Week in Breach
This Week in Breach News: Pharmaceutical companies have a tough week with hacking as manufacturing is disrupted at COVID-19 drug makers and huge patient databases are exposed, why selling access for profit is on the rise, and learn how to think like a hacker in our new ethical hacking webinar!
The Week in Breach News: Dark Web ID’s Top Threats This Week
- Top Source Hits: ID Theft Forum
- Top Compromise Type: Domain
- Top Industry: Education & Research
- Top Employee Count: 1 – 10
The Week in Breach News – United States
United States – Maxex
https://www.inforisktoday.com/blogs/home-loan-trading-platform-exposes-mortgage-documentation-p-2959
Exploit: Unsecured Database
MAXEX: Loan Trading
Risk to Business: 1.772 = Severe
Georgia-based home loan trader MAXEX had a data disaster this week as an estimated 9GB of data leaked from a suspected insecure server. Some of the data is from backend software development for its loan-trading platform. But a substantial portion included confidential banking documents, system login credentials, emails, the company’s data breach incident response policy, and cybersecurity readiness reports. The breach also exposed complete mortgage documentation for at least 23 individuals in New Jersey and Pennsylvania. The incident investigation is ongoing.
Individual Risk: 2.011 = Severe
Financial information for clients was leaked, opening customers up to identity theft concerns. Some impacted clients had no idea that MAXEX currently had their loan, creating complications for informing customers who may be affected. Consumers should check to see who is servicing their mortgage and take precautions against identity theft and spear phishing if that provider is MAXEX.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Sloppy security can mean that if you do have an incident like a data breach, you might not even know where to start looking for the cause, putting your business at risk for an expensive investigation in addition to a data disaster.
ID Agent to the Rescue: Streamline your secure identity and access management with Passly. Single-sign on LaunchPads reduce access points, reducing risk. LEARN MORE>>
United States – Made in Oregon
https://www.infosecurity-magazine.com/news/oregon-retailer-suffers-sustained/
Exploit: Unauthorized Database Access
Made in Oregon: Specialty Gift Retailer
Risk to Business: 1.669 = Severe
Customers of gift retailer Made in Oregon got a little something extra when they purchased their treats – a side order of fraud. For more than 6 months, cybercriminals gained access to its e-commerce site, stealing payment information for transactions that occurred between the first week of February 2020 and the last week of August 2020.
Risk to Business: 1.669 = Severe
Customers who made an online purchase from Made in Oregon may have had their name, billing address, shipping address, email address, and credit card information compromised. The company has sent out notices to people who could be impacted, warning of identity theft and spear phishing dangers.
Customers Impacted: 7,800
How it Could Affect Your Customers’ Business Information that is stolen in incidents like this often ends up on the Dark Web in a data dump or information market where it powers cybercrime for years to come.
ID Agent to the Rescue: Guard against damage from credentials that end up in Dark Web data dumps with Dark Web ID. Keep your business credentials safe with our perfect blend of human and machine intelligence monitoring the Dark Web 24/7/365 to warn you of trouble. LEARN MORE>>
United States – Pfizer
https://pharmafield.co.uk/pharma_news/pfizer-suffers-huge-data-breach-on-unsecured-cloud-storage/
Exploit: Unsecured Database
Pfizer: Drugmaker
Risk to Business: 1.401 = Extreme
In a monster week for pharma hacking, Pfizer leads the pack with a substantial data breach that it brought on itself. In a huge blunder, unsecured and unencrypted data containing logs, transcripts, and details of patient helpline conversations was leaked from a misconfigured Google Cloud storage bucket. The exposed data included detailed information regarding hundreds of conversations between Pfizer’s automated customer support software and patients using drugs including Lyrica, Chantix, Viagra, Ibrance, and Aromasin.
Individual Risk: 1.412 = Extreme
The exposed call or chat transcripts had extensive PII and medical data for patients including full names, addresses, phone numbers, and details of health and medical conditions. The transcripts also contained detailed information about treatments, patient experiences, and questions related to products manufactured and sold by Pfizer.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Leaving this kind of information laying around is a hacker’s dream, and a security nightmare for your business as not only the recovery costs but the regulatory penalties for exposing this kind of data adds up.
ID Agent to the Rescue: Maintaining compliance with many data privacy regulations requires multifactor authentication, just one of the suite of security boosting features that are included with Passly. LEARN MORE>>
United States – City of Shafter
https://bakersfieldnow.com/news/local/city-of-shafter-hit-by-ransomware-attack
Exploit: Ransomware
City of Shafter: Municipal Government
Risk to Business: 1.714 = Severe
Cyberattacks against city governments and municipal services have been climbing worldwide, and Shafter, CA just joined the list after a ransomware attack took it’s systems offline for several days. The attack impaired the operations and delivery of city services, a common hallmark of recent municipal cybercrime.
Individual Risk: No personal or consumer information was reported as impacted in this incident.
Customers Impacted: 20,000
How it Could Affect Your Customers’ Business: Ransomware has been a menace to municipal governments large and small. Just last week, the Hackney Borough Council in London was rocked by ransomware, and the risk is growing for governments as incidents pile up.
ID Agent to the Rescue: Spotting and stopping phishing attacks is key to guarding your business against ransomware. BullPhish ID transforms staffers from a company’s biggest attack surface to it’s biggest asset with dynamic phishing resistance training. LEARN MORE>>
The Week in Breach News – Canada
Canada – The Société de transport de Montréal
Exploit: Ransomware
The Société de transport de Montréal: Municipal Transportation Agency
Risk to Business: 2.502 = Moderate
Getting around Montréal got a bit more complicated at The Société de transport de Montréal (STM) fell victim to a ransomware attack last week. While métro and bus service were not disrupted, after-sales service was not available and reservations for paratransit services were impacted.
Individual Risk: No personal data has been reported as impacted in this incident.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Ransomware attacks on municipal infrastructure and transportation sector targets have been growing more frequent, and businesses that service those industries are also at risk, creating a need for better ransomware protection.
ID Agent to the Rescue: Learn how to protect systems and data from ransomware in our eBook “Ransomware 101“. DOWNLOAD IT NOW>>
The Week in Breach News – United Kingdom & European Union
UK – Foxtons
https://propertyindustryeye.com/foxtons-hit-by-cyber-attack/
Exploit: Malware
Foxtons: Property Management
Risk to Business: 2.671 = Moderate
UK estate agency Foxtons was hit with a malware attack that impacted agency services, including a temporary shutdown of its MyFoxtons customer portal. The company describes the incident as a limited malware incident that infected a small part of the business but did not cause the loss of any data about its clients.
Individual Risk: No individual information has been reported as compromised in this incident.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Ransomware can steal data, but it can also just shut a business down. Even a partially successful attack that doesn’t exfiltrate data or infect the entire network is a headache.
ID Agent to the Rescue: Phishing is up by more than 600% in 2020. As the favored delivery system of ransomware, preventing phishing attacks from hitting your business with strong phishing resistance training using BullPhish ID is critical for stopping ransomware. SEE BULLPHISH ID IN ACTION>>
France – Sopra Steria
https://www.theregister.com/2020/10/22/sopra_steria_ryuk_ransomware_reports/
Exploit: Ransomware
Sopra Steria: IT Services and Data Center Operator
Risk to Business: 2.009 = Severe
French tech services giant Sopra Steria was slammed with a potential new variant of Ryuk ransomware, causing a disaster that could take months to clean up. The company, a member of France’s Cyber Campus, operates data centers for Britain’s NHS as well as operating software development, fintech, and consulting services. The investigation and recovery are expected to take months, and some systems are still not fully operational.
Individual Risk: No personal or financial data is reported as stolen or compromised in this incident.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Attacks on large IT services targets that operate data centers, especially if they have medical information, have been ramping up as the search for a vaccine for COVID-19 makes patient and research data a hot seller in Dark Web data markets.
ID Agent to the Rescue: A new ransomware variant is always a problem, but it’s still most likely to arrive at your business via a phishing email. BullPhish ID has 4 new plug-and-play phishing kits added every month to keep you up to date on the latest threats. LEARN MORE>>
Finland – Vastaamo
Exploit: Ransomware
Vastaamo: Mental Health Clinic Operator
Risk to Business: 2.702 = Severe
In a bizarre incident, a ransomware gang has snatched up the patient records of a mental healthcare clinic chain in Finland and is demanding ransom payments from the patients instead of the business. Vastaamo had not initially publically disclosed the breach due to the sensitive nature of the information stolen but has been working with authorities to investigate the incident and mitigate the damage.
Individual Risk: 1.327 = Extreme
The cybercriminals have been contacting the patients whose information they’ve obtained, demanding that recipients must pay 200 euros within 24 hours, or if they don’t meet that deadline, 500 euros within 48 hours, to prevent the public release of their therapy records.
Customers Impacted: 400,000
How it Could Affect Your Customers’ Business: This is this company’s second major data breach – the CEO was just terminated for the first one a week ago. Failing to implement strict security awareness and data handling policies after an incident, especially when your company keeps sensitive information, is a recipe for disaster.
ID Agent to the Rescue: Start using Passly to secure the points of access to all of your databases and files, especially highly sensitive data. Multifactor authentication puts an affordable extra roadblock between cybercriminals and your data. SEE PASSLY AT WORK>>
Germany – Scalable Capital
https://international-adviser.com/robo-advice-firm-suffers-data-breach/
Exploit: Malicious Insider
Scalable Capital: Online Financial Advice
Risk to Business: 1.227 = Extreme
At least one malicious insider is to blame for a cybersecurity disaster at fintech firm Scalable Capital. The firm said in a statement that it had discovered the incident on October 16 and taken action to prevent further damage, but a large amount of sensitive client data including financial information was snatched. It also concluded that it was clear that the attack was the work of someone with extensive insider knowledge of their systems.
Individual Risk: 1.411 = Extreme
Clients impacted in the breach had what the company characterizes as general information exposed including names, residential addresses, and email addresses.
Customers Impacted: 20,000
How it Could Affect Your Customers’ Business: Insider incidents are incredibly devastating, but also preventable. Whether you’re dealing with a malicious insider like this case or just a careless employee, learning to spot and stop insider threats pays off.
ID Agent to the Rescue: Can you detect an insider threat fast? Don’t let staffers cause your business harm whether they mean to or not. Learn to spot and stop insider threats with our Stop Insider Threats resource package. DOWNLOAD THIS RESOURCE>>
The Week in Breach News – Asia Pacific
India – Dr. Reddy’s
https://www.infosecurity-magazine.com/news/covid19-vaccine-global/
Exploit: Hacking
Dr. Reddy’s: Drugmaker
Risk to Business: 1.206 = Extreme
In yet another attack on a pharmaceutical industry giant, India’s Dr.Reddy’s was crippled by a nasty hacking incident. The producer of vital COVID-19 treatments like remdesivir and favipiravir and expected manufacturer of Russia’s future Sputnik-V COVID-19 vaccine, Dr.Reddy’s was forced to shut operations at several global facilities, just as it was granted permission to begin a second round of human trials for Sputnik-V.
Individual Impact: No personal data was exposed in this incident.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Healthcare targets have been getting nailed with a blizzard of attacks recently. Increasing protection like security awareness training and adding secure identity and access management is a smart move.
ID Agent to the Rescue: Our digital risk protection platform offers businesses multiple tools for securing their systems and data, even from unexpected dangers. LEARN MORE>>
Japan – Shionogi & Company Limited
Exploit: Ransomware
Shionogi & Company Limited: Drugmaker
Risk to Business: 2.211 = Severe
Healthcare and pharmaceutical targets were on every cybercriminal’s menu this week, including Japanese medical giant Shionogi & Company Limited. The company’s Taiwanese subsidiary experienced a data breach that included sensitive information but did not impact its COVID-19 vaccine development programs. Data including import licenses for medical equipment and employee residency permits was exposed on the Dark Web as proof of the attack by the hacking gang to support a ransom demand.
Individual Risk: No individual information was reported as impacted in this incident.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Ransomware typically arrives as the nasty cargo of a phishing email. Phishing is today’s biggest cybersecurity risk, and this kind of damage is exactly what makes it every IT professional’s nightmare.
ID Agent to the Rescue: Refresh your security awareness and phishing resistance training regularly with BullPhish ID to reduce the chance of your business falling prey to a cyberattack by up to 70%. SEE BULLPHISH ID AT WORK>>
The Week in Breach – Africa
South Africa – Nando’s Peri-Peri
Exploit: Credential Stuffing
Nando’s Peri-Peri – Restaurant Chain
Risk to Business: 2.775 = Moderate
A credential stuffing incident gave customers of this popular high street restaurant chain a little more than they bargained for after several customers discovered that huge orders had been placed using their online accounts. to comply with COVID-19 operating regulations, Nando’s customers who are getting takeout are required to scan a QR code with their phone to order their food online, which opened up a vulnerability that cybercriminals were more than happy to exploit.
Individual Risk: 2.802 = Moderate
Some customers have had their accounts hijacked with large food orders places, but the company is working with them to restore any funds snatched from pre-paid carryout orders while encouraging customers to reset their account credentials if they suspect that they may have been impacted.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Credential stuffing is a favorite because it’s easy and cheap. Huge repositories of passwords in Dark Web data dumps give cybercriminals plenty of ammunition and produce results with little investment.
ID Agent to the Rescue: Credential stuffing attacks are pretty easy to mitigate too. Add multifactor authentication with Passly to mount a strong defense that stops credential stuffing attacks cold. SEE A DEMO>>
The Week in Breach News Guide to Our Risk Scores
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.
