Skip to main content

2016 Cyber attacks review #Throwback #Lookout2017

2016 has been an interesting year for Cyber Crime with companies like Yahoo, LinkedIn, Lynda.com, TalkTalk (again), Ashley Maddison (being fined $1.6 million for 2015 data breach), KFC, Wells Fargo, MailChimp, AdultFriendFinder, MichaelPage; to name a few. 
It's Christmas time and I don't want to be the bearer of bad news however it will get worse as the months/years go on and as companies we can only be prepared and react at our best ability. But a word to the wise; learn from others mistakes. Communication is the key here with customers and suppliers; that is internally and externally. Many bury their head in the sand but making sure you have a robust and up-to-date Incident response plan, Governance Risk and Compliance, Runbooks, Security awareness training, Solutions are being used, or needed etc. 
EU GDPR will come into force by 2018 which gives another year to get the ducks in a row. Which could lead to fines of up to €20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater. With a 72 hour disclosure deadline.
However I wanted to pick a few UK companies that have hit our media over the last 12 months and give a brief outline of the type of attacks we have seen. Learn - Don't repeat!
Tesco Bank - November
The weekend of 5-6 November Tesco Bank was hit by a data breach which led to them to suspend online transactions to prevent criminal activity.
Tesco Bank confirmed around 9,000 customers (accounts for just under 7% of there Bank customers) were affected by these fraudulent transactions and all customers affected were fully reimbursed by the evening of Tuesday 8 November. The total cost of refunding these customers was estimated to be £2.5 million.
National Lottery - November
Cyber criminals appeared to use passwords and email addresses from previous breaches to gain access to 26,000 online UK National Lottery accounts.
Camelot, the company behind the National Lottery, detected the scam and subsequent attempted frauds and responded by locking down accounts, triggering compulsory password resets and contacting those affected directly. Although 26,500 accounts were compromised, Camelot have recently stated that 43 had some activity take place within the accounts and that this was limited to some of their personal details being changed. - Ongoing investigation.
PayasuGym - December
The company, which sells passes for gyms around the UK, acknowledged that 300,000 email addresses and passwords of its members had been accessed last week.
PayAsUGym alerted its members to the security breach in an email which said "one of the company's IT servers was accessed by an unauthorised person".
It went on: "Although we do not hold any financial or credit card information, the unauthorised person could have accessed the e-mail address and password of our customers.
Three Mobile - November
More than 133,000 customer accounts were breached by fraudsters in an attempt to upgrade and steal phones to sell them on.
Eight customers have been unlawfully upgraded to a new device and in total, 133,827 accounts were breached.
The company said details, including names and addresses, had been accessed by using a login to its database of customers eligible for a phone upgrade.
It said the breach then allowed upgrade devices to be "unlawfully intercepted".
Sage - August 
The details of employees at around 280 UK businesses may have been compromised after software company Sage Group suffered a data breach. They are still ongoing criminal investigations to understand exact figures. 
Two days after news of the hack, a 32-year-old worker from Sage was arrested at Heathrow on suspicion of conspiracy to defraud.
Asked about potential reputational damage, chief executive Stephen Kelly said: “Our first port of call when it happened was to communicate with our customers… and I think they respect us for that.”
NCT charity - April
A childbirth charity has apologised to over 15,000 new and expectant parents after their registration details were accessed in a "data breach".
The National Childbirth Trust (NCT) sent a message saying their email addresses, usernames and passwords had been "compromised".
Ofcom has had the biggest security breach in its history after an ex-employee was caught offering confidential data on TV companies to his new employee, a major broadcaster.
The incident forced the media watchdog to send out dozens of letters explaining the breach to TV companies holding an Ofcom licence. It is believed the former employee managed to download as much as six years’ worth of data, according to the Guardian.
Labels:

Comments

Post a Comment

Popular posts from this blog

Time to get serious in 2015

Security professionals are faced with the on-going problem of stakeholders under-estimating the security flaws within their organisation. In most cases this is not the failing of the security team but depending on the market/vertical, teams are faced with budget constraints, redundancies, or most commonly, companies not taking responsibility that Security starts within. This means educating internal staff to take responsibility from the moment they walk into the office; I.e. The devices they bring, the doors that they open to 'guests',  the confidential conversations they have in open areas and the general ethos. Furthermore, there is the responsibility of your key suppliers and other third parties that you share information with.  You may have all the IT/Cyber security gadgets and resources you need but what are your suppliers doing with that data? Do they share the same vision for security and are they as vigilant as you? How do you measure that in an effici...
Post a Comment
Read more

ICO Referendum response plus UK Gov recommendations to #DataBreaches and University gets suffers Second #DataBreach

ICO Referendum result response An ICO spokesperson said: “The Data Protection Act remains the law of the land irrespective of the referendum result. “If the UK is not part of the EU, then upcoming EU reforms to data protection law would not directly apply to the UK. But if the UK wants to trade with the Single Market on equal terms we would have to prove 'adequacy' - in other words UK data protection standards would have to be equivalent to the EU's General Data Protection Regulation framework starting in 2018. “With so many businesses and services operating across borders, international consistency around data protection laws and rights is crucial both to businesses and organisations and to consumers and citizens. The ICO’s role has always involved working closely with regulators in other countries, and that would continue to be the case. “Having clear laws with safeguards in place is more important than ever given the growing digital economy, and we will be s...
Post a Comment
Read more

Human Error, a common theme in the ICO data breach findings #UK #ICO

The ICO recently carried out a study of the recent security incidents that have been reported or notified to the ICO. It's no shock that data breaches are on the rise with two-thirds of sectors studied reporting an increase in the first quarter compared with the same time a year ago, according to new ICO figures. The data protection watchdog, ICO have shown findings for the period 1 January – 31 March 2016 and uncovered some worrying statistics. Below are the key data security issues for each sector:  Data security incidents by type: The main data security issues within the health sector were: Data being posted or faxed to an incorrect recipient – 22% of incidents. Loss or theft of paperwork – 20% of incidents. The main issues for local government were: Data being posted or faxed to an incorrect recipient – 23% of incidents. Failure to redact data – 16% of incidents. Loss of theft of paperwork – 14% of incidents. The main issues for education were: Los...
Post a Comment
Read more