Week in Breach
Olympus Corporation of the Americas
Exploit: Ransomware
Olympus Corporation of the Americas: Medical Technology Manufacturer
Risk to Business: 2.122 = Severe
Olympus was forced to take down IT systems in the U.S., Canada, and Latin America following a cyberattack that hit its network Sunday. The medical equipment manufacturer says that it does not believe that any data was stolen. Olympus also said that the incident was contained to the Americas with no known impact to other regions. Just last month, Olympus suffered another ransomware attack on its EMEA region systems.
Individual Impact: No consumer PII or financial data loss was disclosed in this breach as of press time.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business: Many ransomware gangs aren’t bothering to steal data anymore, opting to lock down networks and production lines to force a speedy ransom payment.
ID Agent to the Rescue: 50% of ransomware attacks in 2020 were against SMBs. Learn more about how ransomware is evolving and how to protect your clients in Ransomware Exposed. GET THIS EBOOK>>
Premier Patient Healthcare
https://www.govinfosecurity.com/former-executive-accessed-phi-nearly-38000-individuals-a-17724
Exploit: Malicious Insider
Premier Patient Healthcare: Medical Clinic Chain
Risk to Business: 1.712=Severe
Texas-based accountable care organization Premier Patient Healthcare filed a statement this week detailing a malicious insider incident that caused the exposure of PII for over 37,000 patients from around the country. According to the report, a terminated executive had retained credentials that enabled them to access and obtain an unspecified amount of PHI. No further details were included and a HIPAA filing has not yet appeared. When the breach first came to light, the company’s early statements pointed to a fault at a vendor, which turned out to not be the case.
Individual Risk: 1.712=Severe
The patient records that were accessed included name, age, sex, race, county and state of residence, and zip code, as well as Medicare beneficiary information, such as Medicare eligibility period, spend information, and hierarchical condition category risk score for an unspecified number of patients.
Customers Impacted: 8.5 million
How It Could Affect Your Customers’ Business This incident isn’t just a double helping of embarrassment for Premier Patient Healthcare, it’s also going to be a financial nightmare after regulators get finished with them.
ID Agent to the Rescue: Building cyber resilience helps insulate organizations from trouble like this. Learn more about why cyber resilience is the ticket to a safer future for your clients. GET THIS EBOOK>>
Ecuador- Banco Pichincha
Exploit: Ransomware
Banco Pichincha: Banking & Financial Services
Risk to Business: 1.412=Extreme
Ecuador’s largest private bank Banco Pichincha has suffered a suspected ransomware attack that has resulted in some systems being knocked offline for days. Many services of the bank were disrupted, including online banking, its mobile app and ATM network. The bank is working with national authorities at the Superintendency of Banks to investigate the incident. In an internal notification sent to the Bank’s agencies and seen by BleepingComputer, employees are notified that bank applications, email, digital channels, and self-services will not be operational for an unspecified amount of time due to a technology issue, limiting many bank services to in-person transactions. Some ATM services have been restored. The incident is ongoing.
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business Attacks on the banking and fintech sectors have been growing, creating complications for every financial services organization.
ID Agent to the Rescue: See how to transform every employee into a security asset to become the real secret weapon that successful organizations deploy to fight cybercrime like phishing! WATCH NOW>>
Argentina – Registro Nacional de las Personas (RENAPER)/National Registry of Persons
https://therecord.media/hacker-steals-government-id-database-for-argentinas-entire-population/
Exploit: Hacking
Registro Nacional de las Personas (RENAPER): National Identity Database
Risk to Business: 1.232=Extreme
Hackers have broken into the Argentina Interior Ministry’s IT network and stolen a massive amount of data from Registro Nacional de las Personas (RENAPER)/National Registry of Persons. That extremely sensitive database contains ID card details for the country’s entire population. The leak was announced when a Twitter user posted ID card photos and personal details for 44 Argentinian celebrities including the country’s president Alberto Fernández and soccer superstars Lionel Messi and Sergio Aguero. While the Argentine government admits to the hack, they maintain that no data was stolen. However, cybersecurity experts and journalists were able to contact the threat actors through a dark web posting and confirm the authenticity of the database. The hackers appear to have gained access through a compromised VPN.
Risk to Business: 1.222= Extreme
According to a sample provided by the hacker online, the information they have access to right now includes full names, home addresses, birth dates, gender info, ID card issuance and expiration dates, labor identification codes, Trámite numbers, citizen numbers, and government photo IDs.
Customers Impacted: The population of Argentina is 45 million
How it Could Affect Your Customers’ Business A strong security culture helps reduce the likelihood of an incident caused by employee carelessness as this one reportedly was.
ID Agent to the Rescue: Gamify cybersecurity and information safety to make it interesting. Our Security Awareness Champion’s Guide helps explain complex risks in a fun way! DOWNLOAD IT>>
Brazil – Hariexpress
https://www.infosecurity-magazine.com/news/ecommerce-player-leaks-billion/
Exploit: Misconfiguration
Hariexpress: e-Commerce Firm
Risk to Business: 1.616 = Severe
Brazilian e-commerce firm Hariexpress is in hot water after it exposed an estimated to 1.8 billion client and seller records. The problem appears to have originated with a misconfigured Elasticsearch server, according to researchers. The server was left unencrypted with no password protection in place, exposing 610GB of data and that data may have been exposed for several months.
Individual Risk: 1.616 = Severe
Exposed customer data included full names, home and delivery addresses, phone numbers and billing details. Also exposed were sellers’ full names, email and business/home addresses, phone numbers and business/tax IDs (CNPJ/CPF).
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Human error will always be a company’s biggest cyberattack risk. It pays to make sure that everyone feels like they’re responsible for security to avoid messes like this.
ID Agent to the Rescue Solving complex security problems in a mobile access world can be fraught with peril. Find answers to 5 common remote and hybrid security problems in this handy infographic. DOWNLOAD IT>>
Over 80% of organizations felt the sting of cybercrime in 2020. See what cybercriminals are shopping for to better predict what will happen next in The Global Year in Breach 2021. READ IT>>
Are you ready to slay the Monsters of Cybersecurity? This checklist tells you what you’ll need to succeed! GET CHECKLIST>>
Spain – Meliá Hotels International
https://therecord.media/cyberattack-hits-melia-one-of-the-largest-hotel-chains-in-the-world/
Exploit: Ransomware
Meliá Hotels International: Hotel Chain
Risk to Business: 1.615 = Severe
Meliá Hotels International, one of the largest hotel chains in the world, had fallen victim to a suspected ransomware attack. Attackers took down parts of the hotel chain’s internal network and some web-based servers, including its reservation system and public websites. An investigation is underway. No ransomware gang has yet claimed responsibility.
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Ransomware is always expensive. Even without the extortion demand, it can cause massive losses simply from business interruption.
ID Agent to the Rescue Horrors like ransomware lurk around every corner, lying in wait for unwary organizations. Learn how to defeat them in our new eBook Monsters of Cybersecurity. DOWNLOAD IT NOW>>
Our partners typically realize ROI in 30 days or less. See why nearly 4,000 MSPs in 30 countries choose to grow with ID AGENT solutions and support. BECOME A PARTNER>>
Taiwan – Acer
Exploit: Hacking
Acer: Computer Manufacturer
Risk to Business: 1.631 = Severe
Acer has just been beleaguered by cyberattacks in 2021. In its second time at the dance this year, Acer’s India after-sales service has suffered a data breach. A threat actor has already claimed the attack on a popular hacker forum, saying that they stole more than 60GB of files and databases from Acer’s servers. The stolen data includes client, corporate, and financial data and login details belonging to Acer retailers and distributors from India. The threat actor posted a video showcasing the stolen files and databases to a dark web forum showcasing the records of 10,000 customers, and stolen credentials for 3,000 Indian Acer distributors and retailers.
Individual Impact: No information about the nature of the exposed customer data was available at press time.
Customers Impacted: Unknown
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.
cyberthreats is ransomware, with new varieties coming at businesses and IT professionals faster and more furiously than ever before. Ransomware has been consistently on the rise in 2021, with global attack volume increasing by 151% for the first six months of the year compared with the same period in 2020. As though ransomware wasn’t already a body blow to any business, a fresh twist on that old favorite is adding a touch of extra devastation to anyone it hits.
Ransomware continues to be the story for media coverage about ransomware, and that makes sure it stays at the forefront of your clients’ minds. That’s a good thing; 54% of SMBs in a recent survey claimed that they were too small to be at risk of a cyberattack. Unfortunately, that is a dangerous misconception that puts businesses at risk for trouble.
Ransomware Fast Facts
- 50% of ransomware victims in 2020 were SMBs
- 55% of ransomware attacks now involve companies with fewer than 100 employees
- Ransom demands are up by more than 40% in 2021 in a year-over-year comparison to 2020
Are you ready to take back control of cyberattack risk from the villains on the dark web? This webinar shows you where to start. WATCH NOW>>
A Nasty Rising Threat
A recent report on a nasty up-and-coming variety of ransomware sheds light on exactly how devious – and devastating – one of today’s souped-up ransomware threats can be. Dubbed Yanluowang, researchers report that the cybercriminals behind this type of ransomware have raised the stakes. A Yanluowang attack follows many of the familiar patterns of a traditional ransomware threat, starting with the usual penetration of a company’s IT systems typically through phishing. An estimated 94 % of ransomware arrives at businesses via email.
That grand entrance is followed by a quick-spreading infection that encrypts data and wreaks havoc in the victim’s IT environment. This attack follows the popular double extortion model, demanding that victims pay multiple ransoms to obtain a decryptor for their frozen data and equipment. Similar attacks prefer the triple extortion style, demanding three separate sums from victims. The average ransomware payment climbed 82% over the same period in 2020 to a record $570,000 in the first half of 2021. But that’s where the normalcy in Yanluowang stops because the operators’ further demands take the attack to the next level.
The cybercriminals behind Yanluowang drop an increasingly popular threat on their victims that’s familiar to anyone who’s familiar with classic crime-show kidnapping: don’t call the cops. These ransomware operators promise in their ransom note that the victim calls in outside help or contacts law enforcement officials, the gang will launch DDoS attacks against the victim to snarl their company websites in so much traffic that they’re rendered inoperable. Adding insult to injury, the extortionists also threaten to call customers and business partners and divulge company secrets. They also insinuate that uncooperative victims will face further damage. The bad actors threaten to attack again or return with additional attacks or delete the encrypted data.
Do you have all of the bases covered? Use this checklist to be sure that your client’s business is protected from cybercrime! DOWNLOAD IT>>
Even Cybercriminals Follow Influencers
Sometimes called Ransom DDoS (RDDoS) or Cascading Extortion attacks, this tactic isn’t limited to just one kind of malware or the playbook of one ransomware gang. It’s also not new but it has grown much more prominent in the last few months. Purportedly innovated by legendary ransomware outfit Evil Corp (REvil), the gang provided a free service to its menu that enabled RaaS buyers to pay the group or affiliated partners to take further action against recalcitrant victims, including voice-scrambled VOIP calls to the media or the victim’s business partners and clients with information about the attack to ramp up the pressure by further damaging the victim’s business.
Evil Corp may have brought Ransom DDoS (RDDoS) attacks to prominence in the cybercrime underworld, but other ransomware organizations were quick to hop on that lucrative bandwagon. Well-known ransomware operators such as SunCrypt and Ragnor Locker were also early adopters of the cascading extortion technique, according to a report in Bleeping Computer. Experts also contend that other ransomware gangs are offering the RDDoS option on their menu. Signs point to the Avaddon ransomware group and notorious cybercrime gang DarkSide, who rose to prominence with their Colonial Pipeline attack, as regular users of this type of ransomware threat.
Zero Trust security is the key to keeping your clients safe – and the cornerstone is access management. We can help. LEARN MORE>>
Rapidly Evolving Threats Are Around Every Corner
Ransomware techniques are continually evolving, seemingly popping up like mushrooms after a rainstorm. Bad actors know that they have to keep adding new tactics and changing things around because cybersecurity solutions are evolving just as quickly. That’s why adding an extra component like a DDoS attack is a smart move for threat actors and ransomware developers. DDoS attacks are cheap and easy, creating a very low barrier to entry with very low risk. However, they can be extremely lucrative, making them a perfect add-on to a multi-extortion attack or a menu of cybercrime services,
Businesses just cannot afford the kind of downtime that sustained DDoS attacks promise. In an analysis of almost 200 successful ransomware attacks against US businesses in 2020, researchers discovered that ransomware is as crippling as you think it is. The surveyed companies lost an estimated $21 billion due to attack-induced downtime after a successful ransomware incident. That’s just under 250% more than the same cost in 2019. No matter how big or small the company that is hit may be, they’re going to lose serious money on a ransomware attack, without even considering the ransom demand.
Ransomware is Expensive Beyond the Ransom
- Companies impacted by ransomware lost an average of six working days.
- An estimated 37% of companies experienced downtime that lasted one week or more.
- One incident investigation costs an SMB an estimated $15k
Learn the Secret of How Cybercriminals Trick You Into Falling for Phishing Messages!
