Swedish trucking giant Scania has confirmed the hack of a third-party website leaked 34,000 files, but says the impact is so far "very limited."

Last week, a hacker claimed to have breached an insurance subdomain at Scania's website, claiming to have accessed and exfiltrated 34,000 files – which were then offered for sale on the dark web.

The website that was impacted is part of Scania Corporate Insurance services, and Scania told media that the site is operated by a third-party, adding that "current indications suggest the impact is very limited." The hacker reportedly attempted to extort the company and its employees before listing the data for sale online.

The attack comes amid a rise in ransomware, which could be worse if companies are quietly paying out without reporting such incidents. Manufacturing companies, including the automotive sector, are increasingly becoming victims, with Tata Technologies hit by a ransomware attack earlier this year that forced systems offline, and Toyota hit five times in two years.

"Criminals continue to target the automotive industry due to its profitability through the vast amounts of sensitive data it holds," said Andrew Lintell, General Manager for EMEA at Claroty.

What happened

The company told the BleepingComputer security site that the hackers used credentials stolen using malware to access the insurance claim documents at the end of May, and later emailed Scania employees with ransom demands under threat of leaking the data, before listing it for sale online.

"We can confirm there has been a security-related incident in the application "insurance.scania.com", the application is provided by an external IT partner," a Scania spokesperson said in a statement supplied to the publication. "On the 28th and 29th of May, a perpetrator used credentials for a legitimate external user to gain access to a system used for insurance purposes; our current assumption is that the credentials used by the perpetrator were leaked by a password stealer malware."

The statement added: "Using the compromised account, documents related to insurance claims were downloaded."

According to the statement, the extortion emails arrived the next day to "a number of Scanio employees" with threats to disclose the data. "A follow-up email with similar content came later from an unrelated third party whose email had been compromised," the company added.

A Scania spokesperson told ITPro: "The application was immediately shut down, and an investigation was initiated. Relevant authorities have been notified. Our current assessment is that the impact is very limited, the investigation is ongoing."

Partner risks

Claroty's Lintell noted that the breach highlighted the challenge of keeping corporate data safe when working with partners and suppliers.

"Scania's recent data breach stemmed from third-party compromise, showing how easy it is for attackers to spread through vulnerabilities in external vendors," said Lintell. "Once inside, attackers can gain unrestricted access to data within the wider network and cause operational disruptions."

He added: "Though Scania's operational impact has been limited, the breach will still have reputational impacts and potential financial losses through the leak of documents containing sensitive data."

Lintell said companies in the automotive industry needed to step up their security to more proactive techniques to avoid becoming victims of such attacks.

"To mitigate against third-party attacks, organisations need to move beyond siloed security practices and adopt a unified, proactive approach to security. This means enforcing multi-factor authentication and improving visibility with advanced detection," he said. "Just as critical is a well-drilled incident response plan to empower staff to act quickly and decisively. This is key for the automotive sector to drive resilience."

Data belonging to Toyota customers in Asia and Oceania may have been “publicly accessible” between October 2016 and May 2023 due to a cloud misconfiguration, the company has revealed. 

In an advisory, the car manufacturer revealed exposed data includes names, addresses, phone numbers, email addresses, vehicle identification numbers, and registration details.

Critical data, such as credit card information, was not exposed in the leak, the manufacturer insisted.

Toyota said the leak was caused by a cloud misconfiguration as a result of human error, adding that the flaw has since been remediated. 

“Some of the files that TC (Toyota Connected Corporation) manages in the cloud environment for overseas dealers' maintenance and investigation of systems were potentially accessible externally due to a misconfiguration,” the company said in a statement. 

“After this matter was discovered, we took steps to block access from outside the company.”

Toyota did not disclose the exact number of customers affected. It also said a preliminary investigation found no evidence any of the exposed data had been accessed or maliciously exploited. 

“We have also investigated whether, with this incident, there was any secondary use or if third-party copies remain on the internet, and no evidence of such has been found. At present, we have not confirmed any secondary damage,” it said.

Recurring Toyota data leaks

This latest disclosure follows an investigation into a similar data leak in early May in which data belonging to more than 2.15 million customers in Japan was left accessible for nearly a decade. 

At the time, Toyota said a worker at the firm was believed to have set a cloud system’s access level to ‘public’ instead of ‘private’, meaning that data pertaining to vehicle locations and identification numbers was exposed. 

This incident sparked a probe at the car manufacturer to improve monitoring of its internal systems and bolster employee data protection practices. Toyota said it has since introduced new rules and processes to monitor cloud configurations across its global operations. 

“As we believe that this incident also was caused by insufficient dissemination and enforcement of data handling rules, since our last announcement, we have implemented a system to monitor cloud configuration,” the company revealed. 

“Currently, the system is in operation to check the settings of all cloud environments and to monitor the settings on an ongoing basis. In addition, we will work closely again with TC to explain and thoroughly enforce the rules for data handling.”

This is also the third data breach of its kind in the space of a year for Toyota. In October 2022, the manufacturer revealed that data belonging to nearly 300,000 customers was exposed online. 

An access key was found to have been left publicly available on GitHub for nearly five years. This particular incident affected Toyota’s T-Connect service and allowed access to a server containing customer email addresses. 

The incident prompted Toyota to warn customers that they could face an onslaught of phishing threats in the wake of the leak.

UK pension fund USS has confirmed that nearly half a million customers may have been impacted by the recent Capita data breach. 

In a statement today, USS revealed it was told on Thursday that member data held on Capita servers was accessed by threat actors during a security incident last month. 

USS said that exposed information could include names, dates of birth, USS member numbers, and national insurance numbers. 

The data potentially accessed by hackers dates back to early 2021, and covers “around 470,000 active, deferred, and retired members”. 

According to USS, Capita said it cannot “currently confirm” if this data was exfiltrated by threat actors, but recommended the pension provider to “work on the assumption that it was”. 

“We are awaiting receipt of the specific data from Capita, which we will, in turn, need to check and process,” the company said in a statement. 

“We will be writing to each of the members affected by this – and, where applicable, their employers – as soon as possible to make them aware, to apologize for any distress or inconvenience caused, and to provide ongoing support and advice.”

The USS statement may raise concerns among other clients at the embattled IT outsourcing firm, which was rocked by a security incident last month. 

Initially, Capita said there was “no evidence” that customer data had been compromised. 

However, it later issued a follow-up confirmation stating that there was “some evidence of limited data exfiltration” and that this “might include” customer, supplier, or colleague data.

Earlier this week, Capita revealed that the security incident could cost upwards of $25 million due to recovery and remediation costs and third-party consultancy fees. 

Immanuel Chavoya, senior manager of product security at SonicWall told ITPro that the latest update highlights the potential long-term impact that this breach could have on Capita partner organizations. 

The outsourcing giant provides services for both public and private sector clients, including the UK Ministry of Defence. 

“Cyber attacks such as the one on Capita require a bit of long-tail analysis to capture a clear understanding of impact, but what is known is that the ripple effect of a cyber attack like the one on Capita can be far-reaching, extending beyond the organization itself to shake customer trust, disrupt essential services, and reverberate throughout communities”.

USS has urged members to remain vigilant for potential scams in the wake of the discovery, warning that they could be subject to heightened threats such as phishing. 

“We would encourage members to only ever give out personal information if they are absolutely sure they know who they are communicating with,” the company said. 

“We are sorry that member data has been accessed in this way. We are proactively engaging with Capita in respect of their ongoing investigations and are considering the next steps available to us. We also continue to engage with them about the ongoing support they will be providing to those affected.”

Data belonging to more than 2 million Toyota customers in Japan was left ‘publicly available’ for ten years due to a cloud configuration error, the company has revealed. 

The car manufacturer said that around 2.15 million customers may have been affected by the leak, which saw data left at risk between November 2013 and April this year. 

Toyota said that the leak was due to a misconfigured setting in its cloud environment and caused by human error. 

A worker at the firm is believed to have set a cloud system’s access level to ‘public’ instead of ‘private’, meaning that data pertaining to vehicle locations and identification numbers was exposed. 

Customers of Toyota’s T-Connect network are among those impacted by the incident, along with G-Link users. 

G-Link is a service for Lexus vehicle owners that offers premium services and emergency support features. 

A spokesperson for Toyota said there has been no sign of malicious activity due to the data leak. 

The firm insisted that it took immediate action to block access to the affected data after the issue was revealed. 

A comprehensive review of how the firm monitors its cloud environments is also underway across the breadth of its global operations. 

“Customer information that may have been viewed from the outside will not identify the customer based on this data alone, even if accessed from the outside,” a spokesperson said. 

“Since the discovery of this matter, we have not confirmed any secondary use of customer information on the internet by a third party.”

In the wake of the incident, the company plans to implement changes to its cloud processes. 

The vehicle manufacturer said it will introduce systems to “audit and monitor cloud settings continuously”. 

The firm will also “thoroughly educate employees” to improve data handling.

Gary Cannon, transport practice commercial director at NCC Group told ITPro that incidents such as the Toyota cloud error are uncommon, but when they do occur can have disastrous implications. 

“It's not very common for an internal member of staff to accidentally set a cloud system to public instead of private,” he said. “However, it can happen, especially if the person responsible for the cloud system is not familiar with its configuration or if they are rushing to get something done.”

“It's important to note that setting a cloud system to public instead of private can have serious security implications, as it could expose sensitive data or services to unauthorized access.”

Recurring data leaks at Toyota

This latest data leak marks the second incident of its kind for Toyota in the space of a year. 

In October 2022, the car manufacturer revealed that data belonging to nearly 300,000 customers was exposed after an access key was left publicly available on GitHub for around five years. 

At the time, Toyota said that 296,019 customers were impacted by the breach, which also affected its T-Connect service. 

This issue was compounded by the fact that leaked source code included access keys to a server containing customer email addresses. 

In the wake of the incident, Toyota warned customers to remain vigilant for a potential onslaught of phishing scams. 

Security researchers have discovered that data belonging to customers of online marketplace Gumtree may have been leaked through the site's HTML code.

User data such as GPS location, full names, email addresses, and postcodes of users and sellers, could all be accessed through the site's publicly accessible site code, according to researchers from Pen Test Partners.

Simply opening up the HTML code of the website using a tool like Google Chrome's 'inspect element' was all that was required to view the information in question.

Pen Test Partners said the site "was super leaky" and that every listing on Gumtree would include the seller's postcode or GPS coordinates, even if the seller requested their location to be hidden.

Gumtree's website operates on a first name basis - users and sellers only ever see each other's first names and use a private messaging service built into the site for communication, avoiding emails.

But email addresses were visible in the HTML code and user surnames could also be viewed by exploiting an insecure direct object references (IDOR) vulnerability. The vulnerability was found in an API used exclusively for iOS users, Pen Test Partners said, and one of its endpoints was vulnerable to a simple unauthenticated IDOR attack.

IDOR attacks can be carried out in a number of ways, but commonly attackers can cross-reference account IDs with a website's backend database and pull personal information using it. They can then modify the ID to pull data from other user accounts too.

Before publicly disclosing the leak this week, Pen Test Partners attempted to alert Gumtree via its third-party bug bounty programme. Run by Netherlands-based Zerocopter, the bug bounty programme required researchers to sign a non-disclosure agreement (NDA) as part of the submission, something the researchers were reluctant to do. Instead, they decided to alert Gumtree directly through its customer service team.

Gumtree has since fixed the issues causing the information leak and said it self-reported to the Information Commissioner's Office (ICO).

"People have the right to expect that organisations will handle their personal information securely and responsibly," said an ICO spokesperson to IT Pro. "If an individual has concerns about how their data has been handled, they should raise it with the organisation first, then report them to us if they are not satisfied with the response.

"Gumtree made us aware of an incident. After carefully reviewing the information, we decided no formal action was required and we provided data protection advice to the organisation."

Gumtree told IT Pro it remediated the issues raised by Pen Test Partners "within hours" of being made aware of them and all issues with the website, both with the iOS API and other backend code are fully resolved.

"In response to these issues, we reported the incident to the Information Commissioner’s Office (ICO) outlining our actions already taken, and planned, to monitor the issue," it said.

"These included fixing the vulnerabilities, updating our safety messaging on site and mitigating against future issues. We did not notify our users and are confident that our response to the reported issues was timely, appropriate and proportionate. We have communicated proactively with the regulator as these issues came to light and as we were taking remedial actions. We will take any appropriate further action should that be required."

Restaurant chain California Pizza Kitchen has exposed over 100,000 current and former employees' data to potential theft, the company admitted this week. The data at risk included staff names and Social Security numbers.

The data breach filing with the Maine Attorney General reported a total of 103,767 affected people, including eight residents of that state. The filing said the company discovered suspicious activity in its computing environment on September 15 and launched an investigation.

On October 4, it confirmed hackers could have accessed some files and then discovered the extent of the data theft by October 13.

The data that might have been compromised included names and Social Security numbers, the company said.

"There is no indication that individuals’ specific information was accessed or misused," said the document. "However, CPK is notifying all potentially impacted individuals out of an abundance of caution."

The company is offering a year of credit monitoring to those whose data might have been stolen.

The Costa Mesa, California-based restaurant chain has nearly 200 restaurants across eight countries. Last month, it announced its expansion into Canada. The company, which filed for bankruptcy protection at the height of the pandemic last year, was reportedly considering a sale or IPO to refinance debt in July this year.

While the US still lacks a federal data breach notification law, each state has passed legislation requiring private businesses to notify individuals when their information is breached. Some, such as California and Virginia, have gone further with strict data protection laws that impose penalties for mishandling of personal data.

In June, Senator Kirsten Gillibrand (D-NY) introduced a bill to create a federal data privacy regulator.

Eighty-three percent of firms in the energy and other critical infrastructure industries have had at least one operational technology (OT) cyber security breach in the prior 36 months.

Many organizations underestimate the risk of a cyber attack, with 73% of CIOs and CISOs "highly confident" their organizations will not suffer an OT breach in the next year, according to a new survey by IT security firm Skybox Security. This is compared to only 37% of plant managers, who have more first-hand experiences with the repercussion of attacks. Skybox Security said this underlined the CISO disconnect between perception and reality.

The study questioned OT security decision makers in the US, UK, Germany, and Australia. Many respondents were from companies with $1 billion or more in revenue within the manufacturing, energy, and utility industries.

The new research, “Operational Technology Cybersecurity Risk Significantly Underestimated,” found that 40% of all respondents said OT is an afterthought to other digital initiatives, highlighting that cyber security is often at risk from apathy.

The increasingly complex nature of networks in modern critical infrastructure companies was top of mind for respondents. Seventy-eight percent said complexity due to multivendor technologies is a challenge in securing their OT environment.

In addition, 39% of all respondents said a top barrier to improving security programs is decisions are made in individual business units with no central oversight. Almost half of CISOs and CIOs said disjointed architecture across IT and OT pose the greatest security risk in their OT environment.

There were also major concerns about third-party risks. Forty percent of all respondents said supply chain/third-party access to the network is one of the top-three highest security risks. Yet, less than half said their organization has a third-party access policy that applied to OT.

Skybox Security Research Lab threat intelligence lead, Sivan Nir, argued that new OT vulnerabilities were up 46% compared to the first half of 2020. “Despite the rise in vulnerabilities and recent attacks, many security teams do not make OT security a corporate priority,” he said.

“Why? One of the surprising findings is that some security team personnel deny they are vulnerable yet admit to being breached. The belief that their infrastructure is safe — despite evidence to the contrary — has led to inadequate OT security measures."

Identity Automation has announced a new compromised credentials monitoring service for K-12 schools and universities.

The service, which adds to Identity Automation's RapidIdentity platform, scans the dark web for hacked usernames and passwords, enabling swift and effective protection against ransomware threats and data breaches, according to the company.

Powered by SpyCloud, the service also alerts school IT administrators to compromised managed identities, including students, faculty, staff, parents, alumni, and external third parties, via a daily status report.

Users can create custom automated responses via RapidIdentity, enabling actions such as monitoring identity information, ending sessions with compromised credentials, locking accounts, requiring a password reset before restoring users’ privileges, or implementing multi-factor authentication for affected users.

Administrators can automatically assign users to pertinent groups and distribution lists, revoke access based on provisioning policies, and more through dynamic role management.

"Preventing ransomware is possible by negating the top attack vector: credentials that have been exposed in data breaches. This service gives schools early identification of compromised accounts, enabling them to take action quickly and prevent cyber attacks that leverage recently-breached identity data,” explained Cassio Mello, senior vice president of business development at SpyCloud.

Identity Automation's credentials monitoring service also includes support for secure remote access and virtual private network (VPN) logins. Additionally, RapidIdentity facilitates single sign-on for security assertion markup language (SAML)-compatible mobile applications.

Institutions can also leverage pre-built connectors for integration with Text/Flat File (csv, xml), web services (SOAP/REST), and command line interface (CLI), among others.

Identity Automation CEO Jim Harold said: "Our compromised credentials monitoring service can help schools avoid the fate of other education organizations that have paid out hundreds of thousands of dollars in ransom or suffered massive data loss from a hacking incident.”

"And because it's integrated with the RapidIdentity platform, IT administrators can automate responses and focus on singular threat vectors instead of analyzing credential issues. This approach is more secure and more efficient."

Department store Neiman Marcus is notifying 4.6 million customers that their details were compromised after a 2020 data breach.

The store chain said in a statement an “unauthorized party” obtained personal information associated with certain Neiman Marcus customers' online accounts. The information included names and contact information; payment card numbers and expiration dates (without CVV numbers); Neiman Marcus virtual gift card numbers (without PINs); and usernames, passwords, and security questions and answers associated with Neiman Marcus online accounts.

The incident occurred in May 2020, but the store has only just addressed the breach.

It added that around 3.1 million payment and virtual gift cards were affected, more than 85% of which are expired or invalid. Data of Bergdorf Goodman and Horchow, which are part of the Neiman Marcus Group, were not affected by the breach.

"At Neiman Marcus Group, customers are our top priority," CEO Geoffroy van Raemdonck said in a statement. "We are working hard to support our customers and answer questions about their online accounts. We will continue to take actions to enhance our system security and safeguard information."

The company has notified law enforcement and is working with Mandiant to investigate the security breach. The company has set up a website to help affected customers.

George Papamargaritis, MSS Director of Obrela Security Industries, told IT Pro that this is a concerning incident given that the attack appears to have gone unnoticed for well over a year.

“As Neiman Marcus continues to investigate the breach, more information about exactly who’s personal data was impacted will come to light, however, in the meantime anyone notified about the breach should carefully review their bank statements between now and May last year to spot any fraudulent transactions. Any unfamiliar activity should then be reported to their bank. It will also be worthwhile working with credit reference agencies to also make sure no fraudulent credit applications have been taken out in their name,” he said.

Martin Jartelius, CSO, Outpost24, told IT Pro a shallow glance at this makes it look like yet another personal data breach, but this one is a bit different.

“According to the information, not only have credit card numbers leaked which means that the company has been storing credit card numbers in a readable format, but also that 85% of those would have expired meaning that the organization had little to no justification to keep processing and storing those cards. While the breach notification is good, the lack of hygiene, in this case, is considerable,” he said.

Indiana officials at the Department of Health have notified around 750,000 residents that a company improperly accessed personal data from the state’s online COVID-19 contact tracing survey.

The agency said the state was notified on July 2 that a company gained unauthorized access to data, including names, addresses, dates of birth, emails, and gender, ethnicity and race data.

Indiana’s chief information officer (CIO) Tracy Barnes said the agency took “the security and integrity of our data very seriously.”

“The company that accessed the data is one that intentionally looks for software vulnerabilities, then reaches out to seek business. We have corrected the software configuration and will aggressively follow up to ensure no records were transferred,” she said.

State Health Commissioner Kris Box said the risk to residents of the state was low. “We do not collect Social Security information as a part of our contact tracing program, and no medical information was obtained,” she said.

Indiana’s Department of Health will send letters to affected residents notifying them the state will provide one year of free credit monitoring and is partnering with Experian to open a call center to answer questions. The Indiana Office of Technology also said it will continue its regular scans to ensure information was not transferred to another party.

Trevor Morgan, product manager at comforte AG, told ITPro our personal information, especially when wrapped in the context of our health records, is not something we want unauthorized people or companies to access.

“We place our faith in the assumption that agencies and other organizations which collect and process that data also put forward the strongest effort to guard that information. For any company like this which processes PII or PHI, data-centric security can add another, more appropriate safeguard against unauthorized access alongside more traditional perimeter-based defenses,” Morgan said.

“Methods like tokenization replace sensitive data elements with representational tokens, so even if it falls into the wrong hands the sensitive information is indecipherable and cannot be leveraged. While this incident could have been worse, we’d all feel better knowing that our sensitive personal information could never be compromised, no matter who gets their hands on it."

Erich Kron, security awareness advocate at KnowBe4, told ITPro it appears the company accessed the data in a way that did not put it at risk of cyber criminals obtaining it.

“Unfortunately, ‘software configuration’ errors such as this often lead to the data being accessed by bad actors, putting the users of the systems at risk,” he said. “Incidents such as this are learning opportunities for any organization that handles sensitive data. It also drives home the need for constant security testing and for ensuring processes are in place to help protect data, especially when configuration changes are being made."

The Securities and Exchange Commission (SEC) has ordered UK-based Pearson Education to pay $1 million to settle charges it misled investors about a 2018 data breach that resulted in millions of stolen student records.

The SEC announced the settlement after it found Pearson made “misleading statements and omissions” about the intrusion that involved the theft of student data and administrator log-in credentials of 13,000 school, district, and university customer accounts.

In its semi-annual report filed in July 2019, the SEC said Pearson referred to a data privacy incident as a hypothetical risk, despite the fact the breach had already occurred. In a statement published that same month, Pearson said the breach may include dates of birth and email addresses, but it already knew such records were stolen.

The SEC also said Pearson had "strict protections" in place, “when, in fact, it failed to patch the critical vulnerability for six months after it was notified.”

“As the order finds, Pearson opted not to disclose this breach to investors until it was contacted by the media, and even then, Pearson understated the nature and scope of the incident, and overstated the company’s data protections,” said Kristina Littman, chief of the SEC Enforcement Division’s Cyber Unit. “As public companies face the growing threat of cyber intrusions, they must provide accurate information to investors about material cyber incidents.”

Dominic Trott, UK product manager at Orange Cyberdefense, told IT Pro the $1 million settlement agreed between Pearson and the SEC comes as the education sector faces increasing hostility from malicious actors.

“As the threat landscape evolves and while education remains firmly in the crosshairs, it is more important than ever to maintain an open dialogue. Only through collaboration and transparency can cyber researchers and technologists begin to turn the tide against cybercriminals intent on wreaking havoc in the sector,” Trott said.

“As Pearson has learned, failure to properly disclose a breach can also be far more damaging to an organization’s reputation and can incur severe legal penalties, particularly when customer data is involved.

"Breach disclosure processes should form part of an organization’s blended approach to cyber security, layering a combination of people, process and enabling technologies to reduce the risk, minimize the impact of a breach should one occur, and demonstrate diligence and best practice to both customers and governing bodies.”

According to new research, there is a direct correlation between resignations, departing employees, and data exposure through theft and leaks.

Mark Wojtasiak, vice president of Portfolio Marketing at cyber security company Code42, said that in an analysis of data-exposure telemetry from devices using the company’s software, data was leaving organizations at the same time as employees were handling in letters of resignation.

“Our analysis shows a direct correlation between resignations, departing employees, and exposure events. Turns out, when people leave, so do source code, patent applications, and customer lists,” he said.

The company looked at data from over 700,000 endpoints running Code42’s Incydr software between January 1 and June 30, 2021. The research found that not only was there an 40% increase in data exposure events between H2 2020 and H1 2021, but there was also a 61% increase quarter-over-quarter within the first half of 2021.

The three-month period between April and June 2021 saw 61% more exposure events than the previous quarter and accounts for 86% of all exposure events (across all vectors) experienced by organizations throughout the previous half (July through December 2020). Data exposure peaked at the same time the US experienced a massive shift in employment.

The research also found that source code exposure has increased three times over the past year. During Q2 2021, source code accounted for 11% of all data exposure events. Plus, Q2 2021 accounted for 47% of all source code exposed within the past year, confirming the ties between massive job shifts and valuable, sensitive information exposure.

Removable media, primarily UBSs, represented the most widely used exposure vector. Removable media accounted for 42% of all exposure events, making it the top single exfiltration vector. The second-highest single exfiltration vectors were cloud sync agents at 37%.

The data also revealed that Google Chrome accounted for 52% of all application exposure not tied to a cloud sync agent or removable media. Wojtasiak said that rather than indicating that Google Chrome is particularly problematic — it instead denotes its dominant market share within professional environments.

“Our analysis illustrates that many of these employees will likely take data with them to their next company,” said Wojtasiak. “When data falls into the wrong hands, it’s devastating to a company’s competitive position and jeopardizes the financial, reputational, or operational well-being of a company, its employees, customers, and partners.”

Security researchers have found a major breach that exposed the details of over three million US seniors.

According to WizCase, the data breach affected SeniorAdvisor, “one of the largest consumer ratings and reviews websites for senior care and services across the US and Canada.” Among the exposed details were users’ names, surnames, phone numbers, and more.

Researchers at WizCase discovered a misconfigured Amazon S3 bucket belonging to the website containing over 1 million files and 182GB of data. Contact dates from the files suggest they are from 2002 to 2013, though the files had a 2017 timestamp.

“The majority of data exposed was in the form of leads, a list of potential customers whose details were collected by SeniorAdvisor presumably via their email or phone call campaigns,” said researchers.

Researchers also unearthed 2,000 “scrubbed” reviews. These are reviews where the user’s sensitive information has been wiped or redacted.

“However, this scrubbing process is useless if you have the corresponding information. The scrubbed reviews had a lead id which could be used to trace the review back to who originally wrote it,” researchers said. As both lead data and these scrubbed reviews were in the same database, supposedly anonymous reviewers could have their identity revealed with a simple search operation.

WizCase researchers said since the breach contained data from a section of the public more vulnerable to scams, the risks were higher. In a 2018-2019 report, the Federal Trade Commission (FTC) noted that people who filed a fraud complaint between 60 and 69 years old lost $600 per scam on average. The amount rose in older groups, culminating in $1700 on average per scam for people between 80 and 89.

“In particular, the report found senior citizens were more likely to fall for digital scams such as tech support scams, prize/sweepstakes scams, online shopping scams, and especially phone scams,” said researchers. “As shown, senior citizens are at greater risk for online fraud than the rest of the population, and therefore should be even more careful in their online behavior.”

Researchers urged people using such services to input the bare minimum of information when making a purchase or setting up an online account.

“The less information hackers have to work with, the less vulnerable you are,” warned researchers. Researchers have since contacted the company, and the bucket has since been secured.

A misconfiguration in a CVS Health cloud database left over a billion records exposed, according to an investigation by WebsitePlanet in cooperation with security researcher Jeremiah Fowler.

The roughly 240GB database was not password protected, meaning anyone who knew where to look could find the records held within.

A total of 1,148,327,940 records belonging to the US health care and pharmaceutical behemoth, which owns CVS Pharmacy and Aetna, were found. The database contained production records that exposed Visitor ID, Session ID, and device information (i.e., iPhone, Android, iPad, etc.).

Worryingly, the files also gave threat actors a clear understanding of configuration settings, where data is stored, and a blueprint of how the logging service operates from the backend.

Researchers also found multiple records of visitors’ search histories, including medications, COVID-19 vaccines, and other CVS products.

"Hypothetically, it could have been possible to match the Session ID with what they searched for or added to the shopping cart during that session and then try to identify the customer using the exposed emails," researchers said.

The investigation also carried out a sampling search query that revealed emails hackers could target in a phishing attack or potentially use to cross-reference other actions.

After discovering the unprotected database on March 21, the researchers immediately sent a responsible disclosure notice to CVS Health. The company restricted public access the same day.

In a statement, CVS Health said, “We were able to reach out to our vendor and they took immediate action to remove the database. Protecting the private information of our customers and our company is a high priority, and it is important to note that the database did not contain any personal information of our customers, members or patients.”

Paul Norris, a senior systems engineer at Tripwire, told ITPro that misconfigurations like these are becoming all too common.

“Exposing sensitive data doesn’t require a sophisticated vulnerability, and the rapid growth of cloud-based data storage has exposed weaknesses in processes that leave data available to anyone. A misconfigured database on an internal network might not be noticed, and if noticed might not go public, but the stakes are higher when your data storage is directly connected to the Internet,” he said.

“Organizations should identify processes for securely configuring all systems, including cloud-based storage, like Elasticsearch and Amazon S3. Once a process is in place, the systems must be monitored for changes to their configurations. These are solvable problems, and tools exist today to help."

A data breach at the US subsidiary of the Volkswagen Group has affected 3.3 million customers after a vendor left unsecured data exposed on the internet.

Volkswagen Group of America, Inc. (VWGoA) is the North American subsidiary of the German Volkswagen Group that looks after Volkswagen, Audi, Bentley, Bugatti, and Lamborghini operations in the US and Canada.

According to data breach notifications filed with the attorneys general of California and Maine, the company believed that the data was obtained when a vendor left electronic data unsecured at some point between August 2019 and May 2021.

According to a notification letter sent to customers, on March 10, the company was alerted that an unauthorized third party may have obtained certain customer information.

The letter read: “We immediately commenced an investigation to determine the nature and scope of this event.” The investigation confirmed the third party obtained limited personal information received from or about customers and interested buyers, from a vendor used by Audi, Volkswagen, and some authorized dealers in the United States and Canada. The letter didn’t state who the offending vendor was.

“This included information gathered for sales and marketing purposes from 2014 to 2019. We believe the data was obtained when the vendor left electronic data unsecured at some point between August 2019 and May 2021, when we identified the source of the incident,” the letter continued.

Among the data exposed were customers’ first and last names, personal or business mailing addresses, email addresses, and phone numbers. In some instances, the data also included information about a vehicle purchased, leased, or inquired about, such as the vehicle identification number (VIN), make, model, year, color, and trim packages.

"The data also included more sensitive information relating to eligibility for a purchase, loan, or lease. More than 95% of the sensitive data included was driver’s license numbers. There were also a very small number of dates of birth, Social Security or social insurance numbers, account or loan numbers, and tax identification numbers,” the letter stated.

A letter from the company’s lawyers said that for the 90,000 customers who had more sensitive data exposed, the company would provide free credit protection services, $1 million of insurance, and assistance in the event of identity theft.

VWGoA is now notifying affected customers of the breach and warning them to remain alert for suspicious emails or other communications.

VWGoA is conducting a full security review with the vendor to identify if further security enhancements are reasonable and appropriate, according to the lawyers’ letter.

Security researchers have discovered 23 Android applications that potentially exposed over 100 million users’ personal data through various misconfigurations of third-party cloud services.

According to Check Point Research, the data exposed from these apps included emails, chat messages, location, passwords, and photos. This left users exposed to fraud, identity theft, and service swipes (using the same username-password combination on other services).

Researchers said, “there was nothing in place to stop the unauthorized access from happening.”

“Modern cloud-based solutions have become the new standard in the mobile application development world,” researchers said. “Services such as cloud-based storage, real-time databases, notification management, analytics, and more are simply a click away from being integrated into applications. Yet, developers often overlook the security aspect of these services, their configuration, and of course, their content.”

The first problem researchers discovered was the misconfiguration of real-time databases developers used to store data in the cloud and synchronize with connected clients.

In 13 Android apps, which saw download numbers range from 10,000 to 10 million, no authentication was in place to prevent hackers from accessing these databases containing email addresses, passwords, private chats, device location, user identifiers, and more.

In one app, T’Leva, a taxi app with over 50,000 downloads, researchers could access chat messages between drivers and passengers. They could also access users’ full names, phone numbers, and locations (destination and pick-up) – all by sending one request to the database.

A second issue was with push notifications. “Most push notification services require a key (sometimes, more than one) to recognize the identity of the request submitter,” said researchers. “When those keys are just embedded into the application file itself, it is very easy for hackers to take control and gain the ability to send notifications which might contain malicious links or content to all users on behalf of the developer.”

The third problem occurred in cloud storage. In one app, researchers could access cloud storage keys embedded into the app and all stored fax transmissions.

“With just analyzing the app, a malicious actor could gain access to any and all documents sent by the 500,000 users who downloaded this application,” said researchers.

Researchers said they approached Google and each app developer before publishing its research to share their findings. Researchers said only a few of the apps have since changed their configurations.

Cyber security researchers have discovered an unsecured database exposing a widespread scam in which Amazon customers write fake reviews in exchange for free products from Amazon vendors.

IT security experts with the Safety Detectives, an antivirus review website, found an unclaimed ElasticSearch server with no encryption or password protection.

“The server contained a treasure trove of direct messages between Amazon vendors and customers… potentially implicating more than 200,000 people in unethical activities,” the researchers wrote. “While it is unclear who owns the database, the breach demonstrates the inner workings of a prevalent issue affecting the online retail industry.”

The data breach exposed more than 13 million records and 7GB of data. The database was secured about a week after the cyber security team found it, but it remains unclear who controls it. The server’s owner appears to be based in China.

Data found on the ElasticSearch server showed how this scam works:

Shady Amazon vendors send these fake reviewers the names of products they want 5-star reviews for. The reviewers buy the products and post their “reviews” soon afterward.

Then the reviewer sends the vendor their PayPal information and Amazon profile. The reviewer secretly gets a refund from the vendor, so they keep the product for free.

“The refund for any purchased goods is actioned through PayPal and not directly through Amazon’s platform,” the Safety Detectives said. “This makes the five-star review look legitimate, so as not to arouse suspicion from Amazon moderators.”

So, not only does this ElasticSearch database facilitate a widespread scam, but its owners’ carelessness exposed users’ personal data.

“It’s reasonable to estimate that around 200,000-250,000 people were affected by this breach,” the cybersecurity researchers said. “The server appeared to be located in China, and it is thought the leak affected citizens from Europe and the USA at a minimum.”

Messages on the server included the fake reviewers’ Amazon and PayPal account details, and email addresses. Vendors’ email addresses were exposed, as well as their WhatsApp and Telegram contact info.

“Although a lot of people providing fake reviews likely know what they’re doing, we must also highlight how vendors don’t advertise that fake reviews are illegal,” the cybersecurity researchers said. “Unassuming people may have been targeted by Amazon vendors with the offer of free products in return for a review.”

“What’s clear is that whoever owns the server could be subject to punishments from consumer protection laws, and whoever is paying for these fake reviews may face sanctions for breaking Amazon’s terms of service.”

A flaw in how Peloton fitness bikes communicate with the company’s servers could have inadvertently allowed anyone to access customers’ private data.

According to investigations carried out by Pen Test Partners, the mobile, web application, and back-end APIs had several endpoints that revealed users’ information to authenticated and unauthenticated users.

Jan Masters, a security researcher at Pen Test Partners, spotted the vulnerability in January. He discovered he could make unauthenticated requests to the fitness firm’s API for account data. According to Masters, there were no checks to ensure he was allowed to request the data.

The exposed API allowed the researcher to access a range of information, such as a user’s age, gender, location, weight, workout stats, and birthday, even when a user makes their profile page private.

Master notified Peloton of his findings via its vulnerability disclosure program in the middle of January with a 90-day deadline to fix the issues. That deadline came and went with Peloton only acknowledging the problem and not fixing it.

In early February, Peloton quietly and partly resolved the unauthenticated API endpoint issue. Still, Masters pointed out this meant user data was now only available to all authenticated Peloton users who had taken out a monthly subscription to the service.

Master then asked for an update, given that Peloton had made a partial fix, but Peloton didn’t respond.

After 90 days, Master contacted a journalist at TechCrunch, who then broke the story. “This started a constructive conversation and resulted in the vulnerabilities being largely resolved,” said Masters.

“A full investigation should be conducted by Peloton to improve their security, especially now that famous individuals are openly using this service,” added Masters.

Since contacting the press, Peloton’s new CISO has remained in contact with him over the flaws. The company fixed most of them in a week.

“It’s a shame that our disclosure wasn’t responded to in a timely manner and also a shame that we had to involve a journalist in order to get listened to,” he added.

The Peloton bike has gained popularity over the years to keep fit at home, especially since the coronavirus pandemic hit the world last year. Earlier this year, President Biden was prevented from bringing his Peloton into the White House over concerns that it could be a security risk. It seems now that those concerns were well-founded.

A data breach at a coronavirus contact tracing company has exposed the personal health information of tens of thousands of Pennsylvanians.

According to a report from the Pittsburgh Post-Gazette, officials at Pennsylvania’s Department of Health alleged that employees at Atlanta-based Insight Global “disregarded security protocols established in the contract and created unauthorized documents” outside the state’s secure data system.

In an email, the agency’s spokesman Barry Ciccocioppo said "we are extremely dismayed that employees from Insight Global acted in a way that may have compromised this type of information and sincerely apologize to all impacted individuals."

He added that the state’s computer systems, including Pennsylvania's contact tracing app, were not implicated. The exposed information included names, phone numbers, emails, genders, ages, sexual orientations, and COVID-19 diagnoses and exposure status.

WPXI-TV in Pittsburgh first reported the data breach. Former employees of Insight Global told the TV station they told supervisors that information had been improperly secured, but the company took no action. A spokesperson for Insight told WPXI that contract tracing information "may have been made accessible to persons beyond authorized employees and public health officials."

Pennsylvania will not be renewing the company’s contract, which expires in three months. Free credit monitoring and identity protection services will be available to affected people.

Trevor J. Morgan, product manager at Comforte AG, told ITPro the situation is a cautionary tale. Whether through contractual obligation or regulatory mandate, enterprises working with sensitive data need to meet the acceptable threshold of data security.

“However, vendors can’t trust that sensitive data such as PHI will always remain protected if it travels outside protected perimeters because data is vulnerable even when resting within the security perimeters,” he said.

Morgan added that when data is on the move, it is especially prone to mishandling and compromise, which means that a more data-centric approach to security should be part of those minimum data security standards.

“Data-centric security such as tokenization and format-preserving encryption replaces sensitive data with benign representational information, so even if it falls into the wrong hands the data cannot be compromised by the wrong parties. For more and more regulatory agencies and individual enterprises, data-centric security measures are now part of minimum data security standards because of the ability to protect data even while in motion,” he added.

Online musical instrument marketplace Reverb has warned customers of a data breach affecting the website and 5.6 million user records.

According to security researcher Bob Diachenko, he discovered an unsecured Elasticsearch server earlier this month containing over 5.6 million records. These records contained data about individual listings on Reverb, including full names, email addresses, phone numbers, mailing addresses, PayPal emails, and listing/order information.

“Upon closer inspection, I noticed that there are many 'test' emails coming from @reverb.com domain. I decided to verify shop slugs against real URLs on Reverb site and quickly confirmed the initial thought - it was all Reverb users’ data,” Diachenko said.

He then ran a quick check to see who the sellers were. He found the details of several high-profile sellers, including Bill Ward of Black Sabbath, Jimmy Chamberlin of Smashing Pumpkins, Alessandro Cortini of Nine Inch Nails, and more.

Reverb has started notifying customers that the breach exposed potentially sensitive information.

In an email to users, Reverb wrote: “We take our users’ privacy and security very seriously. Out of an abundance of caution, we wanted to inform you that Reverb recently became aware of an issue relating to user contact information.”

“At this time, we believe that contact information, including name, address, phone number, and email, was publicly accessible for a short period of time. We do not have reason to believe that any of this information has been misused, nor do we believe that password or payment information were involved.”

Paul Norris, senior systems engineer EMEA at Tripwire, told IT Pro that misconfigurations like these are becoming all too common.

“Exposing sensitive data doesn’t require a sophisticated vulnerability, and the rapid growth of cloud-based data storage has exposed weaknesses in processes that leave data available to anyone. A misconfigured database on an internal network might not be noticed, and if noticed might not go public, but the stakes are higher when your data storage is directly connected to the Internet,” he said.

“Organizations should identify processes for securely configuring all systems, including cloud-based storage, like Elasticsearch. Once a process is in place, the systems must be monitored for changes to their configurations.”

Sergio Loureiro, cloud security director at Outpost24, told IT Pro that everyone needs to be “playing from the same music sheet when it comes to security and with the countless possibilities of ‘quickly deploying a system in the cloud,’ security is -still- often overlooked by organizations.”

“As datasets grow to these sizes, the data is becoming increasingly valuable to businesses and in some cases even more valuable than money. Unfortunately, not everyone protects it like the valuable asset it is,” Loureiro said.

Hackers have sold more than $38 million in gift cards from US retailers on an underground Russian hacking marketplace.

According to Gemini Advisory’s investigation, hackers were observed offering to sell 895,000 stolen gift cards from 3,010 companies in early February.

The hackers claimed they had a database of over 3,000 brand-name gift cards. Affected companies included Airbnb, Amazon, American Airlines, Chipotle, Dunkin Donuts, Marriott, Nike, Subway, Target, and Walmart. The database may have originated from an older breach at online discount gift card shop Cardpool.com.

Before closing in early 2021, Cardpool.com operated as a gift card marketplace where individuals could sell unwanted gift cards to the shop. Cardpool.com would then resell those cards to others for less than their face value.

The hackers started the auction at $10,000 with a $20,000 buy-now price. According to security researchers, the gift cards were bought by another actor soon after they were posted for sale.

The original hacker listed data from another 330,000 payment cards on the same forum the next day. This data included payment card number, expiration date, and bank name but not the CVV or cardholder name. Bidding for these details started at $5,000, but there was a $15,000 buy-now price. The payment cards sold within days of the hacker listing them for sale, but not as quickly as the gift cards.

Gemini Advisory’s analysis concluded that the 330,000 payment cards likely came from a Cardpool.com breach between February 4, 2019 and August 4, 2019.

Researchers said the lack of CVV data indicates that the actor likely acquired the cards by gaining backend access to Cardpool.com, which would have enabled them to steal the gift card data and previous shoppers’ payment card data directly from the site’s databases.

“Attackers can acquire backend access to online shops through a variety of methods, including exploiting vulnerabilities in sites’ content management systems (CMS) and brute-forcing admin login credentials,” said researchers.

According to the researchers, the Cardpool.com case “offers a valuable glimpse into the ecosystem of carding.”

“The trick is not in acquiring stolen cards but in devising the most efficient way to cash out the funds on the cards before financial institutions can flag them as compromised,” they said.

Facebook was at the center of a data privacy storm over the weekend after a hacker published 533 million users’ details on a low-level hacking forum.

The data was downloadable for free and allowed anyone downloading it to look up a Facebook user's record using their phone number.

The records, representing roughly a fifth of the company's entire user base, contained users' phone numbers, Facebook IDs, full names, previous locations, birth dates, relationship status, and biographies. It also includes some of their email addresses.

Alon Gal, chief technology officer of cyber crime intelligence company Hudson Rock, tweeted the news on Saturday after discovering the data posted for free on a forum. It followed a tweet he posted in January this year, warning that a vulnerability had allowed the database to be created in early 2020. The January tweet warned that the user had created a Telegram bot that would allow anyone to query the database for a low fee, allowing people to find phone numbers linked to many Facebook accounts.

The January tweet showed the data breach contained 32.3 million US Facebook accounts, representing just under 10% of the entire US population.

According to a statement Facebook sent to Business Insider, the first outlet to report the news, these stolen credentials aren’t new. Facebook said that it stemmed from a vulnerability it patched in 2019. However, once the hacker stole the data from its network, little can the company do to stop it from spreading online.

"Bad actors will certainly use the information for social engineering, scamming, hacking and marketing," Gal said on Twitter.

Security research Troy Hunt added the data to his website over the weekend to allow people to see if their email addresses are part of the breach. At the time of this writing, he hadn’t yet entered the stolen phone numbers and was considering what to do with that information.

This isn’t the first time Facebook has come under fire for privacy and security issues. In 2019, the FTC fined Facebook $5 billion for misleading users over how it shared their data with third parties and for failing to change its privacy practices following a 2011 FTC settlement.

Internet of things (IoT) manufacturer Ubiquiti allegedly downplayed the severity of a data breach it revealed in January, according to reports.

Security blogger Brian Krebs, a former Washington Post reporter, spoke to a security professional claiming to work for Ubiquiti. The employee said the breach was "catastrophic", and the company downplayed the fallout to minimize the effect on its share price.

Ubiquiti makes IoT equipment, including mesh Wi-Fi systems. In January, it warned customers that intruders accessed systems hosted by a third-party cloud provider. "We are not currently aware of evidence of access to any databases that host user data, but we cannot be certain that user data has not been exposed," Ubiquiti said at the time.

Exposed data might include names, email addresses, and encrypted account passwords, the company added, before encouraging people to change their passwords as a cautionary measure.

The security professional said the breach was far worse than the company let on. “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk,” he told Krebs.

According to Krebs' source, the cloud service provider was Amazon Web Services, and the hackers got full administrative access to servers there after finding a Ubiquiti employee's password. This allegedly allowed them read/write access to Ubiquiti's databases, cryptographic secrets for users' online sessions, and sign keys and source code.

The breach also gave the attackers root access to all of the companies' AWS accounts, including all S3 data buckets, the source continued.

This reportedly enabled the attackers to authenticate remotely to Ubiquiti devices worldwide.

Ubiquiti reportedly found a back door the attackers left in the system, but the attackers tried to blackmail the company for 50 bitcoins to stay quiet. The company refused to engage the attackers, according to Krebs' story.

Instead of suggesting a password change, the company should have forcibly changed them, along with reverting device access permissions, the source said. However, the company's legal department overrode those requests.

Security researchers have discovered a data breach at a major foreign exchange (forex) broker.

According to WizCase, online forex trading site FBS left nearly 20 TB of data exposed on an unsecured ElasticSearch server containing over 16 billion records.

The broker had over 16 million traders on its platform spanning 190 countries. According to WizCase web security expert Chase Williams the data contained millions of confidential records, including names, passwords, email addresses, passport numbers, national IDs, credit cards, financial transactions, and more.

There were also files uploaded by users for verification, including personal photos, national ID cards, drivers’ licenses, birth certificates, bank account statements, utility bills, and unredacted credit cards. Among the blog’s redacted pictures were French and Swedish credit cards, a Portuguese password, and details of a $500,000 transaction.

A team of white hat hackers led by Ata Hakcil of WizCase discovered the ElasticSearch server. The team discovered the leak on October 1 and contacted FBS the next day. FBS secured the server on October 5. It’s unknown how long FBS left the server unprotected before that.

“Despite containing very sensitive financial data, the server was left open without any password protection or encryption. The WizCase team found that the FBS information was accessible to anyone. The breach is a danger to both FBS and its customers. User information on online trading platforms should be well secured to prevent similar data leaks,” said Williams.

Williams added that hackers could use the personally identifiable information (PII) exposed by the leak in fraudulent authentication across other platforms. Threat actors can also use the leaked information to launch scams, phishing, and malware attacks against FBS users.

“The data could be the basis for establishing trust to encourage clicks, malware downloads, and the availing of more confidential information. Armed with the sensitive authentic data, a cybercriminal will sound more credible when they request for information over the phone or email,” Williams said.

WizCase urged users to change their passwords, use two-factor authentication on the platform, and watch for unusual and fraudulent activity on financial statements. Experts also advise FBS customers not to share any personal confidential information requested over email or the phone by potential scammers.

New analysis from cyber security firm Tenable has found that third-party breaches accounted for over a quarter of the tracked breaches. These breaches accounted for nearly 12 million records exposed in the health care sector.

The firm’s security response team found 237 breaches in the health care sector in 2020. According to Tenable, breaches are set to continue unabated in 2021, with 56 breaches already disclosed through February.

The research found that in a quarter of cases, breaches occurred due to a separate breach at a third-party organization. This happens when hackers breach a third-party vendor that a health care organization uses, giving attackers access to data the health care provider's stores on the third-party system. Its analysis found that third-party breaches accounted for nearly 12 million exposed records.

A single breach accounted for over 10 million of these records. “This breach has been linked back to 61 of their healthcare customers, with the number of exposed records expected to increase as more of these impacted customers disclose their numbers,” researchers said.

Of all the health care breaches disclosed between January 2020 and February 2021, 93% of them included confirmed record exposure. Researchers admitted that one obstacle with accurately tracking breaches is that public disclosures can occur days, months, or even years after the event. Even then, the level of detail available may be scant.

Of these 293 breaches analyzed, 57.34% of the affected organizations have publicly disclosed how many records the breach exposed. The number of records exposed in this period reached nearly 106 million — 76.45% of these were disclosed in 2020.

The research found that ransomware was the most prominent cause of health care breaches, accounting for 54.95%. Other leading causes included email compromise/phishing (21.16%), insider threat (7.17%), and unsecured databases (3.75%).

Boris Cipot, senior security engineer at Synopsys, told ITPro that this research shows that resilience is much more than the deployment of mitigation procedures, and it starts with software design.

“As software is the cornerstone of life today, it is important to apply security during the development process. If not, mitigation techniques will act simply as “band-aids on bullet holes,” Cipot said.

“It is normal to see cybercriminals focused on exploiting known security holes in commonly used software. It is also normal that phishing campaigns are deployed with the intention of gaining information that can help them to further infiltrate critical infrastructure. It is worrying how these things are considered to be normal.”

Microsoft and FireEye executives have urged Congress to create laws requiring firms to disclose security breaches in the wake of the SolarWinds hack.

According to The Hill, Microsoft president Brad Smith said in written testimony to the Senate Intelligence Committee there is a “need to impose a clear, consistent disclosure obligation on the private sector.” He added that “silence reigns” when companies are hacked.

“This is a recipe for making a formidable problem even worse, and it requires all of us to change,” he added. “We need to replace this silence with a clear, consistent obligation for private sector organizations to disclose when they’re impacted by confirmed significant incidents.”

FireEye CEO Kevin Mandia, whose company discovered the breach, said companies should be able to report breaches that could have national security ramifications without fear of retribution.

“The US government should consider a federal disclosure program for not only sharing threat indicators but for also providing notification of a breach or incident,” he said.

According to White House officials, the SolarWinds breach affected nine federal agencies and 100 private companies. Intelligence officials have said the attacks likely originated in Russia.

Smith added that substantial evidence points to the Russian foreign intelligence agency’s involvement and nowhere else. He and Mandia said companies such as theirs had no legal obligation to disclose breaches, but a “duty nonetheless” to customers, the government, and the public.

“We will not secure this country without that kind of sharing,” said Smith.

Currently, breach notification occurs at the state level, and years of federal efforts to develop laws have netted no changes. This means the full extent of breaches remains unknown.

Mandia added that while the SolarWinds breach was stopped, another will happen, and this highlights the need for stronger breach notification requirements.

“This attacker, maybe their pencil is down for a few months, but the reality is they are going to come back,” Mandia said. “How they break in is always evolving, and all we can do is close the window and close the security gap better next time.”

While some of us may be working in pyjamas and enjoying a much more relaxed commute—shuffling last-minute from the bedroom to the home office or dining table—data protection laws certainly haven’t relaxed, and it’s imperative that your organisation maintain the same attitude toward security that it would if everyone was in the office.

Extended perimeters and the use of personal devices and networks, in combination with the proliferation of the cloud, make data security a lot more difficult. And when everyone is working from home, communicating and managing security measures and monitoring for breaches can be a struggle.

A serious breach can be fatal for your business, whether it’s through crippling regulatory action or through a tarnished reputation, and even a relatively small incident can stymie the success of your business. So even though it might seem like the world’s upside down sometimes, keeping on top of data security will contribute to your business weathering the storm and coming out strong on the other side.

1. Update your cyber security policy

While your existing policy may have fit office life, you’ll almost certainly need to adapt it to the realities of a distributed workforce, if you haven’t already.

Push updates to all company devices, systems, and programs to maintain good data hygiene and get the latest security patches. Also make sure that employees know to update their personal devices, and when not to - in the case of a software vulnerability.

Your home working policy should also cover how employees should deal with data when working remotely, including transportation, storage, and disposal, which are all important components of GDPR. Make your policy known company-wide, invite questions, and highlight the responsibility of every employee to stick to it.

2. Encrypt and control access

As part of your strategy, you’ll want to limit an attacker’s reach in the event of a data breach, and one of the simplest and most effective ways to do this is through encryption.

Your IT team will be used to having the ability to monitor server security and the network from within the office, but encrypting all of your employees’ devices, including personal devices and work phones, can achieve the same effect from home.

Using a VPN to create an encrypted connection to corporate servers also helps maintain data privacy for employees working from any location, particularly as you can’t always ensure that every remote employee is using a secure, private network.

Another method of limiting the spread of a data breach is by limiting the access each employee has.

If an attack is made through an employee who only has access to the resources they need for their daily work, then an attacker will have difficulty reaching some of the more critical areas of your network.

A zero-trust model, in which it’s assumed that no user or device inside or outside the network can be trusted, is a holistic approach to cyber security through limiting user access. Even by picking out components of the model, like multi-factor authentication, you can set up several barriers against potential breaches fairly easily.

3. Train employees in security awareness

Even if you have great policies and the best cyber security tech, they won’t save you if your employees aren’t properly trained in your policies and basic security awareness.

Encrypting your devices and using VPNs and/or zero-trust security measures is important, but you also need to educate your employees on the dangers of setting their home Wi-Fi passwords as ‘password’, or connecting through unsecure public hotspots.

Employees will typically represent the biggest vulnerability in your security posture, whether that’s due to malicious insider attacks or, as is most often the case, human error of some kind.

Train your workers to recognise phishing emails through some form of company-wide cyber security awareness training. This type of attack increased internationally by 59% in the first few months of the pandemic and, followed by stolen credentials, remains the most common vector of attack.

According to the 2020 State of privacy and security awareness report, 43% of employees are not aware that clicking a suspicious link or opening an unknown attachment in an email is likely to lead to a malware infection.

4. Stick to GDPR guidelines if a breach does occur

It’s still possible your organisation gets hit with a data breach, and if it does, you still have the same responsibilities as before the pandemic.

While the Information Commissioner’s Office said in a notice published in September 2020 that it’s committed to an ‘empathetic and pragmatic approach’ that takes into account how difficult times are right now, organisations are still required to report breaches to the ICO within 72 hours of becoming aware of them - provided the incident is likely to infringe on the rights of the data subject.

With a third of respondents in the 2020 State of privacy and security awareness report saying they would ‘probably’ report a security incident and 19% saying they weren’t sure or simply wouldn’t report it, it’s clear that some work is still needed to ensure that employees take responsibility for their own cyber security. Part of this is ensuring they understand when a data breach has occurred, but it’s also important that you foster a culture that makes it clear that accidents can happen and employees shouldn’t feel embarrassed about reporting even the smallest of incidents.

Kia Motors America has been hit with a $20 million ransom by the hackers behind the DoppelPaymer ransomware.

The attack has taken the car manufacturer’s systems offline, and the gang has threatened to leak sensitive information if the company didn’t pay up. So far, the attack has seen a nationwide outage of internal websites used by dealers. Kia Motors

A ransom note sent to Kia’s parent company, Hyundai Motor America, and seen by Bleeping Computer said to prevent the data leak and receive a decryptor, the company must pay the hackers 404 bitcoins (approximately $20 million). If Kia fails to pay, the ransom increases to 600 bitcoins (roughly $30 million).

According to reports, DoppelPaymer hackers haven’t said what data they’ve stolen.

Kia Motors America denied that it suffered a ransomware attack but did admit it was “experiencing an extended systems outage.”

Sam Curry, chief security officer at Cybereason, told ITPro if news reports are accurate, Kia Motors has long since passed the panic mode in dealing with a massive ransomware attack that has affected operations for more than five days.

“From afar, it appears the attackers have taken Kia Motors to its knees. Think about the scale of the problem for a company of this size with tens of thousands of employees and thousands of dealerships. Every additional hour and day they are incapacitated is costing the company tens of millions of dollars that will not be recouped,” Curry said.

Natalie Page, threat intelligence analyst at Talion, told ITPro DoppelPaymer is a problematic strain we’ve seen successfully infiltrate numerous large-scale global organizations recently. It’s infamous for its initial immense ransom demands, often negotiated to a much smaller amount if the organization chooses to pay.

“Unfortunately for Kia there is no guarantee that if the ransom is paid, DopplePaymer’s operators shall not leak any sensitive data,” she said. “Whichever eventuality the company selects, as stressful as the situation will currently be for Kia, for the salvation of the company’s reputation the priority going forward needs to be their clients and shareholders. Communication is key.”

Hackers claim to have stolen confidential files belonging to the Jones Day law firm, which once represented former-president Donald Trump. The hackers allegedly posted sensitive files on the dark web, but the law firm denies the breach occurred.

DataBreaches.net initially reported the attack, which is thought to involve the Clop ransomware gang. The hackers claimed to have obtained 100GB of data from the law firm and published redacted files to prove their attack. The gang has demanded a $20 million ransom payment in return for a decryption key.

The law firm disputed the hackers' claims that they breached its network. However, it did say a file-transfer platform it used was recently compromised, affecting the firm’s data. The compromised platform belongs to California-based cloud computing company Accellion.

“Jones Day has been informed that Accellion’s FTA file transfer platform, which is a platform that Jones Day—like many law firms, companies, and organizations—used was recently compromised and information taken,” a spokesperson for the firm said in a statement to Bloomberg Law.

“Jones Day continues to investigate the breach and has been, and will continue to be, in discussion with affected clients and appropriate authorities.”

The Wall Street Journal said it’s not only seen some breached files, but it could also “see the existence of many more files — mammoth in size — also purported to belong to Jones Day.”

James McQuiggan, Security Awareness Advocate at KnowBe4, told IT Pro that like the SolarWinds supply-chain attack, the cyber criminals are focusing their attacks on those third parties and service providers that support many customers.

“These organizations will want to review and elevate their security programs to ensure they do not suffer a breach, leading to a similar compromise. These attacks damage the organization’s customers and clients and damage the reputation and possible bottom line for that organization,” McQuiggan said.

“With an organization that provides large file transfers, one consideration for them to protect their data is to encrypt the data before transferring it and to protect it from the third-party provider. Upon delivery to the receiver, they would have the key to decrypt and view the data."

Martin Jartelius, CSO at Outpost24, told IT Pro what we’re seeing now are the effects of the Accellion intrusion from December.

“It’s an external file sharing solution that’s decades-old and has been used by several organizations. As we are seeing more and more data related to the breach hitting the news, other organizations that have used the services should review and prepare processes to inform any clients and any individuals for whom data has been processed on this platform,” Jartelius said.

“Noting that we are approaching a two-month mark from when the breach likely occurred, those who suspect they may be affected should consider informing any affected data subjects at the soonest in line with current privacy legislation and not wait and hope for the best.”

Your company deals with sensitive information — all companies do. Whether it’s customers’ private information, your company’s financial records and accounts, or that new top-secret project you don’t want getting out just yet, keeping your data secure is a top priority. Unfortunately, it seems to be getting harder all the time.

We’ve seen many major data breaches at many big name companies, including T-Mobile, Microsoft, and General Electric. Even the Internal Revenue Service (IRS) fell victim to a major data breach.

It doesn’t matter if you’re in charge of a Fortune 500 company or a small business, you must protect your data. While there's no foolproof way to secure all of your sensitive data, these steps can help prevent a data breach.

Data breach defined

Although the exact definition can vary between regulators, a data breach usually occurs when any unauthorised party gains access to confidential information.

The term usually covers everything from one of your own employees logging into a file without permission, to cyber criminals hacking into your systems and taking the personal information of employees and customers.

Normally a breach also involves the failure of a security layer, which results in the accidental or purposeful destruction, alteration, theft, or disclosure of protected data. It is considered a breach if an unauthorised individual simply looks at the data. The consequences can be severe for business, regardless of its exact nature.

The consequences of a data breach

The consequences of a data breach can be as varied as the different forms of breaches themselves. It could be as small as a single employee finding out his peers’ salaries and threatening to sue for higher pay. Alternatively, it could be as severe as cyber criminals or hackers accessing your system’s files and encrypting them before demanding a ransom.

If you follow recent news, you might have seen a variety of data breaches making the headlines which often involve accessing customer data, like addresses, names, social security numbers, and even credit card numbers. These breaches can cost the companies who are affected millions of dollars in lawsuits and lost business.

After a breach has occurred, detecting, defining, and recovering from the incident can be a long and slow process for an organisation. Although the consequences of this kind of leak can be brutal for larger corporations, they can be the death knell for a small business. The best strategy is to be prepared if it occurs and prevent it from ever happening.

10 steps to keeping your data safe

While there is no surefire way to eliminate all data breaches, these nine steps will help your business prevent catastrophic leaks.

1. Hire a professional

You probably have a financial controller or accountant in charge of payroll and accounts payable. Why would you not have a specialized IT security person to safeguard the entirety of your business?

Technology changes quickly, and you need someone dedicated and accountable who can find your vulnerabilities and help you shore them up. This IT watchdog can be your best bet in defending your business from external and internal data breaches.

2. Separate your business and personal accounts

Keeping your business and personal accounts separate should be obvious, but we’re not talking just about bank accounts and credit cards. This separation also goes for all of your accounts, including email and data storage. Keep them separate and have unique passwords for everything.

The last thing you need is someone hacking into your personal email and suddenly having access to sensitive business data.

Make sure everyone in your company follows this practice too. It only takes one small mistake to expose the whole company.

3. Checkout FINRA

The Financial Industry Regulatory Authority (FINRA) is a government-authorized nonprofit organization that oversees US broker-dealers and has a pretty good handle on what it takes to have top-notch cybersecurity.

It has put together a Small Firm Cybersecurity Checklist that’s a handy tool for any business looking to up its cyber security game. It’s free to download and could help you secure some aspects of your business you hadn’t thought about before.

4. Restrict access as much as possible

As much as possible, limit each employee's access to data. That means any employee who doesn’t need access to a program or data file doesn’t get access.

By all means, provide each employee with the permissions she needs to do their job, but limit anything that isn’t necessary. The fewer people accessing data, the lower the risk of a breach—accidental or otherwise.

5. Minimize your data

Think of your business as your home, and all that data is the stuff in your home. The more things you have cluttering an area up, the harder it is to keep track of the important stuff. It’s time to clean up.

Eliminate old programs or data files that serve no purpose. Team up with your IT security officer to establish the proper procedures for identifying and eliminating unnecessary files.

Keeping your data tidy can also help you identify a breach problem sooner too.

6. Encryption

Today’s technology offers plenty of avenues for encrypting your data. Use them. Don’t just encrypt data sitting in files; use encryption for files on the move through email and other means.

7. Educate your employees

One of the most common ways data breaches occur is through an honest employee mistake. You must teach your employees how to create unbreakable passwords and how to identify potential phishing scams and other security threats.

Train, test, and educate your employees on the importance of information security. It can be a tough job to get your employees on board with cyber security training, but it’s essential.

8. Get the C-suite on board

Cyber security awareness and understanding must start at the top. If the company’s executives don’t fully understand the threat and consequences, it will create a difficult hurdle for each step of the process.

Cyber security is an investment, and like any investment a company makes, the C-suite needs to see the benefit before they’ll be willing to pay for it.

9. Don’t ignore hard copies

Data breaches don’t always happen online. Printed documents can cause equal damage in the wrong hands. Keep all sensitive files in a locked cabinet and designate a gatekeeper who only gives access to those who truly need it.

Also, invest in a quality crosscut paper shredder to properly destroy any documents you need to eliminate.

10. Have a data breach response plan

While preventing a data breach is always the number one goal, your company needs to have an action plan for handling a breach. The ability to quickly detect a breach can save millions of dollars in some situations.

Talk with a cyber security professional and establish steps to identify, contain, and then recover from a data breach.

Data protection is an ongoing process

Once you’ve completed all 10 steps, get ready to do them all over again. Technology changes quickly, and cyber criminals are continually finding new ways to break into sensitive information and profit from it.

If you want to avoid becoming a victim of the next big data breach, stay one step ahead of the game. Companies that become complacent with their cyber security end up being vulnerable to attack.

For-profit hacker ShinyHunters has leaked 1.9 million Pixlr user records, including information bad actors could use to carry out targeted phishing and credential-stuffing attacks. Pixlr is a free online photo-editing application.

Experts believe the alleged Pixlr database that ShinyHunters posted may include 1,921,141 user records. Within these records are email addresses, login names, SHA-512 hashed passwords, a user's country, whether they signed up for the newsletter, and other sensitive information.

According to a Bleeping Computer report, ShinyHunters shared the database on the dark web. The hacker claimed they stole the database during their November breach of 123rf, which shares the same parent company as Pixlr.

In the 123rf breach, hackers stole over 8.3 million user data records. These records contained email addresses, MD5 hashed passwords, company names, phone numbers, addresses, PayPal emails, and IP addresses.

ShinyHunters has also been responsible for data breaches at Minted, Chatbooks, Wattpad, and others.

Stephen Kapp, CTO and founder at Cortex Insight, told IT Pro that the Pixlr breach shows how cyber criminals are actively targeting organizations to monetize data.

“To help limit the damage, Pixlr should look to improve its internal processes by holding user information within application databases or dedicated SSO systems, such as those offered by AWS. This would allow for dedicated password hashing that includes a Salt Work Factor to help mitigate against brute force attacks,” Kapp said.

Boris Cipot, senior security engineer at Synopsys, told IT Pro that in the wake of this breach, users should change their password on Pixlr. They should also change the password on other sites where they may have reused their Pixlr password, as hackers can sometimes revert hashed passwords.

“Users should also be prepared for possible phishing attacks. They should not blindly click on links sent via email. These links may lead you to a malicious site where you will be encouraged to 'change' your password. The same goes for documents - do not download anything without first verifying the authenticity of the sender. Cybercriminals will try to abuse every piece of information they have on you for their own personal gain; therefore, think twice before actioning any emails," Cipot said.

A ransomware attack launched against gaming company Capcom last November is much worse than originally reported.

In a statement, the company behind games such as Resident Evil, Street Fighter, and DarkStalkers said the attack potentially compromised up to 390,000 users’ data - 40,000 more than the company initially thought.

Capcom discovered the data breach, which the company said impacted personal and corporate data, in early November 2019.

Initially, the company confirmed the data leak affected only nine people and estimated the total impact to be 350,000 people. In a new update, Capcom said the company has verified that the breach compromised an additional 16,406 users' personal information, bringing the number of confirmed users impacted to 16,415.

The company said its investigations were ongoing, and it's “possible that new facts may come to light going forward.”

“Capcom offers its sincerest apologies for any complications and concerns that this may bring to its potentially impacted customers as well as to its many stakeholders,” the statement said.

Capcom added that none of the at-risk data contains credit card information. “All online transactions etc. are handled by a third-party service provider, and as such Capcom does not maintain any such information internally,” read the statement.

The company also said the areas this attack impacted are unrelated to systems used when connecting to the internet to play or purchase the company's games online. These have continued to use an external third-party server or an external server.

“As such, these systems have been unaffected by this ransomware attack and it is safe for Capcom customers or others to connect to the internet to play or purchase the company's games online,” the company said.

Niamh Muldoon, global data protection officer at OneLogin, told IT Pro that ransomware is the one activity that has a high direct return on investment out of all the cyber crime activities.

“Taking the global economic environment and current market conditions into consideration cybercriminals will, of course, continue to focus on their efforts to this revenue-generating stream. Remember that your employees are your most valuable assets both from a security threat awareness perspective but to provide valuable insights into the pulse and culture of the organization so it's important to keep a close eye on the ground,” Muldoon said.

“The key message here is no one, industry or company, is exempt from the ransomware threat and it requires constant focus, assessment, and review to ensure you and your critical information assets remain safeguarded and protected against it."

Parler, the right-wing social media platform used in the recent insurrection at the Capitol, has been hit by a massive data-scrape campaign, resulting in 70TB of leaked data.

According to a blog post by cyber security firm KnowBe4, hackers could use this leaked data, which included user profile data, admin rights data, videos, and live and deleted posts, to mount various nefarious campaigns aimed at Parler users.

“We anticipate that bad actors will fill the gap by launching phishing campaigns that offer users bogus web sites with fake, malicious Parler downloads or even malware-infected versions of Parler. They may also set up fake web sites and push malicious online advertising to do the same,” said Eric Howes, principal lab researcher at KnowBe4.

Before Parler went offline but after the website was no longer able to use phone or email verification, Twitter user @donk_enby collected 70TB of posts, messages, and videos. This is around 99.9% of all content ever posted to the site.

The breach was possible because the “forgot password” link that would normally require verification was no longer working. Anyone could then override this to log in to accounts that weren’t theirs. Once in, they could log in to accounts with administrator access and create new accounts, also with administrator access. Hackers used these accounts to dump data from the website.

Howes added that Parler-themed phishing emails could take at least two forms. First, spoofed Parler emails offering alternative download/install links. And second, fake right-wing/conservative emails denouncing Google and Apple’s actions and offering alternative download/install links.

“This massive haul of leaked data could allow malicious actors to individually target Parler users in spear phishing campaigns as well as all manner of online scams,” Howes warned.

Howes said his company had developed a handful of simulated phishing emails to be used by customers to test their staff.

“In addition to using these new templates to phish your users, it would also be a good idea to alert your employees and users to the danger that they could be encountering phishing emails as well as fake web sites and deceptive online advertising offering them alternative download sources for Parler that, in reality, will be pushing malware instead,” he said.

Researchers have uncovered vulnerabilities in the United Nations Environmental Program (UNEP) computer systems that could have exposed 100,000 personal data records.

According to a report by the ethical hacking company Sakura Samurai, which looked at the UN network’s strength, they obtained this data in less than 24 hours. By identifying an endpoint that exposed Git credentials, the researchers used the credentials to download Git repositories and identify user data and personally identifiable information (PII).

“In total, we identified over 100K+ private employee records. We also discovered multiple exposed .git directories on UN owned web servers [ilo.org], the .git contents could then be exfiltrated with various tools such as “git-dumper”,” said researchers.

Travel and employee data was among the findings. Records contained employee IDs, names, employee groups, travel justification, start and end dates, approval status, destination, and the length of stay. Researchers also found HR data, such as nationality, gender, and pay grade, on thousands of employees.

“In total, we found 7 additional credential-pairs which could have resulted in unauthorized access of multiple databases. We decided to stop and report this vulnerability once we were able to access PII that was exposed via Database backups that were in the private projects,” said researchers.

Javvad Malik, security awareness advocate at KnowBe4, told IT Pro it’s easy for organizations, especially global ones, to have data spread across various systems and platforms.

“Keeping track of all these disparate systems can be challenging enough and ensuring the right security settings are applied and that credentials are appropriately managed is key,” Malik said. “While many technologies and processes exist to help secure organizations to prevent these kinds of issues, it is essential that organizations cultivate a culture of security so that everyone is aware of the role they have to play in securing the organization as it's not something a security department can do on their own."

Martin Jartelius, CSO at Outpost24, told IT Pro the flaws we see in this case are all related to users configuring those servers, leaving files exposed and software misconfigured.

“Those are flaws in usage, not flaws in software. It is in parts further concerning as those systems were internet exposed, and in turn, held credentials for other systems,” he said.

“With access to some of the indicated information and the simplicity of the breach, attackers may well have access to this information. It is one of the basic controls any experienced analyst performs against a system they are auditing, yet it is still surprisingly often a rewarding path to take provided the attack surface is sufficiently large, such as a full organization."

Swiss-based software engineer and security researcher Tillie Kottmann has discovered the source code for Nissan North America’s internal mobile apps and tools on a misconfigured Git server.

Kottmann said in a tweet he’d found a “complete dump” of all Git repositories from Nissan NA. The dump included sources for the Nissan NA mobile apps, some parts of the ASIST diagnostics tool, and the dealer business systems and portal.

The researcher also found details on Nissan’s internal core mobile library, NCAR/ICAR services, client acquisition and retention tools, sale/market research tools and data, various marketing tools, and vehicle logistics portal.

The leak stemmed from a Git server that was left visible online with its default username and password combo of “admin.” Nissan is probing the leak, and the Git server was taken offline after the data started disseminating on Monday via Telegram channels and hacking forums.

The security researchers who uncovered the misconfigurations received a tip about Nissan's Git server after they found a similarly misconfigured GitLab server in May 2019.

Martin Jartelius, CSO at Outpost24, told ITPro that it’s a basic security control to change the vendor default passwords when deploying a system.

“From the nature of the content, this should be a production system and reviewed prior to having the source code uploaded. This basic control forms part of most organizations ISMS standards, i.e., ISO27001 policies and regulations internally. As Nissan Japan had their 9001 certificate revoked in 2017 by authorities it is not the first time the successful implementation of good plans and strategies has not reached all the way to execution in the large organization,” Jartelius said.

Mark Bower, SVP at comforte AG, told ITPro that this leak was a "classic example of the security being only as good as the weakest link".

"Most likely, in this case, [this is] down to both human error and lack of process for risk scanning of critical infrastructure for vulnerable credentials and effective data security,” Bower said. "The recent Solarwinds situation should have prompted organisations across the industry to revisit their supply chain security, data security and authentication as a matter of priority – including any internet-facing or cloud components."

T-Mobile has suffered a data breach affecting information government agencies consider highly sensitive. The breach is the company's fourth since 2018.

The breach affected about 200,000 customers, according to reports, and T-Mobile said the breach impacted a range of information, including customer phone numbers, the number of lines subscribed on their account, and possibly call-related information collected as part of their cellular service.

It didn't affect personally identifiable information, such as names, addresses, email addresses, financial data, social security numbers, or PINs.

The information affected still represents a serious risk. The leaked data is known as customer proprietary network information (CPNI), and the Federal Communications Commission (FCC) considers it "some of the most sensitive information that carriers and providers have about their customers." CPNI includes the phone numbers the customer called, when they made the calls, and how long the calls were. This is otherwise known as call metadata, and intelligence agencies have long sought it for surveillance purposes.

"Our Cybersecurity team recently discovered and shut down malicious, unauthorized access to some information related to your T-Mobile account," T-Mobile said in the statement on its website.

"We immediately started an investigation, with assistance from leading cybersecurity forensics experts, to determine what happened and what information was involved. We also immediately reported this matter to federal law enforcement and are now in the process of notifying impacted customers."

This isn't the first data breach T-Mobile has suffered. In 2018, the company warned users someone had unauthorized access to information, including their phone number, email address, account number, and date of birth.

In November 2019, T-Mobile admitted a systems breach had affected over 1 million customers. That heist targeted information related to prepaid wireless accounts and included names, addresses, phone numbers, and other CPNI data. In March 2020, the company also notified customers that the breach might have compromised their personal and financial information.

In April 2020, T-Mobile US completed its $26 billion merger with US carrier Sprint Corporation to build a nationwide 5G network.

Most conversations surrounding the cost of a data breach are around fines or compensation.

Financial costs are definitely important as we see an onslaught of regulatory legislation around the world. Many countries have followed in the footsteps of the EU’s implementation of GDPR, like California’s CCPA and Brazil’s LGPD.

Since 2021 is likely to see increased safeguards on consumer privacy and, in the past year, employees have had access to more data at work, the number and value of data breach fines are also expected to increase.

However, an important aspect of data breach cost that is often overlooked is reputational damage.

A good reputation is usually hard to build, but once you’ve gained it, it can sustain a business through tougher times like what we’re currently going through. Back in 1997, Apple was on the verge of bankruptcy and playing second fiddle to Microsoft, but in 2018 it became the first publicly traded American company worth more than a trillion dollars.

Today’s consumers often put a lot of stock in reputation and are loyal to brands that they’ve had good experiences with, so it can be nearly impossible to bounce back from any damage to your rep.

The reputational repercussions of a data breach can last much longer than the short-term fine, causing damage to your bottom line in the long run when customers don’t trust you enough to do business with you, and potentially dealing your organisation a blow from which it will never recover.

In the media glare

In the immediate wake of a data breach, there’s a lot to take in. What was lost? Was it an attack or an accident? Has the breach been closed?

If you’re a household name, such as TalkTalk, Equifax or Yahoo – or involved in something salacious like Ashley Madison – you will likely find yourself in the unenviable position of doing these initial investigations in the full glare of the media spotlight.

For such businesses, especially nowadays, the reputational impact will be immediate. Depending on the size of the data breach and how it happened, big businesses are likely to find themselves on the front pages of the papers and in the broadcast headlines too. In this kind of situation, the axiom that “all publicity is good publicity” falls very flat.

Even if your own organisation’s data breach doesn’t warrant a spot on the evening news, that doesn’t mean you will have escaped public condemnation: Disgruntled customers – or now former customers – will be disavowing you on social media for having shown little care for their personal information, potentially for years to come.

It’s not just the act of losing control over customers’ personal data that can harm a business’ reputation, either. Speaking as a guest on the IT Pro Podcast, Dr Rois Ni Thuama, head of cyber governance at Red Sift, pointed to the fallout of the 2014 Sony Pictures hack as one example.

“You had large dumps of Sony data … you’ll remember there was a lot of stuff on actor compensation, there [were] embarrassing email exchanges. One of the key players (co-chairperson, Amy Pascal) sent something that was racially insensitive,” said Ni Thuama.

“People lost their jobs… their careers and their professional lives were damaged, particularly the woman (Pascal) who sent the charged emails, and then there was definitely a loss of reputation over the actors’ compensation,” she added.

The importance of accountability

Away from the data breach itself, how the organisation acts once the incident can have a major impact on the depth and permanence of the damage an organisation faces.

Gabriel Friedlander, the founder of security awareness training firm Wizer, tells IT Pro: “Yahoo, Uber and Anthem are three data breaches that stand out in the US because of the lack of accountability, lack of transparency, and length of time between a breach happening and the truth coming out.”

“Companies also invest a lot in ‘values’, so when companies lie or try to hide a breach, it ruins the trust and goodwill that has been built up over years with many of their customers, some of whom will quickly look to the competition for a more safe and secure alternative,” he adds.

Simon Smith, a specialist in cybercrime and computer forensics, feels similarly.

“Trust is the driver for any business success. If trust is lost then some businesses may never recover,” Smith tells IT Pro.

“It can depend a lot on the nature of the breach and how the company reaches and remedies the breach. Dishonesty or non-disclosure can cause a great loss of trust that could easily destroy any business after only one incident. Customers, the authorities and society will be concerned about a company's security and ability to protect data if systems are not in place to handle and mitigate the problem.”

Small business, big problems

Sadly, when it comes to reputational damage, SMBs often fare worse than larger ones.

“We see a 60% failure rate among the SMB market after a company discloses a breach within 6-12 months,” says Friedlander. “This partly due to confidence issues, partly due to recovery challenges, etc.

“The SMB market is crowded. Think about a restaurant, if it gets breached people have many options for going to eat somewhere else, and if your accountant got breached, you will probably leave and find someone else.”

Bigger businesses, on the other hand, may be harder to move away from. It’s also likely they have greater resources to put towards crisis management, as well as to pay any regulatory fines and settle lawsuits.

Smith adds that SMBs can suffer worse damage to their reputation as they may not realise their responsibilities or act appropriately.

“Small businesses make up the majority of all business, but as many are not publicly listed, they feel they do not have to disclose every event. This in itself causes a major problem as it is now considered a regulatory issue across the world where businesses of all sizes can be fined for breaching the obligation to secure personal records,” he says.

“Any size business is equally at risk because somewhere along the way, they got the attitude that ‘it can’t happen to us’, or, ‘it can’t happen to us again’. Without proper process, project, policy and infrastructure governance in place to protect their systems, it is always going to be a ticking time bomb,” he adds.

If you survive the initial damage, the lasting impact may not be quite as catastrophic as one would imagine, though – as they say, time heals all wounds.

“Long term, there is an argument that there’s little consequence as humans have short memories,” says Friedlander. “There’s a plethora of breaches and companies get lost in the mix.”

Nevertheless, while there are methods to mitigate reputational damage in the wake of a data breach – including the passage of time – it pays to put as much effort into preventing one happening in the first place. Not only do you reduce the risk of harm, but if a breach does happen the reaction will likely be more sympathetic if it can be shown it happened despite you having ample defences and procedures in place.

Hackers have stolen 8.3 million user data records from royalty-free stock photo website 123RF. The cyber criminals breached a server belonging to 123RF’s parent company, Inmagine Group, to access the data.

According to a report from Bleeping Computer, a known data breach broker began selling the data containing user information last weekend. The data reportedly includes 123RF members' full names, email addresses, MD5 hashed passwords, company names, phone numbers, addresses, PayPal emails and IP addresses. However, it’s not thought to contain financial information, such as credit card numbers.

Inmagine Group said: "We are actively notifying the necessary authorities and 123RF.com members to work with them to remedy the situation. We are also tightening the security policies to include tighter passwords and IP detection to combat suspicious log-ins."

"Our security infrastructure is always under a constant state of security testing, penetration, and development, especially in the past year. We wish to reiterate that we take the privacy and data of our customers seriously and have at all times been vigilant with the handling of our customer’s data."

Chris Hauk, consumer privacy champion at Pixel Privacy, told IT Pro that the state of online security makes New York City in the early 1970s look safe by comparison. He added that while passwords were encrypted, hackers could use online password cracking tools to retrieve credentials for many accounts.

“This means that 123RF members that reused that same password on another site(s) are in danger of having those accounts accessed. So, this brings an added bit of urgency to the usual ‘change your password and check to make sure none of your online accounts use the same password’ advice,” Hauk said.

Niamh Muldoon, senior director of trust and security at OneLogin, told IT Pro that it’s unclear how this breach occurred in the first place; however, what is known is the information is out there, and cybercriminals are likely already taking advantage of it.

“The MD5 hashed passwords are easily hacked, for instance, so they will likely carry out credential stuffing attacks to access other user accounts. Affected individuals would do well to change all passwords immediately, particularly if the same password was used for their PayPal account. A password manager would be useful as well to ensure that passwords are no longer reused across services and to help with crafting long and complex passwords,” Muldoon said.

Prestige Software, a hotel reservation platform used by Hotels.com, Booking.com, and Expedia, left data belonging to “millions” of guests exposed on a misconfigured Amazon Web Services (AWS) S3 bucket.

According to Website Planet, the highly-sensitive information dates back as far back as 2013. It reports that the Spanish company, which sells a channel management platform called Cloud Hospitality that allows hotels automate their availability on online booking websites, was storing years of hotel guest and travel agent data without any protection in place.

As a result, Prestige Software exposed over 10 million individual log files in total. Each of these records exposed sensitive and personally identifiable information (PII), including names, email addresses, national ID numbers, phone numbers, reservation information, and credit card details, including CVV and expiration date.

Website Planet reports that the S3 bucket contained over 180,000 records from August 2020 alone, despite global hotel bookings being at an all-time low for this period.

However, it's difficult to say how many people were affected due to the amount of data exposed. The report notes the actual number of people exposed could be much higher than the number of reservations logged as many of the data logs contained PII data for numerous people on one booking.

While the scope of the data breach remains unknown, it could lead to all too common risks with hotel data exposures, such as credit card fraud, identity theft, and phishing scams. Perpetrators could even use the data to steal someone else's reservation.

Website Planet said the hole was closed a day after telling AWS about the exposure, adding that Prestige Software confirmed it was the owner of the data and the party responsible for the leak.

Due to the fact that Prestige Software is based in Spain, with offices in Madrid and Barcelona, the company could face GDPR action as a result of the breach. If it failed to follow the strict rules set out within the legislation, which includes a requirement to report the breach within 72 hours, the company could be fined €20 million (about £18 million) or 4% of annual global turnover.

Earlier this month, the Information Commissioner's Office (ICO) hit Marriott International with an £18.4 million fine for a data breach that affected 339 million guest records worldwide.

A hacker is trying to blackmail thousands of Finish patients after gaining access to their personal information via a psychotherapy company.

Police have said that an unknown party started demanding ransom from more than 40,000 patients whose data was stolen from the Vastaamo psychotherapy centre, according to local media reports.

The data was taken during a cyber attack in November 2018, and potentially again in March 2019, the Helskinki-based centre said in a statement.

The company is cooperating with the police, but it's reported that some 300 records have already been published on the dark web. It is also being reported that the firm's CEO, Ville Tapio, has been fired for obscuring information about the data breach for more than two years.

The hackers originally sought to extort a ransom from the centre's management but changed tactics over the weekend to elicit payments from individuals that had used the service.

Various patients have spoken to media outlets to say that the hackers have contacted them and threatened to leak mental health records onto the internet unless they provide payment in Bitcoin. Some of the people whose data has been stolen are also underage.

One patient told the BBC that the hacker said Vastaamo had refused to pay 40 Bitcoin (£403,000) and he would now have to pay €200 worth in order to stop his information being released - this included session notes from when he was a teenager.

"I'm anxious about the fact that the attackers are in possession of my notes and conversations from those psychiatrist sessions," he said. "Those notes contain things I'm not ready to share with the world. And having someone threaten me with said notes certainly makes me extremely uncomfortable."

The patient's notes had been taken in a physical notebook and he/she wasn't told these would be uploaded to a server. The country's prime minister Sanna Marin tweeted that the Finish government was looking into ways to support the victims of what he called a "shocking" hack.

Amazon has contacted a portion of its customers to inform them an employee has been discharged from their role after leaking their personal information to an unidentified third-party.

The individual who lost their job for leaking customer email addresses has been referred to the police, according to Motherboard, with criminal investigations now ongoing. The incident highlights the continued threat of insider security risks.

No matter how many cyber security precautions an organisation takes, it’s difficult to guard against either human error or malicious intent, as has been the case with the leakage of Amazon customers’ email addresses.

"We are writing to let you know that your e-mail address was disclosed by an Amazon employee to a third-party in violation of our policies,” the company wrote in a message to customers affected.

“As a result, we have fired the employee, referred them to law enforcement, and are supporting law enforcement criminal prosecution.”

There are few details as to how many customers were affected, or the identity of the third-party to which the customer email addresses were leaked. The news circulated online over the weekend after a number of Twitter users posted copies of the message they received from Amazon.

“The fact that a number of Tweets that have appeared over the last few days from Amazon customers stating that they have been the victim of a data breach will rightfully be a worry to consumers," said Jo O’Reilly, digital privacy expert at ProPrivacy.

“Finding out that an Amazon employee has been passing customer emails to a third party is particularly concerning, especially as Amazon appears to have been very vague about the details.

“The online retail giant has confirmed that they are working directly with the authorities and that the employee in question has been fired however more transparency with the consumer impacted and what this means for their online privacy is now needed. It's entirely possible that they will now find themselves falling victim to phishing attacks, to prevent this Amazon need to be upfront about exactly who these emails have been shared with.”

This incident bears striking similarity to one in January 2020, in which several Amazon employees were fired after sharing customer email addresses and phone numbers with a third-party.

Fitness Depot notified its customers that their personal and financial information may have been stolen as part of an attack impacting the company's e-commerce platform.

The Canadian retailer was informed of the data breach on May 20, and recently sent a breach notification letter to all potentially impacted customers.

Per Fitness Depot’s letter, attackers compromised the company’s online store and gained access to customers’ personal and financial information. Information accessed by the attackers may have included customers' names, addresses, contact information and credit card numbers.

Based on the breach notification letter, all signs point to Fitness Depot having suffered from a Magecart attack. In these attacks, Magecart groups hack an e-commerce store’s checkout page and inject malicious JavaScript-based scripts that steal customer information entered into online payment forms.

Though Fitness Depot discovered the breach on May 20, 2020, it dates as far back as Feb. 18, 2020. While customers who placed orders for home delivery were impacted between Feb. 18 and April 27, any customer who ordered products for home delivery or in-store pick-up would have been affected between April 28 and May 22.

"Once our customers where (sic) redirected to this form the customer information was copied without the authorization or knowledge of Fitness Depot," the company explained. "This is how the personal information was captured and stolen."

While Fitness Depot has stated "personal information was captured and stolen" during the breach, the company also shared it "has no knowledge that any of our customer information was compromised in any manner." Regardless, Fitness Depot has advised customers to protect themselves against identity fraud by monitoring their credit reports and reviewing account statements regularly.

Fitness Depot blames its internet service provider for the data breach, claiming it "neglected to activate the anti-virus software on our account." It’s unclear what Fitness Depot is referring to since it’s not typically an ISP’s job to equip its customers' e-commerce platforms with anti-virus software.

UK Printing company Doxzoo inadvertently exposed 343GB of data through a misconfigured Amazon Web Services (AWS) S3 bucket, including sensitive information said to relate to branches of the UK and US military.

Potentially more than 100,000 users were affected by the data leak, with approximately 270,000 records exposed including personal information and payment information, as well as order details, passport information, and the contents of printing orders.

Among the exposed data was the copyrighted and sensitive work of Doxzoo clients, who spanned from military personnel to screenwriters. Researchers with vpnMentor, led by Noam Rotem and Ran Locar, found a wide range of information including university course material, screenplays, and internal military documents, some of which contained classified information.

“The items contained this leak often hold private and/or confidential information within,” said vpnMentor’s research team.

“The promise of secure facilities and systems are key selling points for clients such as the military, and the breach of that guarantee is not only a failure in service, but also potentially holds a security risk along with it.”

The security firm has been finding pockets of exposed information for many months as part of a wider web-mapping project, and have recently detailed finding several alarming troves of exposed data.

These findings include a database of 604GB of text messages run by US-based communications firm TrueDialog, as well as sensitive information from British consultancy firms and consultants such as passport scans and financial documents.

The firm previously discovered exposed US military data in October 2019 due to a flaw in a reservations management system owned by the Best Western hotel chain. Personnel working for the US Department for Homeland Security (DHS) and the military was seen by researchers from vpnMentor, including travel arrangements both past and future.

The countries affected include not just the US and the UK, but clients in Sri Lanka, Nigeria and India, according to researchers. The UK-based printing company has a number of high profile clients and projects, including full-length books and sought-after paid wellness plans.

Doxzoo could have avoided this leak if they had taken basic security measures to protect the S3 bucket, vpnMentor said, including securing their servers, implementing proper access rules, and preventing system that don't need authentication from being accessed by the public through the internet.

The firm first discovered the exposed database on 22 January, before notifying the company four days later. Because Doxzoo didn’t respond to vpnMentor’s communication attempts, Amazon was notified on 5 February, and the bucket was finally closed on 11 February.

Of all the ways a hacker can disrupt a business, a DDoS attack is arguably the most annoying. DDoS stands for distributed denial of service and it has become very popular to cybercriminals looking to infiltrate, or merely disrupt, businesses.

What’s more, attacks can be administered by anyone, from novice hackers to seasoned pros, and done so virtually. The tools are easily deployed and widely available. It's a case of simply bombarding a targeted website with artificial traffic until it crashes. When a computer visits a website, it requests access to the content of the site and a DDoS attack exploits this by sending more requests than a server can cope with in one go. The attack clogs up the system, causing long delays or even the complete failure of the server.

DDoS attacks are on the rise

The sad fact of life for many organisations is that DDoS attacks are increasing. In the first half of 2020, DDoS attacks increased by a whopping 542%, according to NexusGuard.

The largest DDoS attack ever recorded thus far was in 2017. Google revealed that its infrastructure absorbed a 2.5Tbps distributed denial of service (DDoS) attack in 2017, the largest such attack in terms of its sheer volume ever recorded. This was four times larger than the record-breaking 623 Gbps attack from the Mirai botnet a year earlier.

In 2018, Amazon Web Services (AWS) reportedly blocked an attack that measured at 2.3Tbits/sec. This, it said, was 44% larger than anything it had dealt with before.

But, it's not just the big-name players on the internet who are at risk from DDoS attacks. According to Kaspersky Lab, 27% of businesses caught up in such an incident think they were collateral damage, rather than being the intended target. This reiterates the need for all organisations to know how to protect themselves from a DDoS attack.

In the UK, it has been calculated that DDoS attacks could cost the country almost £1 billion per year, according to Netscout's Worldwide Infrastructure Security Report.

While the cloud has been a boon to many, it has also been sadly useful to criminals. According to research by Link11's Security Operation Center (LSOC), the public cloud was used in a quarter of DDoS attacks in a year.

DDoS safeguarding

Rather than over-provisioning, simple things such as bandwidth buffering can allow for traffic spikes including those associated with DDoS attacks, and give you time to both recognise the attack and react to it.

It's also probably worth putting into place other basic safeguards that can gain you a few precious minutes: rate-limiting your router, adding filters to drop obvious spoofed or malformed packets, and setting lower drop thresholds for ICMP, SYN, and UDP floods. All these will buy you time to try and find help.

It is also a good idea to familiarise yourself with your website's inbound traffic characteristics. The more you know about what looks normal, the easier it becomes to identify anomalous traffic and take action. It is also a good idea to be able to tell the difference between a sudden surge of normal visitors and the start of a DDoS attack.

DDoS response planning

The first thing every organisation should do when suspecting a DDoS attack is confirmed it actually happened. Once you've discounted DNS errors or upstream routing problems, then your DDoS response plan can kick in.

What should be in that response plan? Contact relevant members of your incident response team, including leads from applications and operations teams, as both are likely to be impacted.

Then contact your ISP, but don't be surprised if it black-holes your traffic. A DDoS attack costs it money, so null routing packets before they arrive at your servers is often the default option. It may offer to divert your traffic through a third-party scrubber network instead; these filter attack packets and only allow clean traffic to reach you.

Be warned, this is likely to be a more expensive emergency option than had you contracted such a content distribution network (CDN) to monitor traffic patterns and scrub attack traffic on a subscription basis.

DDoS prioritisation

Ensure the limited network resources available to you are prioritised - make this is a financially driven exercise as it helps with focus. Sacrifice low-value traffic to keep high-value applications and services alive. Remember that DDoS response plan we mentioned?

This is the kind of thing that should be in it, then these decisions aren't being taken on the fly and under time pressure. There's no point allowing equal access to high-value applications, whitelist your most trusted partners and remote employees using VPN to ensure they get priority.

Multi-vector DDoS protection

Multi-vector attacks, such as when a DDoS attack is used to hide a data exfiltration attempt, are notoriously difficult to defend against. It's all too easy to say that you must prioritise data protection, but the smokescreen DDoS remains a very real attack on your business.

The motivation behind a DDoS is irrelevant, they should all be dealt with using layered DDoS defences. These should include the use of a CDN to deal with volumetric attacks, with web application firewalls and gateway appliances dealing with the rest. A dedicated DDoS defence specialist will be able to advise on the best mix for you.

DDoS mitigation services

For businesses particularly susceptible to DDoS attacks, for example, enterprises and larger organisations, investing in mitigation services, or at the very least assessing available options, may be worth your time.

Cloudflare offers perhaps one of the most well-known such services, offering DDoS protection for several high-profile organisations including WikiLeaks, as well as having worked to mitigate many high-profile attacks. The WireX botnet and the Spamhaus attack of 2013 serve as the best examples.

There are many alternatives in the field of DDoS protection services, and many network and application delivery optimisation firms also offer mitigation against DDoS attacks. The WireX botnet, for example, was taken down as a result of a collaboration between several companies, including Cloudflare, but also RiskIQ, Flashpoint, Team Cymru, and Google.

Other companies that fall into the camp include Akami, NETSCOUT Arbor, F5 Networks, Imperva, and Verisign. This is alongside many other options that perhaps don’t have the profile of the aforementioned group, including Neustar, DOSarrest, and ThousandEyes.

A handful of these providers also offer emergency coverage, as it’s known, which can be purchased when a DDoS attack is already in progress, to protect the business and its services against the worst elements of the wave. Others, meanwhile, require a longer-term contract when arranging mitigation for such attacks.

For businesses or organisations using other products from these companies may also want to seek out adding DDoS protection to the overall package. For those using another network optimisation company, alternatively, besides those listed, it would be worth examining what DDoS protection options are on offer, and how much it would cost. ISPs may also offer some form of DDoS mitigation, especially in the form of emergency cover, but this may or may not be as comprehensive as some of the options provided by specialist companies.

The former chief information officer (CIO) of embattled firm Equifax has been sentenced to four months in prison and handed a substantial fine for insider trading following the company's data breach disaster.

Jun Ying, 44, was found guilty of selling $950,000 worth of company shares in March after learning that Equifax had sustained a data breach in 2017, according to the US Attorney's Office for the Northern District of Georgia.

This amounted to illicit trading because Ying managed to avoid losses of $117,000 through the sale, before the data breach news became known to investors, or entered the public domain.

Alongside a four-month prison sentence, the ex-CIO was last week ordered to pay restitution amounting to $117,117.61, as well as a $55,000 fine.

"Ying thought of his own financial gain before the millions of people exposed in this data breach even knew they were victims," said US Attorney Byung J Pak.

"He abused the trust placed in him and the senior position he held to profit from inside information."

The former company executive texted a colleague on 25 August that the breach "sounds bad" and that the company itself may have been the victim.

The following week, Ying made internet searches to learn about the impact of Experian's data breach on the firm's stock price. He then exercised his stock options to receive 6,815 shares of Equifax stock, which he then sold immediately.

Equifax hadn't publicly declared the breach until 7 September in 2017, after which point the firm's stock price fell considerably.

Ying is the second Equifax employee to have been found guilty of insider trading following the data breach. Sudhakar Reddy Bonthu, a former manager at the company, pleaded guilty to insider trading last year.

13/05/19: Incident has cost the firm $1.4 billion so far

The greatest security catastrophe of modern times has cost Equifax more than a billion dollars to date, according to the firm's latest financial results.

The 2017 data breach incident saw the US-based credit rating agency expose more than 145 million people's personal records to hackers due to flaws in its systems. The breach was sizeable, but deemed highly alarming due to the nature of the information stolen; ranging from full names and addresses to credit card information.

Equifax has now revealed that costs relating to the incident, as well as expenditure on IT and data security, have reached $1.35 billion, excluding a raft of legal fees for lawsuits that are yet to be seen.

This stands at more than 350 times the average cost relating to a data breach, according to IBM research released last year, which found that these costs normally average $3.86 million for a large breach. Even for US-based breaches, which cost $7.91 million on average, Equifax's costs are 170 times greater.

For the first quarter of 2019 alone the company incurred $786.8 million dollars in costs, including $690 million in legal expenditure. The total sum also included $82.8 million for technology and data security, $12.5 million for legal and investigative fees, and $1.5 million for product liability.

The company's chief executive Mark Begor told investors in a conference call that Equifax had made progress since the 2017 breach, according to WABE. This is notably by settling legal action brought against the firm.

While costs relating to the Equifax breach are extraordinary by conventional standards, they fall short of the gargantuan $4 billion 'worst-case' figure once tied with the 2011 Epsilon breach.

This sum was determined by research into the incident at the time, which suggested the estimated total damage could hit between $3 to $4 billion over time, when forensic audits, monitoring, litigation and lost business were taken into account.

20/09/18: Equifax hit with maximum 500,000 fine after a massive security breach

The Information Commissioner's Office (ICO) has fined Equifax 500,000 for failing to protect millions of UK citizens' personal data during a cyber attack last year.

Contact information, email addresses and credit card information of 15 million UK Equifax customers were compromised in a massive hack on its US parent company, Equifax Inc, between 13 May and 30 July 2017.

Although systems in the US were targeted, the ICO found the credit agency's UK arm failed to take appropriate steps to ensure its parent firm, which processed this data on its behalf, had protected the information.

"The loss of personal information, particularly where there is the potential for financial fraud, is not only upsetting to customers, it undermines consumer trust in digital commerce," said Information Commissioner Elizabeth Denham.

"This is compounded when the company is a global firm whose business relies on personal data. We are determined to look after UK citizens' information wherever it is held.

"Equifax Ltd has received the highest fine possible under the 1998 legislation because of the number of victims, the type of data at risk and because it has no excuse for failing to adhere to its own policies and controls as well as the law."

The hack led to the theft of 146 million customers' data from around the world. Although the vast majority of the 15 million UK users affected only had their contact information stolen, it is thought 30,000 also lost their email addresses, and a further 15,000 had partial credit card information stolen.

Equifax received the ICO's Monetary Penalty Notice on Wednesday, and are considering the points made in the document, a spokesperson confirmed. It also once again apologised for the incident.

"Equifax has cooperated fully with the ICO throughout its investigation, and we are disappointed in the findings and the penalty," a spokesperson from its UK arm said.

"As the ICO makes clear in its report, Equifax has successfully implemented a broad range of measures to prevent the recurrence of such criminal incidents and it acknowledges the strengthened procedures which are now in effect.

"Data security and combatting criminal digital activity is an ongoing battle for all organisations that requires continued innovation and attention. We have acted and continue to act to make things right for consumers. They will always be our priority."

The 500,000 fine is the culmination of up to a year's long investigation the ICO has been conducting in tandem with the Financial Conduct Authority (FCA).

It has been adjudicated under the Data Protection Act 1998 (DPA), as opposed to the EU's General Data Protection Regulation (GDPR), since the cyber attack occurred before the new laws came into force on 25 May.

The joint probe revealed multiple failures at the credit agency, including that data was retained longer than necessary, and that personal information was vulnerable to unauthorized access.

Investigators also found significant problems with data retention, IT system patching, and its auditing procedures. The US Department of Homeland Security, moreover, had warned its parent firm about a critical vulnerability as far back as March 2017. Steps to address this vulnerability were not taken, and a user-facing portal was not appropriately patched.

"Many of the people affected would not have been aware the company held their data; learning about the cyber attack would have been unexpected and is likely to have caused particular distress," Ms Denham added.

"Multinational data companies like Equifax must understand what personal data they hold and take robust steps to protect it. Their boards need to ensure that internal controls and systems work effectively to meet legal requirements and customers' expectations.

Denham added that Equifax showed "serious disregard" for their customers and the personal information that it held.

This massive penalty follows the ICO's intent to fine Facebook 500,000 in light of the Cambridge Analytica scandal, with notice issued in July.

However, an ICO spokesperson confirmed the regulator has yet to issue the fine itself, having until January to do so. This means Equifax Ltd becomes the first company to be fined the maximum permitted under the DPA.

Telecoms firm TalkTalk was fined 400,000 in 2016 for a data breach involving over 150,000 customers, and then 100,000 after the discovery of a second hack that occurred earlier in 2014, and therefore collectively has faced similar financial penalties.

Although GDPR has been in force for nearly four months, the ICO has yet to conclude any of its ongoing investigations into breaches of the new legislation.

This includes the breach on Ticketmaster's systems in late June, which could be a litmus test for how the ICO will regulate organisations under GDPR. British Airways could potentially face a 500 million fine, though this would be the maximum.

While the maximum fine under the DPA 1998 is 500,000, breaches of GDPR could see organisations hit with a penalty of up to 17 million, or 4% of an organisation's annual turnover, whichever is higher.

13/02/18: Equifax admits even more data stolen than previously thought

Equifax has admitted that the hack on its systems in late 2017 was far worse than previously thought and that criminals were able to steal sensitive personal information on 145 million customers in the US, UK and Canada.

The international credit agency previously said that hackers were able to access names, addresses, dates of birth and credit score data from user accounts during the breach, as well as financial information and driver licences in some instances.

Although the vast majority of the 15 million UK users affected had only their contact information stolen, it was thought that 30,000 also had their email addresses leaked, and around 15,000 had partial credit card information stolen.

However, it's now emerged that hackers were also able to access US taxpayer ID numbers and their associated email addresses and phone numbers, according to documents disclosed by Equifax to the US Senate Banking committee, seen by the Associated Press.

The documents, provided by Senator Elizabeth Warren's office, also revealed that finer details, such as credit card expiry dates and issuing states for driving licences associated with the taxpayer records had also been leaked.

Equifax spokeswoman Meredith Griffanti said that "in no way did we intend to mislead consumers", and that the company wished only to "act with the greatest clarity" when it decided to disclose only those details relating to the greatest number of users.

She added that the document provided detailed every potential data type that may have been accessed by criminals, but that as a whole they affected a relatively small proportion of users.

"When you are making that kind of announcement, where do you draw the line? If you saw the list we provided the banking finance committee it was pretty exhaustive," said Griffanti, speaking to the Associated Press. "We wanted to show them that no stone was left unturned."

However, this will likely be seen as yet another example of the company trying to mitigate the fallout from a catastrophic data breach. Equifax was first criticised for waiting months before disclosing the hack to the public, and then again when it repeatedly revised up the number of those affected and the types of data potentially lost.

In October the UK Treasury Committee called the company to answer questions relating to its failure to patch a well known Apache Struts flaw, which was thought to have created a hole in its security systems. This was shortly followed by the news that the Financial Conduct Authority would be investigating the hack, including Equifax's subsequent handling of it.

Outside of regulatory investigations, the company also faces hundreds of lawsuits brought by customers, and is thought to have set aside almost $90 million to deal with the fallout.

13/11/2017: Hack costs Equifax $87.5 million, as income plummets

Equifax's data breach has cost the company $87.5 million, its latest financial results reveal.

The credit monitoring agency's failure to patch a server flaw over summer resulted in hackers potentially stealing 143 million US citizens' data, and that of 700,000 Brits.

It's set aside $87.5 million ($59.3 million net of tax) to deal with the fallout from the hack, recording the expense in its July-September financial quarter.

Releasing its results for the quarter last week, Equifax revealed that its operating income fell by 28% year-on-year to $152.9 million as a result of the financial hit.

However, it could get even worse, with the firm admitting the total cost of the hack could hit $110 million.

Of the money it's set aside, $55.5 million accounts for the cost of providing hack victims with a free credit file monitoring and identity theft protection service, with a further $17.1 million spent on professional services. Customer support is costing Equifax $14.9 million.

The results update read: "We have incurred $4.7 million through September 30, 2017 [due to the breach] and have estimated a range of additional costs between $56 million and $110 million.

"We have recorded a liability for the low end in the range as we do not believe that any amount within the range is a better estimate than any other amount."

Hack victims who haven't signed up for Equifax's free credit file monitoring and identity theft protection service have until 31 January 2018 to do so.

26/10/2017: Credit agency says victims can still sue, despite rule change

Equifax has denied customers affected by the hack that saw the personal details of millions taken by cyber criminals will be unable to sue the company.

It had been speculated that those affected would be prevented from suing the company, after the US Senate yesterday repealed a law that prohibited "covered providers of certain consumer financial products and services from using an agreement with a consumer that provides for arbitration of any future dispute between the parties to bar the consumer from filing or participating in a class action concerning the covered consumer financial product or service".

Equifax, however, is standing by earlier statements that customers will be able to file a lawsuit if they wish.

In a statement, the company told IT Pro: "Enrolling in the free credit file monitoring and identity theft protection products that we are offering as part of this cyber security incident does not prohibit customers from taking legal action. The congressional action overturning the CFPB's rule does not change our position."

The mention of the free credit file monitoring and identity theft protection products is significant in itself. When these initiatives were first launched, there was a clause in the terms of use that it appeared would have prevented customers for suing the company for the breach. Following public outcry, however, the company clarified that the stipulation referred only to these products, not to the breach itself.

Over 140 million consumers globally were affected by the hack, which took place between May and July 2017, but wasn't discovered until 29 July. No public announcement was made until mid-September.

25/10/2017: Hack victims may not be able to sue Equifax

The US Senate voted early this morning to remove a federal rule that would have allowed people affected by the Equifax hack to sue the company.

A 50/50 tie-break in the Senate was broken by vice-president Mike Pence casting a deciding vote in favour of the joint resolution to get rid of the rule, TechCrunch reported.

The rule in question stops financial services companies that bind their users by arbitration agreements from preventing them from suing as a class.

It was entered into the Federal Register in July by the Bureau of Consumer Financial Protection, with the joint resolution to nullify it - H.J Res.111 - submitted the next day.

The rule says: "The final rule prohibits covered providers of certain consumer financial products and services from using an agreement with a consumer that provides for arbitration of any future dispute between the parties to bar the consumer from filing or participating in a class action concerning the covered consumer financial product or service."

Equifax pointed customers affected by its huge data breach to sign up to its TrustedID Premier service in the aftermath of the hack. TrustedID offers identify theft insurance and scans the web to see if customers' social security numbers have been used illegally.

Initially, the terms of service of TrustedID made clear that signing up to use it prevented users from suing the company and ensured any disputes it had would need to be resolved through arbitration.

Equifax then removed the arbitration clause last month, and said in an FAQ that neither the TrustedID terms of use nor Equifax's own terms of use would prevent people from taking legal action.

It still reads: ''We will not apply any arbitration clause or class action waiver against consumers for claims related to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself''.

From Equifax's TrustedID Premier FAQ

Despite this, it remains unclear what users have signed up for and whether the striking of this federal rule will affect them.

IT Pro has asked Equifax whether people will still be able to use TrustedID Premier, and Equifax's credit monitoring services, and be able to sue it over its cyber security breach, if the rule is nullified.

All that is needed for the rule to be thrown out is for the joint resolution to be signed by president Donald Trump.

24/10/2017: FCA opens investigation into Equifax hack

The Financial Conduct Authority (FCA) has confirmed it's investigating the Equifax hack in which the details of 700,000 Brits were leaked.

The financial watchdog said it was confirming the investigation "given the public interest in these matters."

"The FCA announces today that it is investigating the circumstances surrounding a cybersecurity incident that led to the loss of UK customer data held by Equifax Ltd on the servers of its US parent," the watchdog said, giving no other detail on the inquiry.

In a statement, Equifax said it looked forward to the results of the investigation. "We welcome this opportunity to learn the lessons from this criminal cyber attack in order for all businesses to better protect consumers in the future," it said. "Cybercrime is a real and ever-present risk faced by all companies, so it is important that government, regulators and businesses work together to combat this growing threat. We see today's announcement as a continuation of that process."

As many as 143 million Americans were affected by the data breach, alongside 700,000 in the UK, but Equifax took months to notify victims. Leaked details included phone numbers, driving licence numbers, usernames and passwords, and emails.

13/10/2017: UK Treasury Committee chair demands answers from Equifax over data leak

Equifax could potentially face political backlash over its handling of its recent data leak, as the chairman of the House of Commons has now demanded answers as to why it took so long for UK customers to be alerted.

The head of the treasury select committee, Nicky Morgan, has written a letter to the credit agency's European chief Patricio Remon asking for the full scope of the data breach, and what compensation will be provided to those affected. A letter has also been sent to the Financial Conduct Authority (FCA) to see whether the watchdog plans to move against the UK arm of Equifax.

The company revealed on 7 September that a data breach on its systems in mid-May had resulted in the leak of 143 million data records, later revised up to 145 million. The hack, which was thought to have affected mainly the US systems, was blamed on the company failing to apply an Apache Struts patch, which was known to have been vulnerable.

The company also initially said that 400,000 UK customers had been indirectly affected by the breach, but that no financial details had been accessed.

However, on Tuesday Equifax made yet another revision, admitting that a file containing data on 15.2 million UK records was accessed during a data breach in May, giving access to names and contact details, and of that figure almost 700,000 accounts had had partial credit information and email addresses stolen.

"Equifax has taken too long to notify those affected by its widespread cyber-security breach," said Morgan. "People have been left in the dark for too long, which has increased the risk that they fall victim to identity theft and fraud."

She added that the Treasury Committee will "consider taking public evidence from Equifax, particularly if it does not receive a full and timely response to these questions".

Equifax is facing mounting pressure from both customers and lawmakers to explain why customers are only hearing about the data leak now, and why the company continues to botch its handling of the situation weeks after going public.

Part of the investigations will look into Equifax's handling of its customer help website, which was forced offline this week over concerns it contained malware. An independent security analyst discovered that customers were being asked to download outdated versions of flash player, according to Ars Technica, although Equifax said its systems "were not compromised and that the reported issue did not affect our customer online dispute portal".

The company also used the website 'equifaxsecurity2017.com' as its official breach handling portal, which understandably drew complaints that it looked like a phishing site, and customers complained that its site designed to inform users if their data had been leaked was returning false results.

Political movements in the US are seeking to clamp down on credit agencies in the wake of the industry's largest ever data breach. Democratic senator Elizabeth Warren said last week that "Equifax and this whole industry, should be completely transformed", the Financial Times reports, and that the Equifax data breach, which affected almost half of the American adult population, is evidence of a disregard for the security of customers.

It's likely that Equifax will be asked to appear before a UK committee, although there are no specific demands in place. Equifax's US boss Rick Smith, who stepped down in the wake of the data breach, was asked explain himself in front of a US house committee last week.

11/10/2017: Nearly 700,000 Brits affected by Equifax breach

Nearly 700,000 UK citizens were badly affected by Equifax's data breach, the credit monitoring agency admitted yesterday, revising its initial figure of 400,000.

A huge data set of 15 million UK credentials was also attacked during the raid between May and July, though once Equifax analysed the data it found only 694,000 UK customers who it needed to contact - many of the remaining records consisted of spurious fields and duplicated entries, though others contained names and dates of birth.

"Whilst this does not introduce any significant risk to these people Equifax is sorry that this data may have been accessed," the company said in a statement.

The 694,000 Equifax is now writing to had various data leaked - the vast majority had their phone numbers leaked, 30,000 had their email addresses breached, and 15,000 had their login details and partial credit card details from 2014 leaked, despite earlier statements saying that UK financial data had not been accessed.

Equifax alerted the UK's National Cyber Security Centre, which has put out an advisory statement to affected customers.

"Equifax has today confirmed that a file containing 15.2m UK records dating from between 2011 and 2016 was attacked in the cyber incident that took place in May 2017," A NCSC statement said on Tuesday.

"If you have been told by Equifax that security details from your Equifax.co.uk membership account - such as password and secret questions - have been accessed, you should ensure those details are not used on any other accounts."

Equifax reported in September that it had been the victim of a major data breach between May and July this year, in which 143 million US customers were thought to have been affected, and an undisclosed number of UK and Canadian customers. That figure has since risen to 145.5 million, and recent reports have suggested that as many as 11 million US driver's licenses were leaked during the raid.

It was later found that hackers were able to exploit a months-old flaw in the application framework Apache Struts, which had a patch available, though Equifax failed to apply it. Social security numbers, dates of birth, addresses, credit card details and security information were all thought to have been compromised during the breach.

The NCSC believes the greatest risk will come from subsequent phishing campaigns using leaked personal data. Customers have been warned that given the nature of the data leak, fraudsters will likely use real names in the emails to make the phishing attacks look more genuine.

"The NCSC, with Equifax and partners including the NCA, ICO and FCA, continues to examine this incident and should further information come to light about the extent and nature of the impact on the UK, we will provide further updates and advice as soon as we can," a spokesperson said.

Patricio Remon, president for Europe at Equifax's UK unit, said: "Once again, I would like to extend my most sincere apologies to anyone who has been concerned about or impacted by this criminal act. Let me take this opportunity to emphasise that protecting the data of our consumers and clients is always our top priority."

"It has been regrettable that we have not been able to contact consumers who may have been impacted until now, but it would not have been appropriate for us to do so until the full facts of this complex attack were known, and the full forensics investigation was completed."

Main image credit: Bigstock

03/10/2017: Equifax's systems were vulnerable since March

Equifax's systems have been vulnerable since March, though hackers didn't take advantage of the flaws until May.

Former Equifax CEO Richard Smith stated in a written testimony that the data breach occurred as a result of both human error and technology failures, according to a report from Reuters.

Additionally, Equifax announced that an extra 2.5 million US consumers may have been affected by the data breach, taking the total number up to 145.5 million.

The investigation into how UK consumers have been affected by the breach has been completed and the information is now being analysed by the firm.

Smith's testimony is scheduled to be shared with Congress today. It outlines how on 15 March the company's information security department carried out scans to identify any vulnerabilities in the system, but these failed to do so.

"The vulnerability remained in an Equifax web application much longer than it should have," Smith said. "It was this unpatched vulnerability that allowed hackers to access personal identifying information."

Smith added that the first date he believes hackers accessed private information may have been on May 13. He wrote: "between May 13 and July 30, there is evidence to suggest that the attacker(s) continued to access sensitive information."

Security personnel noticed suspicious activity on 29 July and ended the hacking on 30 July by disabling the web application. Smith said he was alerted the day after but did not realise the extent of the stolen data.

Equifax told the FBI on 2 August and retained a law firm and consulting firm as advisors. Smith told the board's lead director on 22 August.

Smith will testify at three different congressional hearings this week.

Furthermore, an extra 2.5 million US consumers have been identified as potentially being affected by the hack following the completion of a forensic investigation carried out by cybersecurity firm Mandiant. The firm said it hadn't identified any additional or new attacker activity within Equifax's systems too.

Equifax highlighted that the review determined that there is no evidence the attackers accessed databases located outside of the US.

"I want to apologise again to all impacted consumers. As this important phase of our work is now completed, we continue to take numerous steps to review and enhance our cybersecurity practices. We also continue to work closely with our internal team and outside advisors to implement and accelerate long-term security improvements," said interim CEO Paulino do Rego Barros.

Equifax CEO Smith announced his retirement last week, following the data breach in which up to 400,000 UK citizens' personal details and millions of US customers' information was revealed.

Smith was the third executive to leave the company after the breach, as the CIO and CSO also retired after it emerged that the company had failed to protect its customers sufficiently.

27/09/2017: Equifax CEO 'retires' in data breach aftermath

Equifax CEO Richard Smith has announced his retirement, following a serious data breach that revealed up to 400,000 UK citizens' personal information and millions of US customers' details.

Smith is the third executive to leave the credit monitoring agency after the CIO and CSO also officially retired following the revelations the company failed to protect its customers sufficiently.

"Serving as CEO of Equifax has been an honour, and I'm indebted to the 10,000 Equifax employees who have dedicated their lives to making this a better company," Smith said in his departing statement.

"The cyber security incident has affected millions of consumers, and I have been completely dedicated to making this right. At this critical juncture, I believe it is in the best interests of the company to have new leadership to move the company forward."

Board member Mark Feidler will become non-executive chairman, while Paulino do Rego Barros Jr, who most recently served as president of the company's Asia Pacific region, has been appointed as interim chief executive officer, while the company fills the three roles for the long term.

"The board remains deeply concerned about and totally focused on the cybersecurity incident," Feidler said. "We are working intensely to support consumers and make the necessary changes to minimise the risk that something like this happens again.

"Speaking for everyone on the board, I sincerely apologise. We have formed a special committee of the board to focus on the issues arising from the incident and to ensure that all appropriate actions are taken."

20/09/2017: Equifax admits it suffered an earlier leak in March

Credit agency Equifax, which lost 143 million customer data records through a data breach in May, has said it suffered a similar leak back in March, casting doubt over whether executives were entirely ignorant of the incidents when selling company shares.

The company were spurred to admit the earlier breach after sources familiar with the leaks had passed information over to Bloomberg, stating that the widely reported data leak in May was in fact a second breach.

Equifax reportedly hired a security team to investigate the leak and informed its customers, but chose not to inform the individuals it held data on because they were technically not customers of the company.

"Earlier this year, during the 2016 tax season, Equifax experienced a security incident involving a payroll-related service," the company said in a later statement to Gizmodo. "The incident was reported to customers, affected individuals and regulators. This incident was also covered in the media,"

"The March event reported by Bloomberg is not related to the criminal hacking that was discovered on 29 July. The criminal hacking that was discovered on 29 July did not affect the customer databases hosted by the Equifax business unit that was the subject of the March event."

Despite the claim the two leaks were unrelated, sources speaking to Bloomberg believe there is evidence to suggest the hacks were carried out by the same individual or group.

Equifax reportedly informed five organisations affected by the breach in March and admitted the incident in a letter to the New Hampshire attorney general. However, the company is facing mounting backlash for its handling of its second breach in May, as those affected were informed four months after its investigation concluded.

During that time, Equifax executives were able to sell off their stocks in the company, activity that is now being investigated by the US Justice Department as there is suspicion that insider trading was taking place. Although the company has maintained that its executives were unaware of May's data breach, the existence of an earlier incident casts doubt over how ignorant they were.

One report by ThinkAdvisor claims CFO John Gamble, president of US information solutions Joseph Loughran, and president of workforce solutions Rodolfo Ploder, are all currently under investigation. The three are thought to have sold off shares valued almost $1.8 million in early August, one month before the breach was made public.

Shares in the company plummeted by 17% following the news of the breach, wiping almost $3 billion off the value of the company. Equifax announced on Friday that both its CIO and CSO would be immediately leaving the company as a result of the breach.

18/09/2017: Equifax data breach: 400,000 UK customers' data at risk in Equifax hack

Up to 400,000 Brits' data has been leaked in the Equifax hack, the credit monitoring agency has finally revealed.

Data including names, dates of birth, email addresses and telephone numbers "may potentially have been accessed" by hackers who also stole 143 million US consumers' personal data, Equifax said.

The company added that home addresses, passwords and financial data were not included in the UK breach, which occurred as a result of a "process failure" that saw some UK data stored on US servers between 2011 and 2016.

Equifax said its UK systems were not affected by the data breach, which was the result of an Apache Struts flaw the company left unpatched.

Patricio Remon, president at Equifax, said: "We apologise for this failure to protect UK consumer data. Our immediate focus is to support those affected by this incident and to ensure we make all of the necessary improvements and investments to strengthen our security and processes going forward."

UK businesses' data was not included in the breach, though Equifax has only confirmed this is the case 10 days after publicly announcing the breach, which it discovered way back in late July.

A spokesman for the UK's data watchdog, the Information Commissioner's Office (ICO), said: "The ICO has been pressing the firm to establish the scale of any impact on UK citizens and has also been engaging with relevant US and UK agencies about the nature of the data breach.

"It can take some time to understand the true impact of incidents like this, and we continue to investigate. Members of the public should remain vigilant of any unsolicited emails, texts or calls, even if it appears to be from a company they are familiar with. We also advise that people review their financial statements regularly for any unfamiliar activity.

"If any financial details appear to have been compromised, victims should immediately notify their bank or card company. If anyone thinks they may have been a victim of a cyber crime they should contact Action Fraud."

Equifax believes identity theft is unlikely based on the leaked data, but will write to the affected customers to offer them a free identity protection service that monitors their personal data, including credit card details, and alerts them to possible fraud.

The news came alongside Equifax's announcement last Friday that both its CIO and chief security officer (CSO) are "retiring".

In their place, Mark Rohrwasser will serve as interim CIO effective immediately after leading the firm's international IT operations since last year, and vice-president of IT, Russ Ayres, has been appointed CSO, reporting to Rohrwasser.

The company said: "Equifax's internal investigation of this incident is still ongoing and the company continues to work closely with the FBI in its investigation."

14/09/2017: Equifax hackers used a months-old Apache Struts flaw

The massive hack on credit monitoring agency Equifax was carried out using an Apache Struts flaw that was first revealed in March, the company has admitted.

The huge cyber attack resulted in the theft of social security numbers, names, dates of birth and other personal data from 143 million US residents, and more than 200,000 credit card numbers. Equifax still hasn't revealed how many UK customers were affected.

But the company yesterday admitted that it was indeed a flaw in Apache's development framework Struts that had led to the attack.

In an updated statement, it said: "We know that criminals exploited a U.S. website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement."

The hack was carried out in mid-May, according to Equifax, well over a month after the flaw was disclosed and a patch issued. The vulnerability was categorised as 'critical', allowing remote code execution with no privileges and little technical knowledge to carry out.

An Apache Struts flaw was also pointed to as the cause of the breach shortly after it was announced. Quartz initially identified the vulnerability as CVE-2017-9805, which was disclosed earlier in September, although this turned out to be incorrect.

The Apache Foundation has said that the breach was a result of Equifax's inability to patch its systems, rather than flaws in its software.

"This vulnerability was patched on 7 March 2017, the same day it was announced," the Foundation's blog post read. "In conclusion, the Equifax data compromise was due to their failure to install the security updates provided in a timely manner."

The revelation comes as evidence of lax cyber security protocols emerges. Security expert Brian Krebs discovered that corporate tools used by Equifax's Argentinian arm used 'admin' as the default username and password, giving him access to the national identity numbers of thousands of Argentinians.

The company has stated that this was completely unrelated to the incident in the US and that no customers have been affected. It has also taken action to address the problem, it said.

Equifax's response to the attack has led to criticism from all sides. Its cyber security practices are unsurprisingly coming under scrutiny, and US senators are also calling for investigations of the company executives who offloaded their stocks following the breach's discovery.

The data obtained in the breach is hugely valuable for thieves. Not only can it be leveraged for widespread identity theft, but cyber security firm Intsights has calculated that the database itself could fetch upwards of $32 million on dark web black markets.

13/09/2017: Chatbot helps users sue Equifax for data breach

A chatbot originally developed to help people appeal against parking and speeding fines has been re-purposed to help customers affected by the Equifax data breach sue the company.

DoNotPay, which was created by a British student studying at Stanford University, has been programmed to automatically file claims against the credit checking company, which suffered a breach leaking the details of up to 143 million US customers.

Data from UK customers were also stolen, although the company hasn't revealed how many.

The bot works by asking those it thinks are affected various questions it has developed for the case, changing them according to previous answers and how severely the person was impacted. It then provides the documents the user needs to make a claim formally.

The bot has so far helped 375,000 people claim against parking tickets, although developer Joshua Browder hasn't revealed how many Equifax customers have used it yet.

"We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations," said Richard Smith, Equifax chairman and chief executive, when the breach was revealed.

All those that think they were affected by the breach have been encouraged to check online and if they have, Equifax is offering them access to its credit and identity theft monitoring tools for free. Security experts have warned against using these due to waivers people must agree to that would prevent them from taking legal action, though Equifax has claimed these waivers don't apply to the cybersecurity incident.

DoNotPay has been used for a number of other small claims cases, including helping asylum seekers with their immigration applications to gain entry to the US and receive financial support fro the state.

11/09/2017: Equifax's data breach response draws experts' ire

Security experts have slammed Equifax for its actions in the wake of a cyber attack that has hit upwards of 143 million customers.

The credit check agency was hacked in May, then discovered the breach on 29 July, but only revealed it to customers last week (see below), blaming a "US website application vulnerability" without going into any greater detail.

Customers' social security numbers, driving license numbers, dates of birth and addresses have all been stolen, while some customers lost credit card numbers and other personally identifiable information.

An information page for US users requires them to enter their name and last six digits of their social security numbers to determine if their social security number has been stolen, but nothing exists for UK users yet.

Free threat protection and credit monitoring services offered by Equifax include clauses that prevent consumers from suing Equifax or joining class action lawsuits. However, Equifax said these waivers don't apply to this cybersecurity incident.

Nevertheless, Jeff Pollard, principal analyst at research firm Forrester, warned affected customers against using these services.

He added: "We need more information from Equifax other than 'your information was or possibly was accessed'.

"What's even more concerning about this longer term is that Equifax is a major data aggregator, broker, and analytics firm. Given that we don't know the extent of the information breached, it's likely this reaches further into data that Equifax transforms as part of its marketing and analytic services.

"What kind of data did Equifax have, what did they do with it, and what is now in the adversaries' hands? How much do they know about us [and how much of this] is based on these analytics services?"

A class-action lawsuit has already been filed in Portland, Oregon, according to Cyberscoop, warning that costs resulting from the suit could hit $68.6 billion.

Meanwhile, Twitter users have criticised the effectiveness of a call centre deployed by Equifax to handle customer queries. Callers were put on hold or disconnected reports the Guardian. One user who was disconnected nine times eventually got through, only to be referred to a general information website.

Equifax said it has tripled its customer service agents to 2,000 and is continuing to add more.

Did an Apache Struts bug allow Equifax to be hacked?

The root cause of the hack remains unclear, but Quartz claimed last week that it was related to a bug in Apache Struts, a Java-building framework. This flaw, dubbed CVE-2017-9805, was reported publicly last week after being patched in July, and security researchers found it allowed hackers to remotely execute code on businesses' networks.

With Equifax having been hacked in May, the Apache Software Foundation issued a rebuttal of the claim over the weekend, saying the breach referred to by Quartz was identified and patched in July, meaning hackers must have either used an earlier reported flaw on an unpatched Equifax server or discovered a zero-day exploit.

"At this point in time it is not clear which Struts vulnerability would have been utilized if any," said Ren Gielen, VP for Apache Struts.

Quartz has since updated its article to claim the bug may have been one reported back in March, rather than September.

08/09/2017: Credit agency Equifax hit by major data breach

Credit check agency Equifax has fallen victim to a major data breach, which has affected 143 million customers in the US and an undisclosed number in the UK and Canada.

The attack took place between mid-May and July, according to a statement, with the company discovering the breach on 29 July. A public statement has only just been made, however.

According to the company, the intrusion was made via "a US website application vulnerability to gain access to certain files".

"The company has found no evidence of unauthorized activity on Equifax's core consumer or commercial credit reporting databases," the organisation said.

That doesn't mean the breach is insignificant, though, with information on US customers including social security numbers, dates of birth, addresses and driver's license numbers all being stolen. Additionally, some 209,000 customers had their credit card numbers stolen and 182,000 had dispute documents with personally identifiable information accessed.

It's unclear at this time whether or not the information taken was encrypted or not, nor who the perpetrators may be.

IT Pro has contacted Equifax in the UK to find out how many customers are affected and the nature of the breach here, as well as to clarify the encryption question, but hadn't received a response at the time of publication.

The Information Commissioner's Office takes a hard line on data breaches but it nevertheless willing to lend its aid.

"Reports of a significant data loss at US-based Equifax and the potential impact on some UK citizens gives us cause for concern. We are already in direct contact with Equifax to establish the facts including how many people in the UK have been affected and what kind of personal data may have been compromised," said ICO Deputy Commissioner James Dipple-Johnstone.

"We will be advising Equifax to alert affected UK customers at the earliest opportunity.

"In cyber attack cases that cross borders the ICO is committed to working with relevant overseas authorities on behalf of UK citizens."

The company has set up a dedicated website, www.equifaxsecurity2017.com for US customers to find out if they've been affected by the hack.

For UK customers, there's currently no site or specific advice available from the agency.

Security analyst Graham Cluley told IT Pro: "This isn't a case of 'change your passwords'. You don't have the option of changing your name, date of birth, social security number and other personal information.

"The cruel irony of millions of identities being stolen from an organisation that offers identity theft monitoring isn't lost on anyone. This will be very hard for Equifax to live down."

He added: "My advice for companies who don't want to find themselves in similar hot water is to 'hack themselves before someone hacks you'. Find the weaknesses and vulnerabilities by conducting your own penetration tests, as it may protect your company prevent you putting others at risk."

Quocirca analyst Clive Longbottom largely agreed with Cluley's sentiments.

"This is a real bad one for Equifax. The PII that has leaked includes social security numbers, addresses, names and so on the sort of information that forms the basis for criminals to create a false identity.

"If it also includes the rest of a person's Equifax data banks, loans, credit card details, for example, then it puts the people concerned in a very bad place," he told IT Pro. "This is not a username/password issue: there is not much that an individual can do on this."

"To leave a month and a bit between finding out and disclosure is pretty unforgivable in this case," he added.

In his analysis of the hack, security researcher Brian Krebs said: "That the intruders were able to access such a large amount of sensitive consumer data via a vulnerability in the company's Web site suggests Equifax may have fallen behind in applying security updates to its Internet-facing Web applications.

"Although the attackers could have exploited an unknown flaw in those applications, I would fully expect Equifax to highlight this fact if it were true if for no other reason than doing so might make them less culpable and appear as though this was a crime which could have been perpetrated against any company running said Web applications."

He also pointed out that the company was until very recently looking for a vice president of cybersecurity a role equivalent to a CISO according to Equifax and suggested this may have been a contributing factor to web applications potentially being left unpatched.

Main image credit: Bigstock

Almost one in three CEOs have had their usernames and passwords leaked as part of a data breach, new figures have shown.

Infosec company F-Secure analysed the known email addresses of more than 200 CEOs from top businesses across ten countries, comparing these details to leaked spam lists and account databases distributed by hackers.

It found that 30% of CEOs had their password leaked when a service they had signed up for with their corporate account fell victim to a breach.

The biggest cause of this was professional networking service LinkedIn, which was linked to 53% of the leaked accounts F-Secure analysed. Hackers infiltrated the service back in 2012, then last year released the account details of 117 million people.

Next on the list was Dropbox, which 18% of CEOs had signed up to. F-Secure did, however, point out the caveat that someone else could have used a CEO's email address to attempt to sign up for a service.

The issue of password re-use - where people use the same login details for multiple services - means that CEOs may need to change the passwords for other services than those their email addresses were leaked by.

For instance, hackers could try CEOs' credentials leaked in the LinkedIn and Dropbox breaches to attempt to gain access to sensitive corporate information through credential re-use attacks.

"This study once again underscores the importance of proper password hygiene," said F-Secure CISO Erka Koivunen. "The CEO's credentials may have leaked even when they have done nothing wrong.

"We can assume that many of the services we've created an account in have already been compromised and the old passwords are out there on the internet, just waiting for targeted, motivated attackers to try them against other services."

In addition to this, more than 80% of CEOs were found to have had personal information - including email addresses, physical addresses, phone numbers and dates of birth - exposed via leaked marketing databases and spam lists.

In fact, less than one in five CEOs had no leaks whatsoever associated with their email address.

On the other hand, Koivunen also pointed out that signing up to services with a privately-controlled email account may not necessarily be any more secure.

"When using a private email, a personal phone number or a home address to register for a service that the CEO uses to conduct official business, the CEO effectively denies the company's IT, communications, IPR, legal, and security teams a chance to protect the credentials, monitor their misuse or attempts to compromise them and makes it nearly impossible to recover them later," he said.

"To an attacker, a CEO who uses private email to register for a service they use in an official capacity spells a loner - someone who goes it alone and doesn't bother to rely on his/her staff to provide protection."

A London-based plastic surgery clinic has been hit by hackers, potentially leaking sensitive patient data online.

The London Bridge Plastic Surgery which, despite the name, is based in Marylebone admitted it had been hit by an attack, but couldn't yet say what data had been leaked.

"We can confirm that the Clinic has been the victim of a cyber attack," the company said in a statement. "We took measures to block the attack immediately in order to protect patient information and we informed the Metropolitan Police who launched an investigation."

"Regrettably, following investigations by our IT experts and the police, we believe that our security was breached and that data has been stolen," the statement added. "We are still working to establish exactly what data has been compromised."

The clinic said it was "deeply saddened" that its security was breached, claiming it used "market leading technology" and updated systems daily.

A report on the Daily Beast identified the hackers as a group called The Dark Overlord, noting they often used extortion against their victims. The hackers claimed to have stolen terabytes of data and graphic photos of famous patients, including "royal families".

The clinic has swathes of famous patients, including Katie Price who posted on Instagram photos of her own surgery there last month, suggesting not everyone undergoing such work is necessarily embarrassed by it. However, the Daily Beast report suggested sensitive photos had been leaked and could be posted online.

Russian state-sponsored hackers stole highly classified US cyber security information from the NSA in 2015, it has been claimed.

According reports from the Wall Street Journal and Washington Post, the breach occurred when a person working in the US spy agency's "elite hacking unit" Tailored Access Operations (TAO) loaded the information onto their home computer.

TAO is the division of the NSA that "develops tools to penetrate computers overseas to gather foreign intelligence", according to the Washington Post's sources. In particular, the information taken by the person involved included hacking tools that were being developed to replace those considered compromised in the Snowden leaks.

It's currently unclear if the individual was an independent contractor, as claimed by the WSJ, or an employee, as claimed by the Washington Post, but they are unified in their claim that Kaspersky Lab antivirus software installed on the individual's computer was used as the conduit to identify and access the material.

Kaspersky Lab has hit back at the allegations, reiterating it "does not have inappropriate ties to any government, including Russia, and the only conclusion seems to be that Kaspersky Lab is caught in the middle of a geopolitical fight".

The statement also hints at what some independent security researchers had speculated that its software detected the programmes brought home by the individual and classified them as threats, uploading their signatures and other information to its database of threats.

The Washington Post claims the incident, which resulted in the person being removed from their post in November 2015, is still under investigation.

This is the latest in a series of embarrassing breaches for the NSA. While the leaks from Edward Snowden in May 2013 may be the most famous, another contractor Harold Martin was arrested last year in relation to a separate 2013 breach. Then, in 2016, hacking group Shadow Brokers stole a vast cache of hacking tools, once again linked to TAO, from the NSA and leaked them to the public.

These latest reports haven't been confirmed by the NSA, however, with the agency telling Reuters: "[We] never to comment on our affiliates or personnel issues."

The ICO has hit Nottingham County Council with a 70,000 fine for failing to safeguard its citizens' data, which led to anyone being able to view the information online.

The problem was exposed when a member of the public was able to read the data online stored in the council's Home Care Allocation System (HCAS) following a Google search. Nottingham County Council didn't implement any kind of security to stop people being able to access files, such as a login.

The data, which is thought to have been accessible for over five years, held details on whether disabled and elderly people were in hospital and included the gender, addresses, postcodes and care requirements of the individuals. The concern was that criminals could access the data and use the information to break into peoples' homes while they were away.

"This was a serious and prolonged breach of the law. For no good reason, the council overlooked the need to put robust measures in place to protect people's personal information, despite having the financial and staffing resources available," ICO Head of Enforcement Steve Eckersley said.

"Given the sensitive nature of the personal data and the vulnerability of the people involved, this was totally unacceptable and inexcusable. Organisations need to understand that they have to treat the security of data as seriously as they take the security of their premises or their finances."

The breach was first reported in June 2016, when it contained a directory of 81 service users and the data of more than 3,000 people. Not included in the data was the patients' names, although the ICO said it would be easy enough for people to find this information out from other sources if they wanted to.

A Canadian university has lost almost C$12 million after a phishing scam tricked staff into paying money into a fraudulent bank account.

Employees at MacEwan University in Alberta received emails that suggested one of its main clients was changing its banking details and that future funds should be routed to the new account.

The university said the change resulted in C$11.8 (7.5 million) being sent to the account thought to have belonged to the vendor, but realised soon after that it had been a phishing scam.

The majority of the funds has been traced to accounts in Canada and Hong Kong, according to a statement released by the university on Thursday. It added that the suspected accounts had been frozen pending civil action to recover the funds.

"There is never a good time for something like this to happen," said university spokesperson David Beharry. "But as our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident."

Personal and financial information, including any details relating to recent transactions, were unaffected by the scam and remain secure, according to the statement.

The university said it is working with the Edmonton Police Service, as well as law enforcement agencies in Montreal, Hong Kong, and security departments of the banks affected.

Although controls have now been put in place to prevent a similar incident in the future, the university said it had identified that safeguards around the changing of banking details had been inadequate, and that numerous opportunities to detect the fraud had been missed.

Research conducted last year found that almost a third of employees were still falling for phishing scams of this kind, which is particularly concerning given that only one malicious email needs to bypass detection to cause serious damage to an organisation.

The university said it is working to ensure that the incident does not impact the academic and business operations of the institute, and that further updates will be released in the coming weeks.

Photo by WinterE229 / CC BY 2.0