.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
Dark Reading: A new survey shows Generation Z and millennials, younger workers who have grown up as digital natives, are surprisingly more careless about their employer's cybersecurity than their senior Gen X and baby boomer colleagues.
The target: Optus, an Australian Telecommunications company
The take: Personal information for up to 10 million customers, including names, email addresses, postal addresses, phone numbers, dates of birth, and some passport numbers, driver’s license numbers and Medicare numbers.
The attack vector: Reports suggest that an application programming interface (API) was exposed to the public internet and did not enforce any kind of authentication to access customer data.
Where sensitive data is handled, controls must be put in place to authenticate access, and verify an individual’s authorization to access that data. Failing to ensure that such access is carefully controlled is akin to leaving the window open.
ZDNet: The UK's cybersecurity agency has told firms to do more to protect themselves from attacks on their supply chains.
BNN Bloomberg: At least $718 million has been stolen so far in October alone, taking the gross tally for the year past $3 billion and putting 2022 on course to be a record for the total value hacked, according to blockchain specialist Chainalysis Inc.
Private Equity Wire: Vista Equity Partners (Vista) is to acquire KnowBe4, the provider of the world’s largest security awareness training and simulated phishing platforms, in an all-cash transaction valued at approximately $4.6 billion on an equity value basis.
FCW: In an Oct. 11 fact sheet, the White House teed up plans to host a meeting with stakeholders including companies and trade associations to discuss "a common label for products that meet U.S. government standards and are tested by vetted and approved entities."
AP News: Arne Schoenbohm, who heads the BSI agency, co-founded a cybersecurity group a decade ago that brings together experts from public institutions and the private sector. German media reported that one of its members is a company founded by a former Russian intelligence agent.
U.S. News: "The investigation has concluded that no evidence of any compromise was found and as such Lloyd's has been advised that its network services can now be restored," a company spokesperson said in an email.
The Target: American Airlines, U.S based air travel company.
The Take: Exposure of Personally Identifiable Information including: employee and customer names, dates of birth, mailing addresses, phone numbers, email addresses, driver license numbers, passport numbers, and certain medical information.
The Vector: Using a phishing attack, the threat actor compromised an employee’s Office365 account, and acting with all their permissions, exfiltrated the exposed data.
This breach is a stark reminder of the effective of social engineering attacks and how critical authentication controls are in an overall robust cybersecurity posture. Enforcing multi-factor authentication, reasonably paced password resets, and regular social engineering and phishing awareness training are all effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
Bleeping Computer: A ransomware operation named Royal is quickly ramping up, targeting corporations with ransom demands ranging from $250,000 to over $2 million.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
168 Hobsons Lake Drive Suite 301
Beechville, NS
Canada, B3S 0G4
Tel: +1 902 429 8880
Manila
10th Floor, Two Ecom Center
Mall of Asia Complex
Harbor Dr, Pasay, 1300 Metro Manila
Philippines
Sydney
Level 15 Grosvenor Place
225 George Street, Sydney NSW 2000
Australia
Tel: +61 (2) 8823 3370
Abu Dhabi
Floor No. 15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy