.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The Target: Vevor, a California-based online retailer.
The Take: 1.1 billion records across two databases of Personally Identifiable Information including: first and last name, partial credit card numbers, transaction IDs, order and refund information, home addresses, and email addresses. Internal Vevor account admin names and plaintext passwords were also exposed, as well as IP addresse, ports, and pathways.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture and furthermore, that when admin credentials are exposed, dangerous pivot attacks may follow as attackers use these to move into a firm’s other platforms. Multi-factor authentication and password length and complexity rules are effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: ENC Security, Netherlands based data-encryption firm.
The Take: Exposure of security keys for various firm applications and software including: SMTP credentials for sales channels, Ayden, the firm’s single payment platform, email marketing Mailchimp APIs, licensing payment APIs, and public and private keys.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture and furthermore, that such precautions must in place in all third-party vendors that have access to a firm’s data. Multi-factor authentication and password length and complexity rules are effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: DraftKings, a U.S based sports betting website.
The Take: $300,000 USD of customer funds.
The Vector: Via a credential stuffing attack, where user passwords that have been exposed elsewhere were also used as a login for DraftKings, enabled attackers to login and steal the funds.
This breach is a stark reminder of how critical authentication controls are in an overall robust cybersecurity posture. Credential stuffing attacks can be avoided by enforcing multi-factor authentication and reasonably paced password resets. It is important to employ effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
The Target: CorrectCare, a U.S based integreated health service for correctional facilities.
The Take: Exposure of Personally Identifiable Information of 600,000 inmates including: name, date of birth, social security number, and limited health information.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture. Multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: Harcourts’s Melbourne branch, a real estate company.
The Take: Exposure of Personally Identifiable Information including: names, email addresses, home addresses, phone number, copy of signatures, photo identification, and some bank details.
The Vector: An employee’s credentials were compromised at one of Harcourt’s third-party providers, Stafflink. The breach occurred because the employee was using one of their own unsecured devices for work rather than a company issue device. The compromised credentials account allowed the attacker full access to the above personal information.
This breach is a stark reminder of how authentication controls are in an overall robust cybersecurity posture, and more critically, why enforcing security rules and strategies is only effective if employees are using compliant devices where these rules exist. Enforcing multi-factor authentication, reasonably paced password resets, and regular social engineering and phishing awareness training are all effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
The Target: Thomson Reuters, a multi-national media conglomerate.
The Take: Exposure of sensitive company login credentials, including plain-text passwords to some third-party vendors, corporate and legal information, and logs which contain the email addresses of account holders who recently reset their passwords.
The Vector: A misconfigured Elasticsearch server was accessible over the internet to anyone with a connection.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture, especially maintaining correct access configurations. The data exposed here can also lead to pivot attacks and targeted phishing. Multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: Microsoft, one of the world’s leading computer hardware and software companies.
The Take: Exposure of Personally Identifiable Information belonging to over 65,000 business entities. The data included: names, email addresses, email content, company name, phone numbers, Statement of Work documents, product offers, and more.
The Vector: A misconfigured Microsoft server was accessible over the internet to anyone with a connection.
This breach is a stark reminder that authentication controls are a critical piece in an overall robust cybersecurity posture, including maintaining correct access configurations. In addition, multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: American Airlines, U.S based air travel company.
The Take: Exposure of Personally Identifiable Information including: employee and customer names, dates of birth, mailing addresses, phone numbers, email addresses, driver license numbers, passport numbers, and certain medical information.
The Vector: Using a phishing attack, the threat actor compromised an employee’s Office365 account, and acting with all their permissions, exfiltrated the exposed data.
This breach is a stark reminder of the effective of social engineering attacks and how critical authentication controls are in an overall robust cybersecurity posture. Enforcing multi-factor authentication, reasonably paced password resets, and regular social engineering and phishing awareness training are all effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
Cision: Agio, a leading cybersecurity and managed IT provider for financial services firms, published its inaugural 2022 Hedge Fund Managed IT Trends Report.
The Target: DoorDash, a popular food delivery company.
The Take: Exposure of Personally Identifiable Information belong to customers and employees including: names, customer delivery addresses, phone numbers, and some partial credit card information.
The Vector: The attackers breached a third-party company that DoorDash works with through a phishing attack. By using the compromised credentials, they were able to move in the vendor’s network freely and then access some of DoorDash’s own internal tools.
This breach is a stark reminder of the effective of social engineering attacks and how critical authentication controls are in an overall robust cybersecurity posture. Enforcing multi-factor authentication, reasonably paced password resets, and regular social engineering and phishing awareness training are all effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
84 Chain Lake Drive, Suite 501
Halifax, NS
Canada, B3S 1A2
+1-902-429-8880
Manila
Ground Floor, Three E-com Center
Mall of Asia Complex
Pasay City, Metro Manila
Philippines 1300
Sydney
Level 36 Governor Phillip Tower
1 Farrer Place Sydney 2000
Australia
+61 (2) 8823 3370
Abu Dhabi
Floor No.15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy