MSnet

A new Twitter hack exposes data for 5.4 million accounts and LockBit scores hits on two municipalities.

Twitter 

Exploit: Hacking

Twitter: Social Media Network

Risk to Business: 2.783 = Moderate

Cybercriminals say that they’ve exploited a vulnerability in the Twitter platform to obtain data about 5.4 million accounts. Altogether, bad actors claim to have snatched data from 5.4 million accounts, with the data now up for sale on a hacker forum for $30,000. Twitter was alerted to the exploit in January 2022 and fixed it quickly, but the damage had already been done. The method used to scrape the data was similar to an attack on Facebook in 2021. Twitter has not confirmed or denied the attack as of press time, saying that the incident is under investigation.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Cybercriminals are always happy to exploit vulnerabilities and security gaps that allow them to obtain data.

AllOne Health Resources, INC.

Exploit: Business Email Compromise (BEC)

AllOne Health Resources: Insurance Company

Risk to Business: 1.672 = Severe

AllOne Health Resources, Inc. Has experienced a data breach as the result of a business email compromise attack. The company says that an unauthorized party gained access to sensitive consumer data contained on its network after landing the BEC attack. According to AllOne Health, the company discovered the breach after it realized that the company’s finance department had sent several wire transfers to a fraudulently created bank account. That prompted an investigation which revealed that bad actors had gained access to an employee’s email account and snatched sensitive data.  

Individual Risk: 1.703 = Severe

Exposed information includes the names, addresses, dates of birth, driver’s license numbers, Social Security numbers and health information of 13,669 individuals.  

How It Could Affect Your Business A data security disaster in the healthcare sector is extra expensive and damaging after regulators weigh in.

Blue Cross and Blue Shield (BCBS) of Massachusetts

Exploit: Supply Chain Risk

Blue Cross and Blue Shield (BCBS) of Massachusetts: Insurance Company 

Risk to Business: 1.701 = Severe

Blue Cross and Blue Shield (BCBS) of Massachusetts has filed a notice with the Maine Attorney General’s Office stating that the company had suffered a breach of employee pension data thanks to an insider incident at a vendor, LifeWorks US. BCBS of Massachusetts and BCBS of Massachusetts HMO Blue used the vendor for services related to employee pension plan payments. BCBS says that on May 17, 2022, a now former LifeWorks employee mishandled data by emailing spreadsheets containing identifiable information about BCBS employees to both their personal email address and the personal email address of another former LifeWorks employee.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Supply chain risk is an ongoing problem that won’t be going away anytime soon, and cybercrime doesn’t even have to be involved for it to damage a business.

Entrust 

Exploit: Ransomware

Entrust: Software Company

Risk to Business: 1.776 = Severe

Digital security software maker Entrust has confirmed that it suffered a cyberattack where threat actors breached its network and stole data from internal systems. Entrust says that about two weeks ago, bad actors penetrated security and gained access to corporate data. The company maintains that data theft does not have an impact on its products and services. No ransomware group has claimed responsibility for the attack as of press time, and no ransom demand has been released. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Bad actors aren’t just looking for PII/PHI or financial data, they’re also in the market to steal data about OT and proprietary data.

Neopets 

Exploit: Hacking

Neopets: Video Game Website

Risk to Business: 2.304 = Severe

Virtual pet website Neopets has suffered a data breach that resulted in the theft of source code and a database containing the personal information of over 69 million members. A hacker on the dark web going by the name TarTarX is selling the source code and database for the Neopets.com website for four bitcoins. Neopets recently launched NFTs that will be an element in an upcoming online Metaverse game.  

Individual Risk: 2.215 = Severe

The data includes members’ usernames, names, email addresses, zip code, date of birth, gender, country, an initial registration email and other site/game-related information. 

How it Could Affect Your Business The bad guys are always hungry for big pools of data, and adding some source code to the mix makes it even better.

Gas South, LLC

Exploit: Hacking

Gas South, LLC.: Natural Gas Company 

Risk to Business: 1.929 = Severe

Atlanta, Georgia natural gas provider Gas South has disclosed a data breach that may have exposed consumer data. The company says that an unauthorized party had access to its network between February 13 and February 23, 2022, with access to sensitive consumer data related to 38,000 individuals. Gas South is the largest natural gas provider in the Southeastern United States. 

Individual Risk: 2.215 = Severe

The consumer information exposed may have included customers’ Social Security numbers, driver’s license numbers and financial data.    

How it Could Affect Your Business Utilities and other infrastructure targets have been under the gun for the last year, with 14 of 16 critical infrastructure sectors hit by a cyberattack in 2021.

Qmunity

Exploit: Hacking

Qmunity: Non-Profit 

Risk to Business: 2.017 = Severe

Non-profit Qmunity, a 2SLGBTQ+ resource and online community provider, says that its website has been hacked, leading to service disruptions. Cybercriminals injected malicious code into the site, deferring users to download apps and illicit third-party pages. Most website functions have been restored and no client or personal data stored was accessed. This is the second cyberattack aimed at a Vancouver-based 2SLGBTQ+ resource in the past few weeks. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Adding or adjusting links to be malicious is a signature trick of cybercriminals and they never stop using it.

The Town of St. Mary’s, Ontario 

Exploit: Ransomware

St. Mary’s, Ontario: Municipality 

Risk to Business: 2.017 = Severe

A ransomware attack has hit the town of St Mary’s in Ontario, locking staff out of internal systems and encrypted data. The ransomware group LockBit has claimed responsibility. The cybercriminals uploaded a sample to their leak site containing directories corresponding to municipal operations like finance, health and safety, sewage treatment, property files, and public works. Town officials were quick to reassure citizens that essential municipal services like transit and water systems haven’t been impacted. No word on any ransom demand or if the municipality plans to pay. LockBit is also responsible for another attack on a small town this week, hitting Frederick, Colorado on July 14. The group is demanding $200,000 not to publish the data snatched from Frederick, CO. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Governments and agencies have been targets for ransomware because the bad guys know they have a higher chance of getting paid thanks to the time-sensitive nature of government services.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

It’s game over for security at Bandai Namco, human error causes a breach at a UK college and Lending Tree admits they’ve been breached.

Narragansett Bay Commission

Exploit: Ransomware

Narragansett Bay Commission: Utility Company

Risk to Business: 2.783 = Moderate

The Narragansett Bay Commission has been hit with a ransomware attack. The utility runs sewer systems in parts of the Providence and Blackstone Valley areas in Rhode Island.  A spokesperson for the company said that the company experiences the encryption of data on some computers and systems in its network. However, service was not interrupted, and the utility does not store customer payment data. No word on what data was stolen or if the Narragansett Bay Commission paid a ransom.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Experts have warned that utilities are key targets for cybercriminals looking for quick money.

Lending Tree

Exploit: Hacking

Lending Tree: Financial & Mortgage Services

Risk to Business: 1.672 = Severe

Mortgage giant Lending Tree, LLC recently confirmed that the company has experienced a data breach after cybercriminals discovered a code vulnerability on its website. According to a notice filed by the company, on June 3, 2022, Lending Tree discovered a code vulnerability on the company’s website that likely resulted in bad actors gaining access to sensitive personal information for customers. Lending Tree believes that the vulnerability was in place since mid-February 2022.

Individual Risk: 1.703 = Severe

Exposed information varies depending on the individual, but may include client names, Social Security numbers, dates of birth and street addresses.

How It Could Affect Your Business The financial sector was at the top of the cybercriminal hit list in 2021 and that hasn’t changed in 2022.

Family Practice Center

Exploit: Hacking

Family Practice Center: Medical Clinic Operator

Risk to Business: 1.701 = Severe

Pennsylvania-based medical clinic chain Family Practice Center has experienced a data breach. The company filed a notice with the U.S. Department of Health and Human Services saying that on October 11, 2021, it was the target of a cyberattack that attempted to shut down its computer systems. This may have led to an unauthorized party gaining access to sensitive data about 83,969 patients.  

Individual Risk: 1.641 = Severe

The breached information includes a patient’s name, Social Security number, address, medical insurance information and health/ treatment information.

How It Could Affect Your Business: Medical facilities of all kinds should be strengthening security in response to non-stop threats in the sector.

United Kingdom – Morgan Hunt

Exploit: Supply Chain Risk

Morgan Hunt: Recruiting Firm

Risk to Business: 1.776 = Severe

British recruitment agency Morgan Hunt confirmed that it has experienced a data breach that resulted in intruders snatching personal data for some of the freelancers on its books. The recruiter pointed the finger at a third party service provider as the source of the problem. Impacted freelancers were sent a letter informing them of the incident.

Individual Risk: 1.741 = Severe

The information accessed included contractors’ names, contact details, identity documents, proof of address documents (including any bank or building society statement provided), National Insurance number, and date of birth.

How it Could Affect Your Business: Cybercriminals are hungry for fresh stores of data, making service providers very attractive targets

United Kingdom – City College Norwich

Exploit: Human Error

City College Norwich: Institution of Higher Learning 

Risk to Business: 2.304 = Severe

City College of Norwich is in hot water after an employee mistakenly sent the wrong information to a student’s family. A parent tipped off officials after they were sent an expected attachment in an email exchange with one of the college’s customer service team when she received an unanticipated attachment, a spreadsheet titled “P2E links for scheduled applicants”. That spreadsheet contained the personal data of hundreds of people associated with the college. The incident is under investigation.  

Individual Risk: 2.215 = Severe

The spreadsheet included names, telephone numbers, postal and email addresses and other identifying details of students and applicants.

How it Could Affect Your Business Humans will make mistakes, but training can help reduce the chance that employees make security errors like this one.

Japan – Bandai Namco

Exploit: Ransomware

Bandai Namco: Videogame & Toy Maker

Risk to Business: 1.929 = Severe

The ransomware group Black Cat is claiming responsibility for a ransomware attack that hit Japanese entertainment company Bandai Namco. The video gaming giant confirmed that the group’s companies in Asian regions, excluding Japan, were breached by a third party on July 3, 2022. Bandai Namco appeared on the cybercriminal operation’s dark web site immediately afterward. The company said that in a statement “It is a possibility that customer information related to the Toys and Hobby Business in Asian regions (excluding Japan) was included in the servers and PCs, and we are currently identifying the status about [the] existence of leakage, scope of the damage, and investigating the cause.” 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Ransomware attacks on all sorts of businesses have soared in the last 12 months as cybercriminals search for new revenue streams.

Australia – Deakin University 

Exploit: Credential Compromise

Deakin University: Institution of Higher Learning

Risk to Business: 2.017 = Severe

Deakin University in Melbourne has experienced a data security incident. The username and password of a single staff member at Deakin University was hacked and then used to unlock private details of 46,980 past and current students. The hackers then used that data to send phishing messages to students. In the messages, the cybercriminals sent out two links, both of which took the student to a malicious form that phished for information including credit card details. The breach will be reported to the Office of the Victorian Information Commissioner (OVIC). 

Risk to Business: 2.213 = Severe

Altogether, bad actors obtained the contact details of 46,980 past and current Deakin students. The haul included student names, IDs, mobile numbers, email addresses and even recent university results.

How it Could Affect Your Business Just one compromised credential can open organizations up to a world of hurt and an expensive security nightmare.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Marriott gets hit by ransomware.

Marriott International 

Exploit: Ransomware

Marriott International: Hotel Operator 

Risk to Business: 2.783 = Moderate

Marriott is looking at another big data breach after a group of cybercriminals claims to have stolen an estimated 20 gigabytes of data, including financial data like credit card information and confidential information about guests and workers from an employee at the BWI Airport Marriott in Baltimore. The group identified themselves as GNN or “Group with No Name” to media outlets and sent along samples of the purportedly stolen data. Marriott contends that the stolen data consisted of “non-sensitive internal business files regarding the operation of the property.” The incident remains under investigation. 

How It Could Affect Your Business: Hotels are a prime target for cybercriminals because they often have stores of valuable financial and personal data on guests.

American Marriage Ministries (AMM)

Exploit: Misconfiguration

American Marriage Ministries (AMM): Non-Profit  

Risk to Business: 2.617 = Moderate

American Marriage Ministries (AMM), a Seattle-based non-denominational religious organization that ordains wedding officiants, has suffered a data breach. Researchers say they’ve discovered 630 GB of data on about 185,000 officiants and roughly 15,000 married couples as well as their wedding guests exposed in an unsecured Amazon Web Services bucket. The data trove contained Ministers’ program application forms, over 500,000 ordination certificates and minister identification documents, and marriage licenses that contain details about newly wedded couples and more was included in the bucket. The incident was reported to FBI IC3.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business SMBs that handle or store large amounts of data have been high on cybercriminal shopping lists, particularly in recent months.

SHI International

Exploit: Malware

SHI International: IT Services 

Risk to Business: 1.601 = Severe

New Jersey-based IT services provider SHI international suffered a major business disruption over the July 4 weekend after being forced offline by a cyberattack. The company disclosed that the defensive measures it had been forced to take to stop the attack included taking SHI’s public websites and email offline while the attack was investigated. Website and email outages lasted for several days before finally being resolved about July 10. Customers were told that they could still access their representatives by phone throughout the incident which remains under investigation. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: MSPs, MSSPs and other IT/technical services providers have been frequent targets of cybercriminals recently and should strengthen security.

Yuma Regional Medical Centre (YRMC)

Exploit: Ransomware

Yuma Regional Medical Center (YMMC): Medical System

Risk to Business: 1.903 = Severe

A ransomware attack that landed on Yuma Regional Medical Center (YRMC) in Arizona has exposed the protected health information of an estimated 700,000 patients. The company has disclosed that it experienced the ransomware attack in late April and that an unauthorized individual had access to YRMC’s systems from April 21 to April 25, allowing them to steal a subset of files from the systems. There was no impact on patient care.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: A data breach for a healthcare organization is especially damaging between incident costs and regulatory penalties.

WellDyneRx, LLC 

Exploit: Hacking

WellDyneRx, LLC: Pharmacy Benefits Management

Risk to Business: 2.304 = Severe

WellDyneRx has reported a data breach that resulted from unauthorized access to one of the company’s email accounts. The company filed a notice with the U.S. Department of Health and Human Services Office for Civil Rights regarding a data breach in December 2021, indicating that the company estimates the breach affected 38,401 individuals. WellDyneRX is a pharmacy benefit manager and oversees the administration of the pharmacy benefits portion of insurance policies on behalf of insurance companies at 65,000 retail pharmacies from major chains to mom-and-pop shops. 

Individual Risk: 2.215 = Severe

Cybercriminals may have accessed the names, dates of birth, Social Security numbers, driver’s license numbers, treatment information, health insurance information, contact information, prescription information, and other medical and healthcare-related information of individuals served by WellDyneRx.  

How it Could Affect Your Business It’s not just hospitals and doctor’s offices, medical services providers are also experiencing surging risk with big penalties for failure to keep data safe.

United Kingdom – Aon, PLC

Exploit: Hacking

Aon, PLC: Professional Services Provider 

Risk to Business: 2.829 = Moderate

AON, PLC, a U.K.-based company that handles risk mitigation for insurance, pension administration, and health insurance plans, has experienced a data breach that was recently disclosed in a notice on the Maine Attorney General’s Office website. Aon says that the data breach is believed to have affected as many as 31,799 individuals who have been informed via letter.  

Individual Risk: 2.836 = Moderate

 The company says that an unauthorized party temporarily obtained documents that contained the names, driver’s license numbers, Social Security numbers, and some benefit enrollment information of plan enrollees.

How it Could Affect Your Business professional services companies are prime targets for bad guys that are on the hunt for rich stores of data.

France – La Poste Mobile

Exploit: Ransomware

La Poste Mobile: Telecommunications Company

Risk to Business: 1.206 = Extreme

The Lockbit ransomware group has claimed responsibility for a ransomware attack on French telecommunications giant La Poste Mobile. The virtual mobile telephone operator La Poste Mobile was walloped by a ransomware attack on July 4 that paralyzed administrative and management services. The company was forced to suspend operations on its website and customer areas as part of its incident remediation.   

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Telecoms are prime targets for ransomware because of the y cannot afford any network downtime, making them likely to pay the ransom fast.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

July 06, 2022

An insider incident causes trouble for OpenSea, cybercriminals claim to have scored data from AMD and ransomware stops the presses at Macmillan plus.

Geographic Solutions Inc.

Exploit: Ransomware

Geographic Solutions Inc.: Software Company 

Risk to Business: 1.427 = Extreme

A ransomware attack on a major provider of software to state government agencies around the U.S. has resulted in website outages that impacted government services. Geographic Solutions provides workforce development, labor market information, and unemployment insurance software solutions to 35 U.S. states including Nebraska, Tennessee, Texas, Florida, North Carolina, California and Indiana. Labor department job search and unemployment program website outages left citizens and government officials scrambling. The company has engaged a third-party firm to help with the cleanup and most services have been restored.  

How It Could Affect Your Business: A data security incident at a service provider can be a disaster for any business and it will be especially damaging for the healthcare clients involved here.

California Department of Justice

Exploit: Human Error

California Department of Justice: State Government Agency 

Risk to Business: 2.617 = Moderate

The California Department of Justice has disclosed a messy data breach courtesy of its Firearms Dashboard Portal. In the course of an update in late June, user data for anyone who had applied for a concealed carry firearms permit from 2011 through 2021 using the site was exposed for an estimated 24 hours in an unsecured spreadsheet.  Data was also exposed on several other state-maintained gun-related online dashboards, including the Assault Weapon Registry, Handguns Certified for Sale, Dealer Record of Sale, Firearm Safety Certificate and Gun Violence Restraining Order dashboards. 

Individual Risk: 2.613 = Moderate

User data that may have been exposed includes names, dates of birth, gender, race, driver license numbers, addresses, and criminal histories. Social Security numbers and financial information were not involved. 

How It Could Affect Your Business SMBs that handle or store large amounts of data have been high on cybercriminal shopping lists, particularly in recent months.

Napa Valley Community College

Exploit: Ransomware

Napa Valley Community College: Institution for Higher Learning 

Risk to Business: 1.601 = Severe

Napa Valley College has experienced a ransomware attack that resulted in its website and network systems being knocked offline. The incident, which started over two weeks ago, knocked systems including the college’s on-campus telephones and employee email accounts out, leaving social media and an athletic department website run on a separate network as the only communication channels for the college. Professors and staff have since had email restored.  The college also announced that it will continue teaching summer-session classes both in-person and remotely using an online platform that includes email and communication with professors. The incident is under investigation. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: The education sector has been hammered by cyberattacks for the last few years impacting schools at every level.

OpenSea

Exploit: Insider Threat

OpenSea: Non-Fungible Token Marketplace 

Risk to Business: 1.903 = Severe

NFT giant OpenSea has had a data breach caused by an employee at a third-party service provider misusing their access to data. OpenSea announced last week that an employee of email vendor Customer.io, misused their employee access to download and share email addresses of OpenSea’s users and newsletter subscribers with an unauthorized external party. Customer.io told TechCrunch that the culprit was likely an employee who abused their role-specific access privileges and that no other company’s data was involved in this incident.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Finance sector organizations have been at the top of the cybercriminal hit list, especially crypto-related entities.

New Peoples Bank

Exploit: Hacking

New Peoples Bank: Financial Institution 

Risk to Business: 2.304 = Severe

New Peoples Bank, a bank with branches in Virginia, West Virginia and Tennessee, has announced that it has experienced a data breach. An unauthorized person accessed bank systems on June 9, leading to data exposure for customers as well as disrupting banking and financial services. The bank is providing one year of free credit monitoring for impacted clients. Services have since been restored.

Individual Impact: 2.383 = Severe

New Peoples Bank, a bank with branches in Virginia, West Virginia and Tennessee, has announced that it has experienced a data breach. An unauthorized person accessed bank systems on June 9, leading to data exposure for customers as well as disrupting banking and financial services. The bank is providing one year of free credit monitoring for impacted clients. Services have since been restored.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Banks of every size are a likely target of ransomware attacks and need to take extra security precautions.

Advanced Micro Devices (AMD) 

Exploit: Hacking

Advanced Micro Devices (AMD): Semiconductor Company 

Risk to Business: 2.822 = Moderate

Chipmaker AMD is investigating a security breach after cybercrime gang RansomHouse, published a claim that they have obtained the company’s data. claims to have breached AMD on January 5 to steal 450GB of data. The group claims to be targeting companies with weak security, boasting that it was able to compromise AMD due to the organization’s weak passwords. In addition to the passwords, RansomHouse claims to have snatched network files and system information from AMD as well.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Manufacturers aren’t safe from cybercriminals looking to snatch information about operational technology.

United Kingdom – Macmillan Publishing

Exploit: Ransomware

Macmillan Publishing: Media Company 

Risk to Business: 2.206 = Severe

Major publisher Macmillan has experienced a ransomware attack that impacted its offices and warehouses in the U.S. and U.K.. The late June incident caused the company to shut down all of its IT systems. The company said in a statement that “certain files on its network” had been encrypted. Macmillan employees were briefly unable to access email and sales representatives shared that there may be publishing delays as a result of the attack.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Companies that handle time-sensitive business are prime targets for cybercriminals looking for a quick payoff.

United Kingdom – Apetito 

Exploit: Hacking

Apetito: Meal Delivery Service 

Risk to Business: 1.922 = Severe

UK meal delivery company Apetito has announced that meal service to thousands of people in western England was disrupted for several days due to a cyberattack. Apetito delivers ready-to-eat meals to hospitals, elder care facilities, schools, childcare facilities and the homes of vulnerable people. The attack also impacted Apetito’s subsidiary Wiltshire Farm Foods, which delivers frozen heat-and-eat meals. Service was expected to be restored around July 4.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Service providers have been popular targets for cybercriminals hunting for data to sell.

Austria – The Medical University of Innsbruck 

Exploit: Ransomware 

The Medical University of Innsbruck: Institution of Higher Learning 

Risk to Business: 1.922 = Severe

The ransomware group Vice Society has claimed responsibility for a ransomware attack against the Medical University of Innsbruck. That attack took place last week, causing major disruptions and resulting in data exposure. A report in Bleeping Computer noted that the attack forced the university’s IT team to reset all 3,400 student and 2,200 employee account passwords in an arduous process that required everyone to personally collect their new credentials manually. Operations have since been restored. Vice Society has posted a sample of the stolen documents on its website. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Universities are major targets for cyberattacks thanks to the amount of data they store and the need to maintain constant uptime.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Two automotive companies get hit by ransomware and, a remarkable tale of a data loss incident for one Japanese city.

Flagstar Bank

Exploit: Hacking

Flagstar Bank: Banking & Financial Services

Risk to Business: 1.617 = Severe

Flagstar Bank disclosed that they’ve had a data breach that impacts an estimated 1.5 million customers. The Michigan-based bank says that the cyberattack occurred on Dec. 3 and Dec. 4, 2021. However, the company did not determine who was affected until June 2022. The data breach happened during Flagstar Bancorp’s acquisition by New York Community Bank. The US financial organization is headquartered in Michigan and operates over 150 branches in areas including Indiana, California, Wisconsin, and Ohio. 

Individual Risk: 1.878 = Severe

The only available information about the breached data says that the Social Security numbers were exposed.

How It Could Affect Your Customers’ Business: Banking & Finance was the sector that experienced the most cyberattacks including ransomware in 2021.

ADM Associates, Inc.

Exploit: Hacking

ADM Associates: Energy Consulting 

Risk to Business: 2.785 = Moderate

Energy evaluation company ADM Associates has reported a data breach impacting consumers. The company said that between August and September 2021 an unauthorized individual may have accessed and acquired certain information from its systems. ADM associates does energy research and evaluation for public utility companies. Affected individuals have been informed via letter and the company is offering free credit monitoring.  

Individual Risk: 2.831 = Moderate

Exposed information may include customer PII including names, addresses and other identifying data as well as sensitive financial information and Social Security numbers.

How It Could Affect Your Business SMBs that handle or store large amounts of data have been high on cybercriminal shopping lists, particularly in recent months.

Atrium Health

Exploit: Phishing

Atrium Health: Medical System 

Risk to Business: 1.601 = Severe

North Carolina-based Atrium Health has announced a data breach impacting 7,000 patients. The healthcare provider says that an employee at Atrium Health at Home fell victim to a phishing attack, resulting in bad actors accessing that employee’s email and messaging account in April 2021. Atrium is mailing letters to the affected patients and hasn’t determined whether the unauthorized user accessed the protected health information in the accounts. 

Individual Risk: 1.733 = Severe

Patient PII that was exposed included names, addresses, dates of birth and health insurance information. A limited number of patients may have also had their Social Security numbers, driver’s license numbers and financial account numbers compromised in the breach.    

How It Could Affect Your Business: Healthcare data is always a desirable commodity for bad actors and letting them get their hands on it is always an expensive mistake for healthcare providers.

Brazil – Fast Shop

Exploit: Ransomware

Fast Shop: Online Retailer 

Risk to Business: 1.872 = Severe

 A ransomware attack at Brazilian retailer Fast Shop ended up shutting down the company’s online store briefly. The outage impacted the company’s main website, mobile apps and online ordering system. An unnamed hacking group claimed that they’ve snatched the company’s data from various cloud services including AWS, AZURE, GITLAB and IBM cloud including source codes, PCI data, and various user and corporate data. Bad actors also took control of the company’s Twitter account where they announced the breach.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Cybercriminals love to hit online retailers because of the possibility they’re storing profitable sensitive personal and financial customer data

United Kingdom – Yodel 

Exploit: Ransomware

Yodel: Logistics Company

Risk to Business: 2.183 = Severe

UK delivery company Yodel has experienced a suspected ransomware attack that has disrupted its services. Yodel’s tracking and customer services went down over the weekend as a result of the attack and the company is working to restore its services. The firm says that it doesn’t hold any customer payment information, and Yodel is currently investigating whether any personally identifiable information (PII) pertaining to clients has been taken. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Aside from the initial expense, ransomware can also lead to lost productivity, lost business and reputation loss.

Japan – Nichirin

Exploit: Ransomware

Nichirin: Auto Parts Manufacturer 

Risk to Business: 2.206= Severe

Auto hose manufacturer Nichirin has announced that its U.S. subsidiary, Nichirin-Flex USA, has experienced a ransomware attack. The incident has caused the company to take production and technology systems offline, potentially impacting the manufacturing and delivery of customer orders. The firm’s website was briefly taken offline, and the damage appears to have been limited to the company’s U.S. operations.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Manufacturers aren’t safe from cybercriminals looking to score fast payments to prevent supply chain disruption.

Japan – TB Kawashima

Exploit: Ransomware

TB Kawashima: Auto Parts Manufacturer

Risk to Business: 2.206 = Severe

In this week’s second incident at a Japanese auto parts company, automotive fabrics company TB Kawashima has disclosed that it has been the victim of a ransomware attack. The LockBit group has claimed responsibility. TB Kawashima is a division of Toyota Boshoku of the Toyota Group of companies. The company’s website was knocked offline, but they expect minimal impact on production or sales.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Manufacturers that are linchpins in a supply chain are prime targets for hackers these days.

Japan – The City of Amagasaki

Exploit: Insider Threat (Employee Mistake)

Amagasaki: Municipal Government 

Risk to Business: 1.772 = Severe

In this week’s most interesting breach tale, the city of Amagasaki, Japan has found itself embroiled in a data breach thanks to the actions of one careless worker. A contractor who was working for this city to disburse pandemic subsidies took a USB drive containing numerous city records out of the office. But rather than heading straight home, the worker decided to go out on the town. That resulted in the worker passing out in the street and losing the bag containing the USB and all that city data.

Individual Risk: 1.613 = Severe

The USB contained names, birth dates, addresses, tax details, banking information and social security records for city residents.  

How it Could Affect Your Business Data stored on physical devices is data that can be more easily misplaced or lost with careless handling.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Healthcare and education have a bad week nad political hacking intrigue in Germany. 

Kaiser Permanente

Exploit: Credential Compromise

Kaiser Permanente: Healthcare Provider 

Risk to Business: 2.176 = Severe

A data breach at healthcare and insurance giant Kaiser Permanente has exposed the personal information and health data of patients in the state of Washington. The company says that an unauthorized party gained access to its systems through a compromised employee email account in April 2022. The U.S. Department of Health and Human Services Office for Civil Rights reports that 69,589 records were potentially exposed as a result of the email security slip-up at Kaiser’s Washington unit. 

Individual Risk: 2.278 = Severe

Exposed data includes a patient’s first and last name, medical record number, dates of service, and laboratory test result information of the health plan provider. 

How It Could Affect Your Business: This will be an expensive employee mistake (and training failure) once regulators get finished with penalties for this incident.

Comstar

Exploit: Hacking

Comstar: Medical Billing Service 

Risk to Business: 1.742 = Severe

U.S. ambulance billing service Comstar has disclosed that it has exposed sensitive information belonging to medical patients. The company stated that it notices suspicious activity in March 2022, and an investigation determined that certain systems on Comstar’s network were subject to unauthorized access, but investigators were ultimately unable to confirm what specific information on those systems was accessed.

Individual Risk: 1.861 = Severe

Exposed information may include patient names, dates of birth, information regarding medical assessment and medication administration, health insurance information, drivers’ licenses, financial account information, and Social Security numbers.

How It Could Affect Your Business Any breach that involves healthcare data is going to cost the company a pretty penny in clean-up and fines.

Robert Half

Exploit: Credential Stuffing

Robert Half: Staffing Company

Risk to Business: 2.601 = Moderate

Robert Half has determined that more than 1000 job seekers and employees placed by the firm had their accounts accessed by an unauthorized source between April 26 and May 16, 2022, exposing potentially sensitive information that may have been stolen. The company says that there is no evidence that the information was actually accessed or downloaded, and current users are required to update their passwords.  

Individual Risk: 2.612 = Moderate

The release disclosed that the targeted accounts stored information such as name, address, and social security number, as well as wage and tax information. The company noted that bank account numbers for direct deposits are stored in these accounts, but only the last four digits are visible.

How It Could Affect Your Business: Teaching employees to make good, strong passwords and handle them safely with security awareness training prevents problems like this.

Eyecare Leaders

Exploit: Hacking

Eyecare Leaders: Medical Records Service 

Risk to Business: 1.872 = Severe

An estimated two million eyecare patients may have had their personal and health data exposed by medical billing service Eyecare Leaders. 1.3 million of those patients sought treatment at Texas Tech University Health Sciences Center. The company, provider of the myCare Integrity electronic medical record platform has disclosed that it suffered a data security incident in December 2021 that resulted in “the deletion of databases and systems configuration data”. Over 20 other eyecare practices have also had patient data exposed in this incident.  

Individual Risk: 1.721 = Severe

The customer data that was compromised may include names, Social Security numbers, tax ID numbers, driver’s license numbers, passport numbers, financial account/payment card account numbers, and medical or health insurance information.

How it Could Affect Your Business: Service providers can be a source of data breach risk and an incident like this will be very expensive for every organization involved.

Memorial University

Exploit: Employee Error 

Memorial University: Institution of Higher Learning

Risk to Business: 2.077 = Severe

Students at Memorial University have been informed that their data has been exposed after an employee error. The blunder involved a university employee sending the wrong data to several students. About 1,000 students received emails that contained other students’ personal information, according to a statement from Memorial.  

Individual Risk: 2.021 = Severe

Leaked details included names, email addresses, student numbers and programs of study. No financial or medical data was included. 

How it Could Affect Your Customers’ Business Employee errors can lead to big headaches and big bills to clean up the messes left behind.

Regina Public Schools 

Exploit: Ransomware

Regina Public Schools: Local Education Authority

Risk to Business: 2.206= Severe

Regina Public Schools are experiencing technical difficulties in the wake of a late-May cyberattack. The ransomware group BlackCat has claimed responsibility. The group claims to have encrypted 500 gigabytes of files belonging to RPS. BlackCat has also said that the group now possesses employee data from a wide range of sources like tax reports, health information, passports and social insurance numbers, but the school system disputes those assertions. Many schools are still experiencing internet outages, leaving teachers unable to access learning tools, grading systems and other educational assets. Services are slowly being restored. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Schools, universities and colleges have been prime targets for cybercrime since the start of the global pandemic and need to take extra precautions.

Germany – The Green Party

Exploit: Hacking

Green Party: Political Group

Risk to Business: 2.206 = Severe

The German Green party has disclosed that its IT system was hit by a cyberattack last month. The party is part of Germany’s ruling coalition. Ultimately, 11 email accounts were impacted including email accounts belonging to Foreign Minister Annalena Baerbock and Economy Minister Robert Habeck. The hacked accounts were compromised in such a way that some emails were forwarded to addresses outside the party, possibly in Russia according to Der Spiegel. Both politicians have publicly taken anti-Russia stances. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business An unprecedented wave of hacking has emerged in the wake of Russia’s invasion of Ukraine with far-reaching ripples.

South Africa – Shoprite Holdings Ltd.

Exploit: Ransomware 

Shoprite Holdings Ltd.: Supermarket Chain 

Risk to Business: 1.613 = Severe

Africa’s largest supermarket chain has been hit by a ransomware attack. The company warned customers in Eswatini, Namibia and Zambia, that their personal information might have been compromised due to a cyberattack. The RansomHouse group has claimed responsibility for the attack, posting an evidence sample of 600GB of data it claims it stole from the retailer to its dark web site. The attackers were quick to ridicule Shoprite’s cybersecurity practices as part of its leak announcement.

Individual Impact: No specific information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Ransomware is always a business disaster that costs a company time, money and reputation with a long, painful recovery.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

More trouble for two of 2021’s most ransomware-prone sectors and a detailed map of exactly how ransomware hit a Japanese hospital.

Tenafly Public Schools

Exploit: Ransomware

Tenafly Public Schools: Local Government Entity 

Risk to Business: 2.827 = Moderate

Tenafly Public Schools was forced to cancel student final exams and resort to low-tech teaching methods to finish out the school year after ransomware had encrypted data on some computers in the district’s network. A Tenafly Public School District spokesperson said that administrators first identified the security incident Thursday and discovered that it involved the encryption of data by ransomware on some computers in the district’s network. The spokesperson went on to explain that the district’s technology department responded by isolating devices, shutting down the districtwide computer system, launching an investigation and hiring outside cybersecurity experts. No word on whether or not a ransom was or will be paid.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: Schools and education sector organizations at every level have been prime targets for cybercrime in the last few years.

Private Client Services, LLC.

Exploit: Hacking

Private Client Services LLC. : Financial Services

Risk to Business: 1.801 = Severe

Private Client Services, LLC (“PCS”) has disclosed a data breach that the company is blaming on an unauthorized party gaining access to sensitive consumer information through a compromised employee email account. The company sent data breach letters to 22,554 impacted people on May 27, 2022.

Risk to Business: 1.822 = Severe

According to PCS, the breach resulted in the names, Social Security numbers, driver’s license numbers and state identification numbers being compromised. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business Financial Services & Banking was the sector that experience the most ransomware attacks in 2021 and that pace isn’t slowing down.

Aesto Health

Exploit: Hacking

Aesto Health: Medical Information Services Provider 

Risk to Business: 1.976 = Severe

Aesto Health has announced it recently experienced a cyberattack that caused disruption to certain internal IT systems. The Alabama-based company disclosed that it had experienced a security breach that was detected on March 8, 2022. Aesto Health has brought in a third-party computer forensics company to assist with the investigation. They’ve also determined that an unauthorized individual had access to the affected systems from December 25, 2021, to March 8, 2022.

Risk to Business: 1.915 = Severe

A review of the affected files confirmed they contained patients’ protected health information, including names, dates of birth, physician names, and report findings related to radiology imaging at Osceola Medical Center (OMC) in Wisconsin. No Social Security numbers or financial information were viewed or stolen, and OMC systems and electronic medical records were unaffected.   

How It Could Affect Your Business: Healthcare providers in the US don’t just have to worry about the standard expenses of a data breach, they face big regulatory penalties too.

OnDeck Capital

Exploit: Hacking

OnDeck Capital: Financial Services

Risk to Business: 1.872 = Severe

OnDeck has disclosed that the company experienced a data breach after an unauthorized party gained access to the company’s computer network and transferred sensitive data to a private cloud storage account. OnDeck says that it first detected suspicious activity on March 10 and immediately shut down access to all affected devices. But three days later, OnDeck determined that the attackers had copied sensitive data to a private cloud storage account. On March 17, OnDeck’s team of investigators gained control over the cloud storage account, recovered the data, and shut down access, but there’s no word on what the threat actor might have done with the data.   

Risk to Business: 1.721 = Severe

The customer data that was compromised may include names, Social Security numbers, tax ID numbers, driver’s license numbers, passport numbers, financial account/payment card account numbers, and medical or health insurance information.

How it Could Affect Your Business: Entities in the financial services sector need to take extra precautions against trouble because it was 2021’s hardest hit sector for ransomware attacks.

Canada – CMC Electronics

Exploit: Ransomware

CMC Electronics: Aerospace & Defense Engineering

Risk to Business: 2.317 = Severe

The Canadian Department of National Defense (DND) confirmed earlier this week that a defense contractor, CMC Electronics, has alerted the government that it had experienced a cyberattack, suspected to be ransomware, in May. The company says that there is no indication to date that those responsible for the cyberattack have stolen any sensitive military information. The attack was allegedly carried out by the BlackCat ransomware group.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Cybercriminals aren’t just hunting for PII, they’re also in the market for proprietary data, formulas, research and information about operational technology.

Italy – City of Palermo

Exploit: Ransomware

City of Palermo: Municipal Government

Risk to Business: 2.033= Severe

The cybercrime group Vice Society ransomware group has claimed responsibility for the recent ransomware attack on the city of Palermo in Italy last Friday. The incident has caused a large-scale outage for city services that impacts 1.3 million people. Most internet-reliant services remain unavailable and are expected to be down for days. Vice Society claimed they were behind the attack on Palermo in a post on their dark web data leak site, threatening to publish all stolen documents if not paid. No word on the ransom amount or if the city plans to pay.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Governments and government agencies have been high on the cybercriminal’s shopping list partly due to the high possibility of getting paid.

Japan – Handa Hospital

Exploit: Ransomware

Handa Hospital: Medical Center

Risk to Business: 1.780 = Severe

Handa Hospital in Tsurugi, Tokushima Prefecture, Japan has announced that it has been the victim of a ransomware attack. Investigators say that the October 2021 cyberattack occurred after a company that was involved in providing an electronic medical record system for the hospital had disabled anti-virus software on the hospital’s computers. Investigators laid out the chain of events and it is a lesson in security woes. Before the cyberattack occurred, the service provider configured the Windows settings of about 200 computers connected to the electronic medical record system to disable functions including anti-virus software and regular Windows updates because they made the electronic medical record system unstable. Investigators also determined that other circumstances contributed to the problem. Windows was never updated on the computers at the hospital and the hospitals’ VPN had never been updated. The investigation ultimately determined that the cybercriminals exploited defects in the hospital’s VPN device and made an unauthorized intrusion to have the ransomware infect the hospital’s system. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business This is a great illustration of the unfortunate sequence of events that can lead to disaster.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Ransomware hits Foxconn and more cyberattack trouble for governments around the world.

City of Portland, OR

Exploit: Business Email Compromise 

City of Portland, OR: Municipal Government 

Risk to Business: 1.726 = Severe

Bad actors struck the city of Portland, Oregon in an audacious business email compromise attack that resulted in a $1.4 million fraudulent transaction with city funds in April. City officials say that cybercriminals obtained the money after gaining access to a city email account illegally. The compromise was detected in May when the same account attempted another transfer of funds. The incident is under investigation by the FBI, U.S. Secret Service and the Portland Police Bureau.

How It Could Affect Your Business: From municipalities to major national agencies, government targets have been a favourite of cybercriminals in the last few years.

City of Alexandria, LA

Exploit: Ransomware

City of Alexandria, LA – Municipal Government

Risk to Business: 2.733 = Moderate

The AlphV ransomware gang has added the city of Alexandria, Louisiana to its list of victims. Officials confirmed that the city of 50,000 had fallen victim to a ransomware attack. They don’t believe that any sensitive data was stolen, and city operations will proceed as normal. This is the 22nd reported incident affecting a local government in the U.S. this year. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business Governments have been high on the cybercriminal’s shopping list since they tend to have big data stores.

Mexico – Foxconn

Exploit: Ransomware

Foxconn: Electronics Manufacturing

Risk to Business: 1.349 = Extreme

A major factory for Foxconn located in Tiajuana, Mexico near the California border was hit by a ransomware attack in late May that resulted in a shutdown. The plant specializes in the production of medical devices, consumer electronics and industrial operations. The operators of LockBit have claimed responsibility for the attack.  

How It Could Affect Your Business: Manufacturers have been popular targets for cybercriminals, ranking number one for ransomware attacks in 2021.

Costa Rica – Costa Rican Social Security Fund (CCSS)

Exploit: Ransomware

Costa Rican Social Security Fund (CCSS): Government Agency

Risk to Business: 1.872 = Severe

The Costa Rican Social Security Fund (CCSS)was forced to shut down its digital record-keeping system last week due to a ransomware attack, affecting some 1,200 hospitals and clinics. Officials say that 30 of 1500 of its servers were impacted and they saw no evidence that a critical database or system was compromised. For weeks, Costa Rica has been under siege by ransomware, with a parade of government agencies taking big hits.  

How it Could Affect Your Business: Costa Rica has been continually having problems with cyberattacks to the point that it is having an effect on the government’s stability.

Switzerland – Novartis

Exploit: Ransomware

Novartis: Pharmaceutical Company

Risk to Business: 2.717 = Moderate

Novartis has been the victim of an attack by the Industrial Spy data-extortion gang. Last week, the group began selling data allegedly stolen from Novartis on their Tor extortion marketplace for $500,000 in bitcoins. The threat actors claim that the data that they have for sale is related to RNA and DNA-based drug technology and tests from Novartis. The drug company says that no sensitive information was taken. Bleeping Computer reports that the data being sold consists of 7.7 MB of PDF files, which all have a timestamp of 2/25/2022 04:26, likely when the data was stolen. 

How it Could Affect Your Business Cybercriminals aren’t just hunting for PII, they’re also in the market for proprietary data, formulas, research and information about operational technology

Russia – Rustam Kurmaev and Partners

Exploit: Hacking

Rustam Kurmaev and Partners: Law Firm 

Risk to Business: 2.733-Moderate

The Anonymous hacktivists collective claims to have struck another Russian organization. The group leaked approximately 1TB of data from a leading Russian law firm identified as Rustam Kurmaev and Partners (RKP Law). The firm works with major banking, media, oil, and industrial firms and state interests. This incident follows on the heels of another incident two days before in which the collective snatched hundreds of gigabytes of data from the servers of Russia’s largest media holding with over 100 regional radio stations, Vyberi Radio.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Anonymous and its’ associates have been continually hammering at Russian targets in opposition to the Russian invasion of Ukraine.

Australia – iCare 

Exploit: Insider Risk (Employee Error)

iCare: Insurer

Risk to Business: 1.780 = Severe

State insurer iCare is in the hot seat after an employee mistakenly shared the details of almost 200,000 injured workers with 587 employers and insurance brokers after sending the incorrect cost of claims analysis reports to the wrong recipients. The employee information was contained in spreadsheets that were mistakenly sent as attachments to the wrong employers. The company sent impacted workers an apology for the incident in May 2022.  

Risk to Individual: 2.263 = Severe

The missent cost of claims reports included a summary of workers’ claims history, their name, date of birth and injury category, workers’ policy number, a breakdown of weekly payments, claim costs and gross amounts paid, but no banking or contact details. 

How it Could Affect Your Business Employee mistakes can be just as dangerous, damaging and expensive as many cyberattacks.

Australia – ACY Securities

Exploit: Misconfiguration

ACY Securities: Financial Services

Risk to Business: 1.871 = Severe

A misconfigured database owned by ACY Securities is to blame for the exposure of personal and financial data of users and businesses. An estimated 60GB worth of data was left exposed and accessible on the web without any security authentication. The data has since been secured.

Risk to Individual: 2.643 = Severe

Spirit Super says that the information potentially exposed includes client names, addresses, ages, email addresses, telephone numbers, member account numbers and member balances. The company was quick to assure members that the exposed data doesn’t include dates of birth, government identification numbers or any bank details. 

How it Could Affect Your Business This will be a very expensive employee mistake that could have far-reaching effects and regulatory complications.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Government and education targets continue to be rocked by ransomware and GM experiences credential stuffing.

North Orange County Community College District

Exploit: Ransomware

North Orange County Community College District: Institution of Higher Learning

Risk to Business: 2.667 = Moderate

North Orange County Community College District in California has been notifying more than 19,000 people about a data security incident. A statement on the school’s website disclosed that Cypress College and Fullerton College in the NOCCCD system experienced a ransomware attack in March 2022. The notice was also posted to the website for Fullerton College for International Students and the Cypress College on-campus Dental Hygiene Clinic, but no confirmation that students in these locations were impacted.

Risk to Individual: 2.901 = Moderate

Exposed information may include a student’s name and passport number or other unique identification number issued on a government document (such as Social Security number or driver’s license number) and possibly financial account information and/or medical information for some students. 

How It Could Affect Your Business: Schools have been a favourite target of bad actors and school system databases are popular targets because they often hold big stores of information.

Somerset County Government

Exploit: Ransomware

Somerset County Government: Local Government

Risk to Business: 1.963 = Severe

The government of Somerset County, New Jersey with an estimated population of about 350,000, announced on Tuesday that a ransomware attack had caused some systems outages. The county government said that its email system was down. County offices were using temporary Gmail accounts to enable residents to contact critical departments such as the County Commissioners, Health, Emergency Operations, the County Clerk, Sheriff and Surrogate. The county says that it expects the outages to continue for a week. The County Clerk’s office also disclosed that it has been rendered unable to provide most services that require internet access, including gaining access to land records, vital statistics, probate records and title searchers before 1977 In response, the county has activated its Emergency Operations Center and Continuity of Operations of Government Plan.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business Governments have been high on the cybercriminal’s shopping list since they tend to have big data stores.

Verizon

Exploit: Hacking

Verizon: Wireless Network Provider

Risk to Business: 2.802 = Moderate

Verizon has announced that hackers obtained access to a database. The hacked database includes the full name, email address, corporate ID numbers, and phone number of hundreds of Verizon employees. According to reports, the hacker contacted Verizon to ask for an extortion payment of $250,000 to prevent the release of the stolen data. Verizon has said that they do not plan to pay.

Risk to Business: 2.773 = Moderate

Information exposed in the database includes employee names, email addresses, corporate ID numbers, and phone numbers. Verizon says that the database does not include Social Security Numbers, passwords or credit card numbers.

How It Could Affect Your Business: Data security must be a priority for protecting employee PII as well as customer PII.

General Motors (GM)

Exploit: Credential Stuffing

General Motors (GM): Automobile Manufacturer

Risk to Business: 2.872 = Moderate

General Motors (GM) has announced that it was hit by a credential stuffing attack last month that exposed customer information. GM said that they detected the malicious login activity between April 11-29, 2022, and that hackers obtained access through credential stuffing. GM said in a statement “We believe that unauthorized parties gained access to customer login credentials that were previously compromised on other non-GM sites and then reused those credentials on the customer’s GM account.” The bad actors also redeemed loyalty points from some customers’ accounts for gift cards.

Risk to Individual: 2.583 = Moderate

Customer data that was exposed in this incident includes first and last names, personal email addresses, home addresses, usernames and phone numbers for registered family members tied to the account, last known and saved favorite location information, currently subscribed OnStar package (if applicable), family members’ avatars and photos (if uploaded), profile pictures and search and destination information, car mileage history, service history, emergency contacts and Wi-Fi hotspot settings (including passwords).

How it Could Affect Your Business: Dark web data is a credential compromise hazard that can bite any business big or small leading to a data exposure disaster. 

Scarborough Health Network

Exploit: Hacking

Scarborough Health Network: Healthcare Network

Risk to Business: 1.917 = Severe

Toronto healthcare provider Scarborough Health Network has disclosed that it has experienced a data breach. Officials say that an unauthorized actor gained access to the organization’s systems around January 25, 2022. The attacker was shut out of the system by February 1, 2022. The information of anyone treated before February 1, 2022, may have been compromised. The organization says that patients who received care prior to the amalgamation of SHN Centenary Hospital (also known as Scarborough Centenary Hospital), SHN General (also known as Scarborough General), and Birchmount Hospital (also known as Scarborough Grace) under one network in 2016 might be impacted as well as patients who received care at hospitals that were part of the former Rouge Valley Hospital Network, including RVHS Ajax and Pickering Campus or Ajax-Pickering Hospital.

Risk to Business: 1.917 = Severe

The health network says a big pool of information may have been accessed, including patients’ names, dates of birth, marital statuses, home addresses, phone numbers, email addresses, OHIP numbers, insurance policy numbers, lab results, diagnosis information, COVID-19 immunization records. Staff names and numbers may have also been accessed. 

How it Could Affect Your Business Medical data is very profitable for the bad guys, and data security incidents are sure to be expensive for medical systems.

Austria – Government of Carinthia

Exploit: Ransomware

Government of Carinthia: Regional Government

Risk to Business: 1.733-Severe

The Black Cat ransomware gang has struck the government of the Austrian state of Carinthia, demanding a ransom of $5 million. The government of Carinthia disclosed that 3,000 IT workstations were affected. Among services that were impacted by this incident include the issuance of passports and the payment of traffic fines. It doesn’t plan to pay the attackers.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Ransomware is a go-to attack against governments because bad actors gave had plenty of success getting them to pay up.

Turkey – Pegasus Airlines

Exploit: Misconfiguration

Pegasus Airlines: Air Carrier

Risk to Business: 1.963 = Severe

Turkish carrier Pegasus Airlines has disclosed that data including the personal information of flight crew alongside source code and flight data has been exposed as the result of a misconfiguring an AWS bucket. Researchers discovered an estimated 23 million files were found on the bucket, totaling around 6.5TB of leaked data. This included over three million files containing sensitive flight data including flight charts and revisions, insurance documents, details of issues found during pre-flight checks and information on crew shifts. Over 1.6 million of the exposed files contained personally identifiable information (PII) on airline crew, including photos and signatures. Source code and data from Pegasus’s proprietary software was also exposed, including plain text passwords and secret keys.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Employee mistakes can be just as dangerous, damaging and expensive as many cyberattacks.

Australia – Spirit Super

Exploit: Phishing 

Spirit Super: Financial Services

Risk to Business: 2.771 = Severe

Spirit Super has announced that a cyberattack caused by an employee falling for a phishing message is the cause of a cyberattack that has led to data exposure for an estimated approximately 50,000 member records from 2019/2020. The company said that the incident was quickly mitigated, and the damage contained, with new security measures added. 

Risk to Individual: 2.643 = Severe

Spirit Super says that the information potentially exposed includes client names, addresses, ages, email addresses, telephone numbers, member account numbers and member balances. The company was quick to assure members that the exposed data doesn’t include dates of birth, government identification numbers or any bank details. 

How it Could Affect Your Business Phishing is the first step in more than 90% of data breaches, making stopping it a top security priority.

Australia – National Disability Insurance Scheme (NDIS)

Exploit: Supply Chain Risk 

National Disability Insurance Scheme (NDIS): Government Program 

Risk to Business: 2.654 = Severe

A client management system provided by a service provider and used by the National Disability Insurance Scheme (NDIS) has exposed sensitive data. The system was maintained by CTARS, a Sydney-based software and analytics provider for the disability and care sectors. NDIS disclosed that an unauthorized third party had gained access to its systems on May 15, 2022.

Risk to Individual: 2.643 = Severe

NDIS says that personal information relating to patients may have been exposed including details of the diagnoses, treatment, or recovery of a medical condition or disability. Other data possibly compromised includes Medicare and pensioner cards, as well as tax file numbers. 

How it Could Affect Your Business Supply chain risk has been escalating as cybercriminals tap lynchpins in the supply chain and it’s sure to be a major risk for every business this year too.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident

Multiple attacks disrupt education and expose data at U.S. public schools and a novel response to a ransom demand in Zambia. 

Chicago Public Schools

Exploit: Supply Chain Risk

Chicago Public Schools: Regional Education Agency

Risk to Business: 1.944 = Severe

Chicago Public Schools is facing a big breach of student data after a technology vendor experienced a data security incident. CPS has disclosed that it was recently informed that an unauthorized access incident took place at Battelle for Kids in December 2021. In that incident, a server that housed four years’ worth of personal information about students and staff from the 2015-16 through 2018-2019 school years was breached. Officials say that no Social Security numbers, no financial information, no health data, no current course or schedule information, no home addresses and no course grades, standardized test scores, or teacher evaluation scores were exposed in this incident. 

Risk to Individual: 1.672 = Severe

The improperly accessed data included students’ names, schools, dates of birth, gender, CPS identification numbers, state student identification numbers, class schedule information and scores on course-specific assessments used for teacher evaluations. Employee data included names, employee identification numbers, school and course information and emails and usernames.

How It Could Affect Your Business: School system databases are popular targets because they often hold big stores of information.

Fort Sumner Municipal Schools (New Mexico) & Washington Local Schools (Ohio)

Exploit: Ransomware

Fort Sumner Municipal Schools (New Mexico) & Washington Local Schools (Ohio): Local Education Agency 

Risk to Business: 1.804 = Severe

The Cl0p ransomware gang has posted information that points to a successful ransomware attack against the Fort Sumner Municipal Schools agency in New Mexico. The Superintendent of Schools in the district confirmed the incident. This is just the latest in a long string of ransomware attacks that have impacted public school systems in the US. Just this week, the Washington Local Schools district in Ohio was also hit with a ransomware attack, this time impacting the district’s phone, email, internet and WiFi networks as well as Google Classroom.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business Bad actors know that using ransomware against targets with time-sensitive business can be profitable.

The U.S. Drug Enforcement Agency (DEA)

Exploit: Hacking

The U.S. Drug Enforcement Agency (DEA): Federal Government Agency

Risk to Business: 1.763 = Severe

Officials are investigating a potential breach that could allow bad actors to access key systems used by law enforcement agencies in the U.S. A tip pointed officials to information that the LAPSUS$ hacking group may have gained access to the esp.usdoj.gov data portal, the Law Enforcement Inquiry and Alerts (LEIA) system, the U.S. Drug Enforcement Agency (DEA)’s El Paso Intelligence Center (EPIC) and other DEA systems. That unauthorized access may be used by cybercriminals in myriad ways including for impersonation efforts and doxing, as well as affording the bad guys the opportunity to search databases and to obtain sensitive data. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How It Could Affect Your Business: This kind of access and information in the wrong hands could be beneficial to cybercriminals including nation-state actors.

Greenland – Agency for Health and Prevention   

Exploit: Hacking

Agency for Health and Prevention: National Agency

Risk to Business: 2.864 = Moderate

The government of Greenland has announced that healthcare services have become extremely limited as a result of a cyberattack. While the nature of the incident was not specified, government officials noted that the network for the entire system had to be shut down, resulting in medical care providers becoming unable to access patient records and creating delays in care. The government says that patient data is not at risk, and that emergency treatment will not be impacted.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business: Healthcare targets have been at the top of the cybercriminal hit list since the start of the pandemic.  

Zambia – National Bank of Zambia

Exploit: Ransomware

National Bank of Zambia: Banking & Financial Services

Risk to Business: 1.917 = Severe

A cyberattack at the National Bank of Zambia has played out with a bizarre twist. After experiencing a ransomware attack by the Hive ransomware outfit that purportedly encrypted the bank’s Network Attached Storage (NAS) device, officials responded to the cybercriminals’ ransom demands with a refusal to pay. Bloomberg reports that the refusal was accompanied by images of male genitalia and a message referencing a common NSFW insult about what the bad guys could do with their demands. In a statement, the bank said that it had experienced an incident that impacted some systems such as the Bureau De Change Monitoring System and the bank’s website.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business Organisations in the Banking & Finance sector suffered the most cyberattacks in 2021, and pressure isn’t letting up.

South Africa – Dis-Chem

Exploit: Supply Chain Risk 

Dis-Chem: Pharmaceutical Company

Risk to Business: 1.733-Severe

Major pharmaceutical retailer Dis-Chem recently announced that it had been hit by a data breach that may have exposed the personal details of 3.6 million customers thanks to a data security incident at a third-party service provider on May 1, 2022. Dis Chem is the second-largest retail pharmacy chain in South Africa. An investigation is underway, and the company has stated that it will not be offering further comment on the incident.

Risk to Business: 1.733-Severe

The investigation has determined that the incident affected a total of 3,687,881 data subjects so far, exposing subjects’ first name and surname, email addresses, and cell phone numbers. 

How it Could Affect Your Business Defence industry contractors and military-adjacent service providers are tempting targets for cybercriminals looking for back doors.

Singapore – Nikkei Business Publications 

Exploit: Ransomware

Nikkei Business Publications: Publishing Company 

Risk to Business: 2.786 = Moderate

Asian publishing giant Nikkei has disclosed that the organization’s headquarters was hit by a ransomware attack on May 13, 2022. The company, the publisher of several business and technology magazines, said that it is still investigating the incident and has not yet determined if bad actors accessed customer data. Officials in both Singapore and Japan have been notified.  

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

How it Could Affect Your Business More than half of APAC organizations experienced a cyberattack in 2021.

1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a range of factors for each incident