies on multiple fronts, phishing scams have extensive data security consequences, and companies fail to adequately evaluate their third-party data sharing standards.

United States – DeBella’s Subs

Exploit: Malware attack
DeBella’s Subs: Rochester-based restaurant chain

Risk to Small Business: 2 = Severe: Credential stealing malware was discovered in the restaurant chain’s information systems almost a year after the initial incident. However, the company acknowledged that the breach investigation was completed well before the company notified the public, a misstep that will undoubtedly mar the recovery process. The company is taking steps to ensure that this type of attack won’t be successful in the future, but that won’t help the hundreds of thousands impacted by this data breach.

Individual Risk: 2.428 = Severe: Customers’ personal and financial data may have been compromised in the breach. This includes names, payment card numbers, expiration dates, and CVV numbers. The breach is limited to customers in Connecticut, Indiana, Michigan, Ohio, New York, and Pennsylvania between March 22, 2018, and December 28, 2018. Although the damage resulting from the data exposure may already be inflicted, those impacted should still take necessary precautions such as contacting their financial institutions and reviewing card histories to check for unauthorized charges.

Customers Impacted: 305,000

How it Could Affect Your Customers’ Business: Reputation management and restoration is a critical component of an effective data breach response plan. Although it’s more difficult to quantify than direct financial losses, the reputational damage can be extremely problematic for any company and even place their ability to recover in jeopardy. Instead, providing timely communications and a comprehensive overview of what happens to customer data after it’s stolen can help companies demonstrate that they are serious about data security, helping restore customer confidence along the way.

United States – Magellan Rx Management 

Exploit: Phishing scam
Magellan Rx Management: Full-service pharmacy benefit manager

Risk to Small Business: 1.777 = Severe: An employee fell for a phishing scam that provided hackers with access to his account, which contained health plan member data. The breach occurred back on May 28th, and it wasn’t identified until July 5th. However, it’s unclear why the company waited until November before disclosing the breach to the public. Officials haven’t found any evidence that the data was misused, but the lengthy response time makes it more difficult for those impacted by the breach to secure their information before it’s used for nefarious purposes.

Individual Risk: 2 = Severe: The breach included member information, including names, dates of birth, health plan member ID numbers, health plan names, providers, diagnoses, and other healthcare-related information. This information is often used to facilitate additional cybercrimes like spear-phishing attacks, so those impacted by the breach should be critical of digital communications, especially those requesting personal information.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Despite advanced security practices and other defensive efforts, phishing scams will inevitably make their way into employees’ inboxes. Fortunately, such messages can be rendered harmless, unless they are acted upon by an employee. Every business can enhance its defensive posture by providing comprehensive awareness training to keep employees abreast of the latest threats and the best practices for protecting company data.

Netherlands – Vistaprint

Exploit: Exposed database
Vistaprint: Small business marketing product provider

Risk to Small Business: 1.888 = Severe: Vistaprint left an unencrypted database exposed, allowing anyone to access information related to customer service calls, chats, and emails. After the company was publicly alerted to the oversight on Twitter, they brought the database offline. The database has been exposed since November 5th, giving cybercriminals extensive access to sensitive customer data. At the very least, the episode was embarrassing for Vistaprint, which was exposed in a public forum and forced to issue a public notification of their poor data management standards. This hard-to-quantify reputational damage can be an impediment to businesses operating in competitive, digital spaces where customers are increasingly unwilling to do business with companies that can’t protect their data.

Individual Risk: 2.285 = Severe: In addition to information related to users’ customer service interactions, the data breach compromised personally identifiable information, including names, email addresses, phone numbers. The company can’t guarantee that this information wasn’t accessed by bad actors. Since personally, identifiable information has a robust market on the Dark Web, those impacted by the breach should closely monitor their online accounts for suspicious activity, and some users may want to enroll in identity monitoring services.

Customers Impacted: 51,000

How it Could Affect Your Customers’ Business: Today’s customers are increasingly unwilling to do business with companies that can’t protect their personal data. That reality makes an unforced error, like an exposed database, especially egregious. In today’s tech-centered business environment, expansion and advanced features can’t be implemented at the expense of data security, a reality that privacy regulators and ordinary consumers are ready to enforce.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

In Other News:

Australian Companies Have Dangerous Data Sharing Practices

Third-party partnerships have become a normative, even necessary, component of doing business in 2019. Unfortunately, for many companies, these potentially beneficial relationships are often a liability when it comes to data security. According to a recent study by Security in Depth, 84% of Australian companies had not completed a formal review of their data-sharing practices with third-party partnerships, a staggering amount of negligence in today’s digital environment. 

For instance, nearly 60% of those surveyed acknowledged that they had experienced a third-party data breach in the past 12 months, a 3% increase from the previous year. These figures reveal a growing chasm between the known threat landscape and the steps that companies are willing to take to protect their valuable company and customer data.

Indeed, today’s threat landscape is expansive, but companies can mitigate many of the most prescient threats by partnering with MSPs that can offer best practices for securing third-party vulnerabilities. As the cost of a data breach quickly escalates, business leaders have millions of reasons to focus on cybersecurity as a business priority.

A Note From Kobargo

Netherlands Warns of Global Ransomware Attacks 

As this week’s newsletter reveals, ransomware attacks are impacting businesses of every size in every sector. This malware, which restricts access to a company’s IT infrastructure, is often totally debilitating, resulting in opportunity and productivity costs that accompany the already high price associated with ransomware recovery. 

Now a report from the National Cyber Security Center in the Netherlands is shedding some light on just how expansive this malady really is. The report found that 1,800 companies around the world are currently impacted by ransomware, a staggering number that officials believe underrepresents the real sum since many ransomware incidents go unreported.

What’s more, the report found that cybercriminals often rely on a single network intruder to plant the malware. These credentials can cost as much as $20,000 on the Dark Web, but they are readily available, and businesses need to know if their information is available on underground marketplaces to protect their IT from infiltration. Ransomware attacks have proven to be a low-risk, high-reward endeavor for many cybercriminals, which means that these attacks are unlikely to abate any time soon. Instead, SMBs should turn their attention towards maintaining a robust defensive posture capable of ensuring that their company name isn’t added to the growing list of companies impacted by ransomware.

Contact Kobargo Technology Partners to schedule a free consultation today!

 
Read more
Data Breach, Cyber Alert Monday 12-02-2019

Last week, compromised email accounts expose IT infrastructure, a Disney+ data breach exposed credentials to the Dark Web, and cybersecurity incidents are expected to rise this Holiday season.

United States – Select Health Network

Exploit: Unauthorized email account access
Select Health Network: Indiana-based collection of healthcare providers

Risk to Small Business: 1.444 = Extreme: An employee’s compromised email account credentials were used to access sensitive data for thousands of patients. The data was accessed between May 22 and June 13, and it’s unclear why it took the company so long to identify the breach and to report it to patients. Regardless, a small vulnerability will likely result in a sizeable blowback in the form of regulatory scrutiny, brand erosion, and potential financial repercussions.

Individual Risk: 2.142 = Severe: Hackers had access to patient data, including names, addresses, dates of birth, member identification numbers, treatment information, health insurance details, medical history information, and medical record numbers. In addition, some patients’ Social Security numbers were accessible. Those impacted by the breach should know that their credentials could have already been misused, and they should take steps to evaluate their data integrity while also ensuring long-term security.

Customers Impacted: 3,582

How it Could Affect Your Customers’ Business: Small security lapses can have serious consequences, as evidenced by the expansive breach resulting from one compromised employee account. However, companies have an obligation to support their customers after a breach and identifying what happened to their data after it was stolen is a good place to start. Taking the right course of action to support customers after a breach can go a long way towards repairing the reputational damage that can have far-reaching repercussions.

United States – Solara Medical Supplies

Exploit: Compromised email account
Solara Medical Supplies: Supplier of diabetes-related treatment products

Risk to Small Business: 1.444 = Extreme: An unauthorized third-party gained access to several employee accounts containing patient and employee data. The breach was first discovered on June 20th, and the compromised data was exposed between April 2nd and June 20th. In response, the company reset account passwords, and Solara is updating its policies to ensure that a similar scenario doesn’t occur again in the future. Unfortunately, such maneuvers won’t help patients whose data was already stolen in the breach. Moreover, the company’s lengthy response time will certainly invite increased regulatory scrutiny while giving consumers fodder for criticism during the recovery effort.

Individual Risk: 2.142 = Severe: Personal information, including names, addresses, dates of birth, Social Security numbers, employee identification numbers, medical information, health insurance information, financial information, credit/debit card numbers, password information, Medicare/Medicaid numbers, and billing information were all at risk. This comprehensive data set can quickly be distributed on the Dark Web, where it can be used to execute even more egregious cybercrimes. Those impacted by the breach should take every precaution to ensure that their data isn’t being misused.

Customers Impacted: 82,577

How it Could Affect Your Customers’ Business: Preventing a data breach begins with accounting for your vulnerabilities. One of the easiest yet most important cybersecurity initiatives that businesses should undertake is tightening up security around company email accounts. Whether your business fortifies credentials with strong, unique passwords and two-factor authentication or it integrates active monitoring protocols to evaluate data movement, password protection is quickly becoming a “can’t miss” component of any data security strategy.

New Zealand – Disney+

Exploit: Compromised user accounts
Disney+: Media streaming service

Risk to Small Business: 1.888 = Severe: Thousands of Disney+ customers had their login credentials stolen and distributed on the Dark Web. While the data breach isn’t limited to Australian users, it coincided with the Australian launch of the streaming service, which means that the brand’s reputation was damaged before users had an opportunity to judge the service based on its merits. In a crowded marketplace, brand erosion can quickly degrade competitiveness, and these negative headlines will not help Disney’s competition against Netflix and other streaming services.

Individual Risk: 2.142 = Severe: It’s unclear how hackers gained access to user accounts. Some customers admitted to reusing passwords that could have been compromised in other attacks, but some used unique passwords. It’s possible that users had credential-stealing malware installed on their computers or that they responded to a phishing attack. Regardless, account details include their most sensitive personal information, and they should take every precaution to ensure that their data remains secure. At the same time, users should double-check the originality of every account password, as it’s an easy way to thwart many hacking attempts.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business: Even as the cost of a data breach continues to rise exponentially, quantifiable costs aren’t the only expense that companies should consider. Brand erosion is a real problem, as customers are increasingly willing to walk away from platforms and services that can’t protect their data. No matter how you look at it, having thousands of people complaining about your service online is a terrible day for business, and could have long-term costs for the service’s viability.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

In Other News:

Cybersecurity Instances Expected to Rise this Holiday Season

It’s the unwanted gift that keeps on giving. A breach inflicts serious financial and reputational damage on any victim, and new data suggests that such attacks will be on the rise during the holiday season. Hackers have zeroed in on vulnerabilities in websites that collect and store customers’ PII or payment information, ready to be exploited by increased web traffic and distracted IT staff. 

The study found that the average website relies on 31 third-party integrations, each providing a unique opportunity to find vulnerabilities that can compromise users’ information. Indeed, third-party partnerships can often be a weak point in companies’ IT development.

However, rather than waiting to be the next victim, SMBs should take the time now to evaluate their cybersecurity posture and ensure that they are ready to address and defend the most prescient threats for their business. For some, this holiday season will be spent wishing they were more prepared to protect their IT, while others will be thankful that they already did.

A Note From Kobargo

Cybercriminals Targeting Office 365 Admin Credentials with Phishing Attacks 

Office 365 is often used as a starting point for many phishing scams because of its popularity in the business community. Now cybercriminals are upping their game, using information readily available on the internet to target business administrators with phishing scams in hopes of attaining the Office 365 login credentials. 

In launching such targeted attacks, hackers hope to gain access to IT infrastructure using credentials that can provide full access. In addition, admin accounts can often be used to infiltrate other user accounts, or hackers can use admin accounts to create new accounts that can be further used to distribute phishing campaigns.

Ultimately, it underscores the importance of training all employees about the risk of phishing attacks and of keeping them abreast of the latest trends and tactics. Since hackers are nimble with their tactics, businesses need to be dynamic in their training, always ready to stymie their efforts.

Contact Kobargo Technology Partners to schedule a free consultation today!

 
Read more
1 2 3 4 5 6 7 … 14 15

CATEGORIES

Categories

YOU MAY ALSO LIKE

Copyright © Kobargo Technology Partners 2019