Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Information Security. Show all posts
VoIP
Cisco Data Breach Employee Data Information Security Multi-Factor Authentication (MFA) SMS Supply chain vulnerability third party VoIP

Cisco Duo raises awareness over a breach in third-party data security, revealing the exposure of SMS MFA logs.

 

In the ever-evolving landscape of cybersecurity, safeguarding sensitive information and ensuring secure access to corporate networks are paramount concerns for organizations worldwide. Recently, Cisco Duo, a leading provider of multi-factor authentication (MFA) and Single Sign-On services, found itself grappling with a significant breach that shed light on the evolving threats confronting modern enterprises. 

On April 1, 2024, Cisco Duo's security team sent out a warning to its extensive customer base regarding a cyberattack targeting their telephony provider, which handles the transmission of SMS and VoIP MFA messages. According to reports, threat actors leveraged employee credentials acquired through a sophisticated phishing attack to infiltrate the provider's systems. 

Following the breach, the attackers successfully obtained and extracted SMS and VoIP MFA message logs linked to specific Duo accounts, covering the timeframe from March 1, 2024, to March 31, 2024. The ramifications of this breach are deeply concerning. While the provider assured that the threat actors did not access the contents of the messages or utilize their access to send messages to customers, the stolen message logs contain data that could be exploited in targeted phishing campaigns. 

This poses a significant risk to affected organizations, potentially resulting in unauthorized access to sensitive information, including corporate credentials. In response to the breach, Cisco Duo swiftly mobilized, collaborating closely with the telephony provider to conduct a thorough investigation and implement additional security measures. The compromised credentials were promptly invalidated, and robust measures were instituted to fortify defenses and mitigate the risk of recurrence. 

Additionally, the provider furnished Cisco Duo with comprehensive access to all exposed message logs, enabling a meticulous analysis of the breach's scope and impact. Despite these proactive measures, Cisco Duo has urged affected customers to exercise heightened vigilance against potential SMS phishing or social engineering attacks leveraging the stolen information. Organizations are advised to promptly notify users whose phone numbers were contained in the compromised logs, educating them about the risks associated with social engineering tactics. 

Furthermore, Cisco has emphasized the importance of promptly reporting any suspicious activity and implementing proactive measures to mitigate potential threats. This incident serves as a stark reminder of the persistent and evolving threat landscape faced by organizations in today's digital age. As reliance on MFA and other security solutions intensifies, proactive monitoring, regular security assessments, and ongoing user education are indispensable components of an effective cybersecurity posture. 

Moreover, the Cisco Duo breach underscores the broader issue of supply chain vulnerabilities in cybersecurity. While organizations diligently fortify their internal defenses, they remain susceptible to breaches through third-party service providers. Hence, it is imperative for businesses to meticulously evaluate the security practices of their vendors and establish robust protocols for managing third-party risks. 

As the cybersecurity landscape continues to evolve, organizations must remain agile, adaptive, and proactive in their approach to cybersecurity. By prioritizing robust security measures, fostering a culture of cyber resilience, and fostering close collaboration with trusted partners, organizations can effectively mitigate risks and safeguard their digital assets in the face of evolving threats.
Read more »
US Cybersecurity
Breach CISA critical infrastructure risk Cyber Security Data Analytics Information Security supply chain attacks US Cybersecurity

CISA Investigates Sisense Breach: Critical Infrastructure at Risk

 

In the fast-paced landscape of cybersecurity, recent events have once again brought to light the vulnerabilities that critical infrastructure organizations face. The breach of data analytics company Sisense, under investigation by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), serves as a stark reminder of the importance of robust security measures in protecting sensitive data and systems. 

Sisense, a prominent American business intelligence software company, found itself at the center of a security incident impacting not only its own operations but also critical infrastructure sector organizations across the United States. 

With offices in New York City, London, and Tel Aviv, and a clientele including major players like Nasdaq, ZoomInfo, Verizon, and Air Canada, the breach sent shockwaves through the cybersecurity community. CISA's involvement underscores the severity of the situation, with the agency actively collaborating with private industry partners to assess the extent of the breach and its implications for critical infrastructure. 

As investigations unfold, the focus is on understanding the nature of the compromise and mitigating potential risks to affected organizations. In response to the breach, CISA has issued recommendations for all Sisense customers to reset any credentials and secrets that may have been exposed or used to access the company's platform and services.

This proactive measure aims to prevent further unauthorized access and protect sensitive information from exploitation. Sisense's Chief Information Security Officer, Sangram Dash, echoed CISA's advice in a message to customers, emphasizing the importance of promptly rotating credentials used within the Sisense application. This precautionary step aligns with best practices in cybersecurity, where rapid response and mitigation are essential to minimizing the impact of security incidents. 

Additionally, customers are urged to report any suspicious activity related to potentially exposed credentials or unauthorized access to Sisense services to CISA. This collaborative approach between organizations and government agencies is crucial in addressing cybersecurity threats effectively and safeguarding critical infrastructure from harm. The incident involving Sisense is not an isolated event. 

Similar supply chain attacks have targeted critical infrastructure organizations in the past, highlighting the need for heightened vigilance and resilience in the face of evolving cyber threats. One such attack, involving the 3CX breach a year ago, had far-reaching consequences, impacting power suppliers responsible for generating and distributing energy across the grid in the United States and Europe. 

As organizations grapple with the aftermath of the Sisense breach, lessons learned from this incident can inform future cybersecurity strategies. Proactive measures such as continuous monitoring, regular security assessments, and robust incident response plans are essential for mitigating risks and protecting critical infrastructure assets. 

The Sisense breach serves as a wake-up call for the cybersecurity community, emphasizing the interconnected nature of cyber threats and the imperative of collaboration in defending against them. By working together and adopting a proactive stance, organizations can bolster their defenses and safeguard critical infrastructure from cyber adversaries.
Read more »
XZ Utils Library
Backdoor Information Security Linux Linux Security Vulnerabilities and Exploits XZ Utils Library

Unveiling the XZ Utils Backdoor: A Wake-Up Call for Linux Security

 

The recent discovery of a backdoor in the XZ Utils, a vital tool for lossless data compression on Linux, has sent shockwaves through the tech community. This revelation poses a significant risk to nearly all Linux systems, prompting urgent concerns about cybersecurity and system integrity. 

The Common Vulnerabilities and Exposures (CVE) system, a reference for publicly known information-security vulnerabilities, assigned a severity score of 10/10 to the Linux XZ Utils backdoor. This rating underscores the gravity of the situation and underscores the urgent need for action. 

The initial detection of the backdoor was made by Andres Freund, a PostgreSQL developer at Microsoft. Freund noticed unusual SSH login delays and CPU usage spikes on a Debian Linux system, leading to an investigation that uncovered the presence of the backdoor in the XZ Utils. This discovery exposed countless Linux servers and workstations to potential attacks, highlighting the widespread impact of the vulnerability. 

The backdoor was cleverly concealed within binary files in the XZ Utils’ test folder, encrypted using the XZ library itself, making it difficult to detect. While systems running Debian or Red Hat Linux distributions were particularly vulnerable, Arch Linux and Gentoo Linux appeared to be spared due to their unique system architectures. The malware exploited an audit hook in the dynamic linker, a fundamental component of the Linux operating system, enabling attackers to execute code remotely at the system level. 

This capability granted them full control over compromised systems, posing severe risks such as data theft, system disruption, and the deployment of additional malware or ransomware. Further investigations revealed that the breach of the XZ repository was a sophisticated and well-coordinated effort, likely involving multiple individuals. This complexity raises concerns about the extent of the damage and the potential for other undiscovered vulnerabilities. 

The attack's sophistication suggests a deep understanding of the Linux ecosystem and the XZ Utils, highlighting the need for enhanced security measures in open-source software development. Immediate steps, such as updating to patched versions of XZ Utils or reverting to safe earlier versions, are crucial for system security. This incident serves as a wake-up call for the Linux community to reassess its security practices and strengthen defenses against future attacks. 

Rigorous code reviews, increased use of security auditing tools, and fostering transparency and collaboration among developers and security researchers are essential steps to mitigate similar threats in the future. As the tech community grapples with the implications of this backdoor, ongoing research is underway to determine the full extent of the threat. This incident underscores the critical importance of system security and the need for continuous vigilance against evolving cyber threats. Together, we must learn from this experience and work towards building a more secure and resilient Linux ecosystem.
Read more »
Wifi vulnerability
Cyber Security Hacking Risk Information Security Public Wifi VPN WiFi Wifi vulnerability

Hidden Dangers of Public Wi-Fi: What A Traveler Needs To Know

 

Public Wi-Fi networks have become ubiquitous in our modern world, offering convenience and connectivity to travellers and commuters alike. However, beneath the surface lies a web of hidden dangers that could compromise your privacy and security. As an expert in cybersecurity, it's crucial to shed light on these risks and provide travellers with the knowledge they need to protect themselves in an increasingly connected world. 

One of the most significant dangers of connecting to public Wi-Fi is the risk of falling victim to a cyberattack. These networks are often unsecured, making it easy for hackers to intercept sensitive information transmitted over them. From passwords to financial data, travellers risk exposing their most personal information to prying eyes. Another hidden danger of public Wi-Fi is the prevalence of rogue hotspots. 

These malicious networks are designed to mimic legitimate Wi-Fi networks, tricking unsuspecting users into connecting to them. Once connected, hackers can launch various attacks, from phishing scams to malware downloads, putting travellers' devices and data at risk. Furthermore, public Wi-Fi networks are often monitored by cybercriminals looking to steal valuable information from unsuspecting users. 

By intercepting unencrypted data packets, hackers can gain access to usernames, passwords, and other sensitive information, leaving travellers vulnerable to identity theft and fraud. To mitigate the risks associated with public Wi-Fi, travellers should take proactive measures to protect themselves and their data. One of the most effective ways to stay safe is to avoid connecting to public Wi-Fi networks altogether, especially when handling sensitive information such as online banking or email access. 

If connecting to public Wi-Fi is unavoidable, travellers should use a virtual private network (VPN) to encrypt their internet traffic and protect their data from prying eyes. Additionally, travellers should enable two-factor authentication on all their accounts to add an extra layer of security against unauthorized access. It's also essential for travellers to keep their devices and software up-to-date with the latest security patches and updates. 

By regularly updating their devices, travellers can patch known vulnerabilities and reduce the risk of falling victim to cyberattacks. In conclusion, while public Wi-Fi networks offer convenience and connectivity to travellers, they also pose significant risks to privacy and security. By staying vigilant and taking proactive measures to protect themselves and their data, travellers can minimize the hidden dangers of public Wi-Fi and enjoy a safer and more secure travel experience.
Read more »
SMB
BEC BEC frauds Cyber Attacks Information Information Security Ransomware attack SMB

SMB Cyber Threats: Information-Stealing Malware, Ransomware, and BEC

 

In today's digital landscape, small and medium-sized businesses (SMBs) are increasingly becoming prime targets for cybercriminals looking to exploit vulnerabilities for financial gain. A recent report from cybersecurity firm Sophos sheds light on the top cyber threats facing SMBs, highlighting information-stealing malware, ransomware, and business email compromise (BEC) as the most prevalent dangers. 

These malicious programs are designed to clandestinely gather sensitive data and login credentials, posing significant risks to businesses that may not have robust cybersecurity measures in place. The insidious nature of infostealers lies in their ability to operate discreetly, often evading detection until substantial damage has been done. 

Christopher Budd, director of Sophos X-Ops, underscores the escalating value of stolen data among cybercriminals, particularly concerning SMBs. He elucidates a hypothetical scenario where attackers exploit infostealers to compromise a business's accounting software, thereby gaining access to critical financial information and potentially siphoning funds into their own accounts. 

This underscores the dire consequences of falling victim to information-stealing malware, which can have far-reaching financial and reputational implications for SMBs. Despite the prevalence of infostealers, ransomware remains the most significant threat to SMBs' cybersecurity. While Sophos reports that the number of ransomware attacks has stabilized, the evolution of ransomware tactics continues unabated. 

One alarming trend highlighted in the report is the rise of remote encryption attacks, wherein threat actors leverage unmanaged devices within a victim organization to encrypt files on other systems. This sophisticated approach underscores the adaptability and persistence of ransomware operators in their quest to extort businesses for financial gain. 

Following closely behind ransomware, BEC attacks represent another formidable threat to SMBs. These attacks involve cybercriminals engaging in deceptive email correspondence or even phone calls with victims to gather sensitive information or manipulate them into transferring funds. The increasing sophistication of BEC tactics poses significant challenges for SMBs, as attackers leverage social engineering techniques to bypass traditional cybersecurity defenses. 

To mitigate these cyber threats effectively, SMBs must adopt a multi-faceted approach to cybersecurity. This includes implementing robust endpoint protection solutions, regularly updating software to patch known vulnerabilities, and providing comprehensive employee training on cybersecurity best practices. 

Additionally, adopting measures such as multi-factor authentication and encryption can add layers of security to sensitive data and communications, making it more challenging for cybercriminals to exploit vulnerabilities.

The SMBs must remain vigilant in the face of evolving cyber threats and prioritize cybersecurity as a fundamental aspect of their business operations. By staying informed about emerging threats and investing in proactive cybersecurity measures, SMBs can fortify their defenses and safeguard their digital assets against malicious actors. With cyber threats continuing to evolve in sophistication and scale, proactive cybersecurity measures are essential for protecting the interests and integrity of SMBs in today's digital landscape.
Read more »
Information Security
Cybersecurity Data Breach Data Hacking HPE Information Security

HPE Cybersecurity Challenge: Data Breach Sparks Investigation

 

Hewlett Packard Enterprise (HPE), a leading technology company, is currently grappling with a potential security breach as reports emerge of sensitive data being offered for sale on a prominent hacking forum. This latest incident underscores the persistent challenges faced by major corporations in safeguarding their digital assets and protecting user information. 

The breach, which is currently under investigation by HPE's cybersecurity teams, comes amid a wave of increased cyber threats targeting organizations across various industries. The data purportedly for sale on the hacking forum includes information that, if exploited, could pose serious risks to the company and its clients. 

HPE, known for its extensive range of enterprise solutions and IT services, is taking the reported breach seriously. The company has initiated a comprehensive internal investigation to assess the scope of the incident, identify potential vulnerabilities, and implement necessary measures to mitigate the impact. 

The data on the hacking forum is said to contain a variety of sensitive information, including user credentials, proprietary software details, and potentially confidential client data. The potential exposure of such data raises concerns not only about the privacy of individuals associated with HPE but also about the potential misuse of corporate information. 

This incident highlights the evolving tactics employed by cybercriminals, who are becoming increasingly sophisticated in their approach. As organizations fortify their cybersecurity defences, threat actors adapt, finding new avenues to exploit vulnerabilities and gain unauthorized access to sensitive data. 

The timing of this breach is particularly noteworthy, given the global increase in remote work and reliance on digital infrastructure. With a growing attack surface, companies must remain vigilant in implementing robust cybersecurity measures to counteract the heightened risk of cyber threats. 

HPE is urging its clients and stakeholders to exercise caution and implement additional security measures. This includes advising users to update passwords, enable multi-factor authentication, and monitor their accounts for any suspicious activity. The company is also liaising with law enforcement agencies to track down the perpetrators and hold them accountable. The potential fallout from this breach extends beyond the immediate concerns of HPE and its clients. It raises broader questions about the cybersecurity landscape and the need for a collective effort to address the escalating threats faced by organizations globally. 

As the investigation unfolds, HPE will likely face increased scrutiny from industry regulators and cybersecurity experts. The incident serves as a stark reminder that no organization is immune to cyber threats, and constant vigilance and adaptation are imperative in safeguarding digital assets. 

In the wake of the reported breach at HPE and the emergence of sensitive data on a hacking forum, the incident serves as a poignant reminder of the perpetual challenges organisations face in safeguarding their digital assets. As HPE undertakes a thorough investigation and implements measures to mitigate potential repercussions, the broader cybersecurity landscape calls for renewed vigilance, adaptability, and collaborative efforts. The evolving tactics of cybercriminals underscore the necessity for constant innovation in cybersecurity strategies. 

The aftermath of this breach will likely resonate across industries, prompting a collective reflection on the imperative of proactive measures and the ongoing commitment required to stay ahead of ever-evolving cyber threats in our digitally interconnected world.
Read more »
user data security
cryptocurrency Dark Web Data Breach Identity Theft Information Security user data security

Binance Data Breach Sparks Concerns: Dark Web Sale Rumors Surface

 

In a surprising development, cryptocurrency giant Binance finds itself facing the looming threat of a potential data breach, as claims circulate on the dark web suggesting the sale of sensitive user information. This occurrence has sent shockwaves throughout the cryptocurrency community, prompting apprehension about the security of one of the world's leading digital currency exchanges. 

Renowned for its extensive selection of digital assets and user-friendly interface, Binance has not been impervious to the escalating menace of cyberattacks targeting the cryptocurrency sector. Reports indicate that an individual or a group of hackers is asserting possession of a significant amount of user data from Binance, purportedly offering it for sale on the dark web. 

The alleged data breach has cast a spotlight on Binance's security infrastructure, compelling the company to initiate a comprehensive investigation to verify the authenticity of the claims. Users anxiously await official statements from the exchange detailing the extent of the breach, identifying potential vulnerabilities, and outlining measures taken to mitigate the repercussions. 

Should the dark web sale prove to be true, it could expose sensitive information, including user account credentials, email addresses, and other personally identifiable details. This not only raises concerns about individual privacy but also the potential exploitation of this data for illicit activities, such as phishing attempts and identity theft. 

Despite Binance's proactive approach to security, incorporating measures such as two-factor authentication and cold wallet storage, the dynamic nature of cyber threats poses an ongoing challenge for even the most robust security protocols. 

Users are strongly advised to exercise vigilance and adopt precautionary measures, including password updates, enabling two-factor authentication, and regular monitoring of their accounts for any signs of suspicious activity. Binance has reassured users that it is treating the situation seriously and is diligently working to validate the extent of the alleged data breach. 

This potential breach at Binance also prompts broader inquiries into the overall security stance of cryptocurrency exchanges. As the digital asset landscape continues to expand, the imperative to secure user data and assets becomes increasingly paramount. Regulatory bodies and industry stakeholders are expected to scrutinize such incidents, emphasizing the necessity for stringent cybersecurity measures across the cryptocurrency ecosystem. 

In summary, the potential data breach at Binance and the accompanying dark web sale claims underscore the persistent challenges confronting cryptocurrency exchanges in safeguarding user information. This incident serves as a poignant reminder for users to prioritize security best practices, while exchanges must continually reassess and fortify their cybersecurity measures to counter evolving cyber threats. The cryptocurrency community awaits further updates from Binance regarding the investigation and any actions taken to address this disconcerting situation.
Read more »
Threats of Technology
Data Breach Data Theft India Information Security Threats of Technology

Unprecedented Data Breach Exposes Personal Information of Millions in India

Described as the biggest data breach ever, a big security mistake has apparently leaked the personal info of millions of people around the world. CloudSEK, an Indian cybersecurity company, brought attention to the breach, exposing extensive sensitive data, including names, mobile numbers, addresses, and unique 12-digit Aadhaar card numbers. Surprisingly, two groups involved in cybercrime, including CYBO CREW-affiliated CyboDevil and UNIT8200, are selling the data for $3,000. 

CYBOCREW is a relatively new threat group that was initially identified in July 2023. This group has been focusing on organizations in various sectors like automobile, jewellery, insurance, and apparel, carrying out significant breaches. Among its most active affiliates are CyboDevil and UNIT8200. 

Reportedly in the recent attack 750 million Indians have been hit, constituting around 85% of the country's 1.4 billion population, this disclosure raises serious concerns regarding the security and privacy of personal information, marking a critical incident in the cybersecurity domain. 

The breach's severity is magnified by the revelation of Aadhaar card numbers, a crucial identification document in India. The leaked data encompasses details frequently used for identity verification and authentication, leaving affected individuals susceptible to various forms of exploitation, including identity theft and fraud. 

The repercussions of this breach extend to mobile network subscribers in multiple countries, amplifying concerns about privacy and data security. According to CloudSEK researchers, the compromised database contains sensitive security information and has been compressed from 1.8TB to 600GB. 
In their analysis of the extensive personally identifiable information (PII) within the database, CloudSEK identified the global impact on major telecom providers. 

Despite the widespread implications, users in India face heightened risks due to the exposure of their unique Aadhaar identification numbers. This increased vulnerability raises concerns about potential identity theft, financial fraud, and a greater susceptibility to cybercrime for those affected. 

The situation emphasizes the urgent need to address and mitigate risks associated with such breaches to protect personal information and thwart malicious activities. The database is up for sale on Telegram and Breach Forums, which are well-known places for hackers and cybercrime activities. 

Interestingly, this forum recently had another person threatening to release a database from Hathway, which had information from 4 million users. According to CloudSEK, the person selling the data denies being part of the data breach and says they got it through law enforcement channels and undisclosed asset work. However, the source of the data still needs to be clarified.
Read more »
threat prevention
Cyber Security Data protection defense against cyber attacks Digital Security Information Security internet Security Online Privacy Online Safety secure computing threat prevention

Understanding Cold Boot Attacks: Is Defense Possible?

 

Cold boot attacks represent a sophisticated form of cyber threat that specifically targets a computer's Random Access Memory (RAM), presenting a substantial risk to information security. It is imperative to comprehend the mechanics of cold boot attacks and the potential hazards they pose to take necessary precautions. However, if you become a target, mitigating the attack proves extremely challenging due to the requisite physical access to the computer.

Cold boot attacks, although less common, emerge as a potent cyber threat, particularly in their focus on a computer's RAM—a departure from the typical software-centric targets. These attacks have a physical dimension, with the primary objective being to induce a computer shutdown or reset, enabling the attacker to subsequently access the RAM.

When a computer is shut down, one anticipates that the data in RAM, including sensitive information like passwords and encryption keys, vanishes. However, the process is not instantaneous, allowing for the potential retrieval of data remaining in RAM, albeit for a brief period. A critical element of cold boot attacks is the necessity for physical access to the targeted device, elevating the risk in environments where attackers can physically approach machines, such as office spaces. Typically, attackers execute this attack using a specialized bootable USB designed to duplicate the RAM contents, enabling the device to reboot according to the attacker's intentions.

Despite the ominous nature of cold boot attacks, their execution requires a significant investment of skills and time, making it unlikely for the average person to encounter one. Nevertheless, safeguarding your computer from both cyber and physical threats remains a prudent practice.

The essence of a cold boot attack lies in exploiting a unique feature of RAM—the persistence of data even after the computer is powered off. Understanding this attack involves recognizing what happens to the data in RAM during a computer shutdown. The attacker gains physical access to the computer and utilizes a specialized USB to force a shutdown or restart. This USB facilitates the booting or dumping of RAM data for analysis and data extraction. Additionally, malware can be employed to transfer RAM contents to an external device.

The data collected in cold boot attacks encompasses a spectrum from personal information to encryption keys. Speed is paramount in this process, as prolonged power loss to RAM results in data corruption. These attacks pose a significant threat due to their ability to bypass conventional security software, rendering antivirus programs and encryption tools ineffective against them.

To counter cold boot attacks, a combination of physical and software strategies is necessary. Securing the physical space of the computer, employing encryption, and configuring BIOS or UEFI settings to prevent external device booting are recommended. Addressing data remanence is crucial, and techniques like memory scrubbing can be employed to clear RAM of sensitive data after shutdown or reset.

In conclusion, robust defenses against cold boot attacks involve a multi-faceted approach, including strong encryption, physical security measures, and regular updates. Understanding the intricacies of RAM and its data persistence underscores the need for dynamic and proactive cybersecurity measures. Adapting to evolving cyber threats and strengthening defenses is essential in building a resilient digital space that protects against not only cold boot attacks but a range of cyber threats.
Read more »
Sensitive data
Compliance Cyber Essentials scheme Data Breach Data protection Electoral Commission email security government-backed schemes Hackers Information Security IT audit IT Security IT Systems Sensitive data

Electoral Commission Fails Cyber-Security Test Amidst Major Data Breach

 

The Electoral Commission has acknowledged its failure in a fundamental cyber-security assessment, which coincided with a breach by hackers gaining unauthorized access to the organization's systems. 

A whistleblower disclosed that the Commission received an automatic failure during a Cyber Essentials audit. Last month, it was revealed that "hostile actors" had infiltrated the Commission's emails, potentially compromising the data of 40 million voters.

According to a Commission spokesperson, the organization has not yet managed to pass this basic security test. In August of 2021, the election watchdog disclosed that hackers had infiltrated their IT systems, maintaining access to sensitive information until their detection and removal in October 2022. 

The unidentified attackers gained access to Electoral Commission email correspondence and potentially viewed databases containing the names and addresses of 40 million registered voters, including millions not on public registers.

The identity of the intruders and the method of breach have not yet been disclosed. However, it has now been revealed by a whistleblower that in the same month as the intrusion, the Commission received notification from cyber-security auditors that it was not in compliance with the government-backed Cyber Essentials scheme. 

Although participation in Cyber Essentials is voluntary, it is widely adopted by organizations to demonstrate their commitment to security to customers. For organizations bidding on contracts involving sensitive information, the government mandates holding an up-to-date Cyber Essentials certificate. In 2021, the Commission faced multiple deficiencies in their attempts to obtain certification. 

A Commission spokesperson acknowledged these shortcomings but asserted they were unrelated to the cyber-attack affecting email servers.

One of the contributing factors to the failed test was the operation of around 200 staff laptops with outdated and potentially vulnerable software. The Commission was advised to update its Windows 10 Enterprise operating system, which had become outdated for security updates months earlier. 

Auditors also cited the use of old, unsupported iPhones by staff for security updates as a reason for the failure. The National Cyber Security Centre (NCSC), an advocate for the Cyber Essentials scheme, advises all organizations to keep software up to date to prevent exploitation of known vulnerabilities by hackers.

Cyber-security consultant Daniel Card, who has assisted numerous organizations in achieving Cyber Essentials compliance, stated that it is premature to determine whether the identified failures in the audit facilitated the hackers' entry. 

He noted that initial signs suggest the hackers found an alternative method to access the email servers, but there is a possibility that these inadequately secured devices were part of the attack chain.

Regardless of whether these vulnerabilities played a role, Card emphasized that they indicate a broader issue of weak security posture and likely governance failures. The NCSC emphasizes the significance of Cyber Essentials certification, noting that vulnerability to basic attacks can make an organization a target for more sophisticated cyber-criminals.

The UK's Information Commissioner's Office, which holds both Cyber Essentials and Cyber Essentials Plus certifications, stated it is urgently investigating the cyber-attack. When the breach was disclosed, the Electoral Commission mentioned that data from the complete electoral register was largely public. 

However, less than half of the data on the open register, which can be purchased, is publicly available. Therefore, the hackers potentially accessed data of tens of millions who had opted out of the public list.

The Electoral Commission confirmed that it did not apply for Cyber Essentials in 2022 and asserted its commitment to ongoing improvements in cyber-security, drawing on the expertise of the National Cyber Security Centre, as is common practice among public bodies.
Read more »
Interviews
Black hat Conference Cyber Security Cybersecurity Information Security Interview with Security Researcher Interviews

Seasides Conference: Interviewing Prashant Kv and Parveen

1) Could you please start by telling us a bit about yourself and your background? 

Prashant: Hi, my name is Prashant KV. I have been working in information security for more than 15 years. I started my career as a developer and then transitioned into application security. Over the years, I have managed and led many penetration testing, source code review, and other InfoSec tasks. and led many penetration testing, source code review, and other InfoSec tasks. 

I was a part of the null and OWASP Bangalore chapter until 2013. In 2013, I moved to the USA, and I have been living here ever since. Presently, I also manage the OWASP Bay Area chapter. 

Parveen: Parveen, who possesses over 12 years of experience, currently serves as a Product Security Analyst at an Organization specializing in bug bounties. His expertise spans various areas, including Web application testing, Network penetration testing, Thick Client Testing, security assessment of Large Industry printers, Red Teaming, and Mobile Application Testing. In addition to his professional role, Parveen is the co-founder of the OWASP Seaside Conference in Goa and the founder of Bug Bounty Village. He has also presented at both the C0c0n and Seasides Conference. 

2) What inspired you to start the Seasides Conference? Maybe share a story of how you came up with the idea for the Seasides Conference.  

Prashant: Barring a few exceptions, I have attended almost all Nullcon events to date. During the Nullcon training days, we used to simply roam around on the beaches. At that time, we thought, "Why not do something useful?" The idea came to us: "Why not organize some free events that provide quality education to individuals from humble backgrounds?" Hence, the idea of Seasides was born. We were fortunate that Bugcrowd was our first sponsor, and then we secured good sponsors all along the way. If it weren't for the generous sponsorships and our enthusiastic team, we would not have been able to sustain this event.  

Parveen: The Seasides conference's motto is to offer free cybersecurity training to the community, aligning with the ethos of the hacking culture that believes knowledge should be freely accessible to all. We aim to foster the growth of the cybersecurity community without imposing the burden of conference fees on individuals seeking to expand their knowledge in this field. 

3) What were the major challenges you faced in the early stages of establishing the conference? 

Prashant: Finding a venue within our budget was a major challenge. The first event we organized took place at a location with false partitions and no air conditioning. Nevertheless, people showed up with great enthusiasm, and the event was a huge success. We only determine our expenditure after we have estimates of sponsorship, which helps us keep ourselves in check. 

Parveen: The major challenge we faced was figuring out how to initiate the conference and garner support from sponsors, especially given our limited experience in conference management. Initially, our plan was to provide training to only 30-40 students. However, as things progressed, the cybersecurity community in India expressed significant interest in our event. Consequently, we had to transition from a limited number of students to an open-ended approach while still maintaining our commitment to free access and ensuring the quality of the training materials. 

Over time, sponsors began to place their trust in our initiatives, and they started providing sponsorship. Last year, our conference saw tremendous growth, with more than 500 attendees participating. 

4) What are the primary objectives and goals of the Seasides Conference? Perhaps you can elaborate on the main themes of the Conference. 

Prashant: The main objective of the conference is to provide premium quality training to attendees free of cost. We consider the event a success even if we are able to change just one life. Our event primarily consists of training sessions, the topics of which can help students and professionals enter the field of cybersecurity or master certain subjects. This year, we have each day dedicated to specific skill levels. For example, the first day is for advanced training, the second day is for basic level, and the third day focuses on enterprise security-related topics. 

One of the major fun aspects of the conference is our memes and informational posts. We are fortunate that our core group of volunteers has grown from single digits to more than 50 today. Our volunteering team thoroughly enjoys creating memes and blending humor with technology. 

Parveen: We have consistently adhered to the principle that our conference should revolve solely around the sharing of knowledge. Our traditional sessions on topics such as application security, blockchain security, and car hacking will remain a staple. As always, training sessions, meals, and social events will continue to be free and accessible to all. 

We proudly organize Seasides (https://www.seasides.net), a no-cost Infosec conference in India. The conference's primary goal is to provide high-quality cybersecurity training to everyone, free of charge. Furthermore, we extend a scholarship opportunity of 5,000 INR to underprivileged students, enabling them to participate in this event. 

5) How does the conference contribute to the cybersecurity and technology community? 

Prashant: The main objective is to expose students and professionals to various domains in information security. In addition to raising awareness, our events have also assisted many young students in securing jobs. Our sponsors actively seek out talented individuals, and we have successfully recruited some excellent candidates from the event.  

Parveen: In our own modest manner, we are contributing to the growth of India's cybersecurity ecosystem. Last year, several organizations conducted recruitment activities at our conference and even extended job offers on the spot, including many of our scholarship recipients. We are optimistic that more organizations will recognize the talent pool at Seasides and choose to recruit skilled individuals from our event in the future. 

6) There are several renowned cybersecurity conferences like DEFCON, BlackHat, and our own Indian NULL. How does Seasides Conference differentiate itself from these events which is to mean what unique features or offerings does the Seasides Conference bring to the table that sets it apart from other similar conferences? 

Prashant: We aspire to be among the list of conference names you mentioned. Nullcon has done a fabulous job of attracting top-quality researchers from all over the world to India. Nullcon is widely regarded as the best conference in Asia, and many of us have grown and learned through our experiences at Nullcon. 

Our primary focus is on students and young professionals who wish to enter this field. Many students face financial constraints when it comes to covering travel, accommodation, and conference fees. We aim to provide them with the opportunity to experience the atmosphere of world-class conferences without worrying about the cost. 

Parveen: Most of the conferences mentioned above serve as excellent platforms for connection, learning, and networking. However, attending these conferences often comes with substantial financial expenses, which not everyone in India can readily afford. In contrast, Seasides offers high-quality training completely free of cost, making it accessible to anyone on a first-come, first-served basis. 

7) How has the Seasides Conference fostered a sense of community among attendees, speakers, and participants? 

Prashant: As mentioned earlier, our core group of volunteers has grown from single digits to more than 50 today. Even after the conference, team members stay in touch and are always on the lookout to take the conference to the next level. In that way, we are a close-knit community.  

Parveen: Fortunately, all of our speakers have generously offered their training services free of charge up to this point, sharing the same goal of educating and nurturing young minds in the field of cybersecurity. This year, we are introducing a change by compensating our workshop trainers for their dedication and hard work. Additionally, we are bringing in renowned experts from outside India to share their experiences and provide valuable insights to our attendees. 

8) What opportunities does the conference provide for networking and collaboration within the cybersecurity field? 

Prashant: Seasides parties are always legendary, and as much as people look forward to the training, they also eagerly anticipate the Seasides parties. This is a crucial aspect of our networking. In addition to that, we have WhatsApp groups and social media interactions that facilitate collaboration among attendees. 

Parveen: Our conference draws a diverse audience, including both professionals and students, creating a valuable opportunity for mutual connection and learning. To further enhance the experience, we are introducing a Career Booster session at the conference. In this session, esteemed professionals will review resumes and assess aptitude through interviews, providing students with a unique opportunity to gain real interview experience. 

Furthermore, this year, we are introducing a distinctive element by bringing in an English teacher. This instructor will focus on teaching effective communication and interview skills, equipping attendees with essential abilities to excel in their careers. 

9) How do you ensure a balance between technical depth and accessibility for a diverse audience? 

Prashant: We have wCTF, a dedicated Capture The Flag (CTF) competition, to encourage more women to participate in playing CTFs. We consistently have a good number of women trainers and attendees. With a wide range of training sessions, we strive to ensure that people of all skill levels can attend the event and derive value from it. 

Parveen: To create a well-rounded conference experience, we implement several strategies. First and foremost, we curate a diverse speaker lineup that caters to a wide range of expertise levels and backgrounds. This ensures attendees have a plethora of options, from deep technical talks to more accessible introductions. Additionally, we organize the conference into distinct tracks, separating highly technical sessions from those more suitable for beginners. To further enhance the learning experience, we offer workshops and training sessions tailored to various skill levels.  

Our panel discussions provide high-level insights and encourage engaging conversations for a broader audience. Session descriptions are meticulously crafted to indicate the intended audience and technical depth, empowering attendees to make informed choices. Moreover, we foster networking opportunities, enabling knowledge exchange between beginners and experts. Q&A sessions following talks allow attendees to seek clarification and bridge the gap between technical depth and accessibility. Lastly, we highly value attendee feedback, using it to refine future conferences and strike the perfect balance between technical depth and accessibility. 

10) As the founder, where do you envision the Seasides Conference in the next few years? Any plans for expansion or evolution?  

Prashant: We aim to introduce more hardware hacking sessions and invite more researchers who specialize in hardware hacking. This is one area where we aspire to make a contribution and encourage the growth of hardware hacking expertise within India. 

Parveen: As the founder of the Seasides Conference, I am fully dedicated to charting a dynamic and promising course for our event's future. To begin, we are committed to extending the conference's influence well beyond the borders of India. This will be achieved through the inclusion of virtual components and the organization of satellite events across diverse regions, aiming to attract an international audience eager to engage with our vibrant cybersecurity community. Additionally, we will introduce specialized tracks dedicated to emerging trends within the field. These tracks will explore cutting-edge topics such as AI and machine learning security, IoT security, quantum computing, and revolutionary technologies like blockchain. This forward-looking approach ensures that our attendees remain at the forefront of the ever-evolving cybersecurity landscape. 

11) Is there anything else you'd like to share with the CySecurity News audience about the Seasides Conference or your journey as its founder? 

Prashant: A tremendous amount of effort goes into the planning and execution of this event. Beyond the goodwill it generates, we don't expect much in return. All we ask from attendees is to share some kind words on their own accord. Particularly, we appreciate it when they express gratitude towards our sponsors and hardworking volunteers. 

Parveen: My journey as a co-founder of the Seasides conference is undoubtedly rewarding and heartwarming. The stories of students receiving scholarships and job opportunities through Seasides, and how it positively impacts their lives and families, are incredibly fulfilling. It's a testament to the valuable work our team is doing to support and empower the cybersecurity community. The sense of making a meaningful difference in people's lives and contributing to the growth of the industry is a source of great pride and satisfaction.  

12) Lastly, how can interested individuals learn more about the Seasides Conference and get involved? 

Prashant: Certainly, I encourage anyone interested in volunteering for Seasides to check out the website at www.seasides.net and follow their social media handles. You can also reach out to them via direct message (DM) as they are always on the lookout for new volunteers with diverse backgrounds and skills. 

Read more »
Shoulder Surfing
ATM Scams ATM Security Cyber Crime Information Security Shoulder Surfing

Protecting Yourself from ATM Scams: Understanding and Preventing Shoulder Surfing

Shoulder Surfing

What is Shoulder Surfing?

ATM card scams are a growing concern in many countries, including India. Criminals use a variety of techniques to gain unauthorized access to individuals’ ATM cards and withdraw money from their accounts. One such technique is shoulder surfing, where scammers attempt to steal sensitive information such as ATM PINs, CVV numbers, and other details.

Shoulder surfing is a sneaky method of stealing information by looking over someone's shoulder without their knowledge. It's commonly done when people are using ATMs or their phones for transactions. In shoulder surfing, thieves position themselves next to someone and observe their actions.

How Shoulder Surfing is Carried Out?

As the name suggests, these thieves typically peek over the shoulder of an unsuspecting individual at an ATM or while they are occupied with their phone, in order to obtain sensitive information. They attempt to view personal details such as passwords and PIN numbers, which they later exploit for their own financial gain.

Shoulder surfing is often carried out in crowded places where it is easy for thieves to blend in and position themselves beside a person who is filling out a form, entering a PIN at an ATM, or using a calling card at a public pay phone. Additionally, shoulder surfing can also be conducted using technology like binoculars or other devices to enhance the thief's ability to gather information from a distance.

Tips to Protect Yourself from Shoulder Surfing

To protect yourself from shoulder surfing, it is important to be aware of your surroundings and take preventive measures. Make a habit of concealing your screen and obstructing the view of the screen and keyboard from potential onlookers. Using your hand or body to shield the screen and keypad while entering your PIN at an ATM can add an extra layer of security. Additionally, consider using a privacy screen or cover for your phone or tablet when entering sensitive information in public.

Here are some additional tips to protect yourself from shoulder surfing:

  • Never accept help from strangers at the ATM.
  • Be alert to your surroundings and watch out for anyone suspicious who might be trying to see your screen.
  • Use strong and unique passwords for all your accounts.
  • Regularly monitor your bank statements for any unauthorized transactions.

Shoulder surfing is just one of the many techniques used by scammers to steal sensitive information from unsuspecting users for financial gain. By being aware of your surroundings, taking simple precautions, and regularly monitoring your accounts, you can protect yourself from this type of scam.

Read more »
Information Security
Corporate Responsibility Customer Trust Data Privacy Ethical Conduct Information Security

Tesla's Breach of Trust: Employees Share Sensitive Images Recorded by Customer Cars

Tesla's Breach of Trust: Employees Share Sensitive Images Recorded by Customer Cars

  • Tesla workers shared sensitive images recorded by customer cars internally
  • Images included footage of drivers, passengers, and the car's surroundings
  • Concerns raised over the security and privacy of Tesla's customers
  • The incident has sparked outrage among Tesla customers and the public
  • Tesla has issued a statement acknowledging the incident and promising to take action
  • Importance of protecting personal data and data privacy highlighted by this incident
  • Vigilance and training for strong security measures are crucial for companies

The incident involving Tesla workers sharing sensitive images recorded by customer cars has raised serious concerns about the security and privacy of Tesla’s customers, as well as the conduct of its employees. In this blog post, we will examine this incident and its implications. 

The Incident: What Happened?

According to reports, some Tesla workers were sharing sensitive images recorded by customer cars internally. The images were taken from the car’s onboard cameras and included footage of the driver and passengers inside the vehicle, as well as the car’s surroundings. The images were reportedly exchanged in a group chat that was created for the purpose of sharing memes and other light-hearted content. 

In its Customer Privacy Notice, Tesla explains "Your vehicle may collect the data and make it available to Tesla for analysis. This analysis helps Tesla improve its products, and features, and diagnose problems more quickly. Camera recordings remain anonymous and are not linked to you or your vehicle."

The Concerns Raised: Security and Privacy

This incident raises serious concerns about the security and privacy of Tesla’s customers. The fact that employees were able to access and share this sensitive information without the knowledge or consent of the customers is alarming. Tesla’s cars are equipped with a range of cameras and sensors that are intended to enhance the safety and functionality of the vehicle, and customers expect their personal data to be handled with care and respect.

The incident has sparked outrage among Tesla customers and the public at large. It has also raised serious questions about the trustworthiness of Tesla’s employees and the security of its systems. Customers may be hesitant to trust Tesla with their personal information in the future, and the company may face reputational damage as a result of this incident.

Company Response: Acknowledging and Addressing the Issue

Tesla has issued a statement acknowledging the incident and promising to take action to address it. The company has stated that it takes the privacy of its customers seriously and that it is investigating the matter. It has also indicated that it will be implementing additional security measures to prevent similar incidents from occurring in the future.

This incident is a reminder of the importance of protecting personal data and the need for companies to take data privacy seriously. Customers trust companies to handle their personal information with care and to use it only for the purposes for which it was collected. When this trust is breached, it can have serious consequences for both the company and its customers.

Breach of Privacy and Importance of Data Protection

As more and more devices become connected and the amount of data collected increases, companies need to be vigilant about protecting customer data. This includes not only implementing strong security measures but also ensuring that employees are trained on how to handle sensitive information and understand the importance of data privacy.

The incident involving highlights the importance of protecting personal data. It is important for companies to take data privacy seriously and to implement strong security measures to prevent breaches from occurring. As consumers, we should also be mindful of the data we share and the companies we trust with our personal information.

Read more »
User Safety
Data Data Breach Fraud Information Security User Data User Privacy User Safety

LastPass: Hackers Stole Customers’ Password Vaults, Breach Worse Than Initially Thought

 

This past August witnessed a breach at LastPass, one of the most well-known password manager services available. The harm caused by the unidentified hackers is significantly worse than was initially believed, according to the company. Passwords should be changed immediately by users. LastPass stated that "only" the company's source code and confidential information were compromised in the initial report on the data breach event that was detected in August. 

Passwords and user information remained clean and secure. The hostile actors were able to access some users' data as well, according to a subsequent security notification on the same issue. The hat in black According to LastPass, hackers were able to access the cloud storage and decrypt the dual storage container keys. 

By copying a backup that contained "basic customer account data and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service," they were able to further undermine the platform's security.

The encrypted storage container, which holds customer vault data in a proprietary binary format, also allowed the cybercriminals to replicate a backup of that data. The container contains both encrypted and unencrypted information, including sensitive areas like online usernames and passwords, secure notes, and data entered into forms.

According to LastPass, hackers were able to access the cloud storage and decrypt the dual storage container keys. By copying a backup that contained "basic customer account data and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service," they were able to further undermine the platform's security.

The encrypted storage container, which holds customer vault data in a proprietary binary format, also allowed the cybercriminals to replicate a backup of that data. The container contains both encrypted and unencrypted information, including sensitive areas like online usernames and passwords, secure notes, and data entered into forms.

Since they were created using a 256-bit AES-based encryption algorithm and "can only be decrypted with a unique encryption key derived from each user's master password using our Zero Knowledge architecture," the encrypted fields "remain secure," according to LastPass, even when in the hands of cybercriminals. Zero Knowledge signifies that LastPass is unaware of the master password required to unlock the data, and that the decryption process itself is always carried out locally, never online.

LastPass partially stores credit card information in a different cloud environment. Furthermore, there are currently no signs that such data has been accessed. All things considered, LastPass is attempting to convey the idea that users' encrypted data should still be protected in spite of the extensive breach of the company's technology.

However, that doesn't mean there aren't any risks or dangers associated with the breach. Despite the fact that the firm routinely tests "the newest password cracking tools against our algorithms to maintain pace with and improve upon our cryptographic controls," LastPass claims that a determined hostile actor might attempt to brute-force the encrypted passwords.

Additional dangers could be associated with phishing or brute-force attacks against online accounts linked to users' LastPass vaults. LastPass stated that they would never contact a user by phone, email, or text and ask them to click on a link to confirm their personal information. They also won't inquire for a vault's master password. Users of the online password manager are urged to update both their master password and every password kept in the vault as a last line of defense.

Read more »
User Privacy
Cyber Crime Information Security Ransomware Attacks. Unauthorized US Government User Privacy

Indianapolis Housing Authority Hit by Ransomware

According to a senior agency official, a ransomware attack on the federal organization in Indianapolis which manages low-income housing has caused a delay in the distribution of rent payments to landlords.

During the attack, which started weeks ago, every employee of the Indianapolis Housing Agency blocked access to their email. That concerned its executive director, Marcia Lewis, who was unable to access her email for days before being able to do so again on Tuesday, according to a message she wrote to The Indianapolis Star.

The inability to send October rent payments to landlords under the federal housing choice voucher program, generally known as Section 8, on which 8,000 Indianapolis families rely, was caused by the ransomware attack on the Indianapolis Housing Agency. The organization oversees the administration of the Section 8 program in Indianapolis, which offers rental help to very low-income families, the elderly, and people with disabilities for housing on the private market.

Marcia Lewis stated that the attack was still continuing as of Wednesday and that an investigation by data security professionals, police enforcement, and the agency's IT service providers is in progress. The housing authority has not disclosed information regarding the purpose or identity of those responsible for the ransomware attack, which utilizes software to encrypt files within a victim organization in order to demand payment.

With the help of Section 8 or through residing in one of the organization's public housing complexes, almost 25,000 people rely on the Indianapolis Housing Agency for a variety of housing services.

Lewis claimed that as of Monday, the organization had successfully paid every Section 8 landlord's rent for the month of October. The company had to manually send out client power allowance checks and important vendor payments during the previous week since the IT system was unavailable.

The Indianapolis Star has previously written about the abuse that residents of Indianapolis Housing Agency buildings have experienced. Some of the issues residents have encountered include bed insect infestations, air conditioner outages on some of this summer's hottest days, or a lack of hot water at the beginning of October.

Landlords are prohibited from evicting residents for nonpayment by the agency under Section 8 laws set forth by the U.S. Department of Housing and Urban Development, including in the present instance.

Read more »
West
America CNN Cyber Security CyberWar Government Information Security Poland Russia Ukraine US West

The United States and the West are Afraid of Possible Cyber Attacks by Russian Hackers

 

According to CNN, the FBI has warned American businessmen about the growth of possible cyberattacks using ransomware by Russian hackers against the background of sanctions that US President Joe Biden imposed against Russia in connection with the situation around Ukraine. 

Earlier, Jen Easterly, head of the U.S. Agency for Cybersecurity and Infrastructure Protection, said that Russia might consider taking measures that could affect critical U.S. infrastructure in response to U.S. sanctions. She urged all organizations to familiarize themselves with the steps the agency has developed to mitigate cybersecurity risks. In addition, David Ring, head of cybersecurity at the FBI, said that Russia is allegedly a favorable environment for cybercriminals, which will not become less against the background of the confrontation between Russia and the West over the situation around Ukraine. According to CNN, briefings on such topics have been held by the FBI and the Department of Homeland Security for the past two months. 

It is important to note that Polish Prime Minister Mateusz Morawiecki decided to introduce a special high-level security regime for telecommunications and information technology in the country. 

On February 21, he signed a decree introducing the third level of the Charlie– CRP warning throughout the country. This level is introduced if there is an event confirming the probable purpose of a terrorist attack in cyberspace or if there is reliable information about a planned event. 

The Polish Law on Anti-terrorist actions provides that in the event of a terrorist attack or its threat, the head of government may introduce one of four threat levels: Alfa, Bravo, Charlie, and Delta. The highest level, Delta, can be announced if a terrorist attack occurs or incoming information indicates its high probability in Poland. 

Similar levels marked with CRP relate to threats in cyberspace. They are introduced to strengthen the control of the security level of information systems in order to monitor the possible occurrence of violations in their work. 

The Russian Federation has repeatedly rejected the accusations of Western countries in cyberattacks, calling them unfounded, and also stated that it is ready to cooperate on cybersecurity. 

Earlier, CySecurity News reported that CNN reported citing US administration sources that representatives of the White House, US intelligence, the US Department of Homeland Security (DHS), and other agencies have discussed preparations to repel cyber attacks that could be carried out in the United States and Ukraine.
Read more »
User Security
Data Data Breach Data hack Data Leak Data Leakage Information Leak Information Security Privacy Risk Management User Data User Privacy User Security

City of Grass Valley, California, Suffers Data Breach

 

After discovering about the breach, Grass Valley stated that they took quick steps to safeguard their networks, alerted law enforcement, and launched an investigation with the help of a cybersecurity firm.

The information of employees, citizens, and others was duplicated and transmitted to another network, according to more details about a significant data breach at the City of Grass Valley, California. The city council previously admitted that "unauthorised access" to its networks occurred between April 13 and July 1, 2021, according to a statement. 

The scope of the attack has now been determined, with the malicious actor transferring files outside of the city's network, including the financial and personal information of "individuals associated with Grass Valley," according to the investigation. The following information was accessed: 
  • Grass Valley employees, former employees, spouses, dependents, and individual vendors, name and one or more of the following: Social Security number, driver’s license number, and limited medical or health insurance information. 
  • Individual vendors that were employed by the city, name, and Social Security number. 
  • Individuals whose information may have been provided to the Grass Valley Police Department, name and one or more of the following: Social Security number, driver’s license number, financial account information, payment card information, limited medical or health insurance information, passport number, and username and password credentials to an online account.
  • Individuals whose data was provided to the Grass Valley Community Development Department in loan application documents, name and one or more of the following: Social Security number, driver’s license number, financial account numbers, and payment card numbers. 
Grass Valley stated it started contacting those affected on January 7 and has notified the appropriate authorities, including law enforcement. For everyone affected by the hack, the city is also providing free credit monitoring services. 

It noted, “Grass Valley sincerely regrets that this incident occurred and apologizes for any inconvenience or concern. To help prevent something like this from happening again, Grass Valley continues to review its systems and is taking steps to enhance existing security protocols.”
Read more »
Subscribe to: Posts (Atom)