Information Technology

A retired military officer has disclosed a cyberattack that struck the UK Ministry of Defence (MoD) academy and had a “significant” impact on the organization. 

Air Marshal Edward Stringer, an officer in charge at the time, told Sky News that the cyberattack was discovered in March 2021. According to the retired officer, “unusual activity” was detected by IT outsourcer Serco but originally it was thought that this may have been due to some form of IT error rather than something malicious. The Defence Academy of the United Kingdom was the target. The organization is responsible for teaching and training thousands of military personnel, MoD employees, wider government figures, and overseas students. Courses on offer relate to topics including security, strategy, languages, and information warfare.  While full attribution is not available as to whom was responsible, the publication reports that China or Russia was “possibly” involved.  Iran and North Korea were also floated as potential sources of the cyberattack.  “It could be any of those or it could just be someone trying to find a vulnerability for a ransomware attack that was just, you know, a genuine criminal organization,” Stringer said. 

As academy staff worked to keep courses running, management was concerned that the reason behind the attack may not have been to disrupt the educational system – but rather, the academy could have been used as a “backdoor” to target the wider MoD. This prospect had severe ramifications and could have had potential consequences for national security.  Stringer added that despite these concerns, there appears to be no evidence of breaches beyond the Defense Academy.  An investigation has been launched and the National Cyber Security Centre (NCSC) is aware of the cyberattack.  During the interview, Stringer said the cyberattack was “significant, but then manageable” – and further prompted the academic institution to ramp up its security posture and network resiliency after accounting for the “operational cost” of dealing with the incident.  As of now, the IT infrastructure is still being rebuilt and the Defence Academy is set to launch a new website in the future. An MoD spokesperson told Sky News: “In March 2021 we were made aware of an incident impacting the Defence Academy IT infrastructure. We took swift action and there was no impact on the wider Ministry of Defence IT network. Teaching at the Defence Academy has continued.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

The controversial Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, has received the backing of the Parliamentary Joint Committee on Intelligence and Security (PJCIS) in its review of the laws. The TOLA Act, passed three years ago, was criticised heavily when it first became law as it gave intelligence and law enforcement agencies powers to request or demand assistance from communications providers to access encrypted communications.Since its passing, the most public display of these powers has been Operation Ironside, which AFP commissioner Reece Kershaw last year labelled as the Australian Federal Police’s (AFP) “most significant operation in policing history”.In the PJCIS’ review [PDF] of the legislation, it supported the powers enacted in the laws but recommended additional safeguards and oversight mechanisms aimed at providing the public with confidence the legislation would be used proportionally and for its intended purpose.”Agencies have made the case that these powers remain necessary to combat serious national security threats, and some of the worst fears held by industry at the time of passage have not been realised,” committee chair and Liberal Senator James Paterson said. Among those recommended safeguards are that any law enforcement requests cannot result in any persons being detained, as well as more authorisation checks prior to the issuance of notices and warrants through the TOLA Act. These recommended checks include a requirement for the Director-General of Security, who is currently the Australian Security Intelligence Organisation’s (ASIO) head Mike Burgess, to be satisfied with the reasonableness and proportionality of a voluntary assistance request prior to its issuance, external authorisation from the Attorney-General or issuing authority for any concealment activities in relation to executing computer access warrants, and ASIO retaining and requiring written reasons whenever a voluntary assistance request is made.

Read more: How the FBI and AFP accessed encrypted messages in TrojanShield investigation The committee has also called for the federal government, in consultation with relevant stakeholders, to develop a prescribed set of requirements for information that must be included in technical assistance requests. “These are intrusive powers that must be robustly overseen to ensure they are used appropriately, and there are improvements that can be made to the oversight framework which the committee has recommended,” Paterson said. The PJCIS also wants more reviews of the laws, such as a periodic survey in three year’s time to ascertain ongoing economic impacts of the TOLA Act legislation on Australia’s IT industry and a review of the concepts of “serious offence”, “relevant offence”, and others contained in the Act. The committee explained in the review that it hopes the ongoing reviews would address the concerns raised by industry bodies in about the impact of the various notices and requests contained in the TOLA Act. It also recommended that the ASIO brief the PJCIS on the acts or things implemented as part of any compulsory assistance order to facilitate and assist the ongoing review and oversight of the legislation. Another recommendation put forth by the PJCIS is for the Inspector-General of Intelligence to receive expanded functions so it can oversee the intelligence functions of the Australian Federal Police. Speaking to the concerns that the TOLA Act is potentially incompatible with the US CLOUD Act, the committee also said it was satisfied with the co-existence of the two laws as the US Department of Justice said it had no issues with the TOLA Act being in operation.The confirmation came shortly after Australia and the United States entered into a landmark CLOUD Act agreement in December, which gave Australia’s law enforcement agencies the ability to issue orders compelling US service providers to provide communications data for the purposes of combatting serious crime directly on US-based companies, and vice versa. Related Coverage More

An Australian Senate Committee at the end of last year recommended that a government entity be specifically delegated with the responsibility of keeping social media platforms and other government entities accountable in preventing cyber-enabled foreign interference. In an interim report [PDF], the Select Committee on Foreign Interference through Social Media said it made this recommendation as there is currently not a single body dedicated to performing this accountability function. The committee said the need for such an entity would continue to grow in importance as the use of cyber-enabled techniques to interfere in foreign elections and referendums has increased significantly in recent years.In making this finding, the committee considered submissions that said current trends indicated espionage and foreign interference would supplant terrorism as Australia’s principal security concern over the next five years. Another factor in making this recommendation was that there is currently no specific body responsible for combatting COVID-19 misinformation and disinformation. Alarmingly, the committee also wrote in its interim report that the Department of Home Affairs — the supposed policy lead for addressing foreign interference on social media — testified it was not aware which platforms were supposed to report foreign interference attempts. Social media companies also told the committee similar things, saying they have experienced confusion when trying to decipher how and who to report to when it comes to foreign interference residing on their platforms. “Given the impending Federal Election, it is imperative that the government establish clear policies and procedures for social media platforms to refer potential foreign interference for consideration by the relevant government departments or entities,” the report said.

As such, in addition to appointing a government entity to be accountable for cyber-enabled foreign interference, the committee has also recommended that the federal government establish clear requirements and pathways for social media platforms to report suspected foreign interference, including disinformation and coordinated inauthentic behaviour, and other offensive and harmful content. It also recommended for agency remits, powers, and resourcing arrangements regarding these reporting requirements to be formalised. The committee also called for more transparency regarding the extent of government’s awareness about online disinformation and misinformation. To address the lack of transparency, the committee has made the recommendation for the Australian Communications and Media Authority (ACMA) and the Election Integrity Assurance Taskforce (EIAT) to publicly release their findings and responsibilities in relation to foreign interference through social media platforms. Currently, ACMA files a report to government about the Australian Code of Practice on Disinformation and Misinformation, which covers the adequacy of digital platforms’ measures and the broader impacts of misinformation in Australia, but that information is not available for public viewing. Meanwhile, there is “no certainty” around the responsibilities and powers of EIAT members, which the committee warned could create vulnerabilities in Australia’s institutional arrangements that malign foreign actors could exploit. “Although the members can articulate their qualifications to be on the [EIAT] (for example, the Department of Communications is an expert on the social media platforms), there is no certainty about what their responsibilities and powers are, let alone the powers of others. The taskforce is governed by terms of reference have been kept secret to this committee and the public at large,” the committee wrote in the interim report The interim report comes off the heels of Australia announcing various initiatives in recent months to address issues residing in social media platforms and cyber. In December alone, Australia announced the Online Safety Youth Advisory Council, passed “Magnitsky-style” and Critical Infrastructure cyber attack laws, and proposed anti-trolling laws.  Meanwhile, in October, the federal government released an exposure draft for what it has labelled an Online Privacy Bill to make it mandatory for social media organisations to verify users’ age. Another senate committee recently received an update regarding the Online Privacy Bill during Budget Estimates, with Australia’s information commissioner saying it would receive AU$25 million of funding across three years to facilitate timely responses to privacy complaints as part of work on the aforementioned Bill. Related Coverage More

New South Wales’ electoral commissioner has revealed the iVote system failure during the state’s local elections last month may have materially impacted the councillor elections in Kempsey, Singleton, and the City of Shellharbour.  During those elections last month, an unknown number of voters were unable to cast a vote due to the state’s iVote online voting system suffering a failure for a portion of the voting period. In the immediate aftermath, the NSW Electoral Commission (NSWEC) attributed the iVote online voting system failure to a higher-than-expected elector load, with around 650,000 people using the system during the local elections last month.”Almost triple the number of voters have used iVote at these elections than any previous election,” NSWEC said.Since then, an NSWEC investigation into the system failure has concluded that there is a possibility that, if all individuals who registered to use iVote on election day had been able to vote, a different outcome might have occurred.On a technical level, people were unable to cast their vote due to iVote not issuing them with the necessary security credential before the close of voting on election day, which is a prerequisite for accessing the voting component of the system, the NSWEC explained.To address the risk of ongoing ambiguity about the materiality of the iVote issue for these elections, as well as to support the integrity of the electoral system more generally, the electoral commissioner will submit an application to the Supreme Court in the coming weeks for a declaration about the validity of the election results in these three elections.

The election declaration, if approved, will mean the currently elected councillors for the impacted councils will serve in the interim. The declaration will not be a determination that these three elections are valid more generally, however, the electoral commissioner noted.The electoral commissioner said he wanted to apply for the declaration as these elections have already been deferred twice due to the COVID-19 pandemic and it may be practically impossible to hold fresh elections until the middle of 2022.Dr Vanessa Teague, a cryptographer with a particular interest in privacy and election security, has repeatedly warned of the flaws within the iVote system.”Every serious investigation of iVote found serious problems,” Teague tweeted last month in light of the most recent iVote failure. Starting in 2015, she and her colleagues found numerous flaws in iVote, problems that NSWEC has often downplayed. RELATED COVERAGE More

This weekend, the Broward Health hospital system notified more than 1.3 million patients and staff members that their personal information was involved in a data breach that started on October 15. 

ZDNet Recommends

Best security key 2021

While robust passwords go a long way to securing your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.

Read More

In a statement on Saturday, the Florida hospital system said that in addition to names, addresses and phone numbers, Social Security numbers, bank account information and medical history data was included in the breach.  Insurance account information, driver’s license numbers, email addresses and treatments received were also included. The hospital system said it waited months to notify victims because the Department of Justice told them to hold off on sending out breach notification letters. “On October 15, 2021, an intruder gained entry to the Broward Health network through the office of a third-party medical provider permitted to access the system to provide healthcare services. Broward Health discovered the intrusion on October 19, 2021, and promptly contained the incident, notified the FBI and the Department of Justice (DOJ), required a password reset for all employees and engaged an independent cybersecurity firm to conduct an investigation,” the hospital explained.”Broward Health also engaged an experienced data review specialist to conduct an extensive analysis of the data to determine what was impacted, which determined some patient and employee personal information may have been impacted. The DOJ requested the Broward Health briefly delay this notification to ensure that the notification does not compromise the ongoing law enforcement investigation.”The hospital system did not say how many people were involved, but in their submission to the Maine Attorney General’s office, they said 1,357,879 people were affected. The hospital is offering 24 months of identity theft protection services, implemented multifactor authentication for all users of its systems and “minimum-security requirements for devices not managed by Broward Health Information Technology with access to its network.”

The notice warned that people who had their information exposed are now vulnerable to medical identity theft, which is when someone uses a person’s name and information to get medical services or fraudulently bill for medical services. The hospital urged those affected to monitor their benefits statements and financial accounts. Joseph Carson, chief security scientist at ThycoticCentrify, said countries where healthcare is extremely expensive, are the leading targets for cybercriminals to steal and monetize personal health information.  In many instances, personal health information is much more valuable than stolen credit card information, Carson added, noting that it can be sold for up to $500 or more on the dark web because it can easily be abused for fake medical claims, fake prescriptions or fake identities.  “Personal health information can also be used for extortion or blackmail targeting victims who do not want sensitive information disclosed or even to abuse insurance claims and tax refunds,” Carson said. “Unfortunately, for medical records, you cannot change your medical history. Once stolen or disclosed, it is public knowledge, whereas a credit card you can change and get back on track quickly.” More

In 2021, thousands of new cybersecurity incidents have been recorded — and while cryptocurrency theft and data loss are now commonplace, this year stands out due to several high-profile incidents involving ransomware, supply chain attacks, and the exploitation of critical vulnerabilities.The Identity Theft Research Center (ITRC) has reported an increase of 17% in the number of recorded data breaches during 2021 in comparison to 2020. However, an entrenched lack of transparency around the disclosure of security incidents continues to persist — and so this may be a low ball estimation. According to IBM, the average cost of a data breach has now reached over $4 million, while Mimecast estimates that the average ransomware demand levied against US companies is well over $6 million. The world record for the largest payout, made by an insurance company this year, now stands at $40 million.  Read on: This is the perfect ransomware victim, according to cybercriminals | Enterprise data breach cost reached record high during COVID-19 pandemic |Experts have warned that the security issue could persist for years with the recent emergence and rapid exploitation of the Log4j vulnerability. That goes for data leaks, breaches, and theft, too, which are unlikely to decline in number in the near future. Here are some of the most notable security incidents, cyberattacks, and data breaches over 2021. 

ZDNet Recommends

January:Livecoin: Following an alleged hack in December, cryptocurrency exchange Livecoin slammed its doors shut and exited the market in January. The Russian trading post claimed that threat actors were able to break in and tamper with cryptocurrency exchange rate values, leading to irreparable financial damage. Microsoft Exchange Server: One of the most damaging cybersecurity incidents this year was the widespread compromise of Microsoft Exchange servers caused by a set of zero-day vulnerabilities known collectively as ProxyLogon. The Redmond giant became aware of the flaws in January and released emergency patches in March; however, the Hafnium state-sponsored threat group was joined by others for months after in attacks against unpatched systems. Tens of thousands of organizations are believed to have been compromised. MeetMindful: The data of over two million users of the dating app was reportedly stolen and leaked by a hacking group. The information leaked included everything from full names to Facebook account tokens. February:SITA: An IT supplier for aviation services around the world, SITA, said a security incident involving SITA Passenger Service System servers led to the exposure of personal, identifiable information belonging to airline passengers. Airlines involved in the data breach were then required to reach out to their customers. ATFS: A ransomware attack against payment processor ATFS forced multiple US cities to send out data breach notifications. The cybercriminal group which claimed responsibility, Cuba, claimed to have stolen a wide range of financial information on their leak site.  March:Mimecast: Due to the Solarwinds supply chain attack disclosed in December 2020, Mimecast found itself as a recipient of a malicious software update that compromised the firm’s systems. Mimecast said that its production grid environment had been compromised, leading to the exposure and theft of source code repositories. In addition, Mimecast-issued certificates and some customer server connection datasets were also caught in the breach. Tether: Tether faced an extortion demand from cyberattackers who threatened to leak documents online that would “harm the Bitcoin ecosystem.” The demand, of approximately $24 million or 500 Bitcoin (BTC), was met with deaf ears as the blockchain organization refused to pay. CNA Financial: CNA Financial employees were left unable to access corporate resources and were locked out following a ransomware attack which also involved the theft of company data. The company reportedly paid a $40 million ransom.April:Facebook: A data dump of information belonging to over 550 million Facebook users was published online. Facebook IDs, names, dates of birth, genders, locations, and relationship statuses were included in the logs, of which Facebook — now known as Meta — said was collected via scraping in 2019.May: Colonial Pipeline: If there was ever an example of how a cyberattack can impact the physical world, the cyberattack experienced by Colonial Pipeline is it. The fuel pipeline operator was struck by ransomware, courtesy of DarkSide, leading to fuel delivery disruption and panic buying across the United States. The company paid a ransom, but the damage was already done. Omiai: The Japanese dating app said unauthorized entry may have led to the exposure of data belonging to 1.7 million users.June:Volkswagen, Audi: The automakers disclosed a data breach impacting over 3.3 million customers and some prospective buyers, the majority of which were based in the United States. A finger was pointed at an associated vendor as the cause of the breach, believed to be responsible for exposing this data in an unsecured manner at “some point” between August 2019 and May 2021.JBS USA: The international meatpacking giant suffered a ransomware attack, attributed to the REvil ransomware group, which had such a disastrous impact on operations that the company chose to pay an $11 million ransom in return for a decryption key to restore access to its systems. July:UC San Diego Health: UC San Diego Health said employee email accounts were compromised by threat actors, leading to a wider incident in which patient, student, and employee data potentially including medical records, claims information, prescriptions, treatments, Social Security numbers, and more were exposed. Guntrader.uk: The UK trading website for shotguns, rifles, and shooting equipment said that records belonging to roughly 100,000 gun owners, including their names and addresses, had been published online. As gun ownership and supply are strictly controlled in the UK, this leak has caused serious privacy and personal safety concerns. Kaseya: A vulnerability in a platform developed by IT services provider Kaseya was exploited in order to hit an estimated 800 – 1500 customers, including MSPs. August:T-Mobile: T-Mobile experienced a yet-another data breach in August. According to reports, the names, addresses, Social Security numbers, driver’s licenses, IMEI and IMSI numbers, and ID information of customers were compromised. It is possible that approximately 50 million existing and prospective customers were impacted. A 21-year-old took responsibility for the hack and claimed to have stolen roughly 106GB of data from the telecoms giant. Poly Network: Blockchain organization Poly Network disclosed an Ethereum smart contract hack used to steal in excess of $600 million in various cryptocurrencies.Liquid: Over $97 million in cryptocurrency was stolen from the Japanese cryptocurrency exchange.September:Cream Finance: Decentralized finance (DeFi) organization Cream Finance reported a loss of $34 million after a vulnerability was exploited in the project’s market system.AP-HP: Paris’ public hospital system, AP-HP, was targeted by cyberattackers who managed to swipe the PII of individuals who took COVID-19 tests in 2020. Debt-IN Consultants: The South African debt recovery firm said a cyberattack had resulted in a “significant” incident impacting client and employee information. PII, including names, contact details, salary and employment records, and debts owed, are suspected of being involved. October:Coinbase: Coinbase sent out a letter to roughly 6,000 users after detecting a “third-party campaign to gain unauthorized access to the accounts of Coinbase customers and move customer funds off the Coinbase platform.” Cryptocurrency was taken without permission from some user accounts. Neiman Marcus: In October, Neiman Marcus made a data breach that occurred in May 2020 public. The intrusion was only detected in September 2021 and included the exposure and potential theft of over 3.1 million payment cards belonging to customers, although most are believed to be invalid or expired.  Argentina: A hacker claimed to have compromised the Argentinian government’s National Registry of Persons, thereby stealing the data of 45 million residents. The government has denied the report. November:Panasonic: The Japanese tech giant revealed a cyberattack had taken place  — a data breach occurring from June 22 to November 3, with discovery on November 11 — and admitted that information had been accessed on a file server. Squid Game: The operators of a cryptocurrency jumping on the popularity of the Netflix show Squid Game (although not officially associated) crashed the value of the SQUID token in what appears to be an exit scam. The value plummeted from a peak of $2,850 to $0.003028 overnight, losing investors millions of dollars. An anti-dumping mechanism ensured that investors could not sell their tokens — and could only watch in horror as the value of the coin was destroyed. Robinhood: Robinhood disclosed a data breach impacting roughly five million users of the trading app. Email addresses, names, phone numbers, and more were accessed via a customer support system. December:Bitmart: In December, Bitmart said a security breach permitted cyberattackers to steal roughly $150 million in cryptocurrency and has caused total losses, including damages, to reach $200 million.Log4j: A zero-day vulnerability in the Log4j Java library, a remote code execution (RCE) flaw, is now being actively exploited in the wild. The bug is known as Log4Shell and is now being weaponized by botnets, including Mirai. Kronos: Kronos, an HR platform, became a victim of a ransomware attack. Some users of Kronos Private Cloud are now facing an outage that may last weeks — and just ahead of Christmas, too.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Replicable attacks and a low barrier to entry will ensure the rate of supply chain attacks increases next year, cybersecurity researchers have warned. 

ZDNet Recommends

Best security key 2021

While robust passwords go a long way to securing your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.

Read More

The supply chain is a consistent attack vector for threat actors today. By compromising a centralized service, platform, or software, attackers can then either conduct widespread infiltration of the customers and clients of the original — singular — victim or may choose to cherry-pick from the most valuable potential targets. This can save cybercriminals time and money, as one successful attack can open the door to potentially thousands of victims at once.  A ransomware attack levied against Kaseya in 2021 highlighted the disruption a supply chain-based attack can cause. Ransomware was deployed by exploiting a vulnerability in Kaseya’s VSA software, leading to the compromise of multiple managed service providers (MSP) in Kaseya’s customer base.  However, it was only a small number of businesses that were impacted in this case. One of the most powerful examples in recent years is the SolarWinds breach, in which a malicious software update was deployed to roughly 18,000 clients.  The attackers behind the intrusion then selected a handful of high-profile customers to compromise further, including numerous US government agencies, Microsoft, and FireEye.   In an analysis of 24 recent software supply chain attacks, including those experienced by Codecov, Kaseya, SolarWinds, and Mimecast, the European Union Agency for Cybersecurity (ENISA) said that the planning and execution stage of supply chain attacks are usually complex — but the attack methods often chosen are not.

Supply chain attacks can be conducted through the exploitation of software vulnerabilities; malware, phishing, stolen certificates, compromised employee credentials & accounts, vulnerable open source components, and firmware tampering, among other vectors. But what can we expect from supply chain security in 2022? Low barriers to entrySpeaking to ZDNet, Ilkka Turunen, Field CTO of Sonatype, said that malicious software supply chain activity is likely to increase in 2022 due to low barrier to entry attack methods, such as dependency confusion — which is a “highly replicable” attack method.  “It’s a no-brainer to use if the actor’s goal is to affect as many organizations as possible,” Turunen commented. “Add a cryptominer to a dependency confusion attack, and not only does a company need to worry about the effects this has on their software ecosystem, but the actor has now monetized it.” Brian Fox, the CTO of the enterprise software company, added that the majority of threat actors are copycats today, and “fad” attacks — or, the ‘attack of the day’ conducted by fast-acting threat actors — are going to increase the number of supply chain intrusions next year. Read on: Technology and the Global Supply Chain | Supply chain security is actually worse than we think | 91% of IT leaders affected by supply chain disruption: survey |Increasing attacks while redefining the perimeterIn a world of Internet of Things (IoT) devices, old security models, working from home stipulations, hybrid cloud/on-prem setups, and complicated digital supply chains are no longer suitable. According to Sumo Logic’s CSO George Gerchow, enterprise players are “still struggling” with the concept of not having a defined defense perimeter. While also pressing ahead with digital transformation projects, they are failing to account for the expanded attack surface new apps and services can create. “CISOs and IT security teams still don’t have a seat at the table, and security is still being bolted on as the last step in the process. In the next year, the leadership teams at organizations will start to wake up to this. Management boards are becoming more security conscious due to the hype around ransomware and extortion, which forces them to care about security problems.” Companies now increasingly reliant on components, platforms, and services provided at different levels of a supply chain will also have to wake up to this reality, and as a result, security will need to be checked — and reinforced — including outside of a businesses’ own networks. Ransomware incidents will increaseRansomware is now one of the most lucrative aspects of the cybercriminal world, with high illicit payments made and due to the extortion tactics used, including permanent encryption and the threat of sensitive information being released.  With a record blackmail payment made in 2021 of $40 million, ransomware will likely begin to make more of an appearance in supply chain attacks.  However, these take planning, knowledge, and some skill — and so Splunk security strategist Ryan Kovar believes that cybercriminals on the road to becoming “professional” will likely be the ones to combine ransomware and supply chain attack vectors.  “Through attacking the supply chain, attackers can hold an organization’s data for ransom, and research indicates that two-thirds of ransomware attacks are enacted by low-level grifters who bought ransomware tools off the Dark Web,” Kovar says. “With the ongoing supply chain crisis leaving supply lines more vulnerable than ever, organizations must prepare themselves for the inevitability of ransomware attacks to their supply chains.” Technical debt will have to be paid As enterprise organizations begin to analyze the digital supply chain for weak spots, they will also have to deal with their levels of “technical debt” — described by Stuart Taylor, Senior Director at Forcepoint X-Labs, as the difference between “the ‘price’ a technical project should cost in order to be future-proofed and secure, and the ‘price’ an organization is prepared to pay in reality.” Forcepoint expects to see a “significant” rise in copycat attacks against the supply chain next year, and so organizations are urged to conduct frequent code reviews and to keep security in mind during every step in the development and deployment process. Taylor commented:”Software still in use can’t be left to languish, with updates and patching ignored. That couldn’t be an easier way in for attackers to gain a foothold. None of these are small undertakings in themselves but compared to the destruction that software supply chain malware can cause, it’s something no organization can afford to ignore.” SBOMsThe lack of transparency surrounding the components, software, and security posture of players within a supply chain also continues to be a problem for today’s vendors. In light of recent, debilitating attacks such as Solarwinds, Gary Robinson, CSO at Uleska, believes that over the next 12 months, more companies will require a security-orientated Bill of Materials (SBOMs), potentially as part of due diligence in future supply chain business agreements.  SBOMs are software and component inventories designed to enforce open transparency around software use in the enterprise. They may include supplier lists, licenses, and security auditing assurances.  “Organizations will also move to Continual Security Assurance where suppliers will be required to provide up-to-date security reports,” Robinson predicts. “No longer will a security report from six months ago satisfy security concerns of an update delivered yesterday. This gap in security directly relates to the company’s own security assurance, and suppliers will need to catch up.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Rhode Island Attorney General Peter Neronha told The Providence Journal on Thursday that he is going to open an investigation into a data breach involving the Rhode Island Public Transit Authority (RIPTA). This comes after outrage grew this week over the agency’s handling of the incident.  Neronha’s office told the news outlet that they are receiving a high number of calls about the incident, prompting them to look into what happened. 

On December 21, RIPTA sent out a notice saying that August 5 was when it first identified a “security incident.” RIPTA eventually discovered that data was exfiltrated from their systems between August 3 and August 5. The files contained information about RIPTA health plans and included Social Security numbers, addresses, dates of birth, Medicare identification numbers and qualification information, health plan member identification numbers, and claims information.The US Department of Health and Human Services breach website indicates that 5,015 people were affected.Earlier this week, the ACLU of Rhode Island asked RIPTA to explain why the personal information of people with no connection to the agency was included in the data breach.Local ACLU chapter executive director Steven Brown says his chapter has received complaints from people who got letters from RIPTA notifying them that their personal data, including personal health care information, was accessed in a security breach of RIPTA’s computer systems. “According to the letter, the breach was identified on August 5th, but it was purportedly not until October 28th — over two and a half months later — that RIPTA identified the individuals whose private information had been hacked, and it then took almost two more months to notify those individuals,” Brown wrote. 

The letters reveal that the number of victims listed on the US Department of Health and Human Services website (5,015) does not match the number in the breach notices sent to victims: 17,378 people.”Worst — and most inexplicable — of all, the people who have contacted us are even more deeply distressed by the fact that RIPTA somehow had any of their personal information — much less their personal health care information — in the first place, as they have no connection at all with your agency,” Brown added.The ACLU also said that RIPTA was not being transparent about the breach, noting that RIPTA’s public statements about the incident are very different than the letters being sent to victims. RIPTA’s initial statement implied that those affected were only the beneficiaries of RIPTA health plans. “Based on the complaints we have received, this is extremely misleading and seriously downplays the extensive nature of the breach. Most importantly, it ignores, and fails to address, a host of questions regarding how the information that was hacked was in RIPTA’s hands in the first place,” Brown wrote.RIPTA senior executive Courtney Marciano told ZDNet that the state’s previous health insurance provider sent the files that included the sensitive information of those not working for RIPTA.Marciano added that RIPTA only mailed out notification letters to individuals whose personal information was contained in the files (which are from a provider who administered a plan that is no longer active) and accessed by the hackers. The Providence Journal noted that RIPTA previously used UnitedHealthcare but now uses Blue Cross/Blue Shield of Rhode Island. “Upon discovering this incident, RIPTA worked diligently to verify all individuals (both internal RIPTA employees, as well as individuals outside of the agency) whose personal information was in the files that were accessed or infiltrated by an unauthorized party. After the analysis was complete, RIPTA searched its records and identified address information for those individuals,” Marciano said. “This process was time and labor-intensive, but RIPTA wanted to be certain what information was involved and to whom it pertained. No passenger information was compromised.”The situation caused even more outrage when Rep. Edith Ajello told The Providence Journal that her information was involved in the breach despite her never having been on a RIPTA bus in “almost a decade.” Ajello explained that when she pressed RIPTA to explain why her information was involved, she was told that UnitedHealthcare sent RIPTA “all state employees’ health claims.” This allegedly forced the agency to effectively sort through the entire batch to figure out which claims were from RIPTA employees.The Attorney General will now investigate whether RIPTA violated Rhode Island’s Identity Theft Protection Act of 2015, which gives government agencies 45 days to report a breach. It took RIPTA more than two months to notify victims.  More