Here’s the latest installment of the Hacks, Attacks and Breaches cybersecurity news update.
The Logically team provides top cyber security stories every week to keep you up to date on the latest news headlines on cybersecurity, hacking, computer security, ransomware and other cybersecurity threats.
United States Federal Bureau of Investigation
Exploit: Hacking
United States Federal Bureau of Investigation: Federal Government Agency
Risk to Business: The U.S. Federal Bureau of Investigation (FBI)’s InfraGard program has experienced a data breach. The program, launched in 1996, encourages physical and cyber threat information-sharing collaborations between the public and private sector. Cybercriminals advertised a database that they purportedly snatched on the dark web containing contact details of over 87,000 members of InfraGard. Initially, the threat actors were asking for $50k for the database. However, Hackread reported that the thieves had a change of heart and decided not to sell or release the database, telling that publication that they’d decided the stolen InfraGard database would no longer be posted for sale as it would ‘‘cause more harm to everyone’’ than benefit for the hackers.
How it Could Affect Your Customers’ Business: This kind of database is especially sensitive and its exposure could have major national security implications.
Uber
Exploit: Supply Chain Attack
Uber: Ride Sharing & Delivery Service
Risk to Small Business: Uber has suffered a new data breach. A threat actor going by the name of “UberLeaks” published a sample of data purportedly snatched from Uber and Uber Eats including employee email addresses, corporate reports and IT asset information stolen from a third-party vendor, thought to be Teqtivity, which it uses for asset management and tracking services, on its dark web leak site. The leaked data also includes files claiming to be source code associated with the mobile device management platforms (MDM) used by Uber and Uber Eats as well as their third-party vendor services. No user data appears to be involved in this breach.
How it Could Affect Your Customers’ Business: This isn’t the first data breach for Uber, further eroding customer confidence in the company’s ability to keep their information safe.
The Centers for Medicare and Medicaid Services (CMS)
Exploit: Supply Chain Attack
The Centers for Medicare and Medicaid Services (CMS): Federal Government Agency
Risk to Small Business: The Centers for Medicare and Medicaid Services (CMS) has experienced a data breach that impacts 245,000 Medicare beneficiaries. The agency said that the initial security incident that led to the breach was experienced by a subcontractor to another company contracted by Medicare to resolve system errors related to beneficiary entitlement and premium payment records. The subcontractor has been identified as Healthcare Management Solutions and the main contractor is ASRC Federal Data Solutions. CMS explained in its breach notification letter that its initial investigation points to the subcontractor having “acted in violation of its obligations.”
How it Could Affect Your Customers’ Business: This breach can put a lot of very sensitive data at risk for vulnerable people including financial details and will almost certainly incur big regulatory fines.
SevenRooms
Exploit: Hacking
SevenRooms: Customer Relationship Platforms
Risk to Small Business: SevenRooms, a customer relationship management platform used by brands including MGM and Wolfgang Puck, has confirmed it suffered a data breach. A threat actor posted samples of data purportedly stolen from the New York-based company on a dark web forum on December 15. Bad actors claim that they’ve stolen a 427 GB backup database containing information about SevenRooms customers. The company was quick to reassure the public that guests’ credit card information, bank account data, social security numbers, or any other similarly highly sensitive information was not stored on compromised servers or exposed in the attack. The incident is still under investigation.
How it Could Affect Your Customers’ Business: Service providers of all types have been high on cybercriminals’ priority lists as they search for both data and possible backdoors into companies.
