Welcome to GlobalSign’s latest cybersecurity news wrap up.
I think it’s safe to say what’s on many minds this week is what happened at a Florida water treatment facility.
The attack was downright frightening and it’s clear that some attackers are nothing but terrorists with good computer skills. If there’s any silver lining here it is that governments around the world are starting to take cybersecurity much more seriously. As you’ll read in our latest post, just this week the United Nations announced that members are forming a new ‘cyber group’. The final straw for them was December’s unprecedented SolarWinds hack. After that, it seems everyone said enough is enough.
Increasing efforts to thwart cyber criminals is very good to see. Let’s hope more can be done to reign them in. After all, it’s disheartening when you know some of them actually have customer service departments (or at least back when this article was written several years ago.)
Meantime, here’s the rundown of other noteworthy cybersecurity moments from the last week:
- Hackers posted detailed patient medical records from two hospitals on the dark web. The files come from the Leon Medical Centers, which serves eight locations in Miami, and Nocona General Hospital, which has three locations in Texas. Some of the grab includes tens of thousands of scanned diagnostic results and letters to insurers, as well as a folder containing background checks on hospital employees.
- The developers of the video game "Cyberpunk 2077" revealed they were the victim of a "targeted cyber attack" involving ransom. Data impacted by the breach includes full copies of the source codes for games including Cyberpunk and "The Witcher 3”.
- Credit reporting agency Experian says despite reports of a data breach at a Brazilian subsidiary, they couldn’t find any evidence of one. On February 8, Experian said it had launched a “detailed forensic investigation” following reports that sensitive personal data belonging to more than 220 million Brazilians was being sold online.
- British police arrested eight people as part of an investigation into the Sim-swapping hijacking of US celebrities’ phones. The National Crime Agency (NCA) said sports stars, musicians and their families had been targeted by the scam in which criminals gained access to victims’ phones or accounts.
- Miss England beauty queen contestants were targeted by cybercriminals. The competition’s Instagram account was hacked last week by Turkish scammers, who demanded cash to hand back control.
- A security researcher figured out a way to hack older Nespresso coffee machine smart cards in order to obtain virtually unlimited free drinks. The hack, developed by Belgian security researcher Polle Vanhoof, offers a mechanism to meddle with commercial Nespresso coffee machines by dumping and modifying their custom stored-value cards.
- Finally, on Wednesday evening, CISA had a little fun with Jeopardy. In a week when we learned that cybercriminals are trying to poison our water supply, we needed a little laugh. (And although it’s not security-related at all, the “I’m not a cat” Zoom moment was a pretty good one!!)
That’s a wrap. Have a great weekend everyone!
Top Global Security News
Wall Street Journal (February 11, 2021) U.N. Members Plan New Cyber Group as States Suffer Large-Scale Hacks
"European diplomats are pushing to create a long-term United Nations group that would consider how to respond to government-sponsored cyberattacks, while also involving companies in discussions about how to design secure technology.
France is spearheading a proposal to establish the group, which would replace U.N. forums on cybersecurity that will end this year. Large-scale cyberattacks such as last year’s SolarWinds hack on companies and government offices in the U.S. underline the need for more international cooperation on cybersecurity issues, diplomats say.
Expelling diplomats or imposing economic sanctions might be warranted after serious state-sponsored cyber operations, Johanna Weaver, a special adviser to Australia’s ambassador for cyber affairs, said Tuesday at an online event hosted by the Estonian government."
READ MORE (subscription required)
ZDNet (February 8, 2021) Hacker modified drinking water chemical levels in a US city
"An unidentified hacker has accessed the computer systems for the water treatment facility in the city of Oldsmar, Florida, and has modified chemical levels to dangerous parameters. The intrusion took place on Friday, February 5, when the hacker accessed a computer system that was set up to allow for the remote control of water treatment operations.
"Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners. It's also used to control water acidity and remove metals from drinking water in the water treatment plant," said Oldsmar Sheriff Bob Gualtieri.
"The hacker changed the sodium hydroxide from about 100 parts per million to 11,100 parts per million. This is obviously a significant and potentially dangerous increase.""
USA Today (February 8, 2021) 'Cyberpunk 2077' creators say they're victim of ransomware hack
"The developers of the video game "Cyberpunk 2077" said they were the victim of a "targeted cyber attack" involving a requested ransom.
In a tweet published early Tuesday, CD Projekt Red said that to the best of its knowledge, the compromised systems did not contain any personal data from players or users of their services.
Data impacted by the breach includes full copies of the source codes for games including Cyberpunk and "The Witcher 3," said a ransom note received and shared by CD Projekt Red. The hacker's note said the haul included accounting, HR and legal documents and that they had encrypted servers to prevent CD Projekt Red from accessing the data if the company didn't accede to their wishes."
The Register (February 10, 2021) 8 Brits arrested after probe into SIM-swapping scam targeting US celebs
"Brit cops have cuffed eight men in England and Scotland amid a probe into SIM-swapping attacks on high-profile US targets – including sports stars, musicians, and "influencers" – that had money and personal data stolen.
The suspects, aged between 18 and 26, were nabbed in an operation co-ordinated by Police Scotland, the Metropolitan Police, East Midlands and North East Special Operations Units, and the West Midlands Organised Crime Unit.
The arrests are part of an inquiry in the UK by the National Crime Agency, in conjunction with the US Secret Service, Homeland Security Investigations, the FBI, and the Santa Clara California District Attorney's Office."
NBC News (February 5, 2021) Hackers post detailed patient medical records from two hospitals to the dark web
"Hackers have published extensive patient information from two U.S. hospital chains in an apparent attempt to extort them for money.
The files, which number in at least the tens of thousands and were posted to a blog on the dark web that the hackers use to name and extort their victims, includes patients’ personal identifying information, like their names, addresses and birthdays, as well as their medical diagnoses. They come from the Leon Medical Centers, which serves eight locations in Miami, and Nocona General Hospital, which has three locations in Texas.
The files also include at least tens of thousands of scanned diagnostic results and letters to insurers. One folder contains background checks on hospital employees."
Other Industry News
Experian investigating data breach claims in Brazil
Facebook, Instagram, TikTok and Twitter Target Resellers of Hacked Accounts
European Data Protection Board lays out data breach notification guidelines for organizations
Hackers Targeted Financial Sector in Mass Extortion Campaign (Requires WSJ subscription)
Author of uPanel phishing kit arrested in Ukraine
Miss England contestant’s Instagram accounts Hacked
Older Nespresso machines hacked – people get free coffee
U.S. Digital ID bill to make a comeback
Like what you’re reading? Head to the Subscriber form in the sidebar to get insightful GlobalSign content delivered directly to your inbox.
