MSnet

September 28, 2022

Explore the massive Optus telecom breach in Australia, two nasty airline cyberattacks.

The City of Wheat Ridge, CO

Exploit: Ransomware

The City of Wheat Ridge, CO: Municipal Government

Risk to Business: 2.175 = Severe

A Colorado city is putting its IT systems back in order after a successful cyberattack by the BlackCat group. Local media report that following the attack, Wheat Ridge had to shut down its phones and email servers to assess the damage the cybercriminals had done to its network. That, in turn, prompted the city to close down City Hall to the public for more than a week. The cybercriminals demanded $5 million in Monero as the ransom, but the city declined to pay, opting to restore from backups. The city government has been able to return to normal business, and the attack is under investigation by the U.S. Federal Bureau of Investigation.

How It Could Affect Your Business: Ransomware attacks against governments and municipalities have been proliferating.

Rockstar Games

Exploit: Hacking

Rockstar Games: Video Game Developer

Risk to Business: 2.136 = Severe

Rockstar Games confirmed on Monday that a hacker broke into its systems and stole confidential internal data, including footage and source code from the previously unannounced next installment of its popular Grand Theft Auto series. The New York-based company appears to have been breached through a stolen employee Slack account. The hacker that claimed responsibility, “teapotuberhacker”, also says that they’re behind a murky hacking incident at Uber last week. The cybercriminal shared a link to footage and clips purportedly from Grand Theft Auto 6 on a Grand Theft Auto fan forum. The company has confirmed that the game is in development and that the attack occurred.  

How It Could Affect Your Business: This is a mess for Rockstar Games with a potentially nasty impact on the marketing and sales of a major new release that wasn’t ready for prime time yet.

New York Racing Association

Exploit: Ransomware

New York Racing Association: Professional Group 

Risk to Business: 2.703 = Moderate

The Hive ransomware operation has claimed responsibility for an attack on the New York Racing Association (NYRA). The NYRA operates the three major thoroughbred horse racing tracks in New York, the Aqueduct Racetrack, the Belmont Park (home of the Triple Crown event the Belmont Stakes) and the historic Saratoga Race Course. The attack took place in late August 2022 and breach notices were filed with authorities last week. Press reports say that the hackers have also published a link to freely download a ZIP archive containing all of the files they allegedly stole from NYRA’s systems.

Risk to Individual: 2.624 = Major

Member data that may have been exposed includes Social Security numbers (SSNs), driver’s license identification numbers, health records and health insurance information.

How It Could Affect Your Business: The involvement of health data could make this breach especially expensive and complicated.

American Airlines

Exploit: Business Email Compromise

American Airlines: Airline

Risk to Business: 2.639 = Moderate

American Airlines has filed a breach notice declaring that it has had a data breach that may have impacted personal data for about 1700 customers and employees. Bleeping Computer detailed the incident saying that the American Airlines Cyber Security Response Team found out the attack from the targets of a phishing campaign that was using an employee’s hacked Microsoft 365 account to send phishing messages. Reportedly, the attacker accessed multiple employees’ accounts via phishing and used them to send more phishing emails to additional targets that have not been named.

Risk to Individual: 2.714 = Moderate

Employee or customer personal information exposed in the attack may have included employees’ and customers’ names, dates of birth, mailing addresses, phone numbers, email addresses, driver’s license numbers, passport numbers or certain medical information. 

How it Could Affect Your Business: Business email compromise can take many forms but it is always an expensive nightmare in the end.

UK – Revolut

Exploit: Social Engineering

Revolut: Digital Bank

Risk to Business: 1.102 = Extreme

Revolut, a London-based digital banking application that provides banking, investing, currency transfer and other money management services to some 16 million users globally, has experienced a data breach. The FinTech startup confirmed that the personal information of an unspecified number of users (reports point to 50K customers) was accessed illegally after what the company is terming “a social engineering attack” in early September. The company said that impacted customers have been informed via email and relevant authorities have been informed. No information was available on the exact nature of the exposed data at press time.

How it Could Affect Your Business: This kind of bad publicity could be a serious problem for a start-up in the competitive financial services space.

Portugal – TAP Air Portugal

Exploit: Ransomware

TAP Air Portugal: Airline

Risk to Business: 1.637 = Severe

The Ragnar Locker ransomware group has claimed responsibility for a ransomware attack that hit TAP Air Portugal, the country’s state-owned flagship airline. The incident began a month ago but was just confirmed by the airline. Ragnar Locker has been advertising the stolen data on its dark website since early September. No ransom amount has been reported, and the group has posted a portion of the stolen data already. Portugal’s President Marcelo Rebelo de Sousa, MPs, government staff and high-ranking military officers are among the passengers whose data has been stolen. 

Individual Risk: 1.902 = Severe

Exposed customer data includes names, addresses, email addresses, phone numbers, corporate IDs, travel information, nationality, gender and other personal information. 

How it Could Affect Your Business: This breach could have far-reaching implications because it includes the personal information of major government players.

Australia – Optus

Exploit: Ransomware

Optus: Telecom

Risk to Business: 1.102 = Extreme

Australia’s second-largest telecom Optus has been hit by a ransomware attack. One of the largest data breaches in Australian history, the incident impacts an estimated 10 million customers or about one-third of Australia’s population. A bad actor using the moniker “optusdata” claimed to be the force behind the attack and initially posted a ransom demand of $1.5 million as well as the personal data of about 10k people on a dark web forum. They’ve since withdrawn that post. Some news articles have pointed at an API interface configuration error as the access point for the bad guys, but that has not been confirmed. The incident is under investigation.

Risk to Business: 1.236 = Extreme

Customer data has been exposed including home addresses, drivers’ licenses, passport numbers. names, addresses, phone numbers, email addresses and individuals’ preferred pronouns. The company says that no financial or commercial account data was accessed.

How it Could Affect Your Business: An incident this massive is a catastrophe that may spur some changes in Australia’s data privacy laws.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

This week take a look at the events that led to a big IRS data breach and trouble at Bell Canada.

U.S. Internal Revenue Service (IRS)

Exploit: Human Error

U.S. Internal Revenue Service: Federal Government Agency

Risk to Business: 2.026 = Severe

The U.S. Internal Revenue Service on Friday acknowledged that thanks to an employee error, the agency accidentally published confidential information about 120,000 taxpayers on its website. The compromised data came from Form 990-T filings. This form is required for people with individual retirement accounts who earn certain types of business income within retirement plans. While the forms for individuals are supposed to be confidential, charities that generate certain types of income are also required to file Form 990-T, and those are intended to be public. An employee mistakenly uploaded private taxpayers’ data to the agency’s website along with the public charity data.

Risk to Individual: 2.406 = Severe

Exposed taxpayer data includes names, contact information, and financial information about IRA income The exposed data did not include Social Security numbers, full individual income information, detailed financial account data, or other information that could impact a taxpayer’s credit.

How It Could Affect Your Business: Human error is the top cause of cybersecurity trouble, but training helps reduce the risk of a data disaster related to employee mistakes.

U-Haul International

Exploit: Credential Compromise

U-Haul International: Moving & Storage Company

Risk to Business: 2.779 = Moderate

 U-Haul International disclosed a data breach related to its customer contract search tool. U-Haul says that attackers accessed some customers’ rental contracts between November 5, 2021, and April 5, 2022, after compromising two passwords. U-Haul’s email and customer-facing websites were not impacted.

Risk to Individual: 2.626 = Moderate

Hackers gained access to customers’ names and driver’s license information, but U-Haul says that no credit card information was accessed or acquired during the incident.

How It Could Affect Your Business: Cybercriminals have been concentrating their fire on suppliers and service providers, elevating risk for them.

The North Face

Exploit: Credential Stuffing

The North Face: Clothing Brand 

Risk to Business: 1.677 = Severe

California-based outdoor clothing company The North Face disclosed that it has had a data breach after a successful credential stuffing attack exposed the information of an estimated 200,00 customers. The company said that the attack on its website began in late July 2022 and was finally stopped in August 2022. Investigators determined that bad actors had accessed shoppers’ information shortly thereafter. 

Risk to Individual: 1.636 = Severe

Exposed data includes a customer’s full name, purchase history, billing address, shipping address, telephone number, account creation date, gender and XPLR Pass reward records.

How It Could Affect Your Business: Educational institutions have been high on cybercriminal priority lists, and the time pressure here made this attack an attractive prospect for the bad guys.

Bell Technical Solutions (BTS)

Exploit: Ransomware 

Bell Technical Solutions: Telecommunications Services

Risk to Business: 2.712 = Moderate

The Hive ransomware group has claimed responsibility for a ransomware strike on Bell Technical Solutions (BTS), a subsidiary of Bell Canada. BTS provides installation services for the telecom. Hive just published a claim on its dark web leak site saying that it encrypted BTS systems almost a month ago. BTS’ website is currently inaccessible. Parent company Bell Canada published a cybersecurity alert following the incident on its own website

Risk to Individual: 2.834 = Moderate

The Hive ransomware group has claimed responsibility for a ransomware strike on Bell Technical Solutions (BTS), a subsidiary of Bell Canada. BTS provides installation services for the telecom. Hive just published a claim on its dark web leak site saying that it encrypted BTS systems almost a month ago. BTS’ website is currently inaccessible. Parent company Bell Canada published a cybersecurity alert following the incident on its own website

How it Could Affect Your Business: Critical infrastructure targets like utilities have been squarely in cybercriminal sights as ransomware targets.

Argentina – Buenos Aires Legislature

Exploit: Ransomware

Buenos Aires Legislature: Municipal Government Body

Risk to Business: 1.219 = Extreme

Legislators in Argentina’s capital Buenos Aires were left unable to access information systems or wifi in the legislature’s facility after a successful ransomware attack last week. The incident was discovered on September 11, 2022, and persisted into the week. Officials say they took measures to contain the attack immediately and they’re working quickly to restore all operations.  No ransomware group has claimed responsibility for this attack. 

How it Could Affect Your Business: Government agencies have been popular ransomware targets over the last few years.

France – Damart

Exploit: Ransomware

Damart: Clothing Retailer

Risk to Business: 1.863 = Severe

Clothing store Damart has been taken down by ransomware in an attack by the Hive cybercrime gang. The company, with more than 130 stores worldwide, has had a variety of systems encrypted and operations, including sales and customer service, have been disrupted since August 15. The threat actors haven’t posted the victim on their extortion site, but reports say that they’re demanding a $2 million ransom. Damart (through parent company Damartex) says that it has not negotiated with the cybercriminals and it has informed the French national police of the incident.

How it Could Affect Your Business: This breach is bound to have expensive consequences for Damart once regulators get through with them

United Kingdom – Eurocell

Exploit: Hacking

Eurocell: PVC Manufacturing

Risk to Business: 2.122 = Severe

Derbyshire-based PVC manufacturer and building products distributor Eurocell has begun informing former employees that their information may have been stolen in a data breach after bad actors obtained access to the company’s systems. An estimated 2000 current employees and an unknown number of former employees may have been affected.

Risk to Business: 2.236 = Severe

Among the data compromised are employment terms and conditions, PII like names, dates of birth and next of kin, financial information including bank account, NI and tax reference numbers, right to work documents, health and wellbeing documents, learning and development records and disciplinary and grievance forms.  

How it Could Affect Your Business: This kind of data is valuable and sought-after because bad actors can parlay it into easy money.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Welcome to the Business Email Compromise special edition! This week, take a look at some recent BEC attacks and learn more about how to protect your clients from phishing-related disasters like BEC.

Klaviyo

Exploit: BEC

Klaviyo: Email Marketing Firm

Risk to Business: 1.706 = Severe

 In an interesting twist on the usual data breach incident, email marketing firm Klaviyo suffered a concentrated and specific data breach on August 3, 2022. After gaining access to an employee’s account thanks to a successful phishing attack, bad actors then downloaded marketing lists used by cryptocurrency-related clients for outreach efforts and for Klaviyo product and marketing updates.

The threat actor used the internal customer support tools to search for primarily crypto-related accounts and viewed list and segment information for 44 Klaviyo accounts, downloading data from at least 38 accounts.

Stolen data includes customers’ names, addresses, email addresses, account profile information and phone numbers. The hackers also downloaded two internal lists used by Klaviyo for product and marketing updates that contain names, addresses, email addresses, and phone numbers. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Phishing is the most likely way for any organization to open the door to a data breach.

Atrium Health

Exploit: BEC

Atrium Health: Medical System 

Risk to Business: 1.907 = Severe

North Carolina-based Atrium Health has announced a data breach impacting 7,000 patients. The healthcare provider says that an employee at Atrium Health at Home fell victim to a phishing attack, resulting in bad actors accessing that employee’s email and messaging account in April 2021. Atrium is mailing letters to the affected patients and hasn’t determined whether the unauthorized user accessed the protected health information in the accounts. 

North Carolina-based Atrium Health has announced a data breach impacting 7,000 patients. The healthcare provider says that an employee at Atrium Health at Home fell victim to a phishing attack, resulting in bad actors accessing that employee’s email and messaging account in April 2021. Atrium is mailing letters to the affected patients and hasn’t determined whether the unauthorized user accessed the protected health information in the accounts. 

How It Could Affect Your Business: Healthcare data is always a desirable commodity for bad actors and letting them get their hands on it is always an expensive mistake for healthcare providers.

Spirit Super

Exploit: BEC

Spirit Super: Financial Services

Risk to Business: 1.836 = Severe

 Spirit Super has announced that a cyberattack caused by an employee falling for a phishing message is the cause of a cyberattack that has led to data exposure for an estimated approximately 50,000 member records from 2019/2020. The company said that the incident was quickly mitigated, and the damage contained, with new security measures added.

Spirit Super says that the information potentially exposed includes client names, addresses, ages, email addresses, telephone numbers, member account numbers and member balances. The company was quick to assure members that the exposed data doesn’t include dates of birth, government identification numbers or any bank details. 

How It Could Affect Your Business: Phishing is the first step in more than 90% of data breaches, making stopping it a top security priority.

Chester Upland School District

Exploit: BEC

Chester Upland School District: Regional Education Authority

Risk to Business: 1.337 = Severe

A recent business email compromise attack on a Pennsylvania school district resulted in bad actors making off with more than $13 million. Authorities say hackers used a stolen district employee email account to snatch the money by sending official-looking messages from that account and then diverting payments to themselves. After diverting the payments, the cybercriminals then used a romance scam conducted through the dating site eHarmony to entice a Florida woman to launder the money unwittingly. The scheme came to light after the Pennsylvania Department of the Treasury flagged a large transfer, unraveling the whole mess. $10 million of the money has since been recovered.  

How it Could Affect Your Business: Business email compromise is hard to detect but causes the most financial damage. This school district got lucky recovering money.

AllOne Health Resources, INC.

Exploit: BEC

AllOne Health Resources: Insurance Company

Risk to Business: 1.809 = Severe

AllOne Health Resources, Inc. Has experienced a data breach as the result of a business email compromise attack. The company says that an unauthorized party gained access to sensitive consumer data contained on its network after landing the BEC attack. According to AllOne Health, the company discovered the breach after it realized that the company’s finance department had sent several wire transfers to a fraudulently created bank account. That prompted an investigation that revealed that bad actors had gained access to an employee’s email account and snatched sensitive data.   

Exposed information includes the names, addresses, dates of birth, driver’s license numbers, Social Security numbers and health information of 13,669 individuals.   

How it Could Affect Your Business: A data security disaster in the healthcare sector is extra expensive and damaging after regulators weigh in.

City of Portland, OR

Exploit: BEC

City of Portland, OR: Municipal Government

Risk to Business: 1.723 = Severe

Bad actors struck the city of Portland, Oregon in an audacious business email compromise attack that resulted in a $1.4 million fraudulent transaction with city funds in April. City officials say that cybercriminals obtained the money after gaining access to a city email account illegally. The compromise was detected in May when the same account attempted another transfer of funds. The incident is under investigation by the FBI, U.S. Secret Service and the Portland Police Bureau.

How it Could Affect Your Business: Governments have been popular targets for cybercriminals even when they’re not nation-state aligned.

Christie Clinic

Exploit: BEC

Christie Clinic: Healthcare Provider 

Risk to Business: 1.801 = Severe

Illinois medical services provider Christie Clinic has informed an estimated 500,000 individuals that their personal information was potentially compromised in a data breach that occurred last year. In the incident, a bad actor gained unauthorized access to one of the practice’s email accounts in a suspected business email compromise operation with the intent of interrupting financial communications between July 14 and August 19, 2021. The practice assured patients that the bad actor did not compromise other systems, electronic medical records, or the firm’s patient portal.   

Christie Clinic is unsure of the scope of the breach but says that the bad actor may have gained access to patient names, addresses, medical and health insurance information and Social Security numbers through the compromised account.

How it Could Affect Your Business: Business email compromise is the most expensive cyberattack businesses face and in this case, that price will come with regulatory trouble.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Nelnet Servicing (Nelnet) 

Exploit: Hacking

Nelnet Servicing (Nelnet): Student Loans Servicer

Risk to Business: 2.026 = Severe

 A data breach of student loan servicer Nelnet Servicing (Nelnet) has affected over 2.5 million student loan borrowers throughout the United States. The breach affected borrowers whose student loans are serviced by the Oklahoma Student Loan Authority (OSLA) and Edfinancial Services (Edfinancial). The company disclosed that the PII of 2.5 million student loan borrowers was accessible by an unknown actor who gained access to the network in July 2022.  

Risk to Business: 2.406 = Severe

The exposed data includes names, addresses, email addresses, phone numbers and Social Security numbers of borrowers who had loans serviced by the affected institutions. 

How It Could Affect Your Customers’ Business: Service providers like this one are highly at risk for trouble thanks to the combination of valuable data and access to companies that they offer bad actors.

Baker & Taylor

Exploit: Ransomware

Baker & Taylor: Book Distributor

Risk to Business: 1.647 = Severe

 A ransomware attack at leading library book distributor Baker & Taylor has resulted in an outage that impacted the company’s phone systems, offices, and service centers. Those systems were out for a week. No ransomware group claimed responsibility, nor did Baker & Taylor disclose a ransom demand. The company said that they were able to restore their systems from backups and the incident remains under investigation.

How It Could Affect Your Business: Cybercriminals have been concentrating their fire on suppliers and service providers, elevating risk for them.

Los Angeles Unified School District

Exploit: Ransomware

Los Angeles Unified School District: Regional Education Authority

Risk to Business: 1.427 = Extreme

A cyberattack against the Los Angeles Unified School District added complications to the start of the new school year. The ransomware attack hit on the Sunday before schools were scheduled to open for the new year. The district was able to overcome the digital shutdown to open schools on schedule the following Tuesday. However, the personal data of an estimated 400,000 students may have been accessed by cybercriminals. Federal, state and local authorities are investigating the incident. The Vice Society ransomware group has claimed responsibility for the attack, saying that they snatched more than 500GB of unspecified data.

How It Could Affect Your Business: Educational institutions have been high on cybercriminal priority lists, and the time pressure here made this attack an attractive prospect for the bad guys.

Savannah College of Art and Design

Exploit: Ransomware

Savannah College of Art and Design: Institution of Higher Learning

Risk to Business: 2.712 = Moderate

Savannah College of Art and Design (SCAD) has revealed that a hacker gained access to SCAD’s information network systems, exposing data on an estimated 15,00 students. The school said that an unspecified “limited” number of files containing data about students and employees was accessed by bad actors. The AvosLocker ransomware group added SCAD to its leak site, but no ransom specifics have been released. AvosLocker may have taken at least 69,000 files that contained student information, personnel files and business data. No specifics have been released about what data was taken.

How it Could Affect Your Business: Education has been a sector under siege, especially attractive to ransomware groups as the school year opens.

United Kingdom – InterContinental Hotels Group (IHG)

Exploit: BEC

InterContinental Hotels Group (IHG): Hotel Operator

Risk to Business: 1.809 = Severe

InterContinental Hotels Group (IHG) has confirmed that they’ve had a security incident impacting the Holiday Inn hotels chain. A cyberattack downed its booking systems and mobile apps. Although ITG did not reveal the nature of the attack in its public statement, tech experts point to ransomware. The incident is under investigation, and no information about what if any data was stolen or the group responsible was mentioned.

How it Could Affect Your Business: Hospitality organisations rely heavily on their IT systems, and outages lead to disasters.

United Kingdom – Go-Ahead

Exploit: Hacking

Go-Ahead: Bus Company

Risk to Business: 1.723 = Severe

Go-Ahead, a major UK public transport operator disclosed that it is a cyberattack after finding unauthorized activity within its IT systems. The company said that many of its IT systems have been affected by this cybersecurity incident, including the system used to allocate drivers to bus services, with minimal delays expected. Some restoration has taken place using backups, and the incident remains under investigation.

How it Could Affect Your Business: Major transportation providers are juicy targets for bad actors because those services cannot afford disruptions, making them likely to pay ransoms.

Portugal – Armed Forces General Staff agency of Portugal (EMGFA)

Exploit: Hacking

Armed Forces General Staff agency of Portugal (EMGFA): Government Agency

Risk to Business: 1.361 = Extreme

Classified NATO documents belonging to the Armed Forces General Staff agency of Portugal (EMGFA) were spotted for sale on the dark web, leading the agency to discover that it had experienced a data breach. First spotted by US Information Services, hundreds of sensitive documents have apparently been snatched by bad actors. The documents were exfiltrated from systems in the EMGFA, in the secret military (CISMIL) and in the General Directorate of National Defense Resources. Investigators determined that security rules for the transmission of classified documents had been broken, and threat actors were able to access the Integrated System of Military Communications (SICOM) and receive and forward classified documents.

How it Could Affect Your Business: This problem could have been prevented by simple adherence to security rules and compliance with security policies.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Welcome to the Business Email Compromise special edition! This week, take a look at some recent BEC attacks.

Klaviyo

Exploit: BEC

Klaviyo: Email Marketing Firm

Risk to Business: 1.706 = Severe

 In an interesting twist on the usual data breach incident, email marketing firm Klaviyo suffered a concentrated and specific data breach on August 3, 2022. After gaining access to an employee’s account thanks to a successful phishing attack, bad actors then downloaded marketing lists used by cryptocurrency-related clients for outreach efforts and for Klaviyo product and marketing updates.

The threat actor used the internal customer support tools to search for primarily crypto-related accounts and viewed list and segment information for 44 Klaviyo accounts, downloading data from at least 38 accounts.

Stolen data includes customers’ names, addresses, email addresses, account profile information and phone numbers. The hackers also downloaded two internal lists used by Klaviyo for product and marketing updates that contain names, addresses, email addresses, and phone numbers. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Phishing is the most likely way for any organization to open the door to a data breach.

Atrium Health

Exploit: BEC

Atrium Health: Medical System 

Risk to Business: 1.907 = Severe

North Carolina-based Atrium Health has announced a data breach impacting 7,000 patients. The healthcare provider says that an employee at Atrium Health at Home fell victim to a phishing attack, resulting in bad actors accessing that employee’s email and messaging account in April 2021. Atrium is mailing letters to the affected patients and hasn’t determined whether the unauthorized user accessed the protected health information in the accounts. 

North Carolina-based Atrium Health has announced a data breach impacting 7,000 patients. The healthcare provider says that an employee at Atrium Health at Home fell victim to a phishing attack, resulting in bad actors accessing that employee’s email and messaging account in April 2021. Atrium is mailing letters to the affected patients and hasn’t determined whether the unauthorized user accessed the protected health information in the accounts. 

How It Could Affect Your Business: Healthcare data is always a desirable commodity for bad actors and letting them get their hands on it is always an expensive mistake for healthcare providers.

Spirit Super

Exploit: BEC

Spirit Super: Financial Services

Risk to Business: 1.836 = Severe

 Spirit Super has announced that a cyberattack caused by an employee falling for a phishing message is the cause of a cyberattack that has led to data exposure for an estimated approximately 50,000 member records from 2019/2020. The company said that the incident was quickly mitigated, and the damage contained, with new security measures added.

Spirit Super says that the information potentially exposed includes client names, addresses, ages, email addresses, telephone numbers, member account numbers and member balances. The company was quick to assure members that the exposed data doesn’t include dates of birth, government identification numbers or any bank details. 

How It Could Affect Your Business: Phishing is the first step in more than 90% of data breaches, making stopping it a top security priority.

Chester Upland School District

Exploit: BEC

Chester Upland School District: Regional Education Authority

Risk to Business: 1.337 = Severe

A recent business email compromise attack on a Pennsylvania school district resulted in bad actors making off with more than $13 million. Authorities say hackers used a stolen district employee email account to snatch the money by sending official-looking messages from that account and then diverting payments to themselves. After diverting the payments, the cybercriminals then used a romance scam conducted through the dating site eHarmony to entice a Florida woman to launder the money unwittingly. The scheme came to light after the Pennsylvania Department of the Treasury flagged a large transfer, unraveling the whole mess. $10 million of the money has since been recovered.  

How it Could Affect Your Business: Business email compromise is hard to detect but causes the most financial damage. This school district got lucky recovering money.

AllOne Health Resources, INC.

Exploit: BEC

AllOne Health Resources: Insurance Company

Risk to Business: 1.809 = Severe

AllOne Health Resources, Inc. Has experienced a data breach as the result of a business email compromise attack. The company says that an unauthorized party gained access to sensitive consumer data contained on its network after landing the BEC attack. According to AllOne Health, the company discovered the breach after it realized that the company’s finance department had sent several wire transfers to a fraudulently created bank account. That prompted an investigation that revealed that bad actors had gained access to an employee’s email account and snatched sensitive data.   

Exposed information includes the names, addresses, dates of birth, driver’s license numbers, Social Security numbers and health information of 13,669 individuals.   

How it Could Affect Your Business: A data security disaster in the healthcare sector is extra expensive and damaging after regulators weigh in.

City of Portland, OR

Exploit: BEC

City of Portland, OR: Municipal Government

Risk to Business: 1.723 = Severe

Bad actors struck the city of Portland, Oregon in an audacious business email compromise attack that resulted in a $1.4 million fraudulent transaction with city funds in April. City officials say that cybercriminals obtained the money after gaining access to a city email account illegally. The compromise was detected in May when the same account attempted another transfer of funds. The incident is under investigation by the FBI, U.S. Secret Service and the Portland Police Bureau.

How it Could Affect Your Business: Governments have been popular targets for cybercriminals even when they’re not nation-state aligned.

Christie Clinic

Exploit: BEC

Christie Clinic: Healthcare Provider 

Risk to Business: 1.801 = Severe

Illinois medical services provider Christie Clinic has informed an estimated 500,000 individuals that their personal information was potentially compromised in a data breach that occurred last year. In the incident, a bad actor gained unauthorized access to one of the practice’s email accounts in a suspected business email compromise operation with the intent of interrupting financial communications between July 14 and August 19, 2021. The practice assured patients that the bad actor did not compromise other systems, electronic medical records, or the firm’s patient portal.   

Christie Clinic is unsure of the scope of the breach but says that the bad actor may have gained access to patient names, addresses, medical and health insurance information and Social Security numbers through the compromised account.

How it Could Affect Your Business: Business email compromise is the most expensive cyberattack businesses face and in this case, that price will come with regulatory trouble.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

 It’s all ransomware all the time this week with a spate of damaging attacks in the U.S., U.K. and South America.

Accelya

Exploit: Ransomware

Accelya: Airline Technology Services

Risk to Business: 1.706 = Severe

The AlphV/Black Cat ransomware group has claimed responsibility for an attack on airline technology firm Accelya. The group claimed to have stolen emails, worker contracts and other business information. Accelya provides passenger, cargo, and industry analytics platforms for airline retailing to Delta, British Airways, JetBlue, United, Virgin Atlantic, American Airlines and other airlines. The company confirmed the incident after investigators discovered that the company’s data was posted on a ransomware leak site.   

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: This company faced double jeopardy with both an increase in supply chain and transportation industry attacks.

DoorDash

Exploit: Supply Chain Attack

DoorDash: Food Delivery Service

Risk to Business: 1.907 = Severe

DoorDash has confirmed a data breach that has exposed customer information. Employees of the vendor had credentials that were stolen as part of a recent incident at software company Twilio that were then used to access DoorDash’s internal tools. The company said it cut off the third-party vendor’s access to its systems after discovering suspicious activity. DoorDash did not name the third-party vendor but did confirm the attack and that it was related to the Twilio hack.

Individual Risk: 1.975 = Severe

An undisclosed number of customers had their names, email addresses, delivery addresses, phone numbers and partial payment card numbers stolen. For drivers with the company, hackers were able to access names, phone numbers and email address information.

How It Could Affect Your Business: Unfortunately, this kind of exposure is becoming all too common as bad actors strike strategically against service providers.

LastPass

Exploit: Ransomware

LastPass: Software Company

Risk to Business: 1.836 = Severe

Authentication software firm LastPass said on Thursday that someone broke into one of its developer’s accounts and used that to gain access to proprietary data including source code. The company said in a statement that the incident had been contained and that they see no further evidence of unauthorized activity. LastPass says there is no evidence that customer data or encrypted password vaults were compromised. This breach may be related to the recent Twilio hack which impacted many companies.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: The Information Technology sector was one of the 14 critical infrastructure sectors most victimized by ransomware last year.

Chester Upland School District

Exploit: Business Email Compromise

Chester Upland School District: Regional Education Authority

Risk to Business: 1.337 = Severe

A recent business email compromise attack on a Pennsylvania school district resulted in bad actors making off with more than $13 million. Authorities say hackers used a stolen district employee email account to snatch the money by sending official-looking messages from that account and then diverting payments to themselves. After diverting the payments, the cybercriminals then used a romance scam conducted through the dating site eHarmony to entice a Florida woman to launder the money unwittingly. The scheme came to light after the Pennsylvania Department of the Treasury flagged a large transfer, unraveling the whole mess. $10 million of the money has since been recovered.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Business email compromise is hard to detect but causes the most financial damage. This school district got lucky recovering money.

New Hampshire Lottery

Exploit: Hacking

New Hampshire Lottery: Gambling Program

Risk to Business: 2.809 = Moderate

New Hampshire Lottery officials warned of a cyberattack on its website, cautioning players that people visiting the site should not click on any pop-up message. The site began to experience trouble early Friday morning, typically a busy day for lottery sales with the Mega Millions drawing taking place late Friday night. Officials said the site has been taken down as the matter is investigated and the trouble dealt with. They do not believe any personal data of players was stolen.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Cybercriminals love to exploit government-run websites to spread malware or for other nefarious purposes.

The Dominican Republic – Instituto Agrario Dominicano

Exploit: Ransomware

The Instituto Agrario Dominicano (IAD): Government Agency

Risk to Business: 1.223 = Severe

The Instituto Agrario Dominicano (IAD), an arm of the Dominican Republic’s Ministry of Agriculture, has been hit by the Quantum ransomware group. The attack took down four physical and eight virtual servers as well as compromising all of IAD’s data. Officials say that the agency had only basic security in place and no dedicated security workers. The group is demanding an estimated $600k in ransom, but The Dominican Republic is an economically challenged country, making it unlikely that they’ll pay the extortionists.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Governments have been popular targets for cybercriminals even when they’re not nation-state aligned.

Greece – DESFA

Exploit: Ransomware

DESFA: National Natural Gas Provider 

Risk to Business: 2.871 = Moderate

Greece’s national natural gas operator DESFA has been hit by a ransomware attack by the Ragnar Locker ransomware organization. The group added DESFA to its dark web leak site on Friday, noting that it had not received a response to its ransom demand at that time. DESFA said that it will not negotiate with cybercriminals. The company also said that the incident had a “confirmed impact on the availability of some systems and possible leakage of a number of directories and files.” DESFA also said that Greek law enforcement agencies as well as the Ministry of Digital Governance and Hellenic Data Protection Authority have been notified of the attack. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Cybercriminals love to go after utilities because of the high chance they’ll get paid to avoid service disruptions, although these bad actors won’t.

India – Akasa Air

Exploit: Misconfiguration

Akasa Air: Airline

Risk to Business: 1.790 = Severe

 Akasa Air disclosed that it has suffered a data breach resulting in unauthorized individuals gaining access to user information. The breach was caused by a configuration error that left vulnerabilities in the airline’s login and sign-up service. Akasa Air said that no travel-related information, travel records or payment information was compromised in the incident. The company claims to have fixed the problem and reopened all services.

Risk to Business: 1.662 = Severe

 Exposed registered user information includes registrant names, genders, email addresses and phone numbers.  

How it Could Affect Your Business: Employee mistakes like this one can be just as costly and problematic as a cyberattack.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

 It’s all ransomware all the time this week with a spate of damaging attacks in the U.S., U.K. and South America.

Entrust

Exploit: Ransomware

Entrust: Cybersecurity Solutions Company

Risk to Business: 1.877 = Severe

Entrust has fallen victim to a ransomware attack by the LockBit group. LockBit added Entrust to its Tor site last Thursday. The Minneapolis-based provider of payment security solutions confirmed the incident. The company admitted that threat actors had gained access to systems used for HR, finance and marketing, but said there was no evidence that the operation or security of its products and services was impacted. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Ransomware groups have been ramping up operations, with risk up by over 60%.

Practice Resources LLC

Exploit: Misconfiguration

Practice Resources LLC: Medical Billing Service 

Risk to Business: 1.687 = Severe

Practice Resources LLC (PRL) is at the center of a ransomware attack that led to a supply chain data breach impacting 26 healthcare organizations. In a filing, PRL declared that 942,138 people had data exposed in the April 2022 incident. The company provides billing and other related services to healthcare providers. PRL declared that it has sent out data breach letters to all affected parties.  

Individual Risk: 1.733 = Severe

The information exposed in the attack included patient names, addresses, health plan numbers, dates of treatment, and medical record numbers. 

How It Could Affect Your Business Supply chain risk has been a constantly rising risk for businesses as bad actors target service providers.

Valent U.S.A. LLC 

Exploit: Ransomware

Valent U.S.A. LLC: Agricultural Chemical Manufacturing

Risk to Business: 1.902 = Severe

Chemical company Valent U.S.A. LLC has filed notices that it experienced a data breach as a result of a suspected ransomware attack. The company revealed that the attack was discovered when employees were unable to access some of Valent’s computer systems and subsequently discovered that files had been encrypted. Valent said that it secured its network and then retained an outside cybersecurity firm to investigate the incident.

Individual Risk: 1.768 = Severe

The company says the breach resulted in the names, Social Security numbers, driver’s license numbers, passport numbers, financial account information, medical information and dates of birth of certain individuals being compromised.

How It Could Affect Your Business: Both the Chemical and Agricultural sectors have been under heavy pressure from bad actors in the last 12 months.

Brasseler USA

Exploit: Ransomware

Brasseler USA: Dental Equipment Manufacturer

Risk to Business: 2.077 = Severe

Brasseler USA has disclosed that it experienced a data breach as a result of a ransomware attack. The company discovered that this incident occurred in June 2022. In July 2022, the company learned that certain files containing sensitive consumer data were compromised. The company says that it reported the incident to law enforcement and then worked with third-party data security specialists to investigate the scope of the cyberattack Brasseler USA is a dental and surgical product manufacturer based in Savannah, Georgia.

Individual Risk: 1.966 = Severe

Breached information varies depending on the individual, but may include an individual’s name, Social Security numbers, driver’s license numbers, passport number, financial account information (including debit card and credit card numbers), medical and insurance information and other information, such as date of birth. 

How it Could Affect Your Business: Manufacturing companies have ad it rough as bad actors seek valuable OT and personal data.

The Government of Fremont County, Colorado

Exploit: Ransomware

The Government of Fremont County, Colorado: Regional Government 

Risk to Business: 1.684 = Severe

The government of Fremont County, Colorado has been paralyzed by a cyberattack that left employees unable to connect to networks or access email. Local reports say that the Fremont County Administration Building, Garden Park Building, Department of Human Services and Fremont County Sheriff’s Office are closed to the public, although the Sherrif’s Office is still operating. The phone systems for the impacted offices are still working. A spokesperson said that they do not believe that any data was stolen. Efforts are underway to restore services.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business It pays to remember that the most likely vector for ransomware is a phishing message.

Argentina – Judiciary of Córdoba

Exploit: Ransomware

Judiciary of Córdoba: Government Entity

Risk to Business: 1.429 = Severe

New ransomware group Play has hit Argentina’s Judiciary of Córdoba. The government entity was forced to shut down its IT systems last week and its online portal and was left only able to conduct business through old-fashioned paper and pen. The Judiciary confirmed that it was hit by ransomware and engaged with Microsoft, Cisco, Trend Micro, and local specialists to investigate the attack and restore services.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Governments have been popular targets for cybercriminals even when they’re not nation-state aligned.

United Kingdom – South Staffordshire PLC 

Exploit: Ransomware

South Staffordshire PLC: Utility Company

Risk to Business: 2.173 = Severe

This week’s most interesting story starts with South Staffordshire PLC. The parent company of South Staffs Water and Cambridge Water confirmed on Monday that it was the victim of a ransomware attack. The Cl0p ransomware gang claimed responsibility but named the wrong water company on its dark web leak site. The group initially said that the victim was Thames Water and not South Staffordshire. Thames Water is the United Kingdom’s largest water supplier, serving 15 million customers in Greater London and other areas on the river that runs through the city. Data posted to the gang’s dark web site includes a spreadsheet of usernames and passwords featuring South Staff Water and South Staffordshire email addresses.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Cybercriminals love to go after utility companies because of the high chance they’ll get paid to avoid service disruptions.

United Kingdom – Holdcroft Motor Group

Exploit: Ransomware

Holdcroft Motor Group: Car Dealerships

Risk to Business: 1.634 = Severe

U.K. auto retailer Holdcroft Motor Group has admitted that it has fallen victim to a ransomware attack that has led to some dire consequences. The company said that the July 2022 attack caused significant damage, resulting in the deletion of data from its servers. Internal investigations revealed that some of the data that was compromised may have contained employee personal information. Holdcroft Motor Group operates nine different dealer franchises across 23 locations in the Midlands and north of England. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Paying the bad guys doesn’t mean you’re getting your data back, more than 90% of organizations that pay don’t get all their data back.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

 An employee’s compromised Google account is to blame for a nasty incident at Cisco and 7-11 is closed by ransomware in Denmark.

Cisco

Exploit: Hacking 

Cisco: Networking Technology Company

Risk to Business: 2.211 = Severe

Cisco Systems confirmed experiencing a cyberattack in May 2022 that was caused by the compromise of an employee’s Google account, The company’s investigation determined that the attackers obtained details of an employee’s private Google account, which contained passwords synced with Cisco’s web browser. The attackers parlayed that into initial access to Cisco’s VPN. The employee’s credentials were synced through the Chrome browser, where the targeted employee had also stored their Cisco credentials. The Yanluowang ransomware gang has claimed responsibility by publishing files stolen in the incident on its dark web leak site.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Insecure or compromised employee credentials can do big damage in a very short span of time.

PlatformQ

Exploit: Misconfiguration

PlatformQ: Digital Engagement Solutions

Risk to Business: 1.687 = Severe

PlatformQ, a provider of digital engagement solutions for healthcare (PlatformQ Health) and education (PlatformQ Education) sector entities, experienced a data breach after an employee accidentally published a database backup stored in a misconfigured AWS S3 bucket. The data appears to be about marketing the drug Zarex to doctor’s offices and similar places, and PII for healthcare professionals was involved.

Individual Risk: 1.733 = Severe

The leak exposed sensitive information including the full names, personal email addresses, job titles work email addresses, home, work and private phone numbers and National Provider Identifier (NPI) numbers of an estimated 99,000 healthcare professionals

How It Could Affect Your Customers’ Business Employee mistakes and negligence are responsible for more data breaches than any other cause, but training helps fix that.

Behavioral Health Group

Exploit: Hacking

Behavioral Health Group: Addiction Treatment Center Operator 

Risk to Business: 1.716 = Severe

Behavioral Health Group recently began notifying 197,507 patients that their data was stolen in a December 2021 cyberattack. The opioid treatment provider’s 80 clinics suffered a week of IT outages that disrupted patient care after a cyberattack forced the team to shut down portions of the network. That in turn caused delays for health services like refilling patient medications, a critical part of the recovery process for many addiction treatment patients.

Individual Risk: 1.802 = Severe

The stolen data varied by patient and could include patient names, Social Security numbers, driver’s licenses, passports, biometrics, health insurance information, diagnoses, treatments, prescriptions, dates of service, and medical record numbers. Only patients whose SSNs were compromised will receive free credit monitoring. 

How It Could Affect Your Business: Medical entities of all sorts have been high on cybercriminal hit lists because they know that it’s a rich and time-sensitive industry.

Acorn Financial Services

Exploit: Phishing

Acorn Financial Services: Financial Planners

Risk to Business: 1.837 = Severe

In April 2022, Acorn Financial Services discovered unusual activity within an employee email account that ultimately led to uncovering a data breach. Acorn says that the incident was kicked off by an employee falling for a phishing email. The company acted to secure the employee’s email account and confirmed that an unauthorized actor has potentially gained access to sensitive customer data. The company has filed data breach notifications and is informing the impacted customers via mail. 

Individual Risk: 1.646 = Severe

While the breached information varies depending on the individual, it may include the client’s name, address, date of birth, driver’s license number, financial account number, Social Security number and other account-related information.  

How it Could Affect Your Business: The financial services sector was the most heavily under seige by ransomware last year, a pattern that continues in 2022.

Klaviyo

Exploit: Phishing

Klaviyo: Email Marketing Firm

Risk to Business: 2.284 = Severe

In an interesting twist on the usual data breach incident, email marketing firm Klaviyo suffered a concentrated and specific data breach on August 3, 2022. After gaining access to an employee’s account thanks to a successful phishing attack, bad actors then downloaded marketing lists used by cryptocurrency-related clients for outreach efforts and for Klaviyo product and marketing updates. The threat actor used the internal customer support tools to search for primarily crypto-related accounts and viewed list and segment information for 44 Klaviyo accounts, downloading data from at least 38 accounts. 

Risk to Business: 2.284 = Severe

 Stolen data includes customers’ names, addresses, email addresses, account profile information and phone numbers. The hackers also downloaded two internal lists used by Klaviyo for product and marketing updates that contain names, addresses, email addresses, and phone numbers.

How it Could Affect Your Business Phishing is the most likely way for any organization to open the door to a data breach.

Bombardier Recreational Products (BRP) Inc.

Exploit: Ransomware

Bombardier Recreational Products (BRP) Inc.: Recreational Equipment Manufacturer 

Risk to Business: 1.529 = Severe

 BRP, Inc, manufacturer of the Ski-Doo and other all-terrain vehicles, watercraft and snowmobiles, has been hit with a suspected ransomware attack that shut down operations briefly at its plants. This attack may have resulted from exposure by a third-party service provider. After an initial complete closure of manufacturing operations, the company expects its manufacturing sites in Valcourt, Canada, Rovaniemi, Finland, Gunskirchen, Austria and Sturtevant in to resume operations imminently. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Service disruptions from cyberattacks can cost manufacturers and the companies that they supply a fortune.

Union des producteurs agricoles (UPA)

Exploit: Ransomware

Union des producteurs agricoles (UPA): Agricultural Trade Organization 

Risk to Business: 2.017 = Severe

Hackers launched a ransomware attack on the Union des producteurs agricoles (UPA) on Sunday, a regional agriculture organization. Bad actors deployed ransomware that paralyzed the network, leaving an estimated 160 UPA employees and 23 UPA client organizations, like the union of grain producers, unable to connect. An investigation is ongoing, and services are expected to be quickly restored.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Groups like this offer a great opportunity for cybercriminals to snatch profitable and useful data.

Denmark – 7 –11 Stores

Exploit: Hacking

7-11 Stores: Convenience Store Chain 

Risk to Business: 1.211 = Extreme

The chain of 7-11 stores in Denmark was forced to shut down after a cyberattack disrupted stores’ payment and checkout systems throughout the country. The attack occurred on August 8th, and all stores remain closed while the company investigates the incident. No word on when they’ll reopen or the nature of the attack, although ransomware is suspected.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business No company can afford to be shut down entirely for days or weeks because of a cyberattack, especially not in retail.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Supply chain breaches lead to expensive problems for the UK NHS and Aetna, a ransomware kerfuffle in an Iowa school district.

Aetna

Exploit: Supply Chain

Aetna: Insurer

Risk to Business: 2.631 = Moderate

Health insurance heavyweight Aetna has reported a data breach to federal regulators affecting nearly 326,000 individuals. This breach was spurred by a ransomware attack at a service provider for an Aetna subcontractor, mailing company OneTouchPoint. This incident is one of the first reported as a direct result of that cyberattack. The OneTouchPoint breach is expected to impact over 30 large and small health insurers and plan providers.  

Individual Risk: 2.755 = Moderate

Aetna said that the exposed information for individuals may include names, addresses, dates of birth, and limited medical information. 

How It Could Affect Your Business: Business services companies are becoming choice targets for cybercriminals looking for quick scores of data.

Lin-Mar School District

Exploit: Ransomware

Lin-Mar School District: Local Public Education Authority

Risk to Business: 2.372 = Severe

Thanks to a bit of timely reporting by local media, it has been revealed that the Lin-Mar School District in Iowa has become a victim of the Vice Society ransomware group. Screenshots of the group’s ransom note were given to the media by an anonymous district staff member. This leak occurred after the school district informed parents and students that it was suffering unspecified “technical difficulties”, raising concerns about the district’s readiness to open for the new school year. The school district has so far refused further comment.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business School districts will be especially appealing right now since the new school year time crunch makes them more likely to pay a ransom.

Wisan Smith Racker & Prescott

Exploit: Hacking

Wisan Smith Racker & Prescott: Accounting Firm

Risk to Business: 1.716 = Severe

Salt Lake City Utah Based accounting firm Wisan Smith Racker & Prescott has disclosed that they have experienced a data breach. On June 14, 2022, the firm learned that an unauthorized party had penetrated its IT security and accessed information about their clients. That information was subsequently used to file fraudulent tax returns supposedly on behalf of several of the company’s clients. Data breach letters have been sent to all of the clients impacted by this breach.  

Individual Risk: 1.788 = Severe

The exposed information varies depending on the individual, but it may include a clients’ name, Social Security number, driver’s license or state identification card number, passport number, military identification number, government-issued identification number, financial account information, date of birth, electronic signature, medical information and health insurance information. 

How It Could Affect Your Business: Ransomware attacks on service providers in the supply chain are an ongoing problem that won’t be going away anytime soon.

Goodman Campbell Brain and Spine

Exploit: Ransomware

Goodman Campbell Brain and Spine: Specialty Medical Practice

Risk to Business: 1.719 = Severe

Goodman Campbell Brain and Spine, a medical practice in Indiana, has disclosed that it has experienced a data breach as a result of a suspected ransomware attack. The Hive ransomware group is implicated in the attack. The practice noted that they discovered the attack had been successful on May 20, 2022. An estimated 363,000 people had data exposed in this incident.

Individual Risk: 1.606 = Severe

Information affected in the incident includes patient PII and PHI including name, date of birth, address, telephone number, email addresses, medical record number, patient account number, diagnosis and treatment information, physician name, insurance information, dates of service and Social Security numbers. 

How it Could Affect Your Business: Healthcare is the industry with the highest data breach cost, and its’ been beleaguered by ransomware.

United Kingdom – National Health Service

Exploit: Supply Chain

National Health Service: Healthcare System

Risk to Business: 2.304 = Severe

United Kingdom’s National Health Service (NHS) has experienced a service outage of its 111 non-emergency medical service system that was triggered by a cyberattack that hit the systems of British MSP Advanced. The MSP’s Adastra system is used by 85% of NHS 111 services for patient management. Advanced said that the suspected ransomware attack was spotted at 07:00 BST last Thursday. This attack has had a widespread impact, affecting ambulance dispatch, out-of-hours appointment bookings and emergency prescriptions throughout the UK. Advanced says that the issue may not be resolved until this week. The emergency 999 system was not impacted.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business This is a great illustration of how no organization is safe from potential supply chain trouble.

Germany – Semikron

Exploit: Ransomware

Semikron: Semiconductor Manufacturer

Risk to Business: 1.529 = Severe

Semikron, a manufacturer of semiconductors for electric vehicles and industrial automation systems, has confirmed it has fallen victim to a ransomware attack, likely by the LV ransomware group. The attackers are demanding an unspecified ransom after stealing an estimated 2TB of documents and encrypting systems at the Nuremberg-based company. No specifications have been given for the exact data types stolen or the ransom amount demanded.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Service disruptions from cyberattacks can cost manufacturers and the companies that they supply a fortune.

Germany – The Association of German Chambers of Industry and Commerce (DIHK)

Exploit: Ransomware

The Association of German Chambers of Industry and Commerce (DIHK): Business Association

Risk to Business: 2.017 = Severe

The Association of German Chambers of Industry and Commerce (DIHK) has announced that it has been the victim of what it characterized as a “massive cyberattack”. The organization said that all internet connections at the organization were shut off as a way to address the issue, leading to phone, email and website outages that impacted all 79 local outposts to varying degrees. The DIHK is a business association that notes that it helps companies with legal issues, provides general support and promotes German businesses internationally.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Groups like this offer a great opportunity for cybercriminals to snatch profitable and useful data.

Luxembourg – Encevo Group

Exploit: Ransomware

Encevo Group: Energy Conglomerate

Risk to Business: 2.017 = Severe

The BlackCat/ AlphV ransomware group is allegedly responsible for a ransomware attack that landed on two subsidiaries of the Encevo Group, a Luxembourg-based energy supplier. The company disclosed that energy network operator Creos and supplier Enovos had been affected. The attack took down customer portals for both companies but did not affect the supply of electricity and gas. The Encevo Group is partially owned by the government of Luxembourg. The attackers claim to have stolen 150 GB of data that they said includes contracts, passports, bills and emails although that has not been confirmed by Creos, Enovos or the Encevo Group. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business The energy sector has been a popular target for the bad guys who are continuing to pound critical infrastructure with ransomware attacks.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

A new ransomware group makes a splash and more supply chain security problems.

OneTouchPoint 

Exploit: Ransomware

OneTouchPoint: Business Services

Risk to Business: 1.772 = Severe

OneTouchPoint, a provider of mailing and printing services, fell victim to a ransomware attack that has resulted in the compromise of personally identifiable information (PII) stored on its system. The company discovered encrypted files on some of its systems on April 28. It was later determined that the attackers had accessed its network on April 27 determined that the compromised systems contained PII provided by its customers. 

Individual Risk: 2.335 = Severe

 Exposed information includes names, addresses, birth dates, date of service, description of service, diagnosis codes, information provided as part of a health assessment and member ID. OneTouchPoint lists 34 healthcare insurance carriers and healthcare services providers that have been impacted, but the number appears to be larger. 

How It Could Affect Your Business: This is going to end up costing this company a fortune in both incident costs and regulatory penalties.

NetStandard 

Exploit: Ransomware

NetStandard: MSP 

Risk to Business: 1.672 = Severe

Kansas-based managed service provider NetStandard suffered a cyberattack that resulted in the company pressing pause on its MyAppsAnywhere cloud services, consisting of hosted Dynamics GP, Exchange, Sharepoint and CRM services. The MSP detected signs of a cyberattack last Tuesday morning and quickly shut down cloud services to prevent the attack’s spread. The company announced that only the MyAppsAnywhere services are affected, but news outlets report that the attack may have had a broader impact, with the company’s main site shut down as well.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business MSPs have been squarely in cybercriminals’ sights as they concentrate firepower on the supply chain.

WordFly

Exploit: Ransomware

WordFly: Business Services

Risk to Business: 2.773 = Moderate

Email list provider WordFly has been the victim of a ransomware attack. WordFly’s main website is unavailable and has been offline for the past two weeks. The company says that they discovered the problem on July 10. WordFly said that they believe that customer data was accessed but they didn’t specify the nature of that data. The Smithsonian Museums, Canada’s Toronto Symphony Orchestra and the Courtauld Institute of Art in London are among the company’s clientele.   

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Ransomware attacks on service providers in the supply chain are an ongoing problem that won’t be going away anytime soon.

DuPage Medical Group

Exploit: Hacking

DuPage Medical Group: Healthcare Organization 

Risk to Business: 1.619 = Severe

Illinois-based DuPage Medical Group, an organization with more than 700 doctors in 100 locations, has been the victim of a cyberattack that exposed patient data. The incident occurred between July 12-13 and caused a network outage. An investigation determined that bad actors had likely accessed patient data. The medical group is notifying 600,000 patients that their personal information may have been compromised.  

Individual Risk: 1.619 = Severe

Illinois-based DuPage Medical Group, an organization with more than 700 doctors in 100 locations, has been the victim of a cyberattack that exposed patient data. The incident occurred between July 12-13 and caused a network outage. An investigation determined that bad actors had likely accessed patient data. The medical group is notifying 600,000 patients that their personal information may have been compromised.  

How it Could Affect Your Business: Healthcare is the industry with the highest data breach cost, and its’ been beleaguered by ransomware.

United Kingdom – Wooton Academy Trust

Exploit: Ransomware

Wooton Academy Trust: School Operator

Risk to Business: 2.304 = Severe

The Hive ransomware group is claiming responsibility for a ransomware attack against the Wooton Academy Trust, operators of Wooton Secondary School and the Kimberley college for 16-19-year-olds. The gang is demanding a $500,000 ransom, the amount it claims the school has available in cyber insurance. In an unusual twist, the gang allegedly messaged students and parents, informing them that they had stolen the students’ home addresses, bank details, medical records and even psychological reviews. The school says that the incident has affected scheduling for next year, along with the production of some grade sheets. It hopes to retrieve lost data from backups in order to resume normal operations within 10 days.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Cybercriminals have been going after schools consistently for the last few years as virtual learning pens up profit opportunities for them.

United Kingdom – Bromford Housing Association

Exploit: Hacking

Bromford Housing Association: Housing Assistance Organization

Risk to Business: 1.929 = Severe

Bromford Housing Association, a housing program with tenants across Gloucestershire, has been the victim of a cyberattack. Bromford manages 40,000 homes across central and southwest England, providing services for around 90,000 people. The company says it was forced to shut down its technology systems including communications, appointments and online payments. Clients are limited to service and payments by phone. There’s been no word on what if any data was stolen.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Service disruptions from cyberattacks can cost companies big in both productivity and reputation.

France – MDBA

Exploit: Hacking

MDBA: Defense Contractor

Risk to Business: 2.017 = Severe

A new cybercrime group claims that it has snatched data from European missile developer and manufacturer MDBA. The bad actors call themselves Adrastea and claim to have obtained 60GB of confidential data by exploiting vulnerabilities in the company’s network. Adrastea claims to have taken information about the company’s projects, OT, defense systems the company has worked on, and other sensitive data about military matters.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Cybercriminals are hungry for OT information and similar proprietary data, especially of this sensitive nature.

Italy – Italian Revenue Agency (Agenzia delle Entrate)

Exploit: Ransomware

Italian Revenue Agency (Agenzia delle Entrate): Government Agency 

Risk to Business: 2.017 = Severe

A ransomware attack has hit the town of St Mary’s in Ontario, locking staff out of internal systems and encrypted data. The ransomware group LockBit has claimed responsibility. The cybercriminals uploaded a sample to their leak site containing directories corresponding to municipal operations like finance, health and safety, sewage treatment, property files, and public works. Town officials were quick to reassure citizens that essential municipal services like transit and water systems haven’t been impacted. No word on any ransom demand or if the municipality plans to pay. LockBit is also responsible for another attack on a small town this week, hitting Frederick, Colorado on July 14. The group is demanding $200,000 not to publish the data snatched from Frederick, CO. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business The bad guys know they have a higher chance of getting paid thanks to the time-sensitive nature of government services, making them prime targets

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident