Industry News: ESG5

The Target: Car rental company Avis

The Take: The scope of the stolen data varies depending on the customer, but the following information is potentially affected: name, email address, telephone number, date of birth, credit card number and expiration date, driver’s license number.

The Vector: The company detected unauthorized access to one of its business applications at the beginning of August. Avis has described the breach as ‘insider wrongdoing.’

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: CBIZ is a management consulting company that provides financial and benefits and insurance services to various organizations and individual customers.

The Take: Hackers stole information belonging to nearly 36,000 individuals, which includes: name, contact details, Social Security Number, date of birth/death, retiree health information, welfare plan information.

The Vector: The company informs that a threat actor exploited a vulnerability in one of its web pages and was able to steal customer data between June 2 and June 21.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: Patelco is an American not-for-profit credit union that provides financial services, including checking and savings accounts, loans, credit cards, insurance plans, and investments, with assets exceeding $9 billion.

The Take: The information that was exposed to cybercriminals varies per individual and may include: full name, Social Security Number (SSN), driver’s license number, date of birth, email address.

The Vector: Last month, the company disclosed it suffered a ransomware attack on June 29, 2024, that forced it to shut down customer-facing banking systems to contain the damage and protect people's data.

As phishing actors continue to explore every potential abuse opportunity on legitimate service providers, novel security gaps constantly threaten to expose users to severe risks. It is essential not to rely solely on email protection solutions, and also scrutinize every email that lands on your inbox, look for inconsistencies, and double-check all claims made in those messages.

Read more...

The Target: Toyota Motor Corporation is a Japanese multinational automotive manufacturer headquartered in Toyota City, Aichi, Japan.

The Take: The threat actor says they breached a U.S. branch and were able to steal 240GB of files with information on Toyota employees and customers, as well as contracts and financial information.

The Vector: BleepingComputer found that the files had been stolen or at least created on December 25, 2022. This date could indicate that the threat actor gained access to a backup server where the data was stored.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: Advanced Computer Software Group, a provider of IT and software services to the U.K.’s National Health Service (NHS) and other healthcare organizations.

The Take: The data breach affected 82,946 people, with sensitive information being exfiltrated, including medical records, phone numbers, and access details to the homes of 890 individuals receiving care at home.

The Vector: The incident, which occurred in August 2022, involved a ransomware attack that accessed systems via an account lacking multi-factor authentication.

This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: HealthEquity, a Utah-based health savings account (HSA) provider.

The Take: The stolen information included a mix of benefits sign-up information that varied by customer. That mix could include name, address, phone number, employee ID, employer, Social Security number, and dependent information.

The Vector: The company said in a notice that a hacker managed to breach an "an unstructured data repository outside our core systems" containing customer data, making off with various kinds of personally identifiable information.

This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.

Read more...

The Target: MediSecure, an Australian electronic prescription provider.

The Take: The impacted data included personal information including full names, titles, dates of birth, gender, email addresses, phone numbers, and individual healthcare identifiers (IHI).

The Vector: An early forensic investigation by the company into the relevant impact of the incident indicated that 6.5TB of data stored on a database server was likely exfiltrated by a malicious third-party actor, although, encrypted servers couldn’t be examined for further details.

This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.

Read more...

The Target: Trello is an online project management tool owned by Atlassian. Businesses commonly use it to organize data and tasks into boards, cards, and lists.

The Take: The leaked data includes email addresses and public Trello account information, including the user's full name.

The Vector: While Atlassian, the owner of Trello, did not confirm at the time how the data was stolen, emo (the threat actor) said it was collected using an unsecured REST API that allowed developers to query for public information about a profile based on users' Trello ID, username, or email address.

As phishing actors continue to explore every potential abuse opportunity on legitimate service providers, novel security gaps constantly threaten to expose users to severe risks. It is essential not to rely solely on email protection solutions, and also scrutinize every email that lands on your inbox, look for inconsistencies, and double-check all claims made in those messages.

Read more...

The Target: U.S. messaging giant Twilio.

The Take: Data associated with Authy accounts, including 33 million phone numbers.

The Vector: Twilio detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint.

 This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.

Read more...

The Target: Synnovis, a pathology services provider for the National Health Service (NHS) in the U.K.

The Take: The leaked data includes patient names, dates of birth, NHS numbers, and descriptions of blood tests, as reported by the BBC. The extent of the data breach and whether test results are included remains unclear.

The Vector: Synnovis was hit by the ransomware attack earlier this month, creating disruptions at major London hospitals. The leak saw almost 400GB of private information published on the darknet.

This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.

Read more...