.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The Target: Trustanduse.com, a digital platform for consumers to rate products, services, stores, and professionals.
The Take: Exposure of 439,000 records of Personally Identifiable Information including: usernames, first and last names, Facebook IDs, phone numbers, and hashed account passwords.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture. This data is perfect for constructing highly effecting spear-phishing campaigns. Multi-factor authentication and password length and complexity rules on server access are effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: Zendesk, a customer solutions service provider.
The Take: Access to an internal logging database which may have contained service data belonging to Zendesk and its customers.
The Vector: An employee’s credentials were compromised though an SMS phishing attack which led to the employees handing over their login credentials to the attackers.
This breach is a stark reminder of how important authentication controls are in an overall robust cybersecurity posture. Regular social engineering and phishing awareness training are effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
The Target: Myrocket, a Human Resources recruitment company based in India.
The Take: Exposure of 200,000 employees and 9 million candidate records of Personally Identifiable Information including: names, taxpayer information, personal identification numbers, emails, phone numbers, bank details, dates of birth, salaries, payslips, employees roles, and more.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture. This data is perfect for constructing highly effecting spear-phishing campaigns. Multi-factor authentication and password length and complexity rules on server access are effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: CAF, the French Social Security agency
The Take: 10,000 records of Personally Identifiable Information exposed including: physical address, date of birth, household composition and income, amounts and benefits received.
The Vector: An unencrypted and unprotected file containing the above information was sent to a third-party service provider, who then posted the file to their website which was publicly accessible to anyone.
This breach is a reminder of how critical authentication controls are on sensitive data to maintain an overall robust cybersecurity posture, and more critically, ensuring these controls are in place when communicating and sending data to third-party vendors. The information stolen in this attack could lead to highly targeted phishing campaigns against the victims. Regular vendor assessments are also a key component in cybersecurity.
The Target: Cornerstone Payment Systems
The Take: Exposure of 9 million transaction records which exposed Personally Identifiable Information including: email addresses, names, physical addresses, phone numbers, types of credit cards and donation details including destination and dollar amount.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture. This data is perfect for constructing highly effecting spear-phishing campaigns. Multi-factor authentication and password length and complexity rules on server access are effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: Uber, a U.S based ride-service company.
The Take: Exposure of sensitive company information including: IT Asset reports, Windows domain login names and email addresses, and Active Directory information.
The Vector: The data was stolen through a breach in a third-party provider, Teqtivity, using compromised employee credentials. These were used to gain access to an AWS backup server.
This breach is a stark reminder of how authentication controls are in an overall robust cybersecurity posture, and more critically, ensuring these controls are in place on all third-party vendors which have access to a firm’s data. The information stolen in this attack could lead to highly targeted phishing campaigns against Uber. Regular vendor assessments are a key component in cybersecurity.
The Target: Vevor, a California-based online retailer.
The Take: 1.1 billion records across two databases of Personally Identifiable Information including: first and last name, partial credit card numbers, transaction IDs, order and refund information, home addresses, and email addresses. Internal Vevor account admin names and plaintext passwords were also exposed, as well as IP addresse, ports, and pathways.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture and furthermore, that when admin credentials are exposed, dangerous pivot attacks may follow as attackers use these to move into a firm’s other platforms. Multi-factor authentication and password length and complexity rules are effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: ENC Security, Netherlands based data-encryption firm.
The Take: Exposure of security keys for various firm applications and software including: SMTP credentials for sales channels, Ayden, the firm’s single payment platform, email marketing Mailchimp APIs, licensing payment APIs, and public and private keys.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture and furthermore, that such precautions must in place in all third-party vendors that have access to a firm’s data. Multi-factor authentication and password length and complexity rules are effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Target: DraftKings, a U.S based sports betting website.
The Take: $300,000 USD of customer funds.
The Vector: Via a credential stuffing attack, where user passwords that have been exposed elsewhere were also used as a login for DraftKings, enabled attackers to login and steal the funds.
This breach is a stark reminder of how critical authentication controls are in an overall robust cybersecurity posture. Credential stuffing attacks can be avoided by enforcing multi-factor authentication and reasonably paced password resets. It is important to employ effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
The Target: CorrectCare, a U.S based integreated health service for correctional facilities.
The Take: Exposure of Personally Identifiable Information of 600,000 inmates including: name, date of birth, social security number, and limited health information.
The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection could have viewed and downloaded the data.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture. Multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s data.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
168 Hobsons Lake Drive Suite 301
Beechville, NS
Canada, B3S 0G4
Tel: +1 902 429 8880
Manila
10th Floor, Two Ecom Center
Mall of Asia Complex
Harbor Dr, Pasay, 1300 Metro Manila
Philippines
Sydney
Level 15 Grosvenor Place
225 George Street, Sydney NSW 2000
Australia
Tel: +61 (2) 8823 3370
Abu Dhabi
Floor No. 15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Prague
2nd Floor, The Park
V Parku 8
Chodov, Praha, 148 00
Czech Republic
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy