Industry News: ESG5

The Target: Maxar Space Systems is a major player in the American aerospace industry, considered an expert in building communication and Earth observation satellites.

The Take: Maxar Space Systems says that the attacker likely has access to a system that contained the following employee information: name, home address, social security number, business contact information, gender, employment status, employee number, job title, hire/job termination start dates, supervisor, department.

The Vector: The information security team discovered that a hacker using a Hong Kong-based IP address targeted and accessed a Maxar system containing certain files with employee personal data.

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: Schneider Electric is a French multinational company that manufactures energy and automation products ranging from household electrical components found in big box stores to enterprise-level industrial control and building automation products.

The Take: The threat actors claim that the stolen data includes 75,000 unique email addresses and full names for Schneider Electric employees and customers.

The Vector: The threat actor said they breached Schneider Electric's Jira server using exposed credentials. Once they gained access, they claimed to use a MiniOrange REST API to scrape 400k rows of user data.

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: Landmark Admin is a third-party administrator for insurance companies, offering back-office services like new business processing and claims administration for large insurance carriers.

The Take: The following information related to potentially impacted individuals may have been subject to unauthorized access: first name/initial and last name; address; Social Security number; tax identification number; driver's license number/state-issued identification card; passport number; financial account number; medical information; date of birth; health insurance policy number; and life and annuity policy information.

The Vector: Landmark says it found evidence that the threat actor accessed some files during the attack that contained the personal information of 806,519 people.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: One of the largest cryptocurrency infrastructure providers, Transak serves nearly six million users across 160 countries and 46 U.S. states.

The Take: Names, birthdays, passports, driver’s license information and user selfies were leaked in the breach.

The Vector: A “sophisticated phishing attack” granted the attacker access to an unnamed know-your-customer vendor Transak uses for document scanning and verification.

As phishing actors continue to explore every potential abuse opportunity on legitimate service providers, novel security gaps constantly threaten to expose users to severe risks. It is essential not to rely solely on email protection solutions, and also scrutinize every email that lands on your inbox, look for inconsistencies, and double-check all claims made in those messages.

Read more...

The Target: U.S. money transfer giant MoneyGram.

The Take: The stolen customer data includes names, phone numbers, postal and email addresses, dates of birth, and national identification numbers. The data also includes a “limited number” of Social Security numbers and government identification documents, such as driver’s licenses and other documents that contain personal information, like utility bills and bank account numbers.

The Vector: BleepingComputer first reported that MoneyGram was breached through a social engineering attack on its IT help desk where threat actors impersonated an employee. Once they gained access to the network, the threat actors initially targeted the Windows active directory services to steal employee information.

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: ScienceLogic SL1 (formerly EM7) is an IT operations platform for monitoring, analyzing, and automating an organization's infrastructure, including cloud, networks, and applications.

The Take: The hackers exploited the zero-day to gain access to web servers and steal limited customer monitoring data, including customer account names and numbers, customer usernames, Rackspace internally generated device IDs, device name and information, IP addresses, and AES256 encrypted Rackspace internal device agent credentials.

The Vector: Threat actors exploited a zero-day vulnerability in a third-party tool used by the ScienceLogic SL1 platform.

This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.

Read more...

The Target: Car dealership company AutoCanada, which has 66 dealerships.

The Take: The data that has been exposed includes full names, addresses, dates of birth, payroll information, including salaries and bonuses, social insurance numbers, bank account numbers used for direct deposits, scans of government-issued identification documents, and any personal documents stored on a work computer or drives tied to a work computer.

The Vector: The threat actors published terabytes of data allegedly stolen from AutoCanada, including databases, NAS storage images, executives' information, financial documents, and HR data.

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: Stillwater Mining Company, the owner of the only platinum and palladium mines in the U.S.

The Take: In addition to names and contact information, the hackers stole government ID information, passport numbers, Social Security numbers, tax ID numbers, birth certificates, financial information like bank account numbers and medical information like health plan numbers.

The Vector: Stillwater Mining Company told regulators that hackers breached company systems in the middle of June but the incident was only discovered on July 8. The investigation into the attack is ongoing, but the mining company said it was able to confirm the data breach on August 19.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: Car rental company Avis

The Take: The scope of the stolen data varies depending on the customer, but the following information is potentially affected: name, email address, telephone number, date of birth, credit card number and expiration date, driver’s license number.

The Vector: The company detected unauthorized access to one of its business applications at the beginning of August. Avis has described the breach as ‘insider wrongdoing.’

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: CBIZ is a management consulting company that provides financial and benefits and insurance services to various organizations and individual customers.

The Take: Hackers stole information belonging to nearly 36,000 individuals, which includes: name, contact details, Social Security Number, date of birth/death, retiree health information, welfare plan information.

The Vector: The company informs that a threat actor exploited a vulnerability in one of its web pages and was able to steal customer data between June 2 and June 21.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...