The Week in Breach News: 01/12/22 – 01/18/22
Cybercriminals are snatching up financial data, bad actors rain on Parasol’s parade, 5 tips to help you secure your customers in 2022 and rocket fuel for your revenue.
Help your clients start the new year off on the right foot with this checklist of smart cybersecurity practices. GET IT>>
Medical Review Institute of America (MRIoA)
https://www.securityweek.com/mrioa-discloses-data-breach-affecting-134000-people
Exploit: Ransomware
Medical Review Institute of America (MRIoA): Medical Analytics
Risk to Business: 1.227= Severe
Utah-based medical information and analysis company Medical Review Institute of America (MRIoA) announced that it has experienced a data breach. The incident was discovered on November 9, 2021, and officials were able to confirm that data had been stolen by November 16, 2021. In a data breach filing, the company said that over 134,000 individuals were impacted by the incident which is still under investigation. The company did say that it “retrieved and subsequently confirmed the deletion of” stolen data, but no information was released about a ransom amount or if they paid the ransom.
Risk to Business: 1.801= Severe
Protected health information was snatched including patients’ names, gender, physical and email addresses, phone numbers, birth dates, Social Security numbers, full clinical information (including diagnosis, treatment, medical history, and lab test results) and financial information (such as health insurance policy and group plan number).
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business: Ransomware risk is rising for organizations in every sector, especially companies that provide important services for other businesses.
ID Agent to the Rescue: Learn more about how ransomware is evolving and get tips for protecting your clients in 2022 in our hit eBook Ransomware Exposed. GET THIS EBOOK>>
The Metropolitan Detention Center (MDC)
Exploit: Ransomware
The Metropolitan Detention Center (MDC): Prison
Risk to Business: 2.223 =Severe
New Mexico prison officials had a problem on their hands as a ransomware attack impacted county computer systems resulting in a lockdown of the Metropolitan Detention Center (MDC) in Bernalillo County, New Mexico. The prison was not directly targeted. Inmates were forced to stay in their cells since the attack impacted the facility’s security camera networks, automated doors and internet service. Inmates and jailors were also unable to videoconference for trials. Reports say that a number of databases are suspected of being compromised or corrupted including an incident tracker which records inmate fights, attacks, as well as allegations of prison rape and sexual assault.
Risk to Business: 2.419=Severe
The exposed personal data for patients and former patients at Broward health may include Social Security numbers, bank or financial account information, driver’s license numbers, names, addresses, telephone numbers and hospital payment account information. Protected health information including medical information like care history, condition, treatment and diagnosis records may also have been exposed.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business Ransomware can cause serious operational problems in unexpected places in today’s connected world.
ID Agent to the Rescue: Cybersecurity horrors lurk around every corner, lying in wait for unwary organizations. Learn how to defeat them in our eBook Monsters of Cybersecurity. DOWNLOAD IT NOW>>
Illuminate Education
https://nypost.com/2022/01/15/nyc-schools-crippled-by-illuminate-educations-data-outage/
Exploit: Hacking
Illuminate Education: Education Platform
Risk to Business: 1.717= Severe
Illuminate Education, a digital education platform used by 5,200 schools and districts in the US, is still struggling to resume services after a cyberattack. The company owns popular school management platforms Skedula and PupilPath. Illuminate Education says it has continued experiencing a service interruption affecting all IO Classroom applications for nearly 10 days following an unspecified security incident. Investigation and recovery are underway, but the platform has not provided a recent update on the expected timeline.
Individual Impact: No specifics about any consumer/employee PII or financial data loss were available at press time.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business Cybercriminals have been all over targets in the education sector including companies that serve it. Companies should use caution.
ID Agent to the Rescue: Make sure that your clients are doing everything right to stop system and data security threats with the Computer Security To-Do List checklist, available now! GET THIS CHECKLIST>>
TransCredit
https://www.websiteplanet.com/blog/transcredit-leak-report/
Exploit: Misconfiguration
TransCredit: Credit Analysis & Reporting
Risk to Business: 1.719 = Severe
Over half a million credit reports and other financial documents held by Florida-based financial analysis firm TransCredit have been exposed. The Website Planet research team reported discovering a non-password-protected database that contained 822,789 records. Researchers cautioned that this dataset appears to be concentrated on clients in the transportation sector.
Risk to Business: 1.719 = Severe
The exposed data includes detailed information on trucking, transport companies and individual drivers. Also included in this data was information about credit accounts, loans, repayment and debt collections as well as financial data like banking information, tax ID numbers and Social Security Numbers.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Once again, a service provider that maintains a large array of records full of PII was hit, gaining cybercriminals a data bonanza.
ID Agent to the Rescue: Employees are the most likely cause of a cybersecurity incident in any business. See how to spot and stop insider risks in our new Guide to Reducing Insider Risk. DOWNLOAD IT NOW>>
90% of MSPs have had clients hit with a ransomware attack in the last 12 months. Help your clients build stronger defenses with the insight in Ransomware Exposed! DOWNLOAD NOW>>
United Kingdom – Parasol Group
https://www.theregister.com/2022/01/17/umbrella_company_parasol_group_confirms/
Exploit: Hacking
Parasol Group: Business Services
Risk to Business: 1.727= Severe
UK umbrella company Parasol Group was forced to shut down some of its IT systems last week after an intrusion was detected. The outage impacted the company’s MyParasol payment portal for contractors and freelancers, leading to payroll issues that caused some folks to not get paid. The company is also having invoicing problems as a result of the incident.
Individual Impact: No information about exposed customer personal or financial data was available at press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Cybercriminals are especially likely to target companies that provide time-sensitive products and services in hopes of a fast extortion payment.
ID Agent to the Rescue Reduce the chance of a security incident, strengthen your clients’ security culture and start them off on the right foot in 2022 with our Building a Strong Security Culture Checklist. GET THE CHECKLIST>>
Germany – Hensoldt
Exploit: Ransomware
Hensoldt: Defense Contractor
Risk to Business: 1.677 = Severe
Multinational defense contractor Hensoldt was hit with a ransomware attack by the Lorenz ransomware group. The company’s products include radar arrays, avionics, and laser rangefinders used by the US military. The Lorenz ransomware group claims to have stolen an undisclosed number of files from Hensholdt’s network during the attack. The gang says that they have published 95% of all stolen files on their leak website. No ransom demand has been announced.
Individual Impact: No consumer or employee PII or financial data exposure was disclosed in this incident as of press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Cybercriminals don’t just steal personal and financial data, they also love trade secrets, research, formulas and other proprietary data.
ID Agent to the Rescue Learn 4 highly effective ways to protect your clients from ransomware now and set them up for future defensive success in one fun, educational webinar! WATCH NOW>>
Make sure your clients have all the bases covered with the Computer Security To-Do Checklist! GET IT>>
The Philippines – Commission on Elections (Comelec)
Exploit: Hacking
Commission on Elections (Comelec): Government Agency
Risk to Business: 1.806 = Severe
Concerns are mounting about the possibility that sensitive voter data has been exposed after an audacious attack on the Commission on Elections (Comelec) of The Philippines. Bad actors breached the system of the Comelec on January 8 and downloaded files that included sensitive information including the usernames and PINS of vote-counting machines (VCM). The cybercriminals made off with an estimated 60 gigabytes of data. Reports say that the stolen data included network diagrams, IP addresses, list of all privileged users, domain admin credentials, list of all passwords and domain policies, access to the ballot handling dashboard and QR code captures of the bureau of canvassers with login and password. The exposure of this data may impact upcoming elections in The Philippines in May.
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Government agencies have become juicy targets for cybercriminals looking to score a boatload ofsensitive information fast.
ID Agent to the Rescue Building cyber resilience helps insulate organizations from trouble like this. Learn more about why cyber resilience is the ticket to a safer future for your clients. GET THIS EBOOK>>
Thailand – Siriraj Hospital
Exploit: Hacking
Siriraj Hospital: Medical Center
Risk to Business: 2.721 = Moderate
An estimated 39 million patient records from Siriraj Hospital in Thailand, including VIP patients, has turned up for sale on the dark web. Threat actors offered samples from the 38.9 million patient records they claimed to have. This is the second attack on a major Thai hospital in 6 months.
Risk to Business: 2.605 = Moderate
The treasure trove of data supposedly includes names, addresses, Thai IDs, phone numbers, gender details, dates of birth and other patient personal information.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Personal data is always a winner for cybercriminals who are looking to make a quick profit in the booming dark web data markets.
ID Agent to the Rescue Phishing is the leading driver of a data breach. Our eBook The Phish Files can help you gain a strategic edge against phishing. GET THE BOOK>>
Get the cheat codes to defeat cybercrime in our eBook The Security Awareness Champions Guide GET IT NOW>>
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.
Zero Trust security is a piece of cake when you’re sure you’re giving access to the right people at the right levels. SEE HOW TO DO IT>>
Go Inside the Ink to Get the Inside Scoop on Cybercrime
Are you up to date on the latest news that can impact your business and your customers? Here’s a recap:
- Reduce Insider Threats by Building a Strong Security Culture
- 10 More Facts About Phishing That You Need to See
- This Security Flaw Has 1 in 3 Companies Flirting with Disaster
- 5 Ways an Employee Becomes an Insider Risk (+2 You May Not Be Considering)
- The Week in Breach News: 01/05/22 – 01/11/22
Kaseya Patch Tuesday: Patch notes & bug fixes for December 2021: SEE PATCH INFO>>
Take a deep dive into ransomware and learn to protect your clients affordably with this resource bundle! GET IT>>
Get Your Revenue Rocket Fuel!
5 Ways to Make Marketing Magic – Does marketing seem daunting? We can help. Learn how to access done-for-you marketing and other promotional tools. DOWNLOAD IT>>
6 Power-Ups That Will Make You a Sales Superhero – Drive your sales into the stratosphere with the tools and help that are available to you now. DOWNLOAD IT>>
How Security Awareness Training Protects Your Clients & Grows Your MRR – See why security awareness training is your new profit center and how to make it work for your MSP. WATCH NOW>>
Did you miss this? See How to Sell More Security Solutions to Your Clients in just 15 minutes. WATCH NOW>>
See how cyber insurance is changing and how to protect your clients from trouble. WATCH NOW>>
5 Tips for Keeping Your Clients Safe in 2022
Don’t Let Anything Slip Off Your Radar!
You and your clients are gearing up for a busy year ahead. But cybersecurity woes can quickly put a damper on your customers’ 2022 plans as well as your MSPs revenue. In a recent IBM survey, researchers discovered that 67% of survey respondents say that both the volume and severity of cybersecurity incidents increased or significantly increased in the past 12 months. No one expects that pattern to change in 2022. If anything, businesses are looking at an even more dangerous year ahead.
The Guide to Reducing Insider Risk can help IT pros stop security incidents before they start! GET IT>>
Don’t Overlook Malware
Ransomware is the type of malware that sucks up the most headlines, but it’s not the only malware threat that your clients are facing, even if it’s the only one they can readily identify. Ten years ago, the number of detected malware types stood at 28.84 million. By 2020, that number had ballooned to nearly 678 million varieties. Other malware threats like payment skimmers, cryptominers and trojans can cause expensive, devastating damage to your client’s business. Over the last decade, there has been an 87% increase in malware infections. and a terrifying 50% of all malware attacks are aimed at SMBs.
That means that your customers are at risk of a malware attack no matter what the size of their business. But you can help them reduce that risk by helping them protect themselves against the most common way that malware could enter their environment: phishing. More than 90% of malware arrives at businesses thanks to a phishing email. Security awareness training can quickly and effectively lower their risk of trouble while providing a host of other security benefits like increased cyber resilience. That’s important because 97% of employees are unable to recognize a sophisticated phishing email without training.
Go deep into the cybercrime underworld in “Hacker Hotbeds and Malicious Marketplaces” WATCH THIS WEBINAR>>
Ransomware Will Continue to Be a Huge Problem
The ransomware scourge isn’t going away anytime soon. In the final months of 2021, ransomware continued its meteoric rise, chewing up cybercrime records. Ransomware attacks have ballooned from an estimated 78.3 million attacks in Q3 2020 to 190.4 million attacks in Q3 2021. Size, revenue, industry – nothing is a barrier that protects any business from ransomware. SMBs have just as much risk of getting hit by ransomware as the big guys. About half of ransomware attacks hit businesses with less than 100 employees.
Building a strong defense against ransomware isn’t easy, and both the types of ransomware threats that are out there and where they’re coming from is often murky. But you can guide your clients into taking a few precautions that can help them reduce their chances of falling victim to a ransomware attack. Employees can’t guard against something they don’t know how to spot. While ransomware may be top-of-mind for IT professionals, it’s barely a blip on non-IT professionals’ radar – only an estimated 30% of internet users even know what ransomware or malware is. Security awareness training solves that problem.
Is someone’s behavior suspicious? Learn to spot trouble fast with 5 Red Flags That Point to a Malicious Insider at Work. DOWNLOAD IT>>
Make Sure Employees Know That Security is Everyone’s Job
Security is stronger at a company when everyone understands its importance, but a large number of folks just don’t get it. In fact, many employees who are not in traditional technology roles don’t even think that there’s anything they can do about security. Worryingly, 45% of respondents in a HIPAA Journal survey said that they don’t need to worry about cybersecurity safeguards because they don’t work in the IT department. Those employees are engaging in unsafe security behaviors or neglecting to follow procedures because they don’t think security is in their job description, undermining the efforts that you’re making to keep their employer safe. That’s a big problem that all of your clients need to overcome in order to stay out of trouble.
Stepping up security awareness training is a game-changer when it comes to reducing insider risk and developing a strong security culture. Negligent employees are responsible for about 60% of cybersecurity incidents. When employees learn about cybersecurity and how different cyberattacks threaten their organization, they’ll become more security conscious and less likely to make careless mistakes. It’s a great way to illustrate the importance of everyone knowing that they’re part of the security team.
Use this checklist to be sure that you’ve found and mitigated every cyberattack risk that your client faces! DOWNLOAD IT>>
Size Doesn’t Matter
These days, every business is at risk of falling into cybercriminals’ sights. Unfortunately, many businesses don’t believe that’s true. Executives at 54% of small businesses in a 2021 survey said that they’re too small for a cyberattack, a dangerous fallacy. That leads to all sorts of difficulty for the MSPs and other IT professionals that are trying to secure them. More than two in five companies that have 50 or fewer employees don’t have any type of cybersecurity defense in action at all. But they are at risk of trouble.
There are all sorts of excuses for failing to invest in adequate or appropriate security, but money will always be somewhere near the top of the list. One in three small businesses with 50 or fewer employees rely on free or consumer-grade cybersecurity tools for all of their cyber defense. SMB executives may be reluctant to buy security solutions or re-up contracts for security when they’re tightening their belts. But sometimes decision-makers are reluctant because they aren’t well informed on a subject and don’t want to make a wrong move. 25% of SMB execs said that they wouldn’t know where to even start with SMB cybersecurity. Help your clients choose multipurpose solutions that offer strong protection and a great value to overcome objections.
Go inside the world of hackers and see how it really works with these true tales of cybercrime undercover operations! WATCH NOW>>
Threats Will Continue to Grow in Sophistication
Cybersecurity companies aren’t the only ones innovating. Cybercriminals are always upping the ante with new, hard-to-detect attacks in a bid to sneak past their victims’ security. Most businesses’ employees aren’t ready to face the challenge, especially if the company has slacked on security awareness training programs during the pandemic. The biggest bugbear on that front is phishing. When it comes to phishing, more than 95% of untrained employees cannot spot a sophisticated phishing message. Other cyberattacks aren’t much better. Almost 30% of untrained users in a social engineering study fell for lures that enticed them to click on malicious links, download suspicious files and email attachments, enter their credentials at a fake site and even correspond with cybercriminals.
Security awareness training works when it’s done regularly, optimally 11 times per year for each employee. Employees who receive regular security awareness training are much better equipped to spot and stop security threats, especially phishing. In a phishing study, 40 – 60% of the subjects were initially likely to open malicious links or attachments. But after about 6 months of security awareness training, the percentage of employees who took the bait in every industry dropped 20% to 25% – and after 3 to 6 months of more, that number dropped to only 10% to 18%.
Just getting started in cybersecurity? This resource bundle will help you get up to speed to protect your clients fast! GET IT>>
Help Your Business and Your Clients Thrive
Cybercrime costs the global economy an estimated $445 billion annually. Help your clients avoid becoming part of that tally and make smart moves that benefit your MSP with the solutions and support you’ll get when you partner with ID Agent.
BullPhish ID – Give your clients exactly what they need with a security awareness training solution that features both plug-and-play phishing kits or fully customizable campaigns. Plus, teach employees about other cybersecurity topics like password handling and regulatory compliance.
Dark Web ID – Dark web search is a tremendously powerful cybersecurity selling tool. Shock customers and prospects with a real-time search to uncover their exposed credentials to start important ( and profitable) conversations about their need for improved security.
Our partners typically realize ROI in 30 days or less. See why nearly 4,000 MSPs in 30 countries choose to grow with ID AGENT solutions and support. BECOME A PARTNER>>
See what your peers have to say about the benefits of a relationship with ID Agent. SEE TESTIMONIALS>>
Contact our solutions experts today.
Can you spot a phishing email? This infographic shows you how to detect one! DOWNLOAD IT>>
Jan 25 – Quarterly Dark Web ID and BullPhish ID Product Update REGISTER NOW>>
Jan 26 – How to Turn Compromised Credentials into Your Biggest Moneymaker REGISTER NOW>>
Jan 27 – IT Trivia Masters Extravaganza REGISTER NOW>>
Jan 27–28 – 7 Figure MSP Live REGISTER NOW>>
Feb 01 – Insider Risk: Detection and Prevention of the Largest Cyberthreat REGISTER NOW>>
Feb 01 – Quarterly Passly Product Update REGISTER NOW>>
Jun 20-23 – Connect IT Global in Las Vegas REGISTER NOW>>
Psst: Register now for Connect IT and get special early bird pricing. But hurry, it’s only available until 01/31!
No Business is Too Small for a Cyberattack
Do you think your business is too small to fall victim to a cyberattack? That’s not the case. No business is too small to be a target. Cybercriminals aren’t that picky. You may be surprised to learn that 50% of all cyberattacks are aimed at businesses with fewer than 100 employees.
Medium businesses don’t fare any better. From 2020 to 2021, the number of cyberattacks attacks on mid-sized businesses increased by at least 50%, with attacks in health care and transportation increasing by more than 125%.
Now is the time for a checkup to ensure that the solutions you have in place are still right for your business. If you’re not already doing security awareness training, now is also the perfect time to start doing it using a solution like BullPhish ID that offers lessons about cybersecurity and compliance training for employees without any techno-speak. Your business is at risk of a cyberattack. Is your defensive strategy ready to protect it?
Do you have comments? Requests? News tips? Compliments? Complaints (or compliments)? We love to hear from our readers! Send a message to the editor.
ID Agent Partners: Feel free to reuse this post (in part or in its entirety) When you get a chance, email [email protected] to let us know how our content works for you!
Our Partners typically realize ROI in 30 days or less. Contact us today to learn why 3,850 MSPs in 30+ countries choose to Partner with ID Agent!
Check out an on-demand video demo of BullPhish ID or Dark Web ID WATCH NOW>>
See Graphus in action in an on-demand video demo WATCH NOW>>
Book your demo of Dark Web ID, BullPhish ID, RocketCyber or Graphus now!