.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The target: Revere Health, a Utah based multispecialty physician group.
The take: Personally Identifiable Information of 12,000 patients including: medical record numbers, dates of birth, provider names, and procedures and insurance names.
The attack vector: An employee of Revere Health fell victim to a phishing attack, allowing the attacker control of their email account.
Phishing attacks against individual employees remain one of the greatest security threats to an entire organization. Regular social engineering and awareness testing and training, along with tone-from-the-top messaging to emphasize the importance of critical thinking and caution are crucial to protecting sensitive information assets.
Axios: After assembling a team of tough-minded regulators to take on big technology companies, the Biden administration on Wednesday called on many of those same companies to work with the federal government to address a growing wave of cyberattacks.
Forbes: Cybersecurity risk, once the focus of technology professionals, is now a boardroom topic. CEOs, CFOs, risk officers and audit committees are seeing cybersecurity risk come into the scope of their roles.
KnowBe4: A new phishing campaign is exploiting the ongoing uncertainty about company policies related to COVID-19, according to Roger Kay at INKY.
NBC News: For Tanja Vidovic, it was a moment of panic: She had received a series of alerts about someone changing access to her cryptocurrency account. And she realized, as she stared at her computer screen, that nearly all of her $168,000 in holdings was gone — vanished before her eyes.
Security Magazine: The findings come from Trend Micro’s biannual Cyber Risk Index (CRI) report, which measures the gap between respondents’ cybersecurity preparedness versus their likelihood of being attacked.
ZDNet: Singapore and the US have inked a series of memorandums of understanding (MOUs) to widen their collaboration in cybersecurity across defence, financial, and research and development.
IT Pro Portal: Phishing may be the most common cybersecurity threat in the UK, but it could be only a matter of time before ransomware snatches the crown, a report from cybersecurity firm CybSafe suggests.
The target: Ford, a U.S based maker of automobiles.
The take: Exposure of Personally Identifiable Information including: customer and employee records, finance account numbers, database names and tables, internal support tickets, user profiles, and authentication access tokens,
The attack vector: A known vulnerability present in one of Ford’s misconfigured customer management interfaces named Pega Infinity, could have allowed an attacker access to the backend web panel. From here, they could execute malicious commands through the URL to retrieve data base tables, run queries, and more critically, perform administrative actions.
This breach highlights the importance of having processes in place to update software in a timely manner, an essential part of complying with industry standard cybersecurity practices. Furthermore, this exposure also demonstrates how one exposed point of access can have a cascading and multiplying effect on the severity of a breach.
Institutional Asset Manager: According to IBM, 23 per cent of all cyber-attacks are directed at financial institutions, while the total cost of a single data breach is the second largest among all industries, costing financial organisations USD5.72 million on average.
Beta News: Analysis by CybSafe of incidents reported to the UK's Information Commissioner's Office (ICO) shows that ransomware attacks made up 22 percent of all reported cyber security incidents in the first half of 2021. This is up from 11 percent in the first half of 2020.
CNBC: Japanese cryptocurrency exchange Liquid said Thursday it has been hit by a cyberattack that saw hackers make off with a reported $97 million worth of digital coins.
SEC: The Securities and Exchange Commission today announced that Pearson plc, a London-based public company that provides educational publishing and other services to schools and universities, agreed to pay $1 million to settle charges that it misled investors about a 2018 cyber intrusion involving the theft of millions of student records, including dates of births and email addresses, and had inadequate disclosure controls and procedures.
World Bank: Digital transformation is accelerating in many countries, offering new opportunities for economic growth and enabling low- and medium-income countries to leapfrog development through increased productivity and improved service delivery across key sectors, including finance, health, education, and agriculture.
PYMNTS: T-Mobile is investigating claims that sensitive information from 100 million users is being sold on the dark web, Motherboard reported, citing contact with the seller and having seen data samples.
IT Pro: The Financial Industry Regulatory Authority (FINRA) has warned of a new phishing campaign that involves fraudulent emails using domain names pretending to be the financial regulator.
The target: Reindeer, a U.S-based online marketing company.
The take: The exposure of 50,000 records of Personally Identifiable Information including: names, addresses, date of birth, email addresses, Facebook ID’s, and phone numbers.
The attack vector: Reindeer failed to secure this AmazonS3 bucket with any credential management whatsoever, allowing anyone with an internet connection to access the data.
While Reindeer is no longer in operation, the data they held belonged to firms that are currently operating, and this breach highlights not only the necessity of robust credential controls, but also the risks of using third party vendors. Up to date monitoring on where and what systems a firm’s data resides on is essential for maintaining the expected industry standard of cybersecurity.
Bleeping Computer: The Security Service of Ukraine (SBU) took down a network of cryptocurrency exchanges used to anonymize transactions since the beginning of 2021. Over 1,000 "customers" used the clandestine exchanges to launder funds received from Russian electronic payments processors, including Yandex.Money, Qiwi, and Webmoney.
Hedge Week: The implications have been profound as it has become more critical than ever for management firms to offer staff – everyone from portfolio managers to back office teams – the ability to access essential systems remotely.
Markets Insider: Clearlake Capital Group, L.P. (together with its affiliates, "Clearlake") announced that it has completed its strategic equity investment in RSA Security LLC ("RSA" or the "Company").
CNN Business: Hackers have stolen some $600 million in cryptocurrency from the decentralized finance platform Poly Network, in what it says is the largest theft in the industry’s history.
FT Adviser: Abrdn's head of adviser platforms has said the company's acquisition of AI-driven investment business Exo Investing will benefit advisers.
Tech Crunch: U.S. cybersecurity firm NortonLifeLock has confirmed it is acquiring British rival Avast in order to create a global consumer security powerhouse.
Computer Weekly: The average ransom paid by victim organisations has increased by 82% since 2020 to a record $570,000, as cyber criminals intensify their ransomware efforts with increasingly aggressive tactics, according to data from Palo Alto Networks Unit 42 security consulting group.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
84 Chain Lake Drive, Suite 501
Halifax, NS
Canada, B3S 1A2
+1-902-429-8880
Manila
Ground Floor, Three E-com Center
Mall of Asia Complex
Pasay City, Metro Manila
Philippines 1300
Sydney
Level 36 Governor Phillip Tower
1 Farrer Place Sydney 2000
Australia
+61 (2) 8823 3370
Abu Dhabi
Floor No.15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy