Bad news for this company & awful outcome for this hospital after cyber breach

In this week's Cyber Weekly:

1. Bad news for this company
2. All these people at risk
3. Operations had to stop at this hospital
4. Behind the scenes of the aftermath of a cyber breach
5. Fact of the week

Thanks to all 9760 subscribers. It really takes a community to fight against cyberattacks. By sharing these newsletters, we can reach more people and help others from becoming a statistic. Share the post in the top right corner.

Also, follow me on LinkedIn for daily tech discussions >> Luigi Tiano.

1. Bad News for LastPass

‍

LastPass confirmed a breach last week. This means it is the second breach in four months. In August, hackers accessed user accounts for four days and compromised source code. There has been no confirmation that this breach led to the one last week. The CEO, Karim Toubba, also assured that no passwords have been compromised. (spiceworks)

‍

My thoughts: As we’ve seen with many stories this year, it takes most organizations months to investigate a breach and find the root cause. In this situation, LastPass was probably breached before they could implement new security measures.

As easy as it may sound to “repair and lock down after a breach, larger enterprises do not have the advantage or luxury of being nimble. Large enterprises have a larger attack surface sometimes making it difficult to secure the entire parameter. If you can act quickly and protect your enterprise, it’s never too late!

The second thing I want to address is the nature of the LastPass business. Hackers look for large attack surfaces with a large downstream potential. LastPass is exactly that!

‍

‍

2. 500 millions people at risk of a scam this holiday

‍

Meta subsidiary, WhatsApp, was breached. Over 500 million people were affected by the latest breach. This includes 360 million phone numbers from 108 countries. The data was for sale on the dark web for 4 days in November. Now, the data is being given away for free on the dark web. (spiceworks)

‍

My thoughts: In the same month, Meta has been fined $275M by the Irish data watchdog after a breach that resulted in the details of more than 500 million Facebook users being published online. This bring the amount Meta has been fined in the past year by that same regulator to more than $900 million.

They keep getting fined for not complying with data privacy regulations. This needs to be an eye opener for other companies who neglect to protect the data of the users who use their platforms.

Meta has a billion users and a history of breaches and non-compliancy. I don’t think this is the end of the story for Meta. I wouldn’t be surprised if they were fined by many countries since the datasets included users from around the world.

As we see these large companies like Meta and Amazon being fined month after month, we should expect things to heat up, forcing companies to re-evaluate their data safeguarding strategies.

Also, the cyber criminals have been working overtime to get as many data sets through various breaches before holiday season. Expect a huge influx of phishing and smishing campaigns. Be careful out there!

‍

‍

3. Paris Hospital has to halt Operations after Breach

‍

Last Saturday, a hospital in Versailles, near Paris, had to cancel operations due to a cyber breach. Six patients were transferred from the hospital in order to get the necessary care. Other patients may need to be transferred as well. The hospital kept up with walk-in clinics, but while the machines were still functioning extra staff were needed to be called in to watch the screens. (france24)

‍

My thoughts: The worst type of cyber news is when a hospital or health care facility is impacted. Risks increase and it means a potential increase in mortality rates. There are patients that cannot survive a hospital transfer. In the news, the details are never explicit about the patients.

They usually detail how the hospital is handling it. But in reality, they’re covering up the awful situation that many organizations ignore. With all these breaches we see in healthcare, it’s easy for us to think that hospitals are not prioritizing cyber security. That could be is, or on the flip side, it’s demonstrative of how tough this fight really is.

‍

‍

4. The ugly truth behind a hospital cyber breach

‍

In October we reported on a cyber attack that hit one of the largest healthcare chains in the USA, CommonSpirit Health. They told the press that there was an IT Security Incident. This is what they said:

“Patients continue to receive the highest quality of care, and we are providing relevant updates on the ongoing situation to our patients, employees, and caregivers. Patient care remains our utmost priority and we apologize for any inconvenience this matter has created.”

Media outlets interviewed staff. This is what was actually happening in the two weeks they were “down”:

• No access to record patient information
• Backup information was not available
• Safety checks were therefore compromised
• Switch to pen and paper slowed processes
• Delays in the emergency room
• Some patients and their appointments slipped through the cracks
• Ambulances backed up
• Lab results taking hours
• Safeguards in medication delivery were removed
• Communication between departments reduced

‍

My thoughts: Again, when are we going to put more priority in protecting the healthcare industry!

‍

‍

5. Fact of the week:

‍

‍

42% of manufacturers in the UK were hit with a cyber attack this year. Is this an indication of what's to come? (eandt)

In case you didn't know...

I started Assurance IT with my childhood friend Ernesto Pellegrino in 2011. Our mission is to help 100,000 companies become cyber resilient through our services and free content. We focus on helping mid-sized organizations with data protection and data privacy. Our primary services include: endpoint management, cloud backup, DRaaS, Office 365 backup, and Quebec's Law 25 training.

‍