Cronin
Exploit: Misconfiguration
Cronin: Digital Marketing Firm
Risk to Small Business: Researchers discovered a non-password-protected database that contained 92 million records belonging to the digital marketing firm Cronin last week. The exposed server was named “Cronin-Main” and many of the records contained references to Cronin. Exposed client records include internal logging of client advertisement campaigns, keywords, Google analytics data, session IDs, Client IDs, device data and other identifying information. Sales data was also exposed in a “Master Mailing List” with direct physical names, addresses, Salesforce IDs, phone numbers, and references to where the leads came from for customers and prospects. Internal Cronin employee usernames, emails, and hashed passwords and some unspecified PII and financial data were also exposed.
How it Could Affect Your Business: Information security is challenging enough without the complications of sloppy and dangerous mistakes like this.
Supernus Pharmaceuticals
Exploit: Ransomware
Supernus Pharmaceuticals: Pharmaceutical Company
Risk to Small Business: Maryland-based Supernus Pharmaceuticals fell prey to a ransomware attack that resulted in a large amount of data being exfiltrated from its networks in mid-November. The Hive ransomware group claimed responsibility for the attack over the Thanksgiving holiday weekend. The group claims to have breached Supernus Pharmaceuticals’ network on November 14 and exfiltrated a total of 1,268,906 files, totaling 1.5 terabytes of data. Supernus Pharmaceuticals says it did not plan to pay a ransom. In a statement, Supernus Pharmaceuticals also disclosed that it did not experience a significant impact on its business, they were quickly able to restore lost data and the company has enacted stronger security measures.
How it Could Affect Your Business: Companies in the healthcare and pharma sectors have been the favorite targets of ransomware gangs since the start of the global pandemic.
Butler County Community College
Exploit: Ransomware
Butler County Community College: Institution of Higher Learning
Risk to Small Business: Butler County Community College in Pennsylvania was forced to suspend classes for at least two days in the wake of a ransomware attack that has crippled the college’s systems. The college says it is working to restore databases, hard drives, servers and other devices. In a release, the college also announced the cancellation of all remote and online credit classes as it works to restore data, servers and other systems affected by the attack. Noncredit courses are canceled as well for November 29 and 30. The college will not provide services on its main campus or at its additional locations on those days. The incident is under investigation and the college is being assisted in recovery by a local cybersecurity firm.
How it Could Affect Your Business: Ransomware gangs have been taking aim at schools, colleges, school districts and similar education sector targets thanks to the it historically poor security and profit opportunities created by the adoption of widespread distance learning.
