.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The Target: AutoZone is the leading retailer and distributor of automotive spare parts and accessories in the U.S., operating 7,140 shops in the country and also in Brazil, Mexico, and Puerto Rico.
The Take: The data leaked by the cybercriminals is roughly 1.1GB in size, containing employee names, email addresses, parts supply details, tax information, payroll documents, Oracle database files, data about stores, production and sales information, and more. No customer data appears in the leaked files.
The Vector: AutoZone became aware that an unauthorized third party exploited a vulnerability associated with MOVEit and exfiltrated certain data from an AutoZone system that supports the MOVEit application. More specifically, on or about August 15, 2023, AutoZone determined that the exploitation of the vulnerability in the MOVEit application had resulted in the exfiltration of certain data.
This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.
TechCrunch: Fidelity National Financial, or FNF, a Fortune 500 company that provides title insurance and settlement services for the mortgage and real estate industries, announced that it was the victim of a “cybersecurity incident that impacted certain FNF systems.”
CFO: New Securities and Exchange Commission (SEC) rules requiring the disclosure of processes for identifying material cyber risks — and management’s role and expertise in assessing and managing the risks — may require CFOs to hit the books.
Investing.com: European companies, including Airbus SE and Deutsche Telekom AG, have endorsed the European Union Agency for Cybersecurity's (ENISA) proposal for stricter cybersecurity regulations.
Yahoo Finance: Australia will undertake an economy-wide revamp of its cybersecurity protections including revised data laws, mandatory reporting and a new nationwide cyber council in response to several significant hacks targeting businesses and infrastructure over the past year.
Forbes: If you take a look at the headlines surrounding the impact of artificial intelligence (AI) on cybersecurity, there are two dominant themes.
Bleeping Computer: The former chief operating officer of a cybersecurity company has pleaded guilty to hacking two hospitals, part of the Gwinnett Medical Center (GMC), in June 2021 to boost his company's business.
TechCrunch: The Ukrainian government has fired two of its most senior cybersecurity officials following accusations of alleged embezzlement.
The Target: Investment management firm Ellington Management Group L.L.C.
The Take: Ellington determined that the following general categories of information may have been involved in the incident but are not relevant to every individual impacted: name, date of birth, Social Security number, medical information, and driver’s license number. In only three instances, non-Ellington financial account information may have been impacted.
The Vector: Ellington’s investigation determined that between July 18, 2023 and August 8, 2023, an unauthorized actor had access to a single Ellington email account for the demonstrated purpose of sending phishing emails. Ellington analyzed the email account and did not find any evidence of any data being downloaded, emails being forwarded, or the account being synced to other systems.
As phishing actors continue to explore every potential abuse opportunity on legitimate service providers, novel security gaps constantly threaten to expose users to severe risks. It is essential not to rely solely on email protection solutions, and also scrutinize every email that lands on your inbox, look for inconsistencies, and double-check all claims made in those messages.
CSO: With the US Securities and Exchange Commission (SEC) having taken legal action against CISOs at both SolarWinds and Uber, security executives feel the pressure to be absolutely precise when writing up security incidents that the company has decided are material.
Forbes: Most of you have heard a lot in the past month about cybersecurity, hacking attacks and many words that are strange to us, like man in the middle ("MITM") phishing, spoofing, LifeLock, blueprinting, fingerprinting, crypto locker, VPN and so on, in the news and from media ads.
Yahoo Finance: A key reform proposed by the U.S. Securities and Exchange Commission to boost the use of central clearing for U.S. Treasuries could leave the market more exposed to cybersecurity risks, Barclays said, referring to the cyber hack of Industrial and Commercial Bank of China's U.S. broker-dealer.
TechCrunch: Vulcan Cyber, a company developing software to help enterprises detect vulnerabilities in their software stack, announced that it raised $55 million in equity financing led by Maor Investments and Ten Eleven Ventures with participation from Dawn Capital and Wipro Ventures.
Investing.com: OpenText, a global leader in information management, released its annual Cybersecurity Global Ransomware Survey, revealing significant trends in cybersecurity among small and medium-sized businesses (SMBs) and enterprises.
FundsTech: Europe’s main securities regulator has elevated cyber risk and digital resilience to the top of its supervisory authorities for the coming year.
CSO: A cybersecurity self-assessment of 697 Australian organizations revealed 58% have limited or no capability to protect confidential information adequately.
The Target: Hilb Group, a business that handles property, casualty, and employee benefits insurance and advisory services at more than 130 locations across 22 US states.
The Take: People's first and last names and sensitive financial data and credentials. Specifically, Financial Account Number or Credit/Debit Card Number (in combination with security code, access code, password or PIN for the account).
The Vector: Hilb says it discovered "suspicious activity" related to employee email accounts around January 10. After doing some digging, and bringing on a third-party incident response firm, the insurance brokerage determined someone broke into those inboxes between December 1, 2022 and January 12, 2023.
This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.
BNN Bloomberg: OpenAI is grappling with “abnormal traffic” that suggests hackers are trying to swamp its services, revealing for the first time the potential cause of outages that’ve plagued ChatGPT this week.
CSO: As AI technology advances, cyber defenders are spending more on the technology to defend against malicious actors who currently hold an asymmetric advantage in deploying new AI-generated threats.
PR Newswire: Mendoza Ventures, a female and Latinx-founded Fintech, AI, and Cybersecurity Venture Capital firm, announced that Truist Ventures is investing in its Early Growth Fintech Fund as a limited partner. The fund is targeting $100M and will invest in early growth-stage startups with a focus on diverse teams.
Yahoo Finance: Gen Digital beat second-quarter revenue estimates as rising digital threats and hacks drove stable demand for its cybersecurity products, sending the company's shares more than 3% higher before the bell.
Dark Reading: Back in July, the Securities and Exchange Commission (SEC) adopted a rule "requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance."
TechCrunch: Palo Alto Networks has just confirmed one more major piece of security startup M&A out of Israel: It has acquired Talon Cyber Security, a specialist in building enterprise browsers for securing distributed workforces sources.
Yahoo Finance: Electronics makers Siemens, Ericsson and Schneider Electric, along with industry group DigitalEurope warned that onerous proposed EU rules targeting cybersecurity risks of smart devices could disrupt supply chains on a scale similar to during the pandemic.
The Target: The popular optimization app CCleaner
The Take: The hackers took names, contact information and information about the products that were purchased.
The Vector: The hackers exploited a vulnerability in the widely used MOVEit file transfer tool, which is used by thousands of organizations, including CCleaner, to move large sets of sensitive data over the internet.
This breach is a stark reminder of how authentication controls are in an overall robust cybersecurity posture, and more critically, ensuring these controls are in place on all third-party vendors which have access to a firm’s data.
BNN Bloomberg: Saudi Aramco’s venture capital arm has invested in SpiderSilk, a United Arab Emirates-based startup that offers AI-powered cybersecurity services.
Mondaq: The cybersecurity sector is projected to experience 10% CAGR over the next 3 years, fueled by the increasing volume and complexity of cyber threats.
Forbes: The security landscape integrates various models, ideologies and best solutions for team development. Corporations and multiple institutions face challenges when attempting to structure and design functional cybersecurity teams.
CNBC: Information Technology firm SolarWinds, which was targeted by a Russian-backed hacking group in one of the worst cyber-espionage incidents in U.S. history in 2019, committed fraud and failed to maintain adequate internal controls for years prior to the hack, the Securities and Exchange Commission alleged in a lawsuit.
CSO: Artificial intelligence continues to snare the technological limelight and, rightly so as we move well into the final quarter of 2023, there is wide international interest in harnessing the power of AI.
TechCrunch: The U.S. government and dozens of foreign allies have pledged never to pay ransom demands in a bid to discourage financially motivated hackers and ransomware gangs profiteering from cyberattacks.
Bleeping Computer: The U.S. Federal Trade Commission (FTC) has amended the Safeguards Rules, mandating that all non-banking financial institutions report data breach incidents within 30 days.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
84 Chain Lake Drive, Suite 501
Halifax, NS
Canada, B3S 1A2
+1-902-429-8880
Manila
Ground Floor, Three E-com Center
Mall of Asia Complex
Pasay City, Metro Manila
Philippines 1300
Sydney
Level 36 Governor Phillip Tower
1 Farrer Place Sydney 2000
Australia
+61 (2) 8823 3370
Abu Dhabi
Floor No.15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy