A Review of Recent Data Breaches and Their Impact

Do any of these scenarios resemble your work environment?

Microsoft Exchange

On 3^rd March 2021, cybercriminals exploited four vulnerabilities in the Microsoft Exchange Server email system. The attacker exploited the vulnerabilities in the email servers to get the accounts information of more than 30,000 organizations across the world. These organizations include local governments, small businesses, and officials accounts. After exploiting these vulnerabilities the attackers got remote access over the compromised systems, with the privileges of confidential data access. In few days, Microsoft released patches and security updates for these vulnerabilities  (Carlson, 2021).

SITA

SITA is an IT company that provides support and services to airline companies throughout the world in case of any cyber-attack. This company became a victim of a cyberattack on 4^th March 2021, in which attackers exposed the PII (Personally Identifiable Information) belonging to an undisclosed number of airline passengers. This sensitive information included the traveler’s name, their service card numbers, and the statuses about their services (Staff, 2021).

MultiCare

MultiCare is a non-profit healthcare organization that runs a healthcare system that experienced a ransomware attack on 9^th March 2021 and exposed the personal information of over 200,000 patients as a result of a ransomware attack. The attackers were able to access personal information including names, insurance policy numbers, dates of birth, social security numbers, bank account details, and types of diseases. Multicare uses Woodcreek provider services as its medical practice management company. After paying the ransom money the breached data was retrieved  (Lewis, 2021).

California State Controller’s Office (SCO)

A phishing attack was launched on 23^rd March 2021 on California State Controller’s Office (SCO). An employee of the office lured by the attackers to click on a malicious link, logging into a cloned website and granted access to the email accounts. The attackers maintained their access over the system for 24 hours with privileges to view PII (Personally Identified Information) and sending phishing emails to the compromised SCO employees. A strange thing in this attack that attackers did not disclose the numbers of compromised employees and their personal information (Cobler, 2021).

Hobby Lobby

A data breach occurred on 23^rd March 2021 containing records of more than 300,000 customers of arts and crafts chain store Hobby Lobby. A vulnerability of cloud-bucket misconfiguration was exploited to execute this data breach attack. The data disclosed in this attack include customers’ names, phone numbers, home, and email addresses, and payment card information. A source code of the company’s application was also leaked in this data breach (Seals, 2021).

Cancer Treatment Centers of America (CTCA)

On 26^th March 2021, the medical information of more than 100,000 patients was leaked by the cybercriminals from Cancer Treatment Centers of America. After the attack, the organization alerted their patients that their email accounts containing medical information have been hacked by an unknown third party. These compromised emails contained patients’ names, medical record numbers, health insurance details, and medical information. Moreover, the account holder’s credentials were changed, and the previous email credentials are no longer available for use (Mitchell).

Facebook

The personal data of above 533 million Facebook users from 106 countries have been disclosed on 3^rd April 2021 by a low-level hacking group. A vulnerability was exploited while scraping the data that was patched in 2019. The data includes usernames, phone numbers, email addresses, full names, and biographical information. This disclosure has over 32 million records of the US and 11 million records of UK users. This leaked data could be valuable to attackers who can use this leaked information for impersonation and scam the victims to get login credentials (Holmes, 2021).

LinkedIn

The cybercriminals released the profiles of more than 500 million LinkedIn users on the dark web. This data leakage was conducted on 6^th April 2021. To prove the legitimacy of the information the attackers shared two million LinkedIn records with a total cost of $2. All the leaked data was imported into a database that includes names, LinkedIn IDs, associated email addresses, gender, phone numbers, connected social media profiles, professional CVs, and careers related information. Other threat actors are trying to get benefits from this data breach. A subset of this leaked data was put on sale by the attackers for $7000 worth of bitcoin  (Team, 2021)..

ClubHouse

A database of over 1.3 million ClubHouse user’s records was leaked during scrapping on 10^th April 2021. The leaked database includes usernames, photos, names, URLs, Twitter handlers, user’s follower lists, Instagram handlers, account creation details, and many more. The CEO of ClubHouse claimed in his tweet that their data was not breached. The data supposed to be leaked contains only public information from the ClubHouse application. He emphasized that the breached data doesn’t include any sensitive information like user’s credentials or email information. However, the leaked data still be used for phishing attacks on ClubHouse users or other social engineering techniques (Lyon, 2021).

ParkMobile

A vulnerability in third-party software caused data leakage of more than 21 million customers on 12 April 2021. This data belonged to ParkMobile which is a contactless parking payment application. The leaked data includes email addresses, phone numbers, license plate numbers, hashed passwords, and home addresses of the individuals who used this application. The company running this application immediately started to investigate the cause of this data breach. In an initial investigation, the investigating team found that the ParkMobile application did not store users’ passwords. However, the application stored the hash of the password by using the bcrypt algorithm. The database breached from this application contained these hash password and put up for sale.

GEICO

A Government Employees Insurance Company is known as GEICO, an auto insurance company that filed a data breach on 19 April 2021. The information gathered from different sources was used to obtain unauthorized access to the online system. This system stores and manage profiles of the company’s customers includes driver license details and other confidential information. GEICO said that they had secured the data breach immediately and fully aware of all the risks associated with such data breaches. They have implemented additional security controls to avoid such a misadventure in the future.

Experian

An insecure API (Application Programming Interface) was discovered by a group of researchers on 26 April 2021. This insecure API was causing data leakage in the Experian application that is used for lending sites, giving access to the private information of more than 10 million citizens of America with their names, mailing address, and date of birth (Beker, 2021).

Summary of latest data breaches

Strengthen your overall security strategy with these best practices:

• Review your risk posture to prepare for any threats and attacks. Implement a risk management program.
• Test your security controls.
• Ensure your team is response-ready.
• Update your data inventory.
• Make sure you are current in all relevant compliance requirements.

If you have been breached, review your security safeguards to check for ‘reasonableness’ and how to enhance your strategy while reinforcing your controls. Our comprehensive Risk Management Program can help you continually manage your risk to be “reasonable”, prioritize your IT investment and resources, and provide you with ready executive reporting to justify your budgets.

Schedule a call to see how we can help support you.

HALOCK Breach Bulletins
Recent data breaches to understand common threats and attacks that may impact you – featuring description, indicators of compromise (IoC), containment, and prevention.