Please fill in the form below to subscribe to our blog

The Week in Breach News: 02/09/22 – 02/15/22

February 16, 2022

This week, hackers come calling at two telecoms, QR codes go wrong in Australia, an NFL team is defeated by ransomware and three unexpected approaches to overcome client and prospect objections and sell more security awareness training.


Get ready to pack your bags for Connect IT 2022! Join us June 20-23 in Las Vegas for the industry’s premier event! REGISTER NOW>>



San Francisco 49ers 

https://abcnews.go.com/Sports/wireStory/ransomware-gang-hacked-49ers-football-team-82865844

Exploit: Ransomware

San Francisco 49ers: National Football League (NFL) Team

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.727= Severe

While everyone was focused on the big game last week, cybercriminals were focused on the San Francisco 49ers. The team was hit by a ransomware attack, purportedly by BlackByte. The cybercriminals claim they stole some of the football team’s financial data, invoices and other internal documents. The team stressed the fact that this event appeared to be limited to their corporate network and did not endanger any fan or stadium databases.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

Customers Impacted: Unknown

How It Could Affect Your Customers’ Business: Organizations in industries that have had historically poor security are attractive low-hanging fruit for cybercriminals.

ID Agent to the Rescue: Get an in-depth look at how ransomware is evolving and who profits from it in our hit eBook Ransomware ExposedGET THIS EBOOK>>  


EasyVote Solutions

https://www.govtech.com/security/georgia-voter-info-posted-online-after-software-company-breach 

Exploit: Misconfiguration

EasyVote Solutions: Voting Software Company

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.561 =Severe

EasyVote Solutions has exposed some voter and poll worker data. The data was left unguarded and easily accessible on the internet. The software company says that exposed information does not include full voting records or registrations. The breach was discovered by South Carolina Law Enforcement Division (SLED) internet researchers. SLED and the FBI are investigating.

cybersecurity news represented by agauge showing severe risk

Individual Risk: 1.772 =Severe

Exposed data for voters can include names, addresses, races and dates of birth. Exposed data for poll workers may include those details plus identity documents, Social Security numbers and financial data.  

Customers Impacted: 3,000 so far

How It Could Affect Your Customers’ Business Misconfiguration and sloppy security aren’t uncommon mistakes, but they’re always a problem and could be an expensive regulatory disaster in some industries.

ID Agent to the Rescue: Share The Computer Security To-Do List with your clients to help them find vulnerabilities and you’ll start profitable conversations! DOWNLOAD IT>>


Meter

https://www.zdnet.com/article/4-4-million-stolen-in-attack-on-blockchain-infrastructure-meter/

Exploit: Hacking

Meter: De Fi Platform 

cybersecurity news gauge indicating extreme risk

Risk to Business: 1.279= Extreme

Another day, another DeFi hack. This time the victim was blockchain infrastructure company Meter. $4.4 million was stolen during a cyberattack on the Meter Passport platform in the form of 1391 ETH and 2.74 BTC. The incident also impacted Meter’s Moonriver Network. The company acknowledged the hack on Saturday, urging users not to trade unbacked meterBNB circulating on Moonriver. The company says that it plans to repay some investors and the incident is under investigation.

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

Customers Impacted: Unknown

How It Could Affect Your Customers’ Business De Fi continues to be a hotbed of hacking activity as cybercriminals seek quick scores of cryptocurrency, and there’s still no end to the danger in sight.

ID Agent to the Rescue:  Building cyber resilience helps insulate organizations from trouble like this. Learn more about why cyber resilience is the ticket to a safer future for your clients. GET THIS EBOOK>>  


Memorial Hermann Health System

https://www.khou.com/article/news/local/memorial-hermann-cyberattack-security-breach/285-1cc8295d-48a4-452e-a6f2-1b4fd059f201 

Exploit: Third-Party Breach

Memorial Hermann Health System: Healthcare Provider

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.861 = Severe

Memorial Hermann Health System is notifying patients that their data has been exposed after a data security incident at one of their service providers, Advent Health Partners. That company has been investigating unauthorized activity on company email accounts related to Memorial Hermann data. The incident was first spotted in September 2021. 

cybersecurity news represented by agauge showing severe risk

Individual Risk: 1.712 = Severe

An unauthorized third party accessed multiple files containing Memorial Hermann patients’ protected health information (PHI) that may include first names, last names, dates of birth, social security numbers, driver’s license numbers, financial information, health insurance information and treatment information.

Customers Impacted: 6,260

How it Could Affect Your Customers’ Business Cybercriminals are poised to attack any company that handles or stores large amounts of valuable personal or health-related data.

ID Agent to the Rescue: Cybersecurity horrors lurk around every corner, lying in wait for unwary organizations. Learn how to defeat them in our eBook Monsters of Cybersecurity. DOWNLOAD IT NOW>>


Go deep into the cybercrime underworld in “Hacker Hotbeds and Malicious Marketplaces” WATCH THIS WEBINAR>>



Switzerland – Swissport International

 https://securityaffairs.co/wordpress/127655/cyber-crime/swissport-international-ransomware-attack.html

Exploit: Ransomware

Swissport International: Aviation Services

cybersecurity news represented by agauge showing severe risk

Risk to Business: 2.171= Severe

Aviation services company Swissport International was struck with a ransomware attack that had a major impact on its operations, leading to flight delays for 22 flights out of Zurich Airport. The aviation company provides cargo handling, security, maintenance, cleaning and lounge hospitality at airports in 50 countries. The company’s website was back up and running quickly, and the incident is under investigation. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business Ransomware attacks against transportation and transportation infrastructure targets have been increasing as cybercriminals look for quick paydays.

ID Agent to the Rescue Help your clients stay safe from the most common delivery system for ransomware, a phishing message, with our Can You Spot the Phishing Email? infographic! DOWNLOAD IT>>  


Portugal – Vodafone

https://therecord.media/cyberattack-brings-down-vodafone-portugal-mobile-voice-and-tv-services/ 

Exploit: Hacking

Vodafone: Communications Carrier 

cybersecurity news gauge indicating extreme risk

Risk to Business: 2.919 = Moderate

Wireless carrier Vodafone Portugal said that a substantial amount of its customer data services went offline for one overnight period following a cyberattack. The company’s 4G and 5G mobile networks, along with fixed voice, television, SMS and voice/digital answering services went down. The company says that customer data doesn’t appear to have been accessed or compromised. Some services still remain offline a week after the attack. 

Individual Impact: No information about consumer/employee PII, PHI or financial data exposure was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business Attacks against communications companies have been a major component of the recent wave of infrastructure and related hacking.

ID Agent to the Rescue Find and slay dastardly vulnerabilities in your clients’ security strategy and emerge victorious with the Cybersecurity Monster Hunter’s Checklist! GET IT>> 


Croatia – A1 Hrvatska

https://www.bleepingcomputer.com/news/security/croatian-phone-carrier-data-breach-impacts-200-000-clients/

Exploit: Unauthorized Access

A1 Hrvatska: Communications Carrier

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.904 = Severe

Croatian telecom A1 Hrvatska has disclosed a data security incident that led to the exposure of personal data for an estimated 200,000 customers. The company says that the exposure was due to unauthorized access to one of their user databases that contained sensitive personal information. The company was quick to specify that no consumer financial data was exposed. The incident has not affected A1 Hrvatska’s services or operations. 

cybersecurity news represented by a gauge indicating moderate risk

Individual Risk: 2.711 = Moderate

The customer information exposed includes users’ full names, personal identification numbers, physical addresses and telephone numbers. 

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business Utilities/Infrastructure are at the top of the cybercriminal hit list these days, and companies in those sectors should take note.

ID Agent to the Rescue Immerse yourself in a crash sourcse on cybersecurity to gain the insight you need intosecuring your clients against today’s biggest risks with our Deep Dive Into Cybersecurity resource bundle. DOWNLOAD IT>>


Slovenia – Pop TV

https://therecord.media/cyber-attack-disrupts-slovenias-top-tv-station/

Exploit: Ransomware

Pop TV: Television Network

cybersecurity news represented by agauge showing severe risk

Risk to Business: 1.2011 = Severe

Ransomware practitioners stole the show at Pop TV, Slovenia’s most popular TV channel. As a result news programs including the station’s news broadcast 24UR were unable to show any computer graphics. Particularly irksome for customers was the fact that the attack prevented new content from being added to the platform, impacting streaming any of its channels and live sporting events, such as the Winter Olympics. Slovenia’s Computer Emergency Response Team, SI-CERT is investigating.

No information about consumer/employee PII, PHI or financial data exposure was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business Cybercriminals looking for fast money are likely to target businesses that are in time-sensitive industries.

ID Agent to the Rescue Ransomware 101, our most popular eBook, is full of tips and expert advice to guide you through securing your clients effectively from today’s scariest risk. READ IT>>


dark web economy represented by the words dark web in white on a black background blurred like a faint tv transmission

Are you ready to take back control of cyberattack risk from the villains on the dark web? This webinar shows you where to start. WATCH NOW>>



New South Wales Department of Customer Service 

https://www.smh.com.au/politics/federal/sensitive-business-addresses-among-500-000-published-in-covid-data-breach-20220214-p59wal.html

Exploit: Misconfiguration

New South Wales Department of Customer Service: Regional Government Agency

cybersecurity news gauge indicating extreme risk

Risk to Business: 1.211 = Extreme

A real data exposure mess has brewed in New South Wales, Australia thanks to a government-run QR code-based COVID-19 check-in program. The COVID Safe Businesses and Organizations dataset was discovered loose on the internet and it included data for sensitive sites and organizations alongside data about run-of-the-mill companies. Some of the sensitive data posted gave details about the physical facilities and locations of prisons, critical infrastructure networks including power stations and tunnel entry sites as well as dozens of shelters and crisis accommodation centers. Even national security-related locations were exposed. In this program, businesses and organizations registered as COVID-safe to access a QR code for staff and customers to check-in at their physical locations. The program has been discontinued.  

No information about consumer/employee PII, PHI or financial data exposure was available at press time.

Customers Impacted: Unknown

How it Could Affect Your Customers’ Business Information is gold on the dark web. The locations of sensitive infrastructure targets will be circulating quickly and could easily fall into the wrong hands.

ID Agent to the Rescue Employee blunders can cost your client’s company a fortune, especially compliance-related failures. Learn how to nip employee mistakes in the bud in The Guide to Reducing Insider Risk. GET IT>>


Our partners typically realize ROI in 30 days or less. See why nearly 4,000 MSPs in 30 countries choose to grow with ID AGENT solutions and support. BECOME A PARTNER>>



1 – 1.5 = Extreme Risk

1.51 – 2.49 = Severe Risk

2.5 – 3 = Moderate Risk

Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.



Go Inside the Ink to see how today’s biggest threats can impact your MSP and your customers in our blog.



Don’t let roadblocks trap you in the slow lane. Learn to overcome obstacles and put your MSP on the road to prosperity fast. SEE HOW>>



Pump Up Your Sales Fast

This trio of resources will help you expand your security business and your wallet!

Kaseya Speed Dating: Simple, Quick, Effective Dark Web Monitoring – See how you’ll benefit from being able to uncover every single compromised employee credential in minutes. WATCH NOW>>

How to Sell More Security Solutions to Your Clients – Learn how to start profitable security conversations that end in signed deals! WATCH NOW>>

6 Power-Ups That Will Make You a Sales Superhero – Find the tools you need to crush your sales goals and send your MRR soaring fast. DOWNLOAD IT>>

Did you miss this? Learn to help your clients prevent insider incidents with The Guide to Reducing Insider RiskDOWNLOAD IT>>


See how cyber insurance is changing and how to protect your clients from trouble. WATCH NOW>>



3 Approaches to Help You Overcome Objections to Security Awareness Training


Outside-the-Box Hooks Can Land Deals


You know that security awareness training is one of the smartest security investments that a business of any size can make. But in an uncertain economy, getting your cost-conscious customers to buy in to that conclusion is often challenging even with surging cybercrime numbers. Security awareness training can sound nebulous and unnecessary to executives without cybersecurity savvy, landing training programs on the chopping block when it comes time to trim the security budget. But when the big-picture cybercrime prevention benefits of security awareness training just aren’t doing the trick, there are a few alternative ways to try to get your message across to budget controllers who are looking for black-and-white, dollars- and cents hard data to prove that security awareness training works.  


Show your clients how to spot and stop malicious insiders with this infographic that’s perfect for social media! GET IT>>


Untrained Employees Are Vulnerabilities  


Employees that don’t have security awareness training are cybersecurity disasters waiting to happen. By far the most compelling data point comes from the HIPAA Journal. Their researchers discovered that average non-IT employees don’t even think about security because they don’t think that maintaining security is their problem. An astonishing 45% of respondents in a HIPAA Journal survey said that they don’t need to worry about cybersecurity safeguards or procedures because they don’t work in the IT department.  

Untrained employees are also extremely likely to be taken in by phishing-related social engineering, and that’s a very bad thing for their employers considering the fact that phishing is the cyberattack that employees encounter the most. Almost 30% of untrained users in a social engineering study fell for phishing lures that enticed them to click on malicious links, download suspicious files and email attachments. In fact, employees are almost comically bad at spotting phishing. 97% of employees in a cybersecurity survey were unable to detect a sophisticated phishing email without training. 

If the client thinks that everyone already knows about cyberattacks and a training program is just a waste of time, let them know that they’d better think again. By and large, people are overwhelmingly ignorant of even the biggest security threats. That gives way to a whole lot of employees are extremely uniformed about cybersecurity. A paltry 16% of employees can recognize any cyber threats without security awareness training. When looking at specific threats, the picture is even more dismal. Only about 30% of average internet users even know what ransomware or malware is.  


faint images of US dollars in a pile shaded in rainbow prismatics

Find out exactly how security awareness training makes your client’s business safer & saves them money. WATCH NOW>>


Compliance Failures Cost a Fortune 


Emphasize the importance of compliance and the dire consequences of screwing up. Compliance is an area in which employee negligence around cybersecurity can cost a pretty penny, and penalties add up fast. Organizations lose an average of $4 million in revenue due to a single non-compliance event. Every incident is an upfront budget buster too. The average cost of a violation for organizations experiencing non-compliance problems is $9.4 million. Each statute has its own requirements and penalties, but the bottom line really is that non-compliance is punishingly expensive. 

Companies are regularly failing at security compliance and that can mostly be chalked up to employee negligence. More than 60% of companies have had employees cause a compliance-related security failure. This is not a problem that is going to get better on its own, nor will the penalties for non-compliance grow any cheaper over time. When considered against the price of a compliance failure, it’s easy to see that training to avoid compliance failures is a bargain. The average cost of maintaining compliance for an organization including safeguards like employee security awareness training is $3.5 million – about one-third of the average penalty for noncompliance. 


Learn the secret to conjuring up amazing stress-free marketing campaigns in 5 Ways to Make Marketing Magic! GET IT>>


It’s Got an Impressive ROI 


Business leaders know that it pays to invest in people. That’s why it’s compelling to point out the fact that and companies that invest in security awareness training for their people are maximizing their security spending. When considered overall in comparison to other security investments, security awareness training programs have a 3-fold return on investment or more. Want something even more black-and-white?  In a more granular breakdown, businesses with less than 1000 employees enjoy an ROI of 68% and big businesses (companies with more than 1,000 employees) enjoy an eye-popping 562% ROI. 


Security Awareness Training Works 


The bottom line is that in every circumstance, security awareness training is a smart investment that does exactly what it’s supposed to: it reduces a company’s chance of having a security incident by up to 70%.  Employees that receive security awareness training on a regular schedule, (ideally 11 times per year or every 6 weeks or so), are more likely to spot security threats, notice potential insider threats, and comply with their company’s security policies.  

Unfortunately, far too many companies just don’t take security awareness training seriously to their detriment. That failure to engage in the right amount of security awareness training is a serious vulnerability as they try to build strong defenses to keep their data and systems safe in today’s volatile threat atmosphere –  60% of companies do not do enough security awareness training to enjoy any of the benefits it provides.  

Security awareness training is the low-cost, highly effective cure for employee cybersecurity woes – and BullPhish ID makes security awareness training a snap for trainers and employees. 

  • Gain access to a large library of training videos and modules is included to educate employees how to avoid cyberattacks like ransomware 
  • Simplify compliance training with video lessons that make complex requirements easy for everyone to understand 
  • Train your way – plug and play phishing simulation kits or customizable content that can be tailored to fit your industry’s unique threats 
  • Be confident that you’re educating employees about the latest threats or compliance requirements – at least 4 new training videos are added every month 
  • Training content is available in 8 languages: English, Dutch, French, German, Italian, Portuguese, Spanish (Iberian/European) and Spanish (Latin) 
  • In-lesson quizzes and simple, easy-to-read reports show the value of training and indicate who needs more help. 
  • Streamline the training process with personalized user portals for every employee that offer the option to deliver training automatically 
  • Automation makes administration a snap by automatically generating and sending reports to stakeholders 

Don’t just take our word for it, see what these MSPs have to say: https://www.idagent.com/case-studies/


It’s a bird, it’s a plane, it’s your revenue rising into the stratosphere with 6 Power-Ups That Will Make You a Sales Superhero. GET IT>>



Feb 17 – Preparing Employees for the Inevitable Attack with Security Awareness Training REGISTER NOW>>

Feb 23 – GlueTalks: How to Tackle Today’s Sophisticated Cyberthreats REGISTER NOW>>

Mar 1 – Empower Your Employees to Be the Front Line of Cybersecurity Defense REGISTER NOW>>

Mar 21 – 22 – Midsize Enterprise Summit REGISTER NOW>>

Mar 30 – 31 Cybersecurity Expo REGISTER NOW>> 

Jun 20-23 – Connect IT Global in Las Vegas REGISTER NOW>>  



This Tool Helps Prevent Expensive Compliance Failures  


Compliance failures are an expensive nightmare, and the requirements for maintaining compliance can be tricky. Add to that a steady escalation in non-compliance penalties and you’ve got a recipe for business disaster. 

But you can take action to ensure that your company is doing everything possible to maintain compliance with cybersecurity-related regulations through security awareness training. Security-related risks are reduced by 70% when businesses invest in cybersecurity awareness training.  

It’s easy to get started and trainibg brings many benefits to your companyEmbark on an employee security awareness training program using a solution that teaches employees how to maintain compliance like BullPhish ID before a compliance failure comes knocking at your door.  


Do you have comments? Requests? News tips? Compliments? Complaints (or compliments)? We love to hear from our readers! Send a message to the editor.

ID Agent Partners: Feel free to reuse this post (in part or in its entirety) When you get a chance, email [email protected] to let us know how our content works for you!


let us help secure you against passwords reuse with contact information and the ID Agent logo on grey.

Our Partners typically realize ROI in 30 days or less. Contact us today to learn why 3,850 MSPs in 30+ countries choose to Partner with ID Agent!

LEARN MORE>>


Is your password compromised? Find out in seconds!

USE OUR PASSWORD COMPROMISE CHECKER>>


Book your demo of Dark Web ID, BullPhish ID and Passly now!

SCHEDULE IT NOW>>