CYBER SECURITY NEWS – WEEK OF SEPTEMBER 09, 2024

Hearing Aid Company WS Audilogy Breach: Patients Info, Employees’ Bank Details Leaked

• WS Audiology, the third-largest global hearing aid company and second-largest in Denmark, has fallen victim to a cyberattack that has compromised sensitive personal data.
• The breach, which impacted IT systems in Australia, New Zealand, Singapore, and Hong Kong, was first detected by WS Audiology’s Hong Kong office on July 5, 2024.
• WS Audiology is still assessing the full scope of the data breach and its financial implications
• The company has notified the Office of the Privacy Commissioner of Personal Data and is actively cooperating with the authority
• Stolen information includes patients’ names, birth dates, gender, addresses, phone numbers, email addresses, health information, audiologist details, hearing aid information, visit data, and current and former employees’ salary and bank account details

*Source

Mystery database containing sensitive info on 762,000 car-owners discovered by researchers

• In early August, cybersecurity researchers from Cybernews discovered an unprotected database containing sensitive information on 762,000 car owners in China.
• This database, found using Elasticsearch, included personal details such as names, ID numbers, phone numbers, email addresses, postal addresses, birth dates, vehicle identification numbers (VIN), car brands, models, engine numbers, and vehicle colors.
• The comprehensive nature of this data raises significant concerns about potential identity theft and financial fraud.
• The origin of the database remains unknown, as it was hosted on a US-based IP address and was secured within 48 hours of its discovery.

*Source

Microchip Technology confirms data was stolen in cyberattack

• Microchip Technology, a major semiconductor supplier, has confirmed that employee information was stolen in an August cyberattack claimed by the Play ransomware gang.
• The attack impacted the company’s manufacturing operations and forced it to shut down and isolate affected systems to contain the breach.
• The company is still investigating the extent of the breach but believes employee contact information and encrypted passwords were stolen.
• The Play ransomware group claims to have stolen a wide range of confidential data including client documents, budgets, payroll, accounting, contracts, taxes, IDs, and financial information.

*Source

Car rental giant Avis discloses data breach impacting customers

• Avis, a prominent American car rental company, disclosed a data breach affecting customer personal information, which occurred in early August 2024.
• The breach was detected on August 5, and an investigation revealed that unauthorized access to a business application lasted from August 3 to August 6. During this time, attackers managed to steal personal information, including customer names and other sensitive data.
• Following the incident, Avis took immediate action to block the attacker and has since collaborated with external cybersecurity experts to enhance security measures for the affected application.
• Avis has warned customers about potential risks of identity theft and fraud, advising them to monitor their account statements and credit history for any unauthorized activity.
• To assist affected customers, Avis is offering a free one-year membership to Equifax’s credit monitoring service, which helps detect and resolve identity theft issues.

*Source

33,928 Bank Customers Receive Data Breach Alerts As US Lenders Warn Personal Information Fumbled

• Recent data breach alerts have been issued by two U.S. banks, USAA Bank and the Bank of Clarke, affecting a total of approximately 33,928 customers.
• In USAA Bank Incident A “system error” during a routine update caused around 32,276 customers’ documents to be sent to incorrect accounts.
• Exposed personal information may include names, addresses, email addresses, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, vehicle identification numbers, loan numbers, health information, and property insurance policy details.
• USAA, primarily serving military personnel and their families, has stated that there is no evidence of misuse of the exposed information to date.
• The Bank of Clarke reported a separate breach where an unauthorized third party accessed an employee’s email account on June 17, 2024.
• The bank has not disclosed the specific types of personal information exposed, only confirming that customers’ names were included.
• Both banks have filed notifications with the Office of the Maine Attorney General regarding these breaches.

*Source

Halliburton confirms data stolen in recent cyberattack

• Halliburton has confirmed that sensitive data was stolen in a recent cyberattack attributed to the RansomHub ransomware gang. In a filing with the Securities and Exchange Commission (SEC), Halliburton stated that an unauthorized third party accessed and exfiltrated information from its systems.
• While Halliburton has not disclosed specific details about the attack to the media or its customers, it is actively communicating with stakeholders and assessing the need for notifications.
• The company believes the financial impact of the breach will be minimal, although it acknowledges potential risks related to litigation and reputational damage.

*Source

SECUREFACT ARCHIVE >