Tucson, Arizona Data Breach

City of Tucson, Arizona Discloses Data Breach

In mid-October of 2022, the city of Tucson, Arizona announced that it had experienced a data breach involving the personal information of more than 125,000 individuals. The attack took place between May 17th – 31st, 2022, with the full gamut of the attack realized on August 12th, 2022. Data types that may have been compromised in the attack include personal names, Social Security numbers (SSN), driver’s license numbers, and passport numbers. While the city is working under the worst-case scenario, city officials are still uncertain how much data the threat actors managed to steal. Those affected included current and former city employees as well as anyone who had applied for a business license with the city.

The city was made aware of suspicious activity involving the account of an authorized user. It is believed that a threat actor compromised the user’s account. On August 4th, the city was informed that some files may have been copied and exfiltrated from the city’s network.

Immediately upon discovering the compromise of a user account, Tucson’s internal IT team shut down the city’s website for two days. An investigation began shortly thereafter involving third party forensic specialists to determine the means and scope of the attack. A separate review was conducted in August to assess the level of compromise to its stored data. Notification letters were sent out in September to all individuals whose data may have been exposed in the attack. The city is providing free credit monitoring services to those affected for one year. Everyone notified has been encouraged to stay vigilant in their own credit monitoring efforts. Since the confirmation of the attack, the city has begun reviewing its existing cybersecurity policies and procedures. Leaders are also evaluating additional measures and safeguards to prevent a similar attack in the future. This includes contracting with an outside cybersecurity team to monitor more than 6,000 of city servers and PCs as part of an extensive monitoring system. Tucson is also providing cybersecurity training to its employees to improve their cyber hygiene.

The compromised user account used in the attack was most likely the result of a credential stuffing attack. External threat actors launch such attacks on millions of user accounts every day. In 2020 there were more than 193 billion credential stuffing attacks detected. While users are encouraged to change their password periodically and not use the same password for all accounts, password rotation provides little protection against such attacks. No organization today should be relying on password protection as their only authentication method. Consider implementing these security controls.

• MFA – Some type of multifactor authentication (MFA) should be utilized for all email and web-based accounts. The most popular MFA forms are either SMS text messaging or authenticator apps that reside on a smart phone. Strengthen your security prevention capabilities with MFA.
• Privileged Account Management – Privileged accounts such as senior IT admins or any account with privileged access to critical resources within an organization should be secured and monitored using some type of Privileged Access Management (PAM) solution. A PAM creates or enables privileged user accounts on demand to perform a privileged task. Once the task is completed, the privileged account is retired or disabled. This prevents persistent privileged accounts from lying dormant, in which case they can be unknowingly compromised.
• Web Application Firewalls (WAF) – These solutions protect web applications from web-based attacks including credential stuffing. These solutions identify malicious attacks attempting to access web applications and prevents the attacks from reaching the web application. Enhance your safeguards with WAF.
• Educate your teams of new threats with Security Awareness Training.
• Update your Incident Response Readiness (IRR) to prepare for an attack.
• Evaluate your current security posture, evaluate configurations, and model attacks with a Security Architecture Assessment.
• Identify areas of risk and opportunities for improvement with a Risk Assessment.