Industry News: ESG5

The Target: ScienceLogic SL1 (formerly EM7) is an IT operations platform for monitoring, analyzing, and automating an organization's infrastructure, including cloud, networks, and applications.

The Take: The hackers exploited the zero-day to gain access to web servers and steal limited customer monitoring data, including customer account names and numbers, customer usernames, Rackspace internally generated device IDs, device name and information, IP addresses, and AES256 encrypted Rackspace internal device agent credentials.

The Vector: Threat actors exploited a zero-day vulnerability in a third-party tool used by the ScienceLogic SL1 platform.

This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.

Read more...

The Target: Car dealership company AutoCanada, which has 66 dealerships.

The Take: The data that has been exposed includes full names, addresses, dates of birth, payroll information, including salaries and bonuses, social insurance numbers, bank account numbers used for direct deposits, scans of government-issued identification documents, and any personal documents stored on a work computer or drives tied to a work computer.

The Vector: The threat actors published terabytes of data allegedly stolen from AutoCanada, including databases, NAS storage images, executives' information, financial documents, and HR data.

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: Stillwater Mining Company, the owner of the only platinum and palladium mines in the U.S.

The Take: In addition to names and contact information, the hackers stole government ID information, passport numbers, Social Security numbers, tax ID numbers, birth certificates, financial information like bank account numbers and medical information like health plan numbers.

The Vector: Stillwater Mining Company told regulators that hackers breached company systems in the middle of June but the incident was only discovered on July 8. The investigation into the attack is ongoing, but the mining company said it was able to confirm the data breach on August 19.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: Car rental company Avis

The Take: The scope of the stolen data varies depending on the customer, but the following information is potentially affected: name, email address, telephone number, date of birth, credit card number and expiration date, driver’s license number.

The Vector: The company detected unauthorized access to one of its business applications at the beginning of August. Avis has described the breach as ‘insider wrongdoing.’

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: CBIZ is a management consulting company that provides financial and benefits and insurance services to various organizations and individual customers.

The Take: Hackers stole information belonging to nearly 36,000 individuals, which includes: name, contact details, Social Security Number, date of birth/death, retiree health information, welfare plan information.

The Vector: The company informs that a threat actor exploited a vulnerability in one of its web pages and was able to steal customer data between June 2 and June 21.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: Patelco is an American not-for-profit credit union that provides financial services, including checking and savings accounts, loans, credit cards, insurance plans, and investments, with assets exceeding $9 billion.

The Take: The information that was exposed to cybercriminals varies per individual and may include: full name, Social Security Number (SSN), driver’s license number, date of birth, email address.

The Vector: Last month, the company disclosed it suffered a ransomware attack on June 29, 2024, that forced it to shut down customer-facing banking systems to contain the damage and protect people's data.

As phishing actors continue to explore every potential abuse opportunity on legitimate service providers, novel security gaps constantly threaten to expose users to severe risks. It is essential not to rely solely on email protection solutions, and also scrutinize every email that lands on your inbox, look for inconsistencies, and double-check all claims made in those messages.

Read more...

The Target: Toyota Motor Corporation is a Japanese multinational automotive manufacturer headquartered in Toyota City, Aichi, Japan.

The Take: The threat actor says they breached a U.S. branch and were able to steal 240GB of files with information on Toyota employees and customers, as well as contracts and financial information.

The Vector: BleepingComputer found that the files had been stolen or at least created on December 25, 2022. This date could indicate that the threat actor gained access to a backup server where the data was stored.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: Advanced Computer Software Group, a provider of IT and software services to the U.K.’s National Health Service (NHS) and other healthcare organizations.

The Take: The data breach affected 82,946 people, with sensitive information being exfiltrated, including medical records, phone numbers, and access details to the homes of 890 individuals receiving care at home.

The Vector: The incident, which occurred in August 2022, involved a ransomware attack that accessed systems via an account lacking multi-factor authentication.

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: HealthEquity, a Utah-based health savings account (HSA) provider.

The Take: The stolen information included a mix of benefits sign-up information that varied by customer. That mix could include name, address, phone number, employee ID, employer, Social Security number, and dependent information.

The Vector: The company said in a notice that a hacker managed to breach an "an unstructured data repository outside our core systems" containing customer data, making off with various kinds of personally identifiable information.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: MediSecure, an Australian electronic prescription provider.

The Take: The impacted data included personal information including full names, titles, dates of birth, gender, email addresses, phone numbers, and individual healthcare identifiers (IHI).

The Vector: An early forensic investigation by the company into the relevant impact of the incident indicated that 6.5TB of data stored on a database server was likely exfiltrated by a malicious third-party actor, although, encrypted servers couldn’t be examined for further details.

This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.

Read more...