February 1, 2023
We believe there is a need for additional information when it comes to cyber security, as organisations have made it clear that investment in a proper security strategy is paramount. SoftwareOne’s monthly Cyber security update provides information on the most recent threats, the latest breaches and how to react to them in order to stay on top of malware and ransomware threats.
The personal details of over two million Japanese insurance policy holders have been exposed after attacks on insurance companies Aflac and Zurich. It’s thought the breach occurred when a file transfer vulnerability on a third-party contractor in the US was exploited. It’s unclear if the two attacks are related.
Twitter is being investigated by Ireland's Data Protection Commission (DPC) after a hacker claimed to have stolen the private details of over 400 million accounts. The DPC is looking into whether Twitter was in full compliance with EU data protection laws. The accounts include high-profile users such as US Congresswoman Alexandria Ocasio-Cortez and presenter Piers Morgan.
Almost one million users of Norton Password Manager are being urged to change their passwords after Gen Digital, formerly Symantec Corporation, became aware of a security “incident” in December.
T-Mobile has suffered its second major breach in two years after around 37 million customer records were compromised in a credential stuffing attack. Stolen details include customers’ names, addresses and dates of birth.
Equifax has started distributing compensation payments following a settlement over its data breach in 2017, where almost 150 million consumer records were exposed. The company has set aside $425 million for restitution, and those affected can make a claim from the official settlement website.
In related news, T-Mobile is also paying compensation after 75 million people were affected by a data breach in 2021. The company settled a class action lawsuit by agreeing to pay out $350 million to victims.
The increasing number of people working remotely has opened security vulnerabilities that are being actively exploited by hackers, according to Forbes. The US is the most targeted nation, with more than seven security incidents for each person.
US federal authorities have warned that criminals are using business email compromise (BEC) techniques to steal large shipments of food and ingredients. Although BEC is more typically used to steal money by deceiving company employees the FBI warns the technique is being used to steal food products.
The Iranian government was behind an advanced persistent threat activity on US federal organisation. According to a joint cyber security advisory from the US government, hackers exploited the Log4Shell vulnerability to compromise the federal network and deploy a crypto miner and credential harvester.
The FBI has warned that pro-Russian hacktivists are using DDoS attacks on critical national infrastructure (CNI) to support the invasion of Ukraine, albeit with limited success. The private industry notification provides advice to CNI companies on how to stay secure.
Over the past 20 years the most common web vulnerabilities have hardly changed, with social engineering being the most common attack vector. Last year, targeted phishing attacks were responsible for exposing brands including Dropbox, Marriott International and Uber – and 2023 is expected to bring more of the same.
Phishing has evolved from easy-to-spot ‘419’ advanced-fee scam emails that contained basic grammar and spelling mistakes into highly sophisticated targeted attacks that have fooled the most astute employee. Phishing attacks are also no longer limited to email, with SMS-based attacks on the rise.
According to the World Economic Forum, 95% of successful attacks are due to human error, and most could have been prevented with proper cyber security education.
Cyber crime as a service is a growing industry, with criminal actors collaborating to provide more effective hacking services, and being paid in cryptocurrency. These services mean that almost anyone can launch a cyber attack by simply employing the growing number of hacking groups that are openly advertising their services.
Apart from cyber education, two-factor authentication provides some of the most effective protection. Apps like Google Authenticate and Microsoft Authenticator create an additional layer of security that was previously only available to large corporations and government agencies in the form of RSA tokens.
Automation, artificial intelligence and machine learning tools are also increasing in popularity to tighten up security. However, since its inception, the security industry has been in an arms race with cyber criminals, and these technologies are also being used by the bad actors to find and exploit vulnerabilities.
Finally, the reliance on third-party infrastructure software solutions has increased as more companies migrate to the cloud. Security experts are warning that attacks on these third-party applications are expected to increase in the coming months.
Consider these cyber security predictions when planning for the year ahead, especially as the cyber skills gap continues to widen. Acting proactively on such trends rather than in reactive mode will enhance your organization’s cyber protection in 2022.
Find out how SoftwareOne can help you stay ahead of the latest malware and ransomware threats.
Find out how SoftwareOne can help you stay ahead of the latest malware and ransomware threats.
