CYBER SECURITY NEWS – WEEK OF AUGUST 26, 2024

European Parliament Faces Data Breach: Noyb Files Complaints with EDPS Over GDPR Violations

• The European Parliament is facing significant scrutiny following a data breach that compromised the personal information of over 8,000 current and former employees.
• The breach occurred in the Parliament’s recruitment platform, known as “PEOPLE,” and involved sensitive data such as ID cards, passports, and even marriage certificates, which could expose applicants’ sexual orientations.
• Privacy advocacy group noyb has filed two complaints with the European Data Protection Supervisor (EDPS), citing violations of the EU General Data Protection Regulation (GDPR) and calling for corrective actions and potential fines.

*Source

CannonDesign confirms Avos Locker ransomware data breach

• CannonDesign, a prominent architectural and engineering firm, has confirmed a data breach that occurred in early 2023 due to an Avos Locker ransomware attack.
• The breach resulted in the theft of 5.7 TB of data, including names, addresses, social security numbers, and driver’s license numbers of over 13,000 clients.
• The attack took place between January 19-25, 2023, but CannonDesign only discovered the intrusion on January 25 and completed the investigation on May 3, 2024.
• The stolen data was subsequently published online multiple times by various hacker groups, including Dunghill Leaks in September 2023 and on dark web forums in February and July 2024.
• CannonDesign is offering 24-month credit monitoring through Experian to affected individuals to mitigate the risks associated with the data exposure, although the notification comes with a significant delay.

*Source

US oil giant Halliburton confirms cyberattack behind systems shutdown

• Halliburton, a major player in the energy sector, confirmed that it was the target of a cyberattack that led to the shutdown of some of its systems on August 21, 2024.
• The company reported to the U.S. Securities and Exchange Commission (SEC) that an unauthorized third party gained access to its systems, prompting an immediate activation of its cybersecurity response plan and an internal investigation, supported by external advisors.
• To contain the breach, Halliburton proactively took certain systems offline and notified law enforcement.

*Source

Toyota confirms third-party data breach impacting customers

• Toyota has confirmed a data breach involving customer information due to a third-party incident.
• A hacker group known as ZeroSevenGroup leaked 240GB of stolen data on a hacking forum, claiming to have accessed a U.S. branch of Toyota.
• The leaked data includes sensitive information about employees and customers, financial documents, and network infrastructure details.
• Toyota stated that while they are aware of the situation, their own systems were not compromised.
• The breach appears to have originated from a third-party entity misrepresented as Toyota, although the company has not disclosed the name of this entity.

*Source

Data leak affecting everyone in the US, UK, and Canada was even worse than we thought

• A significant data leak has exposed the personal information of nearly everyone in the US, UK, and Canada, revealing around 2.7 billion records that include names, mailing addresses, and social security numbers.
• Alarmingly, this data was not encrypted, making it highly vulnerable.
• Recent reports indicate that the situation worsened when a partner company accidentally published its own login credentials on its homepage, allowing unrestricted access to the sensitive data.
• Additionally, another data broker inadvertently disclosed its database passwords in a publicly accessible file.
• The exposed records suggest that users were assigned a common six-character password, many of whom failed to change it, further increasing the risk of unauthorized access.

*Source

FlightAware configuration error leaked user data for years

• A configuration error at FlightAware, a major flight tracking platform, has led to the exposure of user data for over three years, from January 1, 2021, until its discovery on July 25, 2024.
• The error may have compromised personal information, including user IDs, passwords, email addresses, and potentially other sensitive data such as full names, addresses, IP addresses, and Social Security numbers.
• In response, FlightAware is requiring affected users to reset their passwords upon their next login and is offering a 24-month identity protection package through Equifax.

*Source