.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The target: Clubillion, an online gambling and casino app.
The take: Over 200 million user records containing the following personally identifiable information: emails, private messages, winnings, IP addresses, and movements in the app itself.
The attack vector: An unsecured Elasticsearch database hosted on Amazon Web Services was left unsecured and publicly accessible. Unlike other recent cases, this database was not a single static backup/archive of information, but was a live, ‘production’ database, constantly updated with up to 200M new records per day.
In addition to the usual phishing attacks that could be launched with access to personal information, the inclusion of app movement and the fact the exposed data was continuously updated makes highly targeted spear-phishing campaigns extremely likely to succeed. While it is always disappointing to see lapses in security around database backups, it is absolutely crucial that production systems housing sensitive data are adequately protected.
CTV: A report from the Cybersecure Policy Exchange at Ryerson University in Toronto found 57 per cent of respondents in an online survey in May had encountered at least one cybercrime.
DarkReading: Thoma Bravo, a leading private equity investment firm focused on the software and technology-enabled services sector, today announced the completion of its acquisition of Exostar, LLC, a leader in trusted, secure business collaboration.
Saudi Gazette: Sheikh Hamdan Bin Mohammed Bin Rashid Al Maktoum, crown prince of Dubai and chairman of the executive council of Dubai, on Wednesday launched the Dubai Cyber Index, an initiative aimed at supporting the efforts of Dubai’s government entities to ensure the highest standards of cybersecurity. The first initiative of its kind in the world, the index seeks to establish Dubai as the city with the safest cyberspace in the world.
Cision: More than half of financial services companies plan to accelerate implementation of their next generation technology strategies, according to a new global survey of 500 financial services C-Suite executives and their direct reports released today by Broadridge Financial Solutions, Inc. (NYSE:BR), a global fintech leader.
Bleeping Computer: Microsoft took control of domains used by cybercriminals as part of the infrastructure needed to launch phishing attacks designed to exploit vulnerabilities and public fear resulting from the COVID-19 pandemic.
ITProPortal: The company that sells services related to data management claims to have polled 1,000 workers, coming to the conclusion that more than a third (37 per cent) expect both the number and value of fines to rise by 2025. Furthermore, six per cent expect a “dramatic rise”, while just three per cent expect the figures to fall.
ITProPortal: A report by Beaming says that a quarter of UK businesses fell victim to cybercriminals last year, most of which were large enterprises. That’s roughly 1.5 million businesses, up from 755,000 back in 2015.
The target: V Shred, a Las Vegas based fitness company which sells fitness plans, nutrition advice, and supplements.
The take: The combined Personally Identifiable Information of 99,000 of customers and potential clients including: names, home addresses, email addresses, dates of birth, usernames and passwords, age, gender, citizenship status, and user photos.
The attack vector: All of this information was hosted on a very common problem, an unsecured Amazon Web Services storage server accessible to the public online. However, in this case, anonymous users were also able to access the information without login credentials making the breach wider and deeper.
The exposed information could lead to highly sophisticated phishing attacks, and crucially, the user photos to identity theft. Credential management around publicly available company data is paramount to robust cybersecurity.
IT Wire: Medfin, a subsidiary of the National Australia Bank that works with healthcare professionals, was hit by an attempted cyber attack on 14 June, the company's chief executive Paul Freeman says.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
168 Hobsons Lake Drive Suite 301
Beechville, NS
Canada, B3S 0G4
Tel: +1 902 429 8880
Manila
10th Floor, Two Ecom Center
Mall of Asia Complex
Harbor Dr, Pasay, 1300 Metro Manila
Philippines
Sydney
Level 15 Grosvenor Place
225 George Street, Sydney NSW 2000
Australia
Tel: +61 (2) 8823 3370
Abu Dhabi
Floor No. 15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy