Medical Review Institute of America (MRIoA)

https://www.securityweek.com/mrioa-discloses-data-breach-affecting-134000-people
Exploit: Ransomware

Medical Review Institute of America (MRIoA): Medical Analytics
Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware risk is rising for organizations in every sector, especially companies that provide important services for other businesses.

 

---

 

The Metropolitan Detention Center (MDC)

https://www.techtimes.com/articles/270004/20220103/hospital-data-breach-personal-info-1-3-million-patients-staff-data-breach.htm
Exploit: Ransomware

The Metropolitan Detention Center (MDC): Prison
Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware can cause serious operational problems in unexpected places in today’s connected world.

 

---

 

Illuminate Education

https://nypost.com/2022/01/15/nyc-schools-crippled-by-illuminate-educations-data-outage/
Exploit: Hacking

Illuminate Education: Education Platform
Individual Impact: No specifics about any consumer/employee PII or financial data loss were available at press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Cybercriminals have been all over targets in the education sector including companies that serve it. Companies should use caution.

 

---

 

TransCredit

https://www.websiteplanet.com/blog/transcredit-leak-report/
Exploit: Misconfiguration

TransCredit: Credit Analysis & Reporting
Customers Impacted: Unknown

How it Could Affect Your Business: Once again, a service provider that maintains a large array of records full of PII was hit, gaining cybercriminals a data bonanza.

 

---

 

United Kingdom – Parasol Group

https://www.theregister.com/2022/01/17/umbrella_company_parasol_group_confirms/
Exploit: Hacking

Parasol Group: Business Services
Individual Impact: No information about exposed customer personal or financial data was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals are especially likely to target companies that provide time-sensitive products and services in hopes of a fast extortion payment.

 

---

 

Germany – Hensoldt

https://www.bleepingcomputer.com/news/security/global-it-services-provider-inetum-hit-by-ransomware-attack/
Exploit: Ransomware

Hensoldt: Defense Contractor
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals don’t just steal personal and financial data, they also love trade secrets, research, formulas and other proprietary data.

 

---

 

The Philippines – Commission on Elections (Comelec)

https://mb.com.ph/2022/01/10/comelec-servers-hacked-downloaded-data-may-include-information-that-could-affect-2022-elections/

Exploit: Hacking

Commission on Elections (Comelec): Government Agency
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Government agencies have become juicy targets for cybercriminals looking to score a boatload ofsensitive information fast.

 

---

 

Thailand – Siriraj Hospital

https://www.straitstimes.com/singapore/consumer/personal-data-of-og-department-store-customers-leaked
Exploit: Hacking

Siriraj Hospital: Medical Center
Customers Impacted: Unknown

How it Could Affect Your Business: Personal data is always a winner for cybercriminals who are looking to make a quick profit in the booming dark web data markets.

 

---

 
 

Why You Should Prioritize Your Technology Gaps

 
Technology is an unavoidable component of most businesses these days, helping them achieve their goals and vision. However, if you are not cautious, technological flaws could allow cybercriminals to access your network and cause harm to your company. Technology auditing is the solution to this problem.

 
A technology audit can assist you in better understanding and identifying gaps in your organization's security, compliance and backup postures. But if you don't have a background in IT, the results of a technology audit can be confusing. You may be overwhelmed by the number of items that need to be refreshed or replaced, and you may not know where to start.

 
Having a managed service provider (MSP) by your side can help you avoid these stumbling blocks. An MSP can provide you with a prioritized list of the most urgent to least urgent gaps, allowing you to decide how to proceed and allocate funds.

 

Why should you prioritize your organization’s technology gaps?

Here are some reasons why prioritizing technology gaps is critical:

1. To fix the most critical gaps immediately

 
Following an audit, you may discover hundreds of vulnerabilities, prompting the question, "Should all of these be fixed at once?"

 
To make an improvement on a major highway, you wouldn't close every lane at the same time. Instead, you would first block and repair the most damaged one during non-peak hours. The same is true for vulnerabilities, and it is always better to bridge the most critical one first.
 
Bridging all the gaps at once is rarely practical, both financially and in terms of time and effort. Furthermore, if you prioritize a lower-priority vulnerability first, cybercriminals can swoop in and exploit critical flaws in the blink of an eye.

 

2. To promote better budgetary decisions

 
Budgets, when properly planned, can serve as a tool to assist you in meeting organizational objectives.

 
Randomly allocating funds to bridge gaps will neither help defend against threats nor be a wise budgetary decision. Instead, prioritize gaps and distribute financial resources based on vulnerability severity.

 

3. To improve control over transformation and upgrade

 
Timely upgrades and associated transformation are crucial for a business to stay competitive in constantly evolving business landscapes. Even so, it is critical to maintain control over such transitions. Otherwise, it could lead to confusion and poor decisions, ultimately harming your company's growth.

 
Get a better understanding of upgrades and transformation by prioritizing gaps and systematically bridging them based on their severity.

 

4. To avoid overburdening key stakeholders

 
Tending to all gaps at once can overwhelm your employees, in turn lowering their productivity and deteriorating customer service. Avoid this to the greatest extent possible. If your customers and employees are dissatisfied, your business can suffer serious setbacks such as employee attrition, customer churn, accidental data breaches and so on.
 

Collaborate for success

 
Not sure where to start? We can help you prioritize technology gaps in order to optimize IT platforms and help you get the most out of your technology investment, all while ensuring uptime and productivity.

 
Contact us to learn how we can help your organization successfully prioritize technology gaps to achieve targeted goals in a sustainable manner.

 
 

Why You Should Prioritize Your Technology Gaps

  Technology is an unavoidable component of most businesses these days, helping them achieve their goals and vision. However, if you are not cautious, technological flaws could allow cybercriminals to access your network and cause harm to your company. Technology auditing is the solution to this problem.

  A technology audit can assist you in better understanding and identifying gaps in your organization's security, compliance and backup postures. But if you don't have a background in IT, the results of a technology audit can be confusing. You may be overwhelmed by the number of items that need to be refreshed or replaced, and you may not know where to start.

  Having a managed service provider (MSP) by your side can help you avoid these stumbling blocks. An MSP can provide you with a prioritized list of the most urgent to least urgent gaps, allowing you to decide how to proceed and allocate funds.

 

Why should you prioritize your organization’s technology gaps?

Here are some reasons why prioritizing technology gaps is critical:

1. To fix the most critical gaps immediately

  Following an audit, you may discover hundreds of vulnerabilities, prompting the question, "Should all of these be fixed at once?"

  To make an improvement on a major highway, you wouldn't close every lane at the same time. Instead, you would first block and repair the most damaged one during non-peak hours. The same is true for vulnerabilities, and it is always better to bridge the most critical one first.   Bridging all the gaps at once is rarely practical, both financially and in terms of time and effort. Furthermore, if you prioritize a lower-priority vulnerability first, cybercriminals can swoop in and exploit critical flaws in the blink of an eye.

 

2. To promote better budgetary decisions

  Budgets, when properly planned, can serve as a tool to assist you in meeting organizational objectives.

  Randomly allocating funds to bridge gaps will neither help defend against threats nor be a wise budgetary decision. Instead, prioritize gaps and distribute financial resources based on vulnerability severity.

 

3. To improve control over transformation and upgrade

  Timely upgrades and associated transformation are crucial for a business to stay competitive in constantly evolving business landscapes. Even so, it is critical to maintain control over such transitions. Otherwise, it could lead to confusion and poor decisions, ultimately harming your company's growth.

  Get a better understanding of upgrades and transformation by prioritizing gaps and systematically bridging them based on their severity.

 

4. To avoid overburdening key stakeholders

  Tending to all gaps at once can overwhelm your employees, in turn lowering their productivity and deteriorating customer service. Avoid this to the greatest extent possible. If your customers and employees are dissatisfied, your business can suffer serious setbacks such as employee attrition, customer churn, accidental data breaches and so on.  

Collaborate for success

  Not sure where to start? We can help you prioritize technology gaps in order to optimize IT platforms and help you get the most out of your technology investment, all while ensuring uptime and productivity.

  Contact us to learn how we can help your organization successfully prioritize technology gaps to achieve targeted goals in a sustainable manner.

   

All You Need to Know About Least Privilege

 
In IT, the principle of least privilege (PoLP) refers to the concept that any process, program or user must be provided with only the bare minimum privileges (access or permissions) needed to perform a function. For instance, if a user account has been created for accessing database records, it need not have admin rights. Also, a programmer responsible for updating lines of legacy code can do so without access to the company’s financial records.

 
PoLP is a cybersecurity best practice and often considered a critical step for protecting privileged access to a businesses’ high-value assets and data (including customer/employee records). Since this principle extends beyond the scope of human access, it is also applicable to systems, applications and connected devices that require certain permissions or privileges to perform a task.

 

What Least Privilege is Used For

 
Did you know that two of the most infamous data breaches on record, namely the ones at Home Depot[i] and Target[ii], occurred due to a compromise of their network credentials? In both the cases, hackers used privileged accounts to access critical business data and private records of customers. Taking cue from the breaches in the past, you need to understand that your informational security professionals and network managers must deploy security strategies for users and applications to perform critical functions within the network.

 
For ensuring efficient enforcement of the principle of least privilege, you need to devise a strategy to manage and secure your privileged credentials centrally and deploy flexible controls to strike a balance between your operational and end-user needs and your compliance and cybersecurity requirements.

 

Securing Your Business

The Vectra 2020 Attacker Behavior Industry Report[iii] highlights that privileged access is a key aspect that hackers leverage for lateral movement in cyberattacks. They use these privileges to gain access to the most critical assets that a business relies on.

 
PoLP is an efficient cybersecurity strategy that can be used to restrict unauthorized access of data from the different levels within your IT environment including applications, end users, systems, networks, databases, processes and so on. You can grant permissions to your users to execute, read or write only those resources or files that they need to perform their job. Additionally, you can restrict access rights for devices, processes, systems and applications to privileges required to carry out authorized activities.

 

Managing Access Levels

In some cases, the assignment of privileges is done on role-based attributes such as the business unit, time of day, seniority and other special circumstances. Some examples of role-based privileges include:

 
Least privileged user accounts — These are standard user accounts that operate with a limited set of privileges. Under normal circumstances, most of your users should be operating under these accounts, 90 to 100 percent of the time.

 
Superuser accounts — These are essentially admin accounts that are used by specialized IT users and often come with unlimited privileges. In addition to the read/write/execute privileges, these accounts have the permission to execute systemic changes in your IT network.

 
Guest user accounts — These accounts are created on a situational basis and often have the least number of privileges — lower than those of the standard user accounts.

Managing Third-Party Vendor Risk

An interesting thing to note about the Target data breach is that it started with the hackers gaining access to nearly 70 million customer accounts through an HVAC contractor who had access to Target’s network and the permission to upload executables.[iv] What this implies is that you must not ignore third-party vendor risk management. Apart from your internal users, you must also implement principle of least privilege for your third-party vendors as they can be a major security risk for your business. Limiting third-party vendor access to your critical data can be an efficient strategy towards minimizing the associated risk.

 

Benefits of Principle of Least Privilege

 
We have rounded up a list of benefits of leveraging the principle of least privilege for your business. Read on:

 

Diminishes the Attack Surface

As mentioned earlier, the role of an HVAC contractor was critical to the Target data breach. Given the fact that the third-party vendor had elevated privileges, one can safely say that Target failed to implement PoLP, which consequently created a broad attack surface for the hacker to leverage.

Under PoLP, restricting privileges for your applications, processes and users significantly diminishes the attack surface and limits the ingresses and pathways for exploit.

 

Reduces the Impact of Breaches

By implementing PoLP, you can significantly reduce the impact of a breach that might occur as a result of unauthorized or unwanted use of network privileges. For instance, if a user account that has only limited privileges is compromised, the scope of catastrophic harm is relatively low.

 

Reduces Malware Propagation and Infection

Hackers usually target applications and systems with unrestricted privileges. As one of the most common web applications cyberattacks out there, a SQL injection attacks by inserting malicious instructions within SQL statements. The hacker can then enhance his privileges and acquire unauthorized control over your critical systems. However, by implementing PoLP, you can efficiently stunt and contain such malware attacks to where they first entered your system.

 

Ensures Superior Data Security Capabilities

In addition to eliminating any security flaws on the periphery of your business, you also need to focus on minimizing the risk of proprietary data thefts and insider leaks. That being said, it is imperative to monitor and control the activity of your authorized users to reinforce your cybersecurity stance.

Since PoLP restricts privilege elevations as well as the number of users that are given access to confidential information, it inherently enhances the security of your critical data.

PoLP Best Practices

 
There are certain best practices that you must follow to efficiently implement PoLP in your security policies.

 
Here is a list:

 

• For starters, you must conduct a privilege audit for all your existing programs, processes and user accounts to make sure that they have only the bare minimum permissions required to do their jobs.
• Make sure that you start all your user accounts with privileges set to the lowest possible level. Implement least privilege as the default for all your existing as well as new user accounts, applications and systems.
• You must elevate account privileges as needed and only for a specific time period that is required to do the job. An efficient strategy to provide the required access while also maintaining control is using one-time-use credentials and expiring privileges.
• Keep track of all the activity on your network including access requests, systems changes and individual logins. Having a comprehensive understanding of who is operating on your network and what they are doing is critical to maintaining control over who can access what.
• Maintain a management platform that allows flexibility to securely elevate and downgrade privileged credentials.
• Conduct regular audits to check if there are any old accounts, users or processes that have accumulated privileges over time and analyze whether or not the elevated privileges are still relevant

 
According to PoLP, organizations should operate under the zero-trust framework by not blindly trusting anything within or outside their network and verifying everything before granting permissions for access.

 
Implement PoLP across your IT environment today to strengthen your cybersecurity posture. Don’t know how? Contact us now to help you understand how you can implement and leverage the powerful capabilities of PoLP.

 
 

 
 
 
 
 
Article curated and used by permission.
 
 
[i] https://www.webtitan.com/blog/cost-retail-data-breach-179-million-home-depot/#:~:text=The%20Home%20Depot%20data%20breach,one%20of%20the%20retailer's%20vendors
 
[ii] https://arxiv.org/pdf/1701.04940.pdf#:~:text=1%20INTRODUCTION,of%20personal%20information%20were%20stolen
 
[iii] https://www.securitymagazine.com/articles/91830-surge-in-attacker-access-to-privileged-accounts-and-services-puts-businesses-at-risk
 
[iv] https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/
 

All You Need to Know About Least Privilege

 
In IT, the principle of least privilege (PoLP) refers to the concept that any process, program or user must be provided with only the bare minimum privileges (access or permissions) needed to perform a function. For instance, if a user account has been created for accessing database records, it need not have admin rights. Also, a programmer responsible for updating lines of legacy code can do so without access to the company’s financial records.

 
PoLP is a cybersecurity best practice and often considered a critical step for protecting privileged access to a businesses’ high-value assets and data (including customer/employee records). Since this principle extends beyond the scope of human access, it is also applicable to systems, applications and connected devices that require certain permissions or privileges to perform a task.

 

What Least Privilege is Used For

 
Did you know that two of the most infamous data breaches on record, namely the ones at Home Depot[i] and Target[ii], occurred due to a compromise of their network credentials? In both the cases, hackers used privileged accounts to access critical business data and private records of customers. Taking cue from the breaches in the past, you need to understand that your informational security professionals and network managers must deploy security strategies for users and applications to perform critical functions within the network.

 
For ensuring efficient enforcement of the principle of least privilege, you need to devise a strategy to manage and secure your privileged credentials centrally and deploy flexible controls to strike a balance between your operational and end-user needs and your compliance and cybersecurity requirements.

 

Securing Your Business

The Vectra 2020 Attacker Behavior Industry Report[iii] highlights that privileged access is a key aspect that hackers leverage for lateral movement in cyberattacks. They use these privileges to gain access to the most critical assets that a business relies on.

 
PoLP is an efficient cybersecurity strategy that can be used to restrict unauthorized access of data from the different levels within your IT environment including applications, end users, systems, networks, databases, processes and so on. You can grant permissions to your users to execute, read or write only those resources or files that they need to perform their job. Additionally, you can restrict access rights for devices, processes, systems and applications to privileges required to carry out authorized activities.

 

Managing Access Levels

In some cases, the assignment of privileges is done on role-based attributes such as the business unit, time of day, seniority and other special circumstances. Some examples of role-based privileges include:

 
Least privileged user accounts — These are standard user accounts that operate with a limited set of privileges. Under normal circumstances, most of your users should be operating under these accounts, 90 to 100 percent of the time.

 
Superuser accounts — These are essentially admin accounts that are used by specialized IT users and often come with unlimited privileges. In addition to the read/write/execute privileges, these accounts have the permission to execute systemic changes in your IT network.

 
Guest user accounts — These accounts are created on a situational basis and often have the least number of privileges — lower than those of the standard user accounts.

Managing Third-Party Vendor Risk

An interesting thing to note about the Target data breach is that it started with the hackers gaining access to nearly 70 million customer accounts through an HVAC contractor who had access to Target’s network and the permission to upload executables.[iv] What this implies is that you must not ignore third-party vendor risk management. Apart from your internal users, you must also implement principle of least privilege for your third-party vendors as they can be a major security risk for your business. Limiting third-party vendor access to your critical data can be an efficient strategy towards minimizing the associated risk.

 

Benefits of Principle of Least Privilege

 
We have rounded up a list of benefits of leveraging the principle of least privilege for your business. Read on:

 

Diminishes the Attack Surface

As mentioned earlier, the role of an HVAC contractor was critical to the Target data breach. Given the fact that the third-party vendor had elevated privileges, one can safely say that Target failed to implement PoLP, which consequently created a broad attack surface for the hacker to leverage.

Under PoLP, restricting privileges for your applications, processes and users significantly diminishes the attack surface and limits the ingresses and pathways for exploit.

 

Reduces the Impact of Breaches

By implementing PoLP, you can significantly reduce the impact of a breach that might occur as a result of unauthorized or unwanted use of network privileges. For instance, if a user account that has only limited privileges is compromised, the scope of catastrophic harm is relatively low.

 

Reduces Malware Propagation and Infection

Hackers usually target applications and systems with unrestricted privileges. As one of the most common web applications cyberattacks out there, a SQL injection attacks by inserting malicious instructions within SQL statements. The hacker can then enhance his privileges and acquire unauthorized control over your critical systems. However, by implementing PoLP, you can efficiently stunt and contain such malware attacks to where they first entered your system.

 

Ensures Superior Data Security Capabilities

In addition to eliminating any security flaws on the periphery of your business, you also need to focus on minimizing the risk of proprietary data thefts and insider leaks. That being said, it is imperative to monitor and control the activity of your authorized users to reinforce your cybersecurity stance.

Since PoLP restricts privilege elevations as well as the number of users that are given access to confidential information, it inherently enhances the security of your critical data.

PoLP Best Practices

 
There are certain best practices that you must follow to efficiently implement PoLP in your security policies.

 
Here is a list:

 

• For starters, you must conduct a privilege audit for all your existing programs, processes and user accounts to make sure that they have only the bare minimum permissions required to do their jobs.
• Make sure that you start all your user accounts with privileges set to the lowest possible level. Implement least privilege as the default for all your existing as well as new user accounts, applications and systems.
• You must elevate account privileges as needed and only for a specific time period that is required to do the job. An efficient strategy to provide the required access while also maintaining control is using one-time-use credentials and expiring privileges.
• Keep track of all the activity on your network including access requests, systems changes and individual logins. Having a comprehensive understanding of who is operating on your network and what they are doing is critical to maintaining control over who can access what.
• Maintain a management platform that allows flexibility to securely elevate and downgrade privileged credentials.
• Conduct regular audits to check if there are any old accounts, users or processes that have accumulated privileges over time and analyze whether or not the elevated privileges are still relevant

 
According to PoLP, organizations should operate under the zero-trust framework by not blindly trusting anything within or outside their network and verifying everything before granting permissions for access.

 
Implement PoLP across your IT environment today to strengthen your cybersecurity posture. Don’t know how? Contact us now to help you understand how you can implement and leverage the powerful capabilities of PoLP.

 
 

---

 
 
 
 
 
Article curated and used by permission.
 
 
[i] https://www.webtitan.com/blog/cost-retail-data-breach-179-million-home-depot/#:~:text=The%20Home%20Depot%20data%20breach,one%20of%20the%20retailer's%20vendors
 
[ii] https://arxiv.org/pdf/1701.04940.pdf#:~:text=1%20INTRODUCTION,of%20personal%20information%20were%20stolen
 
[iii] https://www.securitymagazine.com/articles/91830-surge-in-attacker-access-to-privileged-accounts-and-services-puts-businesses-at-risk
 
[iv] https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/
 

FinalSite

https://thejournal.com/articles/2022/01/07/thousands-of-schools-affected-by-ransomware-attack-on-website-provider-finalsite.aspx
Exploit: Ransomware

FinalSite: Education Technology Provider
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware risk is rising for organizations in every sector, especially companies that provide important services for other businesses.

 

 

Broward Health

https://www.techtimes.com/articles/270004/20220103/hospital-data-breach-personal-info-1-3-million-patients-staff-data-breach.htm
Exploit: Hacking

Broward Health: Hospital System
Customers Impacted: Unknown

How It Could Affect Your Business: Medical data is always a win for cybercriminals and losing it is an expensive nightmare for hospitals once regulators are finished with them.

 

 

D.W. Morgan

https://www.websiteplanet.com/blog/dwmorgan-leak-report/
Exploit: Hacking

D.W. Morgan: Logistics and Supply Chain Management
Individual Impact: No specifics about any consumer/employee PII or financial data loss were available at press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Service providers like this are goldmines for cybercriminals, amping up supply chain risk for everyone.

 

 

Ravkoo

https://www.bleepingcomputer.com/news/security/us-online-pharmacy-ravkoo-links-data-breach-to-aws-portal-incident/
Exploit: Hacking

Ravkoo: Pharmacy
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Once again, a service provider that maintains a large array of records full of PII was hit, gaining cybercriminals a data bonanza.

 

 

FlexBooker

https://www.bleepingcomputer.com/news/security/flexbooker-discloses-data-breach-over-37-million-accounts-impacted/
Exploit: Hacking

FlexBooker: Scheduling Platform
Individual Impact: No specific information about exposed customer personal or financial data was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals are especially likely to target companies that provide time-sensitive products and services in hopes of a fast extortion payment.

 

 

France – Inetum Group

https://www.bleepingcomputer.com/news/security/global-it-services-provider-inetum-hit-by-ransomware-attack/
Exploit: Ransomware

Inetum Group: IT Services Provider
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: IT services companies are juicy targets for crooks who may be able to parlay a successful attack on them into an intrusion on one of their clients.

 

 

Switzerland – CPH Chemie + Papier

https://www.hackread.com/german-audio-tech-sennheiser-expose-customers-data/

Exploit: Malware

CPH Chemie + Papier: Industrial Packaging. Paper and Chemicals
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Ransomware isn’t the only malware on the block. Other types of malware also pack a nasty punch that can devastate businesses.

 

 

Singapore – OG Department Stores

https://www.straitstimes.com/singapore/consumer/personal-data-of-og-department-store-customers-leaked
Exploit: Hacking

OG Department Stores: Retailer
Customers Impacted: Unknown

How it Could Affect Your Business: Personal data is always a winner for cybercriminals who are looking to make a quick profit in the booming dark web data markets.

 

 
 

FinalSite

https://thejournal.com/articles/2022/01/07/thousands-of-schools-affected-by-ransomware-attack-on-website-provider-finalsite.aspx
Exploit: Ransomware

FinalSite: Education Technology Provider
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware risk is rising for organizations in every sector, especially companies that provide important services for other businesses.

 

---

 

Broward Health

https://www.techtimes.com/articles/270004/20220103/hospital-data-breach-personal-info-1-3-million-patients-staff-data-breach.htm
Exploit: Hacking

Broward Health: Hospital System
Customers Impacted: Unknown

How It Could Affect Your Business: Medical data is always a win for cybercriminals and losing it is an expensive nightmare for hospitals once regulators are finished with them.

 

---

 

D.W. Morgan

https://www.websiteplanet.com/blog/dwmorgan-leak-report/
Exploit: Hacking

D.W. Morgan: Logistics and Supply Chain Management
Individual Impact: No specifics about any consumer/employee PII or financial data loss were available at press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Service providers like this are goldmines for cybercriminals, amping up supply chain risk for everyone.

 

---

 

Ravkoo

https://www.bleepingcomputer.com/news/security/us-online-pharmacy-ravkoo-links-data-breach-to-aws-portal-incident/
Exploit: Hacking

Ravkoo: Pharmacy
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Once again, a service provider that maintains a large array of records full of PII was hit, gaining cybercriminals a data bonanza.

 

---

 

FlexBooker

https://www.bleepingcomputer.com/news/security/flexbooker-discloses-data-breach-over-37-million-accounts-impacted/
Exploit: Hacking

FlexBooker: Scheduling Platform
Individual Impact: No specific information about exposed customer personal or financial data was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals are especially likely to target companies that provide time-sensitive products and services in hopes of a fast extortion payment.

 

---

 

France – Inetum Group

https://www.bleepingcomputer.com/news/security/global-it-services-provider-inetum-hit-by-ransomware-attack/
Exploit: Ransomware

Inetum Group: IT Services Provider
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: IT services companies are juicy targets for crooks who may be able to parlay a successful attack on them into an intrusion on one of their clients.

 

---

 

Switzerland – CPH Chemie + Papier

https://www.hackread.com/german-audio-tech-sennheiser-expose-customers-data/

Exploit: Malware

CPH Chemie + Papier: Industrial Packaging. Paper and Chemicals
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Ransomware isn’t the only malware on the block. Other types of malware also pack a nasty punch that can devastate businesses.

 

---

 

Singapore – OG Department Stores

https://www.straitstimes.com/singapore/consumer/personal-data-of-og-department-store-customers-leaked
Exploit: Hacking

OG Department Stores: Retailer
Customers Impacted: Unknown

How it Could Affect Your Business: Personal data is always a winner for cybercriminals who are looking to make a quick profit in the booming dark web data markets.

 

---

 
 

Why Your Business Needs a Data Security Policy

 
Today, the competitive business environment is data-driven. Data provides key insights into your customers and business performance that helps you make better decisions and improve processes. However, the sudden influx of employees working remotely exposes your organization’s information to several security threats.

According to the FBI, cybersecurity complaints increased from 1,000 to 4,000 complaints daily during the COVID-19 pandemic.[i] The growing number of data breaches only validates that data security should be a top priority.

 

Data Security Versus Data Privacy

 
A well-crafted data security policy is critical to protecting your organization’s data from unauthorized access. It is important to understand the difference between data security and data privacy to develop a clearly defined data security policy. Data security is the process of securing sensitive information, such as company and customer data, from unauthorized access and exploitation. On the other hand, data privacy, also known as information privacy, is the process of managing how information is collected, used, stored and disseminated by an organization.

 

Risks and Consequences of Not Having a Data Security Policy

 
Despite the growing number of data breaches, most small and midsized businesses do not have well-established data security policies. The lack of a data security program opens the door to a wide variety of security risks, such as data theft, data tampering and unauthorized access to sensitive information. The impact of a single data breach can be much more devastating and result in huge financial loss. It can also have the following serious consequences:

 
Damage Brand Reputation: A security breach can tarnish your brand’s image and drive away potential customers. Your customers will lose trust and confidence in your company.

 
Disrupt Business Operations: The period of downtime from the moment a security incident occurs, right up to restoration, significantly affects business operations, leading to low productivity, revenue loss and unhappy customers.

 
Legal Implications: Organizations that fall victim to data breaches face serious consequences including fines, legal action and compensation to customers.

 
Loss of Intellectual Property: A data breach not only puts your company and customer information at risk, but you also run the risk of losing patents, blueprints and other certifications.

Proactive and Preventative Strategies to Protect Your Data

 
The truth is anyone can become a victim of data breaches. The costs of recovering your compromised data can be greater than taking proactive measures to prevent breaches from occurring in the first place.

 
Protecting your organization’s most valuable asset requires far more than an IT security program. Having a well-documented information security policy in place is an important step to protect sensitive data and minimize threats. Apart from setting up the policy, you should constantly communicate guidelines and best practices for data protection across your organization.

 

Understanding the Key Elements of a Data Security Policy

 
It is critical to identify both internal and external risks that could disrupt business operations in order to establish a robust data security policy. Here are some key elements your company’s data protection policy should include:

 
Data Privacy: As businesses gather massive amounts of customer information, it is extremely important to ensure confidential data records are safeguarded from prying eyes and opportunistic scammers. Having a data privacy policy in place will not only help you stay compliant with regulations but will also help prevent malicious misuse of your clients’ sensitive data.

 
Password Management: According to the 2020 Data Breach Investigations Report, over 80 percent of data breaches due to hacking are password-related. It is vital that you implement a strong password management policy for all users who have access to your company’s resources so as to mitigate the risks of security breaches. The policy should state the importance of periodically updating passwords, how to manage and secure passwords, and the implications of not adhering to the policies and procedures.

 
Internet Usage: Businesses today rely heavily on the internet for their day-to-day operations, which also makes them vulnerable to several security risks. Therefore, it’s important to have an internet usage policy to guide your employees on how to securely access the internet. Your employees should be made aware that browsing restricted sites and downloading unnecessary files are prohibited and failing to adhere to these rules can be detrimental.

 
Email Usage: In the 2019 Data Breach Investigations Report, 94 percent of malware was delivered through email. A carefully outlined email policy will protect your employees and organizations from threats related to malicious emails. Training programs on email etiquette will ensure corporate emails are responsibly used and confidential client-related information is secured and protected.

 
Company-Owned and Personal Employee Devices: The sudden shift to remote working has dramatically increased the level of security risks. Having a company-owned device policy will help in managing, monitoring and securing both the device and the information on it from unauthorized access and data theft.

 
As personal employee devices are used for both recreational and business purposes, it’s difficult to monitor and control personal devices, which can be easily exploited. By outlining a comprehensive information security policy, such as using up-to-date software, connecting to the network through secure VPN and immediately reporting if the device is lost or stolen, you can minimize the risks of data breaches.

 
Software User Agreements: Every software user should comply with the end-user license agreement. Breaching this agreement could result in lawsuits and fines. A software user agreement policy will ensure your employees are using only those software applications that are legal and approved by your company.

 
Reporting Security Breaches: A security incident can occur when you least expect it. Data breaches should be immediately reported to minimize negative impacts and prevent further attacks. A data breach policy will guide your employees on what actions need to be taken to manage data breaches. It will also ensure your employees follow appropriate procedures while reporting such incidents.

 
Conquer the Challenge of Data Policies
 
For any organization, data is a valuable asset that needs to be protected at all costs. Adding to the challenge are the constantly evolving and complex data privacy regulations that every business should comply with.

 
To find out how you can secure your data while staying compliant with regulations, contact us today.

 
 
 


 
 
Article curated and used by permission.
 
 
 
 
[i] https://thehill.com/policy/cybersecurity/493198-fbi-sees-spike-in-cyber-crime-reports-during-coronavirus-pandemic
 

Why Your Business Needs a Data Security Policy

  Today, the competitive business environment is data-driven. Data provides key insights into your customers and business performance that helps you make better decisions and improve processes. However, the sudden influx of employees working remotely exposes your organization’s information to several security threats.

According to the FBI, cybersecurity complaints increased from 1,000 to 4,000 complaints daily during the COVID-19 pandemic.[i] The growing number of data breaches only validates that data security should be a top priority.

 

Data Security Versus Data Privacy

  A well-crafted data security policy is critical to protecting your organization’s data from unauthorized access. It is important to understand the difference between data security and data privacy to develop a clearly defined data security policy. Data security is the process of securing sensitive information, such as company and customer data, from unauthorized access and exploitation. On the other hand, data privacy, also known as information privacy, is the process of managing how information is collected, used, stored and disseminated by an organization.

 

Risks and Consequences of Not Having a Data Security Policy

  Despite the growing number of data breaches, most small and midsized businesses do not have well-established data security policies. The lack of a data security program opens the door to a wide variety of security risks, such as data theft, data tampering and unauthorized access to sensitive information. The impact of a single data breach can be much more devastating and result in huge financial loss. It can also have the following serious consequences:

  Damage Brand Reputation: A security breach can tarnish your brand’s image and drive away potential customers. Your customers will lose trust and confidence in your company.

  Disrupt Business Operations: The period of downtime from the moment a security incident occurs, right up to restoration, significantly affects business operations, leading to low productivity, revenue loss and unhappy customers.

  Legal Implications: Organizations that fall victim to data breaches face serious consequences including fines, legal action and compensation to customers.

  Loss of Intellectual Property: A data breach not only puts your company and customer information at risk, but you also run the risk of losing patents, blueprints and other certifications.

Proactive and Preventative Strategies to Protect Your Data

  The truth is anyone can become a victim of data breaches. The costs of recovering your compromised data can be greater than taking proactive measures to prevent breaches from occurring in the first place.

  Protecting your organization’s most valuable asset requires far more than an IT security program. Having a well-documented information security policy in place is an important step to protect sensitive data and minimize threats. Apart from setting up the policy, you should constantly communicate guidelines and best practices for data protection across your organization.

 

Understanding the Key Elements of a Data Security Policy

  It is critical to identify both internal and external risks that could disrupt business operations in order to establish a robust data security policy. Here are some key elements your company’s data protection policy should include:

  Data Privacy: As businesses gather massive amounts of customer information, it is extremely important to ensure confidential data records are safeguarded from prying eyes and opportunistic scammers. Having a data privacy policy in place will not only help you stay compliant with regulations but will also help prevent malicious misuse of your clients’ sensitive data.

  Password Management: According to the 2020 Data Breach Investigations Report, over 80 percent of data breaches due to hacking are password-related. It is vital that you implement a strong password management policy for all users who have access to your company’s resources so as to mitigate the risks of security breaches. The policy should state the importance of periodically updating passwords, how to manage and secure passwords, and the implications of not adhering to the policies and procedures.

  Internet Usage: Businesses today rely heavily on the internet for their day-to-day operations, which also makes them vulnerable to several security risks. Therefore, it’s important to have an internet usage policy to guide your employees on how to securely access the internet. Your employees should be made aware that browsing restricted sites and downloading unnecessary files are prohibited and failing to adhere to these rules can be detrimental.

  Email Usage: In the 2019 Data Breach Investigations Report, 94 percent of malware was delivered through email. A carefully outlined email policy will protect your employees and organizations from threats related to malicious emails. Training programs on email etiquette will ensure corporate emails are responsibly used and confidential client-related information is secured and protected.

  Company-Owned and Personal Employee Devices: The sudden shift to remote working has dramatically increased the level of security risks. Having a company-owned device policy will help in managing, monitoring and securing both the device and the information on it from unauthorized access and data theft.

  As personal employee devices are used for both recreational and business purposes, it’s difficult to monitor and control personal devices, which can be easily exploited. By outlining a comprehensive information security policy, such as using up-to-date software, connecting to the network through secure VPN and immediately reporting if the device is lost or stolen, you can minimize the risks of data breaches.

  Software User Agreements: Every software user should comply with the end-user license agreement. Breaching this agreement could result in lawsuits and fines. A software user agreement policy will ensure your employees are using only those software applications that are legal and approved by your company.

  Reporting Security Breaches: A security incident can occur when you least expect it. Data breaches should be immediately reported to minimize negative impacts and prevent further attacks. A data breach policy will guide your employees on what actions need to be taken to manage data breaches. It will also ensure your employees follow appropriate procedures while reporting such incidents.

  Conquer the Challenge of Data Policies   For any organization, data is a valuable asset that needs to be protected at all costs. Adding to the challenge are the constantly evolving and complex data privacy regulations that every business should comply with.

  To find out how you can secure your data while staying compliant with regulations, contact us today.

     

---

    Article curated and used by permission.         [i] https://thehill.com/policy/cybersecurity/493198-fbi-sees-spike-in-cyber-crime-reports-during-coronavirus-pandemic  

Shutterfly

https://www.bleepingcomputer.com/news/security/shutterfly-services-disrupted-by-conti-ransomware-attack/
Exploit: Ransomware

Shutterfly: Digital Image & Photography Services
Individual Impact: Although there appears to be customer data involved in this incident including payment card data, that exposure has not been confirmed and no further information was available at press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware risk is rising for organizations in every sector, especially companies that provide important services for other businesses as well as retail users.

 

 

Pro Wrestling Tees

https://www.bleepingcomputer.com/news/security/pro-wrestling-tees-discloses-data-breach-after-credit-cards-stolen/
Exploit: Hacking (Payment Skimmer)

Pro Wrestling Tees: Merchandise & Fan Experience Platform
Customers Impacted: Unknown

How It Could Affect Your Business: Payment card skimmers and other similar malware are an occupational hazard for any company that processes online payments.

 

 

Maryland Department of Health

https://www.washingtonpost.com/dc-md-va/2021/12/05/maryland-health-department-cyberattack/
Exploit: Hacking

Maryland Department of Health: State Government Agency
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: State agencies have been high on cybercriminals’ target lists throughout 2021 because they’re likely to pay the ransom and that trend is expected to continue in 2022.

 

 

UK – Gloucester City Council

https://www.bbc.com/news/uk-england-gloucestershire-59831468
Exploit: Hacking

Gloucester City Council: Municipal Government Body
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Infrastructure targets and municipalities have been very attractive to cybercriminals looking for quick ransom payments to restore essential services.

 

 

Norway – Amedia

https://therecord.media/cyberattack-on-one-of-norways-largest-media-companies-shuts-down-presses/
Exploit: Ransomware

Amedia: Media Company
Individual Impact: Although there appears to be employee data involved in this incident, that exposure has not been confirmed and no further information was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals are especially likely to target companies that provide time-sensitive products and services in hopes of a fast extortion payment.

 

 

Portugal – Impresa

https://www.itp.net/security/portuguese-media-group-impresa-crippled-by-ransomware-attack
Exploit: Ransomware

Impresa: Media Company
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Multiple media companies were hit this week, a reminder that cybercriminals sometimes set their sights on many targets in one industry at the same time.

 

 

Germany – Sennheiser

https://www.hackread.com/german-audio-tech-sennheiser-expose-customers-data/

Exploit: Misconfiguration

Sennheiser: Audio Equipment Manufacturer
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Simple cybersecurity blunders and employee carelessness can create complicated and expensive security incidents.

 

 

Ghana – National Service Secretariate (NSS)

https://www.zdnet.com/article/nsw-government-casual-recruiter-suffers-ransomware-hit/
Exploit: Misconfiguration

National Service Secretariate (NSS): National Government Agency
Customers Impacted: Unknown

How it Could Affect Your Business: Any entity that is storing large amounts of sensitive data needs to make sure that they have taken reasonable precautions to protect it.

 

 
 

Shutterfly

https://www.bleepingcomputer.com/news/security/shutterfly-services-disrupted-by-conti-ransomware-attack/
Exploit: Ransomware

Shutterfly: Digital Image & Photography Services
Individual Impact: Although there appears to be customer data involved in this incident including payment card data, that exposure has not been confirmed and no further information was available at press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware risk is rising for organizations in every sector, especially companies that provide important services for other businesses as well as retail users.

 

---

 

Pro Wrestling Tees

https://www.bleepingcomputer.com/news/security/pro-wrestling-tees-discloses-data-breach-after-credit-cards-stolen/
Exploit: Hacking (Payment Skimmer)

Pro Wrestling Tees: Merchandise & Fan Experience Platform
Customers Impacted: Unknown

How It Could Affect Your Business: Payment card skimmers and other similar malware are an occupational hazard for any company that processes online payments.

 

---

 

Maryland Department of Health

https://www.washingtonpost.com/dc-md-va/2021/12/05/maryland-health-department-cyberattack/
Exploit: Hacking

Maryland Department of Health: State Government Agency
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: State agencies have been high on cybercriminals’ target lists throughout 2021 because they’re likely to pay the ransom and that trend is expected to continue in 2022.

 

---

 

UK – Gloucester City Council

https://www.bbc.com/news/uk-england-gloucestershire-59831468
Exploit: Hacking

Gloucester City Council: Municipal Government Body
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Infrastructure targets and municipalities have been very attractive to cybercriminals looking for quick ransom payments to restore essential services.

 

---

 

Norway – Amedia

https://therecord.media/cyberattack-on-one-of-norways-largest-media-companies-shuts-down-presses/
Exploit: Ransomware

Amedia: Media Company
Individual Impact: Although there appears to be employee data involved in this incident, that exposure has not been confirmed and no further information was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals are especially likely to target companies that provide time-sensitive products and services in hopes of a fast extortion payment.

 

---

 

Portugal – Impresa

https://www.itp.net/security/portuguese-media-group-impresa-crippled-by-ransomware-attack
Exploit: Ransomware

Impresa: Media Company
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Multiple media companies were hit this week, a reminder that cybercriminals sometimes set their sights on many targets in one industry at the same time.

 

---

 

Germany – Sennheiser

https://www.hackread.com/german-audio-tech-sennheiser-expose-customers-data/

Exploit: Misconfiguration

Sennheiser: Audio Equipment Manufacturer
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Simple cybersecurity blunders and employee carelessness can create complicated and expensive security incidents.

 

---

 

Ghana – National Service Secretariate (NSS)

https://www.zdnet.com/article/nsw-government-casual-recruiter-suffers-ransomware-hit/
Exploit: Misconfiguration

National Service Secretariate (NSS): National Government Agency
Customers Impacted: Unknown

How it Could Affect Your Business: Any entity that is storing large amounts of sensitive data needs to make sure that they have taken reasonable precautions to protect it.

 

---

 
 

Phishing is a social engineering attack used to obtain sensitive information, such as login credentials and payment details, from users. It happens when an attacker, posing as a trusted source, dupes a victim into clicking on a malicious link or downloading a spam file sent over email, text messages, phone calls or social media. If you fall into this trap, you could end up with malware, system slowdowns and sensitive data loss, among other things.

 
The term phishing is one of the most reviled in today’s digital landscape and is a significant concern for executives. It's no surprise that the word is frowned upon when the attack vector is responsible for more than 20% of data breaches.^*
 
These attacks can be severely damaging for people and businesses. While individuals are affected by illicit purchases, financial fraud or identity theft, a company that is the victim of such an attack, in most cases, suffers severe financial losses as well as a loss of market share, reputation and stakeholder trust.

 
An unfortunate reality regarding phishing is that the attack vector is becoming more sophisticated and frequent with each passing day.

 
Why phishing attacks are becoming more frequent

 

• Remote/hybrid workforce

Over the last year and a half, a significant number of organizations had to transition to remote/hybrid work models. While the switch allowed operations to continue without interruption, the scattered workforce and mobile endpoints brought their own set of challenges. One of the main problems was vulnerabilities becoming more visible to hackers, who quickly exploited them through phishing attacks.

 

• Organizational oversights

Many businesses, in efforts to stay afloat amid the global crisis, completely disregarded cybersecurity. This included decreased spending on security posture, a lack of employee training and much more. Such mistakes opened the door for cybercriminals.

 

• Constantly evolving cybercriminals

Keep in mind that hackers constantly strive to uncover and exploit even the tiniest flaws in your business. They're constantly shifting their strategy, so you're practically defending against a moving attacker.

 
Threat actors have recently targeted businesses via the website contact form, pretending to be legal authorities, saying that the company is not complying with the law and asking the organization to download a "report."

 

• Cheap phishing tools

Several low-cost phishing tools are available on the dark web, allowing even non-technical people to become hackers.

 

How can businesses stay safe?

 
To avoid falling victim to phishing, all small and midsize businesses (SMBs) must be constantly vigilant. To keep your business safe, you must:

 

• Facilitate regular security awareness training to ensure that everyone is on the same page and that employees strictly adhere to relevant security requirements.
• Ensure that your IT infrastructure is up to date so that hackers cannot exploit unpatched/non-updated systems.
• Enforce strong password policies and create a system that prohibits anyone from evading them.
• Try and isolate vital infrastructure components as much as possible, so that everything doesn't collapse like a house of cards after a breach.
• Conduct mock phishing drills to get data on your employees' degree of alertness.
• Deploy an automated phishing detection solution that is powered by artificial intelligence.

 
Trying to guard against phishing on your own takes a lot of effort and resources, especially if you're running a business. Collaborating with an expert like us relieves you of additional concern and responsibility. Contact us today to set up a consultation and we'll handle the heavy lifting for you.

 
 


 
 

Source:

*Verizon DBIR

Phishing is a social engineering attack used to obtain sensitive information, such as login credentials and payment details, from users. It happens when an attacker, posing as a trusted source, dupes a victim into clicking on a malicious link or downloading a spam file sent over email, text messages, phone calls or social media. If you fall into this trap, you could end up with malware, system slowdowns and sensitive data loss, among other things.

 
The term phishing is one of the most reviled in today’s digital landscape and is a significant concern for executives. It's no surprise that the word is frowned upon when the attack vector is responsible for more than 20% of data breaches.^*
 
These attacks can be severely damaging for people and businesses. While individuals are affected by illicit purchases, financial fraud or identity theft, a company that is the victim of such an attack, in most cases, suffers severe financial losses as well as a loss of market share, reputation and stakeholder trust.

 
An unfortunate reality regarding phishing is that the attack vector is becoming more sophisticated and frequent with each passing day.

 
Why phishing attacks are becoming more frequent

 

• Remote/hybrid workforce

Over the last year and a half, a significant number of organizations had to transition to remote/hybrid work models. While the switch allowed operations to continue without interruption, the scattered workforce and mobile endpoints brought their own set of challenges. One of the main problems was vulnerabilities becoming more visible to hackers, who quickly exploited them through phishing attacks.

 

• Organizational oversights

Many businesses, in efforts to stay afloat amid the global crisis, completely disregarded cybersecurity. This included decreased spending on security posture, a lack of employee training and much more. Such mistakes opened the door for cybercriminals.

 

• Constantly evolving cybercriminals

Keep in mind that hackers constantly strive to uncover and exploit even the tiniest flaws in your business. They're constantly shifting their strategy, so you're practically defending against a moving attacker.

 
Threat actors have recently targeted businesses via the website contact form, pretending to be legal authorities, saying that the company is not complying with the law and asking the organization to download a "report."

 

• Cheap phishing tools

Several low-cost phishing tools are available on the dark web, allowing even non-technical people to become hackers.

 

How can businesses stay safe?

 
To avoid falling victim to phishing, all small and midsize businesses (SMBs) must be constantly vigilant. To keep your business safe, you must:

 

• Facilitate regular security awareness training to ensure that everyone is on the same page and that employees strictly adhere to relevant security requirements.
• Ensure that your IT infrastructure is up to date so that hackers cannot exploit unpatched/non-updated systems.
• Enforce strong password policies and create a system that prohibits anyone from evading them.
• Try and isolate vital infrastructure components as much as possible, so that everything doesn't collapse like a house of cards after a breach.
• Conduct mock phishing drills to get data on your employees' degree of alertness.
• Deploy an automated phishing detection solution that is powered by artificial intelligence.

 
Trying to guard against phishing on your own takes a lot of effort and resources, especially if you're running a business. Collaborating with an expert like us relieves you of additional concern and responsibility. Contact us today to set up a consultation and we'll handle the heavy lifting for you.

 
 

---

 
 

Source:

*Verizon DBIR

Virginia Museum of Fine Arts

https://www.securityweek.com/virginia-museum-shuts-down-website-amid-it-breach
Exploit: Ransomware

Virginia Museum of Fine Arts: Art Museum
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware risk is rising for organizations in every sector including non-profits and cultural institutions.

 

 

McMenamins

https://www.kgw.com/article/news/local/mcmenamins-ransomware-attack/283-dc039d56-cf82-4f06-8862-c2f6223e3893
Exploit: Ransomware

McMenamins: Hotel and Restaurant Chain
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Companies that may be holding financial data and PII for clients will be attractive targets for ransomware groups.

 

 

The Oregon Anesthesiology Group (OAG)

https://www.zdnet.com/article/oregon-medical-group-notifies-patients-of-cybersecurity-breach-says-fbi-seized-hellokitty-accounts/
Exploit: Ransomware

The Oregon Anesthesiology Group (OAG): Medical Care Provider
Customers Impacted: Unknown

How It Could Affect Your Business: Medical centers and providers can have big scores of data that are attractive to cybercriminals.

 

 

Superior Plus

https://www.darkreading.com/attacks-breaches/propane-distributor-hit-with-ransomware
Exploit: Ransomware

Superior Plus: Propane Distributor
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted:
How it Could Affect Your Business: Infrastructure targets have been very attractive to cybercriminals looking for quick ransom payments to restore essential services.

 

 

Brazil – Ministry of Health (MoH)

https://www.zdnet.com/article/brazilian-ministry-of-health-hit-by-second-cyberattack-in-less-than-a-week/
Exploit: Ransomware

Ministry of Health (MoH) – National Government Agency
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Getting hit with multiple attacks in a short period of time could be a death blow to many organizations.

 

 

Ireland – Coombe Hospital

https://www.independent.ie/news/ransomware-cyberattack-hits-coombe-hospital-it-services-locked-down-as-precaution-41156106.html

Exploit: Hacking

Coombe Hospital: Medical Center
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Targets in the medical sector have been getting absolutely pounded by ransomware since the start of the global pandemic.

 

 

---

Greece – VulcanForged

https://www.vice.com/en/article/4awxep/hackers-steal-dollar140-million-from-users-of-crypto-gaming-company
Exploit: Ransomware

VulcanForged: Cryptocurrency Gaming Company
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Any operation that handles or stores cryptocurrency is at a very high risk for trouble. This is the third cryptocurrency outfit to be hit by hackers this month

 

 

Australia – Finite Recruitment

https://www.zdnet.com/article/nsw-government-casual-recruiter-suffers-ransomware-hit/
Exploit: Ransomware

Finite Recruitment: Staffing Firm
Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals are always on the hunt for big troves of personal and financial information and companes that store it are at a high risk for ransomware.

 

 
 

Virginia Museum of Fine Arts

https://www.securityweek.com/virginia-museum-shuts-down-website-amid-it-breach
Exploit: Ransomware

Virginia Museum of Fine Arts: Art Museum
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Ransomware risk is rising for organizations in every sector including non-profits and cultural institutions.

 

---

 

McMenamins

https://www.kgw.com/article/news/local/mcmenamins-ransomware-attack/283-dc039d56-cf82-4f06-8862-c2f6223e3893
Exploit: Ransomware

McMenamins: Hotel and Restaurant Chain
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: Companies that may be holding financial data and PII for clients will be attractive targets for ransomware groups.

 

---

 

The Oregon Anesthesiology Group (OAG)

https://www.zdnet.com/article/oregon-medical-group-notifies-patients-of-cybersecurity-breach-says-fbi-seized-hellokitty-accounts/
Exploit: Ransomware

The Oregon Anesthesiology Group (OAG): Medical Care Provider
Customers Impacted: Unknown

How It Could Affect Your Business: Medical centers and providers can have big scores of data that are attractive to cybercriminals.

 

---

 

Superior Plus

https://www.darkreading.com/attacks-breaches/propane-distributor-hit-with-ransomware
Exploit: Ransomware

Superior Plus: Propane Distributor
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted:
How it Could Affect Your Business: Infrastructure targets have been very attractive to cybercriminals looking for quick ransom payments to restore essential services.

 

---

 

Brazil – Ministry of Health (MoH)

https://www.zdnet.com/article/brazilian-ministry-of-health-hit-by-second-cyberattack-in-less-than-a-week/
Exploit: Ransomware

Ministry of Health (MoH) – National Government Agency
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Getting hit with multiple attacks in a short period of time could be a death blow to many organizations.

 

---

 

Ireland – Coombe Hospital

https://www.independent.ie/news/ransomware-cyberattack-hits-coombe-hospital-it-services-locked-down-as-precaution-41156106.html

Exploit: Hacking

Coombe Hospital: Medical Center
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Targets in the medical sector have been getting absolutely pounded by ransomware since the start of the global pandemic.

 

---

 

---

Greece – VulcanForged

https://www.vice.com/en/article/4awxep/hackers-steal-dollar140-million-from-users-of-crypto-gaming-company
Exploit: Ransomware

VulcanForged: Cryptocurrency Gaming Company
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Any operation that handles or stores cryptocurrency is at a very high risk for trouble. This is the third cryptocurrency outfit to be hit by hackers this month

 

---

 

Australia – Finite Recruitment

https://www.zdnet.com/article/nsw-government-casual-recruiter-suffers-ransomware-hit/
Exploit: Ransomware

Finite Recruitment: Staffing Firm
Customers Impacted: Unknown

How it Could Affect Your Business: Cybercriminals are always on the hunt for big troves of personal and financial information and companes that store it are at a high risk for ransomware.

 

---

 
 

Atalanta

https://portswigger.net/daily-swig/us-food-importer-atalanta-admits-ransomware-attack
Exploit: Ransomware

Atalanta: Food Importer
Individual Impact: No details were offered by the company about how many records were exposed and what personal information they contained.

Customers Impacted: Unknown

How It Could Affect Your Business: Data breach risk has become especially nasty as cybercriminals look to distributors and service providers who may maintain large stores of data for a quick score.

 

 

Cox Communications

https://www.bleepingcomputer.com/news/security/cox-discloses-data-breach-after-hacker-impersonates-support-agent/
Exploit: Phishing (Vishing)

Cox Communications: Digital Cable Provider
Customers Impacted: 3 million

How It Could Affect Your Business: Vishing has been gaining popularity as employees handle fewer phone calls, making them more likely to take the ones they do get seriously. This is the same method of attack that was used in the 2020 Twitter hack.

 

 

The Virginia Division of Legislative Automated Systems (DLAS)

https://apnews.com/article/technology-legislature-executive-branch-virginia-ralph-northam-8adc7aa73b93c91b0687b741b6acd202
Exploit: Ransomware

The Virginia Division of Legislative Automated Systems (DLAS): Government Technology Services
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: In an ultra-competitive sector like crypto, customers will be watching every move a company makes, especially if it could potentially cost them money.

 

 

Kronos Ultimate Group

https://www.bostonglobe.com/2021/12/14/business/businesses-face-payroll-scheduling-woes-after-ransomware-attack-kronos/
Exploit: Ransomware

Kronos Ultimate Group: Payroll Services
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted:
How it Could Affect Your Business: Once again, cybercriminals choose a target that offers them a huge stash of data, especially valuable personal and financial information.

 

 

United Kingdom – SPAR Convenience Stores

https://www.infosecurity-magazine.com/news/cyberattack-closes-uk-convenience/
Exploit: Ransomware

SPAR Convenience Stores: Convenience Store Chain
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

 

 

Sweden – Volvo Cars

https://www.securityweek.com/hackers-steal-research-data-swedens-volvo-cars

Exploit: Hacking

Volvo Cars: Automotive Manufacturer
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Research and development data is a niche market on the dark web that can be very profitable for the bad guys.

 

 

Germany – Hellmann Worldwide Logistics

https://www.zdnet.com/article/german-logistics-giant-hellmann-reports-cyberattack/
Exploit: Ransomware

Hellmann Worldwide Logistics: Transportation Logistics Firm
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Transportation companies have been squarely in cybercriminals’ sights since the start of the global pandemic, upping risk for businesses in that sector.

 

 

France – Régie Autonome des Transports Parisiens (RATP)

https://www.infosecurity-magazine.com/news/french-transport-giant-exposes/
Exploit: Misconfiguration

Régie Autonome des Transports Parisiens (RATP): Transportation Authority
Customers Impacted: Unknown

How it Could Affect Your Business: This error could have been prevented and the resulting incident will not be cheap to fix after GDPR regulators get finished slapping down penalties.

 

 

Singapore – AscendEX

https://www.coindesk.com/business/2021/12/13/crypto-exchange-ascendex-hacked-losses-estimated-at-77m/
Exploit: Hacking

AscendEX: Cryptocurrency Trading Platform
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Crypto and DeFi platforms have been getting hit right and left by bad actors looking for a quick payday, with major attacks every week for the last month.

 

 

Australia – Frontier Software

https://www.zdnet.com/article/south-australian-government-employee-data-taken-in-frontier-software-ransomware-attack/
Exploit: Ransomware

Frontier Software: Payroll Services Technology Provider
Customers Impacted: Unknown

How it Could Affect Your Business: The second appearance of a payrolls services firm this week is a reminder that these companies store exactly the kind of data that is cybercriminals catnip.

 

 
 

Atalanta

https://portswigger.net/daily-swig/us-food-importer-atalanta-admits-ransomware-attack
Exploit: Ransomware

Atalanta: Food Importer
Individual Impact: No details were offered by the company about how many records were exposed and what personal information they contained.

Customers Impacted: Unknown

How It Could Affect Your Business: Data breach risk has become especially nasty as cybercriminals look to distributors and service providers who may maintain large stores of data for a quick score.

 

---

 

Cox Communications

https://www.bleepingcomputer.com/news/security/cox-discloses-data-breach-after-hacker-impersonates-support-agent/
Exploit: Phishing (Vishing)

Cox Communications: Digital Cable Provider
Customers Impacted: 3 million

How It Could Affect Your Business: Vishing has been gaining popularity as employees handle fewer phone calls, making them more likely to take the ones they do get seriously. This is the same method of attack that was used in the 2020 Twitter hack.

 

---

 

The Virginia Division of Legislative Automated Systems (DLAS)

https://apnews.com/article/technology-legislature-executive-branch-virginia-ralph-northam-8adc7aa73b93c91b0687b741b6acd202
Exploit: Ransomware

The Virginia Division of Legislative Automated Systems (DLAS): Government Technology Services
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: In an ultra-competitive sector like crypto, customers will be watching every move a company makes, especially if it could potentially cost them money.

 

---

 

Kronos Ultimate Group

https://www.bostonglobe.com/2021/12/14/business/businesses-face-payroll-scheduling-woes-after-ransomware-attack-kronos/
Exploit: Ransomware

Kronos Ultimate Group: Payroll Services
Individual Impact: No consumer/employee PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted:
How it Could Affect Your Business: Once again, cybercriminals choose a target that offers them a huge stash of data, especially valuable personal and financial information.

 

---

 

United Kingdom – SPAR Convenience Stores

https://www.infosecurity-magazine.com/news/cyberattack-closes-uk-convenience/
Exploit: Ransomware

SPAR Convenience Stores: Convenience Store Chain
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

 

---

 

Sweden – Volvo Cars

https://www.securityweek.com/hackers-steal-research-data-swedens-volvo-cars

Exploit: Hacking

Volvo Cars: Automotive Manufacturer
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Research and development data is a niche market on the dark web that can be very profitable for the bad guys.

 

---

 

Germany – Hellmann Worldwide Logistics

https://www.zdnet.com/article/german-logistics-giant-hellmann-reports-cyberattack/
Exploit: Ransomware

Hellmann Worldwide Logistics: Transportation Logistics Firm
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Transportation companies have been squarely in cybercriminals’ sights since the start of the global pandemic, upping risk for businesses in that sector.

 

---

 

France – Régie Autonome des Transports Parisiens (RATP)

https://www.infosecurity-magazine.com/news/french-transport-giant-exposes/
Exploit: Misconfiguration

Régie Autonome des Transports Parisiens (RATP): Transportation Authority
Customers Impacted: Unknown

How it Could Affect Your Business: This error could have been prevented and the resulting incident will not be cheap to fix after GDPR regulators get finished slapping down penalties.

 

---

 

Singapore – AscendEX

https://www.coindesk.com/business/2021/12/13/crypto-exchange-ascendex-hacked-losses-estimated-at-77m/
Exploit: Hacking

AscendEX: Cryptocurrency Trading Platform
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Crypto and DeFi platforms have been getting hit right and left by bad actors looking for a quick payday, with major attacks every week for the last month.

 

---

 

Australia – Frontier Software

https://www.zdnet.com/article/south-australian-government-employee-data-taken-in-frontier-software-ransomware-attack/
Exploit: Ransomware

Frontier Software: Payroll Services Technology Provider
Customers Impacted: Unknown

How it Could Affect Your Business: The second appearance of a payrolls services firm this week is a reminder that these companies store exactly the kind of data that is cybercriminals catnip.

 

---

 
 

When used strategically, technology can help small and medium-sized businesses (SMBs) develop a more productive, efficient and innovative workforce. That’s why businesses that prioritize technology are three times more likely to exceed corporate goals.^* In a business world that’s evolving at a breakneck pace, your company may not be able to perform at its full potential if it lacks the necessary technology.

 

Technology can improve:

 

• Business communication
• Decision making
• Marketing
• Security
• Customer support
• Resource management
• Time and cost efficiency

 
However, even the most cutting-edge technology can experience the occasional hiccup and slow you down if you don't keep up with regular updates and support. Performing an annual technology refresh can help you avoid this altogether.

 
A technology refresh is the process of replacing technology components regularly by evaluating their ability to integrate with other infrastructure components and obsolescence, rather than waiting until the outdated element becomes the most significant impediment to achieving your company's vision.

 
A technology refresh is crucial because maintaining legacy infrastructure components comes at a cost. It exposes your systems to hackers, reduces overall productivity and may even drive your most valuable employees out the door because they are tired of dealing with outdated technology that makes it difficult to do their jobs. Additionally, as the costs of maintaining outdated IT components and the risks of failure continue to rise, day-to-day operations can be negatively impacted.

 

Warning Signs to Look Out For

 
Is it time to refresh your company's technology? Keep an eye out for the following six signs:

 

1. Systems are running slowly

Slow systems consume a significant amount of a company's valuable time. The slowness could be due to several factors including a failed integration, virus or lack of updates. It's critical to find and fix the problem as soon as possible to get back to optimal performance levels.

 

2. Experiencing suspicious pop-ups

Suspicious pop-ups typically warn users that their system is vulnerable to a security threat or has a technical problem. Cybercriminals then prey on worried users who want to make sure their system is secure by extorting money to fix issues and eliminate threats that do not exist. One of the best ways to keep such malicious players at bay is by immediately refreshing/updating legacy systems.

 

3. Random shutdowns

It's normal for systems to shut down to install critical updates. However, if the shutdowns are frequent and unpredictable, then there's a problem that needs to be addressed. While random shutdowns can be due to a range of factors, such as an unstable power supply, virus/malware or corrupted files, it could also be a warning sign that the system is due for an update/refresh.

 

4. Connection issues

Getting cut off from the internet in the middle of a crucial task or meeting occasionally can be inconvenient, but what if it happens regularly? It could be a sign that your system has a flaw that needs to be fixed. However, if software patching fails to resolve the issue, it may be time to refresh the system.

 

5. Lack of integration between your systems, software and technology

Integration is critical for today's firms because the current technology landscape is evolving rapidly, and businesses may have to depend on multiple vendors for different solutions. So, if any technology component in your company does not integrate with the rest of the infrastructure, it should be replaced immediately.

 

6. Your system acts possessed

You've probably seen situations where tabs open and close on their own, the mouse moves in the opposite direction, things open on your desktop at random and files get downloaded without your knowledge. In such cases, you should consider a system refresh before consulting an exorcist. Systems without proper patching and update history may exhibit strange behavior.

 

Collaboration Is the Best Way Forward

 
Technological roadblocks can be frustrating and attempting to overcome them on your own can be overwhelming. Get started on your path to a technology refresh with an experienced partner like us. Knowing that the process is in expert hands gives you peace of mind and allows you to focus on growing your business. Contact us now for a free consultation.

 
 


 
 

Source:

*Adobe Digital Trends Report

 

When used strategically, technology can help small and medium-sized businesses (SMBs) develop a more productive, efficient and innovative workforce. That’s why businesses that prioritize technology are three times more likely to exceed corporate goals.^* In a business world that’s evolving at a breakneck pace, your company may not be able to perform at its full potential if it lacks the necessary technology.

 

Technology can improve:

 

• Business communication
• Decision making
• Marketing
• Security
• Customer support
• Resource management
• Time and cost efficiency

  However, even the most cutting-edge technology can experience the occasional hiccup and slow you down if you don't keep up with regular updates and support. Performing an annual technology refresh can help you avoid this altogether.

  A technology refresh is the process of replacing technology components regularly by evaluating their ability to integrate with other infrastructure components and obsolescence, rather than waiting until the outdated element becomes the most significant impediment to achieving your company's vision.

  A technology refresh is crucial because maintaining legacy infrastructure components comes at a cost. It exposes your systems to hackers, reduces overall productivity and may even drive your most valuable employees out the door because they are tired of dealing with outdated technology that makes it difficult to do their jobs. Additionally, as the costs of maintaining outdated IT components and the risks of failure continue to rise, day-to-day operations can be negatively impacted.

 

Warning Signs to Look Out For

  Is it time to refresh your company's technology? Keep an eye out for the following six signs:

 

1. Systems are running slowly

Slow systems consume a significant amount of a company's valuable time. The slowness could be due to several factors including a failed integration, virus or lack of updates. It's critical to find and fix the problem as soon as possible to get back to optimal performance levels.

 

2. Experiencing suspicious pop-ups

Suspicious pop-ups typically warn users that their system is vulnerable to a security threat or has a technical problem. Cybercriminals then prey on worried users who want to make sure their system is secure by extorting money to fix issues and eliminate threats that do not exist. One of the best ways to keep such malicious players at bay is by immediately refreshing/updating legacy systems.

 

3. Random shutdowns

It's normal for systems to shut down to install critical updates. However, if the shutdowns are frequent and unpredictable, then there's a problem that needs to be addressed. While random shutdowns can be due to a range of factors, such as an unstable power supply, virus/malware or corrupted files, it could also be a warning sign that the system is due for an update/refresh.

 

4. Connection issues

Getting cut off from the internet in the middle of a crucial task or meeting occasionally can be inconvenient, but what if it happens regularly? It could be a sign that your system has a flaw that needs to be fixed. However, if software patching fails to resolve the issue, it may be time to refresh the system.

 

5. Lack of integration between your systems, software and technology

Integration is critical for today's firms because the current technology landscape is evolving rapidly, and businesses may have to depend on multiple vendors for different solutions. So, if any technology component in your company does not integrate with the rest of the infrastructure, it should be replaced immediately.

 

6. Your system acts possessed

You've probably seen situations where tabs open and close on their own, the mouse moves in the opposite direction, things open on your desktop at random and files get downloaded without your knowledge. In such cases, you should consider a system refresh before consulting an exorcist. Systems without proper patching and update history may exhibit strange behavior.

 

Collaboration Is the Best Way Forward

  Technological roadblocks can be frustrating and attempting to overcome them on your own can be overwhelming. Get started on your path to a technology refresh with an experienced partner like us. Knowing that the process is in expert hands gives you peace of mind and allows you to focus on growing your business. Contact us now for a free consultation.

   

---

   

Source:

*Adobe Digital Trends Report

 

Planned Parenthood

https://www.washingtonpost.com/nation/2021/12/01/los-angeles-planned-parenthood-hack/
Exploit: Ransomware

Planned Parenthood: Healthcare Provider
Customers Impacted: 400,000

How It Could Affect Your Business: Medical information is valuable, especially sensitive information like this that can be used for both cybercrime and blackmail, and patients expect that healthcare providers will protect it.

 

 

Gale Healthcare Solutions

https://www.zdnet.com/article/sensitive-information-of-30k-florida-healthcare-workers-exposed-in-unprotected-database/
Exploit: Misconfiguration

Gale Healthcare Solutions: Healthcare Job Placement
Customers Impacted: 300,000

How It Could Affect Your Business: This mistake will be expensive and coveted healthcare workers may be inclined to choose a different staffing agency because of this carelessness.

 

 

MonoX

https://www.hackread.com/hackers-steal-badger-defi-monox/
Exploit: Hacking

MonoX: Cryptocurrency Finance
Individual Impact: No consumer PII or financial data loss was disclosed in this breach as of press time.

Customers Impacted: Unknown

How It Could Affect Your Business: In an ultra-competitive sector like crypto, customers will be watching every move a company makes, especially if it could potentially cost them money.

 

 

DNA Diagnostics Center

https://www.zdnet.com/article/dna-testing-center-admits-to-breach-affecting-ssns-banking-info-of-more-than-2-million-people/

Exploit: Ransomware

DNA Diagnostics Center: Healthcare Services
Customers Impacted: 2,102,436

How it Could Affect Your Business: Companies that store two kinds of valuable data like this are at high risk for an expensive and damaging ransomware incident that will have lasting financial results.

 

 

United Kingdom – BitMart

https://portswigger.net/daily-swig/crypto-exchange-bitmart-reports-150-million-theft-following-hack
Exploit: Hacking

BitMart: Cryptocurrency Exchange
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Crypto platforms have been squarely in cybercriminals’ sights in the last few months and consumers are watching to see which ones are able to avoid trouble.

 

 

Japan – Panasonic

https://www.securitymagazine.com/articles/96615-panasonic-discloses-data-breach

Exploit: Hacking

Panasonic: Electronics Manufacturer
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Large companies are treasure troves for data-hungry cybercriminals looking for a quick, low-risk score to turn over for fast profit.

 

 

Australia – CS Energy

https://www.itpro.co.uk/security/ransomware/361687/cs-energy-ransomware-attack
Exploit: Ransomware

CS Energy: Energy Company
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.

Customers Impacted: Unknown

How it Could Affect Your Business: Utility companies and other critical infrastructure businesses are tempting targets for cybercriminals because their essential nature makes the owners more likely to pay a ransom.