Week in Breach

Risk to Business: 1.761= Severe

CareFirst BlueCross BlueShield’s Community Health Plan District of Columbia (CHPDC) has announced a data breach carried out by what it described as a “foreign cybercriminal” group. The insurer confirmed that sensitive information about members was snatched and that they’ve notified authorities including the FBI and the Office of the Attorney General for the District of Columbia

Individual Risk : 1.603 = Severe

In a written notification to customers, CHPDC noted that the stolen information may have included names, addresses, phone numbers, dates of birth, Medicaid identification numbers, and other medical information. The company is offering free two-year credit and identity theft monitoring and a website with more information on help for consumers.

Risk to Business: 1.803 = Severe

Security researchers discovered a non-password-protected Elasticsearch database belonging to Office Depot that contained just under a million records. The exposed records were labeled as “Production” and contained customer information, file logs and other internal records for European customers, primarily in Germany. The company has addressed the issue.

Individual Risk: 2.267 = Severe

The exposed data includes names, phone numbers, physical addresses (home and/or office), @members.ebay addresses, and hashed passwords. The leak also exposed Marketplace logs and order history, exposing the customers’ past purchases and costs from European customer records.

Risk to Business: 1.612 = Severe

Bad actors have dropped notice that they’ve obtained an archive containing data purportedly scraped from 500 million LinkedIn profiles. A sample of data was posted on a popular hacker forum, with another 2 million records leaked as proof of the haul. More than 780,000 email addresses are associated with this leak. The initial listing contained 4 archives, but after LinkedIn denied the data breach, threat actors updated their ad to include 6 additional archives that allegedly include 327 million scraped LinkedIn profiles, putting the overall number of scraped profiles at 827 million including potential duplicates.

Individual Risk: 2.309 = Severe

This mass of leaked files contains PII about LinkedIn users including LinkedIn IDs, full names, email addresses, phone numbers, genders, links to LinkedIn profiles, links to other social media profiles, professional titles and other work-related data.

Risk to Business: 1.241 = Extreme

New York based medical services provider PTHC has announced a data breach impacting patients. The conglomerate operates Medicare-certified home health agencies, licensed home care service agencies, hospice at home services and Early Intervention Programs, as well as a managed care plan in New York. Both patient data and Member information has been impacted. The incident is under investigation.

Individual Risk: 1.412 = Extreme

Exposed patient information may include medical treatment information, insurance card and health plan benefit numbers, medical record numbers, first and last name, address, telephone numbers, date of birth, Social Security number, and financial information, including check copies, credit card numbers, and bank account information. Leaked Member information may include Medicaid ID number, ID number, provider name, clinical/medical information, first and last name, address, telephone number, date of birth, Social Security numbers, and credit card numbers and/or banking information if members paid their Medicaid surplus through credit card or check.

Risk to Business: 2.463 = Severe

Ransomware shut down operations briefly at the National College of Ireland (NCI). School officials announced significant disruption to IT services that has impacted a number of college systems, including Moodle, the Library service and the current students’ MyDetails service. Access to NCI’s IT systems was suspended and the campus building is also currently closed to both students and staff until IT services are restored. The Tallaght campus of the Technological University Dublin (TU Dublin) was also impacted in a similar attack.

Risk to Business: 1.772 = Severe

REvil ransomware is to blame for an attack at leading French pharmaceutical group Pierre Fabre. The threat actors initially demanded a $25 million ransom, but that number doubled the REvil ransom to $50 million when the company missed the attackers’ deadline for contact. The nature of the information stolen is unclear, and the company is working to restore its systems and data from backups.

Risk to Business: 1.755 = Severe

Popular stock trading app Upstox has alerted users of a security breach that exposed some PII for an estimated 2,500,000 customers. The company was careful to note that funds and securities were not impacted.  Upstox notified users that it had received messages that claimed unauthorized access to its database along with the breach of its data and KYC details from third-party data-warehouse systems.

Risk to Business: 2.055 = Severe

Upstox has not been specific about the exact customer data stolen but admits that contact data and some identification details may have been exposed. The company has initiated a secure password reset via OTP (one-time password) for all accounts.