The Week in Breach News: 02/09/22 – 02/15/22
This week, hackers come calling at two telecoms, QR codes go wrong in Australia, an NFL team is defeated by ransomware and three unexpected approaches to overcome client and prospect objections and sell more security awareness training.
Get ready to pack your bags for Connect IT 2022! Join us June 20-23 in Las Vegas for the industry’s premier event! REGISTER NOW>>
San Francisco 49ers
https://abcnews.go.com/Sports/wireStory/ransomware-gang-hacked-49ers-football-team-82865844
Exploit: Ransomware
San Francisco 49ers: National Football League (NFL) Team
Risk to Business: 1.727= Severe
While everyone was focused on the big game last week, cybercriminals were focused on the San Francisco 49ers. The team was hit by a ransomware attack, purportedly by BlackByte. The cybercriminals claim they stole some of the football team’s financial data, invoices and other internal documents. The team stressed the fact that this event appeared to be limited to their corporate network and did not endanger any fan or stadium databases.
Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business: Organizations in industries that have had historically poor security are attractive low-hanging fruit for cybercriminals.
ID Agent to the Rescue: Get an in-depth look at how ransomware is evolving and who profits from it in our hit eBook Ransomware Exposed. GET THIS EBOOK>>
EasyVote Solutions
https://www.govtech.com/security/georgia-voter-info-posted-online-after-software-company-breach
Exploit: Misconfiguration
EasyVote Solutions: Voting Software Company
Risk to Business: 1.561 =Severe
EasyVote Solutions has exposed some voter and poll worker data. The data was left unguarded and easily accessible on the internet. The software company says that exposed information does not include full voting records or registrations. The breach was discovered by South Carolina Law Enforcement Division (SLED) internet researchers. SLED and the FBI are investigating.
Individual Risk: 1.772 =Severe
Exposed data for voters can include names, addresses, races and dates of birth. Exposed data for poll workers may include those details plus identity documents, Social Security numbers and financial data.
Customers Impacted: 3,000 so far
How It Could Affect Your Customers’ Business Misconfiguration and sloppy security aren’t uncommon mistakes, but they’re always a problem and could be an expensive regulatory disaster in some industries.
ID Agent to the Rescue: Share The Computer Security To-Do List with your clients to help them find vulnerabilities and you’ll start profitable conversations! DOWNLOAD IT>>
Meter
https://www.zdnet.com/article/4-4-million-stolen-in-attack-on-blockchain-infrastructure-meter/
Exploit: Hacking
Meter: De Fi Platform
Risk to Business: 1.279= Extreme
Another day, another DeFi hack. This time the victim was blockchain infrastructure company Meter. $4.4 million was stolen during a cyberattack on the Meter Passport platform in the form of 1391 ETH and 2.74 BTC. The incident also impacted Meter’s Moonriver Network. The company acknowledged the hack on Saturday, urging users not to trade unbacked meterBNB circulating on Moonriver. The company says that it plans to repay some investors and the incident is under investigation.
Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business De Fi continues to be a hotbed of hacking activity as cybercriminals seek quick scores of cryptocurrency, and there’s still no end to the danger in sight.
ID Agent to the Rescue: Building cyber resilience helps insulate organizations from trouble like this. Learn more about why cyber resilience is the ticket to a safer future for your clients. GET THIS EBOOK>>
Memorial Hermann Health System
Exploit: Third-Party Breach
Memorial Hermann Health System: Healthcare Provider
Risk to Business: 1.861 = Severe
Memorial Hermann Health System is notifying patients that their data has been exposed after a data security incident at one of their service providers, Advent Health Partners. That company has been investigating unauthorized activity on company email accounts related to Memorial Hermann data. The incident was first spotted in September 2021.
Individual Risk: 1.712 = Severe
An unauthorized third party accessed multiple files containing Memorial Hermann patients’ protected health information (PHI) that may include first names, last names, dates of birth, social security numbers, driver’s license numbers, financial information, health insurance information and treatment information.
Customers Impacted: 6,260
How it Could Affect Your Customers’ Business Cybercriminals are poised to attack any company that handles or stores large amounts of valuable personal or health-related data.
ID Agent to the Rescue: Cybersecurity horrors lurk around every corner, lying in wait for unwary organizations. Learn how to defeat them in our eBook Monsters of Cybersecurity. DOWNLOAD IT NOW>>
Go deep into the cybercrime underworld in “Hacker Hotbeds and Malicious Marketplaces” WATCH THIS WEBINAR>>
Switzerland – Swissport International
Exploit: Ransomware
Swissport International: Aviation Services
Risk to Business: 2.171= Severe
Aviation services company Swissport International was struck with a ransomware attack that had a major impact on its operations, leading to flight delays for 22 flights out of Zurich Airport. The aviation company provides cargo handling, security, maintenance, cleaning and lounge hospitality at airports in 50 countries. The company’s website was back up and running quickly, and the incident is under investigation.
Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Ransomware attacks against transportation and transportation infrastructure targets have been increasing as cybercriminals look for quick paydays.
ID Agent to the Rescue Help your clients stay safe from the most common delivery system for ransomware, a phishing message, with our Can You Spot the Phishing Email? infographic! DOWNLOAD IT>>
Portugal – Vodafone
https://therecord.media/cyberattack-brings-down-vodafone-portugal-mobile-voice-and-tv-services/
Exploit: Hacking
Vodafone: Communications Carrier
Risk to Business: 2.919 = Moderate
Wireless carrier Vodafone Portugal said that a substantial amount of its customer data services went offline for one overnight period following a cyberattack. The company’s 4G and 5G mobile networks, along with fixed voice, television, SMS and voice/digital answering services went down. The company says that customer data doesn’t appear to have been accessed or compromised. Some services still remain offline a week after the attack.
Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Attacks against communications companies have been a major component of the recent wave of infrastructure and related hacking.
ID Agent to the Rescue Find and slay dastardly vulnerabilities in your clients’ security strategy and emerge victorious with the Cybersecurity Monster Hunter’s Checklist! GET IT>>
Croatia – A1 Hrvatska
Exploit: Unauthorized Access
A1 Hrvatska: Communications Carrier
Risk to Business: 1.904 = Severe
Croatian telecom A1 Hrvatska has disclosed a data security incident that led to the exposure of personal data for an estimated 200,000 customers. The company says that the exposure was due to unauthorized access to one of their user databases that contained sensitive personal information. The company was quick to specify that no consumer financial data was exposed. The incident has not affected A1 Hrvatska’s services or operations.
Individual Risk: 2.711 = Moderate
The customer information exposed includes users’ full names, personal identification numbers, physical addresses and telephone numbers.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Utilities/Infrastructure are at the top of the cybercriminal hit list these days, and companies in those sectors should take note.
ID Agent to the Rescue Immerse yourself in a crash sourcse on cybersecurity to gain the insight you need intosecuring your clients against today’s biggest risks with our Deep Dive Into Cybersecurity resource bundle. DOWNLOAD IT>>
Slovenia – Pop TV
https://therecord.media/cyber-attack-disrupts-slovenias-top-tv-station/
Exploit: Ransomware
Pop TV: Television Network
Risk to Business: 1.2011 = Severe
Ransomware practitioners stole the show at Pop TV, Slovenia’s most popular TV channel. As a result news programs including the station’s news broadcast 24UR were unable to show any computer graphics. Particularly irksome for customers was the fact that the attack prevented new content from being added to the platform, impacting streaming any of its channels and live sporting events, such as the Winter Olympics. Slovenia’s Computer Emergency Response Team, SI-CERT is investigating.
No information about consumer/employee PII, PHI or financial data exposure was available at press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Cybercriminals looking for fast money are likely to target businesses that are in time-sensitive industries.
ID Agent to the Rescue Ransomware 101, our most popular eBook, is full of tips and expert advice to guide you through securing your clients effectively from today’s scariest risk. READ IT>>
Are you ready to take back control of cyberattack risk from the villains on the dark web? This webinar shows you where to start. WATCH NOW>>
New South Wales Department of Customer Service
Exploit: Misconfiguration
New South Wales Department of Customer Service: Regional Government Agency
Risk to Business: 1.211 = Extreme
A real data exposure mess has brewed in New South Wales, Australia thanks to a government-run QR code-based COVID-19 check-in program. The COVID Safe Businesses and Organizations dataset was discovered loose on the internet and it included data for sensitive sites and organizations alongside data about run-of-the-mill companies. Some of the sensitive data posted gave details about the physical facilities and locations of prisons, critical infrastructure networks including power stations and tunnel entry sites as well as dozens of shelters and crisis accommodation centers. Even national security-related locations were exposed. In this program, businesses and organizations registered as COVID-safe to access a QR code for staff and customers to check-in at their physical locations. The program has been discontinued.
No information about consumer/employee PII, PHI or financial data exposure was available at press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Information is gold on the dark web. The locations of sensitive infrastructure targets will be circulating quickly and could easily fall into the wrong hands.
ID Agent to the Rescue Employee blunders can cost your client’s company a fortune, especially compliance-related failures. Learn how to nip employee mistakes in the bud in The Guide to Reducing Insider Risk. GET IT>>
Our partners typically realize ROI in 30 days or less. See why nearly 4,000 MSPs in 30 countries choose to grow with ID AGENT solutions and support. BECOME A PARTNER>>
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.
Go Inside the Ink to see how today’s biggest threats can impact your MSP and your customers in our blog.
- 4 Pandemic Phishing Scams Coming Soon to a Mailbox Near You
- Growing Ransomware Woes Are Swamping These 3 Sectors
- 10 Facts About the Benefits of Security Awareness Training
- 3 Phishing Threats Right Under Every Employee’s Nose
- The Week in Breach News: 02/02/22 – 02/08/22
Don’t let roadblocks trap you in the slow lane. Learn to overcome obstacles and put your MSP on the road to prosperity fast. SEE HOW>>
Pump Up Your Sales Fast
This trio of resources will help you expand your security business and your wallet!
Kaseya Speed Dating: Simple, Quick, Effective Dark Web Monitoring – See how you’ll benefit from being able to uncover every single compromised employee credential in minutes. WATCH NOW>>
How to Sell More Security Solutions to Your Clients – Learn how to start profitable security conversations that end in signed deals! WATCH NOW>>
6 Power-Ups That Will Make You a Sales Superhero – Find the tools you need to crush your sales goals and send your MRR soaring fast. DOWNLOAD IT>>
Did you miss this? Learn to help your clients prevent insider incidents with The Guide to Reducing Insider Risk. DOWNLOAD IT>>
See how cyber insurance is changing and how to protect your clients from trouble. WATCH NOW>>
3 Approaches to Help You Overcome Objections to Security Awareness Training
Outside-the-Box Hooks Can Land Deals
You know that security awareness training is one of the smartest security investments that a business of any size can make. But in an uncertain economy, getting your cost-conscious customers to buy in to that conclusion is often challenging even with surging cybercrime numbers. Security awareness training can sound nebulous and unnecessary to executives without cybersecurity savvy, landing training programs on the chopping block when it comes time to trim the security budget. But when the big-picture cybercrime prevention benefits of security awareness training just aren’t doing the trick, there are a few alternative ways to try to get your message across to budget controllers who are looking for black-and-white, dollars- and cents hard data to prove that security awareness training works.
Learn how to spot and stop malicious insiders and educate users with this handy infographic! GET IT>>
Untrained Employees Are Vulnerabilities
Employees that don’t have security awareness training are cybersecurity disasters waiting to happen. By far the most compelling data point comes from the HIPAA Journal. Their researchers discovered that average non-IT employees don’t even think about security because they don’t think that maintaining security is their problem. An astonishing 45% of respondents in a HIPAA Journal survey said that they don’t need to worry about cybersecurity safeguards or procedures because they don’t work in the IT department.
Untrained employees are also extremely likely to be taken in by phishing-related social engineering, and that’s a very bad thing for their employers considering the fact that phishing is the cyberattack that employees encounter the most. Almost 30% of untrained users in a social engineering study fell for phishing lures that enticed them to click on malicious links, download suspicious files and email attachments. In fact, employees are almost comically bad at spotting phishing. 97% of employees in a cybersecurity survey were unable to detect a sophisticated phishing email without training.
If the client thinks that everyone already knows about cyberattacks and a training program is just a waste of time, let them know that they’d better think again. By and large, people are overwhelmingly ignorant of even the biggest security threats. That gives way to a whole lot of employees are extremely uniformed about cybersecurity. A paltry 16% of employees can recognize any cyber threats without security awareness training. When looking at specific threats, the picture is even more dismal. Only about 30% of average internet users even know what ransomware or malware is.
Find out exactly how security awareness training makes your client’s business safer & saves them money. WATCH NOW>>
Compliance Failures Cost a Fortune
Emphasize the importance of compliance and the dire consequences of screwing up. Compliance is an area in which employee negligence around cybersecurity can cost a pretty penny, and penalties add up fast. Organizations lose an average of $4 million in revenue due to a single non-compliance event. Every incident is an upfront budget buster too. The average cost of a violation for organizations experiencing non-compliance problems is $9.4 million. Each statute has its own requirements and penalties, but the bottom line really is that non-compliance is punishingly expensive.
- For a HIPAA violation, a company could be looking at paying $100 to $50,000 per violation (or per record).
- A GDPR penalty could set a company back up to 4% of its annual global revenue or 20 million euros ($22.8 million)
- A company in breach of PIPEDA requirements can be fined up to $100,000 for each violation.
Companies are regularly failing at security compliance and that can mostly be chalked up to employee negligence. More than 60% of companies have had employees cause a compliance-related security failure. This is not a problem that is going to get better on its own, nor will the penalties for non-compliance grow any cheaper over time. When considered against the price of a compliance failure, it’s easy to see that training to avoid compliance failures is a bargain. The average cost of maintaining compliance for an organization including safeguards like employee security awareness training is $3.5 million – about one-third of the average penalty for noncompliance.
Learn the secret to conjuring up amazing stress-free marketing campaigns in 5 Ways to Make Marketing Magic! GET IT>>
It’s Got an Impressive ROI
Business leaders know that it pays to invest in people. That’s why it’s compelling to point out the fact that and companies that invest in security awareness training for their people are maximizing their security spending. When considered overall in comparison to other security investments, security awareness training programs have a 3-fold return on investment or more. Want something even more black-and-white? In a more granular breakdown, businesses with less than 1000 employees enjoy an ROI of 68% and big businesses (companies with more than 1,000 employees) enjoy an eye-popping 562% ROI.
Security Awareness Training Works
The bottom line is that in every circumstance, security awareness training is a smart investment that does exactly what it’s supposed to: it reduces a company’s chance of having a security incident by up to 70%. Employees that receive security awareness training on a regular schedule, (ideally 11 times per year or every 6 weeks or so), are more likely to spot security threats, notice potential insider threats, and comply with their company’s security policies.
Unfortunately, far too many companies just don’t take security awareness training seriously to their detriment. That failure to engage in the right amount of security awareness training is a serious vulnerability as they try to build strong defenses to keep their data and systems safe in today’s volatile threat atmosphere – 60% of companies do not do enough security awareness training to enjoy any of the benefits it provides.
Security awareness training is the low-cost, highly effective cure for employee cybersecurity woes – and BullPhish ID makes security awareness training a snap for trainers and employees.
- Gain access to a large library of training videos and modules is included to educate employees how to avoid cyberattacks like ransomware
- Simplify compliance training with video lessons that make complex requirements easy for everyone to understand
- Train your way – plug and play phishing simulation kits or customizable content that can be tailored to fit your industry’s unique threats
- Be confident that you’re educating employees about the latest threats or compliance requirements – at least 4 new training videos are added every month
- Training content is available in 8 languages: English, Dutch, French, German, Italian, Portuguese, Spanish (Iberian/European) and Spanish (Latin)
- In-lesson quizzes and simple, easy-to-read reports show the value of training and indicate who needs more help.
- Streamline the training process with personalized user portals for every employee that offer the option to deliver training automatically
- Automation makes administration a snap by automatically generating and sending reports to stakeholders
Don’t just take our word for it, see what these MSPs have to say: https://www.idagent.com/case-studies/
It’s a bird, it’s a plane, it’s your revenue rising into the stratosphere with 6 Power-Ups That Will Make You a Sales Superhero. GET IT>>
Feb 17 – Preparing Employees for the Inevitable Attack with Security Awareness Training REGISTER NOW>>
Feb 23 – GlueTalks: How to Tackle Today’s Sophisticated Cyberthreats REGISTER NOW>>
Mar 1 – Empower Your Employees to Be the Front Line of Cybersecurity Defense REGISTER NOW>>
Mar 21 – 22 – Midsize Enterprise Summit REGISTER NOW>>
Mar 30 – 31 Cybersecurity Expo REGISTER NOW>>
Jun 20-23 – Connect IT Global in Las Vegas REGISTER NOW>>
This Tool Helps Prevent Expensive Compliance Failures
Compliance failures are an expensive nightmare, and the requirements for maintaining compliance can be tricky. Add to that a steady escalation in non-compliance penalties and you’ve got a recipe for business disaster.
But you can take action to ensure that your company is doing everything possible to maintain compliance with cybersecurity-related regulations through security awareness training. Security-related risks are reduced by 70% when businesses invest in cybersecurity awareness training.
It’s easy to get started and trainibg brings many benefits to your companyEmbark on an employee security awareness training program using a solution that teaches employees how to maintain compliance like BullPhish ID before a compliance failure comes knocking at your door.
Do you have comments? Requests? News tips? Compliments? Complaints (or compliments)? We love to hear from our readers! Send a message to the editor.
ID Agent Partners: Feel free to reuse this post (in part or in its entirety) When you get a chance, email [email protected] to let us know how our content works for you!
Our Partners typically realize ROI in 30 days or less. Contact us today to learn why 3,850 MSPs in 30+ countries choose to Partner with ID Agent!
Check out an on-demand video demo of BullPhish ID or Dark Web ID WATCH NOW>>
See Graphus in action in an on-demand video demo WATCH NOW>>
Book your demo of Dark Web ID, BullPhish ID, RocketCyber or Graphus now!