The Week in Breach News: 10/13/21 – 10/19/21
Ransomware rocks Ecuador’s largest bank, a malicious insider strikes at a US healthcare organization, everyone in Argentina had their identity stolen and a look at a diabolical ransomware attack that’s in fashion right now.
Learn how to defeat terrifying cybersecurity monsters to keep systems & data safe in a dark world! READ IT IF YOU DARE!>>
Olympus Corporation of the Americas
Exploit: Ransomware
Olympus Corporation of the Americas: Medical Technology Manufacturer
Risk to Business: 2.122 = Severe
Olympus was forced to take down IT systems in the U.S., Canada, and Latin America following a cyberattack that hit its network Sunday. The medical equipment manufacturer says that it does not believe that any data was stolen. Olympus also said that the incident was contained to the Americas with no known impact to other regions. Just last month, Olympus suffered another ransomware attack on its EMEA region systems.
Individual Impact: No consumer PII or financial data loss was disclosed in this breach as of press time.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business: Many ransomware gangs aren’t bothering to steal data anymore, opting to lock down networks and production lines to force a speedy ransom payment.
ID Agent to the Rescue: 50% of ransomware attacks in 2020 were against SMBs. Learn more about how ransomware is evolving and how to protect your clients in Ransomware Exposed. GET THIS EBOOK>>
Premier Patient Healthcare
https://www.govinfosecurity.com/former-executive-accessed-phi-nearly-38000-individuals-a-17724
Exploit: Malicious Insider
Premier Patient Healthcare: Medical Clinic Chain
Risk to Business: 1.712=Severe
Texas-based accountable care organization Premier Patient Healthcare filed a statement this week detailing a malicious insider incident that caused the exposure of PII for over 37,000 patients from around the country. According to the report, a terminated executive had retained credentials that enabled them to access and obtain an unspecified amount of PHI. No further details were included and a HIPAA filing has not yet appeared. When the breach first came to light, the company’s early statements pointed to a fault at a vendor, which turned out to not be the case.
Individual Risk: 1.712=Severe
The patient records that were accessed included name, age, sex, race, county and state of residence, and zip code, as well as Medicare beneficiary information, such as Medicare eligibility period, spend information, and hierarchical condition category risk score for an unspecified number of patients.
Customers Impacted: 8.5 million
How It Could Affect Your Customers’ Business This incident isn’t just a double helping of embarrassment for Premier Patient Healthcare, it’s also going to be a financial nightmare after regulators get finished with them.
ID Agent to the Rescue: Building cyber resilience helps insulate organizations from trouble like this. Learn more about why cyber resilience is the ticket to a safer future for your clients. GET THIS EBOOK>>
Ecuador- Banco Pichincha
Exploit: Ransomware
Banco Pichincha: Banking & Financial Services
Risk to Business: 1.412=Extreme
Ecuador’s largest private bank Banco Pichincha has suffered a suspected ransomware attack that has resulted in some systems being knocked offline for days. Many services of the bank were disrupted, including online banking, its mobile app and ATM network. The bank is working with national authorities at the Superintendency of Banks to investigate the incident. In an internal notification sent to the Bank’s agencies and seen by BleepingComputer, employees are notified that bank applications, email, digital channels, and self-services will not be operational for an unspecified amount of time due to a technology issue, limiting many bank services to in-person transactions. Some ATM services have been restored. The incident is ongoing.
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.
Customers Impacted: Unknown
How It Could Affect Your Customers’ Business Attacks on the banking and fintech sectors have been growing, creating complications for every financial services organization.
ID Agent to the Rescue: See how to transform every employee into a security asset to become the real secret weapon that successful organizations deploy to fight cybercrime like phishing! WATCH NOW>>
Argentina – Registro Nacional de las Personas (RENAPER)/National Registry of Persons
https://therecord.media/hacker-steals-government-id-database-for-argentinas-entire-population/
Exploit: Hacking
Registro Nacional de las Personas (RENAPER): National Identity Database
Risk to Business: 1.232=Extreme
Hackers have broken into the Argentina Interior Ministry’s IT network and stolen a massive amount of data from Registro Nacional de las Personas (RENAPER)/National Registry of Persons. That extremely sensitive database contains ID card details for the country’s entire population. The leak was announced when a Twitter user posted ID card photos and personal details for 44 Argentinian celebrities including the country’s president Alberto Fernández and soccer superstars Lionel Messi and Sergio Aguero. While the Argentine government admits to the hack, they maintain that no data was stolen. However, cybersecurity experts and journalists were able to contact the threat actors through a dark web posting and confirm the authenticity of the database. The hackers appear to have gained access through a compromised VPN.
Risk to Business: 1.222= Extreme
According to a sample provided by the hacker online, the information they have access to right now includes full names, home addresses, birth dates, gender info, ID card issuance and expiration dates, labor identification codes, Trámite numbers, citizen numbers, and government photo IDs.
Customers Impacted: The population of Argentina is 45 million
How it Could Affect Your Customers’ Business A strong security culture helps reduce the likelihood of an incident caused by employee carelessness as this one reportedly was.
ID Agent to the Rescue: Gamify cybersecurity and information safety to make it interesting. Our Security Awareness Champion’s Guide helps explain complex risks in a fun way! DOWNLOAD IT>>
Brazil – Hariexpress
https://www.infosecurity-magazine.com/news/ecommerce-player-leaks-billion/
Exploit: Misconfiguration
Hariexpress: e-Commerce Firm
Risk to Business: 1.616 = Severe
Brazilian e-commerce firm Hariexpress is in hot water after it exposed an estimated to 1.8 billion client and seller records. The problem appears to have originated with a misconfigured Elasticsearch server, according to researchers. The server was left unencrypted with no password protection in place, exposing 610GB of data and that data may have been exposed for several months.
Individual Risk: 1.616 = Severe
Exposed customer data included full names, home and delivery addresses, phone numbers and billing details. Also exposed were sellers’ full names, email and business/home addresses, phone numbers and business/tax IDs (CNPJ/CPF).
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Human error will always be a company’s biggest cyberattack risk. It pays to make sure that everyone feels like they’re responsible for security to avoid messes like this.
ID Agent to the Rescue Solving complex security problems in a mobile access world can be fraught with peril. Find answers to 5 common remote and hybrid security problems in this handy infographic. DOWNLOAD IT>>
Over 80% of organizations felt the sting of cybercrime in 2020. See what cybercriminals are shopping for to better predict what will happen next in The Global Year in Breach 2021. READ IT>>
Are you ready to slay the Monsters of Cybersecurity? This checklist tells you what you’ll need to succeed! GET CHECKLIST>>
Spain – Meliá Hotels International
https://therecord.media/cyberattack-hits-melia-one-of-the-largest-hotel-chains-in-the-world/
Exploit: Ransomware
Meliá Hotels International: Hotel Chain
Risk to Business: 1.615 = Severe
Meliá Hotels International, one of the largest hotel chains in the world, had fallen victim to a suspected ransomware attack. Attackers took down parts of the hotel chain’s internal network and some web-based servers, including its reservation system and public websites. An investigation is underway. No ransomware gang has yet claimed responsibility.
Individual Impact: No consumer PII or financial data exposure was disclosed in this incident as of press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Ransomware is always expensive. Even without the extortion demand, it can cause massive losses simply from business interruption.
ID Agent to the Rescue Horrors like ransomware lurk around every corner, lying in wait for unwary organizations. Learn how to defeat them in our new eBook Monsters of Cybersecurity. DOWNLOAD IT NOW>>
Our partners typically realize ROI in 30 days or less. See why nearly 4,000 MSPs in 30 countries choose to grow with ID AGENT solutions and support. BECOME A PARTNER>>
Taiwan – Acer
Exploit: Hacking
Acer: Computer Manufacturer
Risk to Business: 1.631 = Severe
Acer has just been beleaguered by cyberattacks in 2021. In its second time at the dance this year, Acer’s India after-sales service has suffered a data breach. A threat actor has already claimed the attack on a popular hacker forum, saying that they stole more than 60GB of files and databases from Acer’s servers. The stolen data includes client, corporate, and financial data and login details belonging to Acer retailers and distributors from India. The threat actor posted a video showcasing the stolen files and databases to a dark web forum showcasing the records of 10,000 customers, and stolen credentials for 3,000 Indian Acer distributors and retailers.
Individual Impact: No information about the nature of the exposed customer data was available at press time.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business Companies that store large amounts of data are hacker catnip. The data that they can steal will not only reap a big profit, it also opens other cybercrime doors.
ID Agent to the Rescue See why data like this has become so valuable and see how it impacts the cybercrime landscape in our annual cybercrime report The Global Year in Breach 2021. DOWNLOAD IT NOW>>
Solve five of the most exhausting remote and hybrid security problems fast with this handy infographic! DOWNLOAD IT>>
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.
Learn to defend castles from cybercriminal invaders in our How to Build Your Cybersecurity Fortress webinar! WATCH NOW>>
Go Inside the Ink to Get the Inside Scoop on Cybercrime
Are you up to date on the latest news that can impact your business and your customers? Here’s a recap:
- Phight the Phish: 1 in 4 Companies is at Risk of a Phishing-Related Data Breach
- 10 SMB Cybersecurity Facts that MSPs Need to Know About Attitudes & Purchasing
- The Cost of Cybercrime in Dollars and Cents is Shocking
- 3 Ways to Improve Security for Less This Cybersecurity Awareness Month
- The Week in Breach News: 10/06/21 – 10/12/21
Kaseya Patch Tuesday: NEW! Patch notes & bug fixes for October 2021 are up: SEE PATCH INFO>>
Knock Out Your Sales Goals with This 1–2 Punch
Ready to score a great Q4? These two webinars will help you clobber the competition.
ID Agent Quarterly Product Update 4
Find out what we’ve got in store this quarter and how you can boost your MRR! WATCH NOW>>
Battle of the Killer QBR Strategies
Don’t let QBRs intimidate you. Learn to harness their power to score more wins! WATCH NOW>>
Are You Afraid of the Dark (Web)?
Cybercrime horrors lurk around every corner. Using an unholy combination of dark web data, phishing and malware, bad actors have cooked up a brew that’s sure to devastate every business unless they’re ready for trouble. Arm yourself with this pair of resources to help your clients ward off danger!
Monsters of Cybersecurity – Everything you need to know about today’s nastiest threats is packed into one essential guide that helps you keep your clients’ systems and data safe from harm. DOWNLOAD IT>>
The Cybersecurity Monster Hunter’s Checklist – Use this checklist to make sure your clients have all the right equipment to face today’s nastiest cybercrime threats like ransomware, BEC and more! DOWNLOAD IT>>
Did You Miss…? Hear about Cloud Tech 24’s experience as an ID Agent partner. WATCH NOW>>
Protection from cybercrime danger is easy when you deploy your secret weapon: security-savvy employees! WATCH WEBINAR>>
New Ransomware Variant Packs an Extra Punch
Bad Actors Threaten Even Bigger Damage
The good guys may be innovating (check out our Q4 Product Update Webinar) but the bad guys are too. One of today’s fastest evolving cyberthreats is ransomware, with new varieties coming at businesses and IT professionals faster and more furiously than ever before. Ransomware has been consistently on the rise in 2021, with global attack volume increasing by 151% for the first six months of the year compared with the same period in 2020. As though ransomware wasn’t already a body blow to any business, a fresh twist on that old favorite is adding a touch of extra devastation to anyone it hits.
Ransomware continues to be the story for media coverage about ransomware, and that makes sure it stays at the forefront of your clients’ minds. That’s a good thing; 54% of SMBs in a recent survey claimed that they were too small to be at risk of a cyberattack. Unfortunately, that is a dangerous misconception that puts businesses at risk for trouble.
Ransomware Fast Facts
- 50% of ransomware victims in 2020 were SMBs
- 55% of ransomware attacks now involve companies with fewer than 100 employees
- Ransom demands are up by more than 40% in 2021 in a year-over-year comparison to 2020
Are you ready to take back control of cyberattack risk from the villains on the dark web? This webinar shows you where to start. WATCH NOW>>
A Nasty Rising Threat
A recent report on a nasty up-and-coming variety of ransomware sheds light on exactly how devious – and devastating – one of today’s souped-up ransomware threats can be. Dubbed Yanluowang, researchers report that the cybercriminals behind this type of ransomware have raised the stakes. A Yanluowang attack follows many of the familiar patterns of a traditional ransomware threat, starting with the usual penetration of a company’s IT systems typically through phishing. An estimated 94 % of ransomware arrives at businesses via email.
That grand entrance is followed by a quick-spreading infection that encrypts data and wreaks havoc in the victim’s IT environment. This attack follows the popular double extortion model, demanding that victims pay multiple ransoms to obtain a decryptor for their frozen data and equipment. Similar attacks prefer the triple extortion style, demanding three separate sums from victims. The average ransomware payment climbed 82% over the same period in 2020 to a record $570,000 in the first half of 2021. But that’s where the normalcy in Yanluowang stops because the operators’ further demands take the attack to the next level.
The cybercriminals behind Yanluowang drop an increasingly popular threat on their victims that’s familiar to anyone who’s familiar with classic crime-show kidnapping: don’t call the cops. These ransomware operators promise in their ransom note that the victim calls in outside help or contacts law enforcement officials, the gang will launch DDoS attacks against the victim to snarl their company websites in so much traffic that they’re rendered inoperable. Adding insult to injury, the extortionists also threaten to call customers and business partners and divulge company secrets. They also insinuate that uncooperative victims will face further damage. The bad actors threaten to attack again or return with additional attacks or delete the encrypted data.
Use this checklist to be sure that you’ve found and mitigated every cyberattack risk that your client faces! DOWNLOAD IT>>
Even Cybercriminals Follow Influencers
Sometimes called Ransom DDoS (RDDoS) or Cascading Extortion attacks, this tactic isn’t limited to just one kind of malware or the playbook of one ransomware gang. It’s also not new but it has grown much more prominent in the last few months. Purportedly innovated by legendary ransomware outfit Evil Corp (REvil), the gang provided a free service to its menu that enabled RaaS buyers to pay the group or affiliated partners to take further action against recalcitrant victims, including voice-scrambled VOIP calls to the media or the victim’s business partners and clients with information about the attack to ramp up the pressure by further damaging the victim’s business.
Evil Corp may have brought Ransom DDoS (RDDoS) attacks to prominence in the cybercrime underworld, but other ransomware organizations were quick to hop on that lucrative bandwagon. Well-known ransomware operators such as SunCrypt and Ragnor Locker were also early adopters of the cascading extortion technique, according to a report in Bleeping Computer. Experts also contend that other ransomware gangs are offering the RDDoS option on their menu. Signs point to the Avaddon ransomware group and notorious cybercrime gang DarkSide, who rose to prominence with their Colonial Pipeline attack, as regular users of this type of ransomware threat.
Zero Trust security is the key to keeping your clients safe – and the cornerstone is access management. We can help. LEARN MORE>>
Rapidly Evolving Threats Are Around Every Corner
Ransomware techniques are continually evolving, seemingly popping up like mushrooms after a rainstorm. Bad actors know that they have to keep adding new tactics and changing things around because cybersecurity solutions are evolving just as quickly. That’s why adding an extra component like a DDoS attack is a smart move for threat actors and ransomware developers. DDoS attacks are cheap and easy, creating a very low barrier to entry with very low risk. However, they can be extremely lucrative, making them a perfect add-on to a multi-extortion attack or a menu of cybercrime services,
Businesses just cannot afford the kind of downtime that sustained DDoS attacks promise. In an analysis of almost 200 successful ransomware attacks against US businesses in 2020, researchers discovered that ransomware is as crippling as you think it is. The surveyed companies lost an estimated $21 billion due to attack-induced downtime after a successful ransomware incident. That’s just under 250% more than the same cost in 2019. No matter how big or small the company that is hit may be, they’re going to lose serious money on a ransomware attack, without even considering the ransom demand.
Ransomware is Expensive Beyond the Ransom
- Companies impacted by ransomware lost an average of six working days.
- An estimated 37% of companies experienced downtime that lasted one week or more.
- One incident investigation costs an SMB an estimated $15k
Learn the Secret of How Cybercriminals Trick Users Into Falling for Phishing Messages! GET EBOOK>>
Help Clients Resist Ransomware
MSPs and SMBs agree: ID Agent can help make sure that businesses of every size are ransomware ready. Take action now to build a strong defense against ransomware with the powerful combination of our award-winning solutions: BullPhish ID and Passly.
Passly combines the functionality of multiple solutions into one affordable package, including:
- Multifactor authentication (MFA) is a must-have for zero-trust security that stops 99% of password-based cybercrime,
- Single-sign on adds another layer of protection by minimizing the number of credentials each employee has.
- Simple remote management makes it easy for IT teams to respond quickly in an emergency
- Automated password resets eliminate tickets, saving time, money and stress.
BullPhish ID is the streamlined, user-friendly solution to every training challenge, including:
- Choose from lessons on phishing, ransomware, compliance, data handling, password security and more in 7 languages.
- A frequently updated library of plug-and-play phishing simulation kits that can be scheduled to run automatically.
- Lots of options for customization and white labeling for everything from training content to access portals.
- Simple, clear reporting that enables everyone to clearly see employee progress and measure the value of training.
Make sure that your clients have powerful protection from threats like ransomware with the ID Agent digital risk protection platform including award-winning solutions Dark Web ID, BullPhish ID and Passly.
90% of MSPs have had clients hit with a ransomware attack in the last 12 months. Help your clients build stronger defenses with the insight in Ransomware Exposed! DOWNLOAD NOW>>
Oct 21: Phish & Chips EMEA Special REGISTER NOW>>
Oct 21-22 Robin Robins Roadshow: Newark REGISTER NOW>>
Oct 27: Top 5 Ways to #BeCyberSmart (APAC) REGISTER NOW>>
Oct 27: Modern Cyber Risk Management REGISTER NOW>>
Oct 27-28: ASCII Success Summit: Orlando REGISTER NOW>>
Oct 28: Kaseya Trick or Treat REGISTER NOW>>
Oct 28-29: Robin Robins Road Show: Chicago REGISTER NOW>>
Nov 02-03:Robin Robins Road Show: Las Vegas REGISTER NOW>>
Nov 02-03: ASCII Success Summit: Washington DC REGISTER NOW>>
Nov 4: Cyber Risks and Threats in 2021 REGISTER NOW>>
Nov 06 – 10: 20th Annual TAG Convention REGISTER NOW>>
Dec 07: Connect IT Local: Atlanta REGISTER NOW>>
Dec 08-09: ASCII Success Summit: Anaheim REGISTER NOW>>
Dec 09: Connect IT M&A Symposium: Miami REGISTER NOW>>
Help your clients stay off of cybercriminal hooks with the expert tips and strategies that we share to combat phishing in our webinar The Phish Files. LISTEN NOW>>
Are You Ready to Face Fresh Ransomware Threats?
Ransomware incidents are regular newsmakers. But it’s not just the big dogs who are facing increased cyberattack danger from ransomware threats. Did you know that 50% of ransomware attacks last year were actually aimed at small and medium businesses?
We’ve all read and heard about the enormous sums that cybercriminals are asking for as ransoms in their various extortion schemes. But ransomware attacks are incredibly expensive without even considering the ransom. Companies impacted by ransomware lose an average of six working days, and an estimated 37% of companies experienced downtime that lasted one week or more.
No business can afford to shutter for a week. But many small and medium businesses are facing tough budget decisions this year, putting the squeeze on every department, including IT, and that can make it hard to shake out the cash to invest in new solutions. You need to find the right solutions, the kind that offers you strong protection against ransomware and a great value.
That’s not as hard as you may think. Protecting your business from ransomware threats starts with protecting your business from phishing attacks. Security awareness training that includes phishing resistance using a solution like BullPhish ID will help your business build cyber resilience, enabling it to resist more cyberattacks and keep on moving in adverse conditions.
ID Agent Partners: Feel free to re-use this blog post (in part or in its entirety) for your own social media and marketing efforts. Please send an email to [email protected] to let us know – we love to hear about how our content works for you!
Our Partners typically realize ROI in 30 days or less. Contact us today to learn why 3,850 MSPs in 30+ countries choose to Partner with ID Agent!
Check out an on-demand video demo of BullPhish ID or Dark Web ID WATCH NOW>>
See Graphus in action in an on-demand video demo WATCH NOW>>
Book your demo of Dark Web ID, BullPhish ID, RocketCyber or Graphus now!
We’d love to hear your story of security success with ID Agent. Contact our marketing/pr team to set up a meeting with our staff to tell the world about your experiences in our next case study! To learn more about how the ID Agent Digital Risk Protection Platform can secure your prosperity, book a personalized demo today.