2016 has been an interesting year for Cyber Crime with companies like Yahoo, LinkedIn, Lynda.com, TalkTalk (again), Ashley Maddison (being fined $1.6 million for 2015 data breach), KFC, Wells Fargo, MailChimp, AdultFriendFinder, MichaelPage; to name a few.
It's Christmas time and I don't want to be the bearer of bad news however it will get worse as the months/years go on and as companies we can only be prepared and react at our best ability. But a word to the wise; learn from others mistakes. Communication is the key here with customers and suppliers; that is internally and externally. Many bury their head in the sand but making sure you have a robust and up-to-date Incident response plan, Governance Risk and Compliance, Runbooks, Security awareness training, Solutions are being used, or needed etc.
EU GDPR will come into force by 2018 which gives another year to get the ducks in a row. Which could lead to fines of up to €20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater. With a 72 hour disclosure deadline.
However I wanted to pick a few UK companies that have hit our media over the last 12 months and give a brief outline of the type of attacks we have seen. Learn - Don't repeat!
Tesco Bank - November
The weekend of 5-6 November Tesco Bank was hit by a data breach which led to them to suspend online transactions to prevent criminal activity.
Tesco Bank confirmed around 9,000 customers (accounts for just under 7% of there Bank customers) were affected by these fraudulent transactions and all customers affected were fully reimbursed by the evening of Tuesday 8 November. The total cost of refunding these customers was estimated to be £2.5 million.
National Lottery - November
Cyber criminals appeared to use passwords and email addresses from previous breaches to gain access to 26,000 online UK National Lottery accounts.
Camelot, the company behind the National Lottery, detected the scam and subsequent attempted frauds and responded by locking down accounts, triggering compulsory password resets and contacting those affected directly. Although 26,500 accounts were compromised, Camelot have recently stated that 43 had some activity take place within the accounts and that this was limited to some of their personal details being changed. - Ongoing investigation.
PayasuGym - December
The company, which sells passes for gyms around the UK, acknowledged that 300,000 email addresses and passwords of its members had been accessed last week.
PayAsUGym alerted its members to the security breach in an email which said "one of the company's IT servers was accessed by an unauthorised person".
It went on: "Although we do not hold any financial or credit card information, the unauthorised person could have accessed the e-mail address and password of our customers.
Three Mobile - November
More than 133,000 customer accounts were breached by fraudsters in an attempt to upgrade and steal phones to sell them on.
Eight customers have been unlawfully upgraded to a new device and in total, 133,827 accounts were breached.
The company said details, including names and addresses, had been accessed by using a login to its database of customers eligible for a phone upgrade.
It said the breach then allowed upgrade devices to be "unlawfully intercepted".
Sage - August
The details of employees at around 280 UK businesses may have been compromised after software company Sage Group suffered a data breach. They are still ongoing criminal investigations to understand exact figures.
Two days after news of the hack, a 32-year-old worker from Sage was arrested at Heathrow on suspicion of conspiracy to defraud.
Asked about potential reputational damage, chief executive Stephen Kelly said: “Our first port of call when it happened was to communicate with our customers… and I think they respect us for that.”
NCT charity - April
A childbirth charity has apologised to over 15,000 new and expectant parents after their registration details were accessed in a "data breach".
The National Childbirth Trust (NCT) sent a message saying their email addresses, usernames and passwords had been "compromised".
Ofcom has had the biggest security breach in its history after an ex-employee was caught offering confidential data on TV companies to his new employee, a major broadcaster.
The incident forced the media watchdog to send out dozens of letters explaining the breach to TV companies holding an Ofcom licence. It is believed the former employee managed to download as much as six years’ worth of data, according to the Guardian.
Comments
Post a Comment