Welcome back to GlobalSign’s weekly news round-up. Naturally, hackers continue to do their dirty work. It was revealed this week that patients at a mental health clinic in Finland were targeted by a hacker who has stooped so low as to attempt to extort payments from them. This follows the hacker gaining access to their medical records from therapy sessions. The hacker emailed more than 40,000 patients, and is threatening to leak the records onto the internet unless the patients – some of them underaged -- provide payment in bitcoin.
Swedish security firm Gunnebo was hacked. It is deeply concerning since it is believed that many of the documents are security blueprints, including details regarding at least two German banks and the Swedish parliament. Hopefully, the data of its other clients – which include several nuclear power plants – are safe.
Then, it was revealed yesterday that hackers stole $2.3 million from the Wisconsin Republican Party’s account that was being used to help reelect President Donald Trump. The party first became aware of suspicious activity on October 22 and then contacted the FBI, which is now investigating the matter.
In business news, the biggest story of the week was indeed the announcement that AMD is acquiring Xilinx for $35 billion. This is the latest announcement shaking up the semiconductor industry, which has seen other deals in recent months such as Nvidia’s intention to acquire Arm.
That’s a wrap of the week. Grab a cup of joe to read these stories. Have a great weekend!
Top Industry News
Tech Radar (October 29, 2020) Nuclear power stations, airports at risk after hackers breach security giant
"Swedish security firm Gunnebo, which boasts a variety of high-level customers, including airports, banks, government agencies and nuclear plants, has had important documents stolen following a substantial hacking operation. Although the hack took place some months ago, the effects of the break-in are only just coming to light.
Back in March, Gunnebo Group was informed by KrebsOnSecurity that hackers had infiltrated its network and sold access to a criminal group with a history of deploying ransomware attacks. Some months later, Gunnebo confirmed that it had been the victim of a cyberattack but believed that due to its fast response, the impact would be insignificant.
It has now been revealed, however, that 38,000 documents were stolen during the attack and subsequently uploaded to a public server. It is thought that many of the documents are security blueprints, including details regarding at least two German banks and the Swedish parliament."
Techno Paedia (October 29, 2020) Officials Warn of Cyberattacks on Hospitals as Virus Cases Spike
"Hundreds of American hospitals are being targeted in cyberattacks by the same Russian hackers who American officials and researchers fear could sow mayhem around next week’s election.
The attacks on American hospitals, clinics and medical complexes are intended to take those facilities offline and hold their data hostage in exchange for multimillion-dollar ransom payments, just as coronavirus cases spike across the United States.
'We expect panic,' one hacker involved in the attacks said in Russian during a private exchange on Monday that was captured by Hold Security, a security company that tracks online criminals.
Some hospitals in New York State and on the West Coast reported cyberattacks in recent days, though it was not clear whether they were part of the attacks, and hospital officials emphasized that critical patient care was not affected."
Associated Press (October 29, 2020) Wisconsin Republican Party says hackers stole $2.3 million
"Hackers stole $2.3 million from the Wisconsin Republican Party’s account that was being used to help reelect President Donald Trump in the key battleground state, the party’s chairman told The Associated Press on Thursday.
The party noticed the suspicious activity on Oct. 22 and contacted the FBI on Friday, said Republican Party Chairman Andrew Hitt.
Hitt said the FBI is investigating. FBI spokesman Leonard Peace did not immediately return a message seeking comment.
The attack was discovered less than two weeks before Election Day as both Trump and Democratic rival Joe Biden made their final push to win Wisconsin and its 10 electoral votes."
Data Breach Today (October 28, 2020) Aetna Fined $1 Million After 3 Data Breaches
"Federal regulators have slapped health insurer Aetna with a $1 million HIPAA settlement for three 2017 breaches - including a mailing incident that exposed HIV information - that occurred within six months. The incident involving the exposure of nearly 12,000 health plan members' HIV information previously resulted in $3 million worth of settlements in 2018 and 2019 with several state attorneys general plus a $17.2 million class action lawsuit settlement.
In a statement Wednesday, the Department of Health and Human Services' Office for Civil Rights says its investigation into the three incidents involving impermissible data disclosures revealed a number of HIPAA deficiencies."
DW.com (October 28, 2020) Coronavirus: Cyberattack blamed for delay in Germany's health data
"The Robert Koch Institute (RKI), Germany's national institute for disease control, was the target of a cyberattack that delayed publication of daily coronavirus numbers on Wednesday. The attack was the second in less than a week.
In both cases, hackers hit the RKI's website with so-called Distributed Denial of Service (DDoS) attacks, which use hijacked computers and automated bots to overwhelm a website, causing it to freeze or crash, the ITZBund federal agency for information technology said.
Germany's Federal Office for Information Security (BSI) offered the RKI technical assistance in defending itself against future attacks — while at the same time emphasizing that the RKI is in fact capable of successfully defending itself against them."
Tech Crunch (October 28, 2020) True, the social networking app that promises to protect your privacy, exposed private messages and user locations
"True bills itself as the social networking app that will “protect your privacy.” But a security lapse left one of its servers exposed — and spilling private user data to the internet for anyone to find.
The app was launched in 2017 by Hello Mobile, a little-known virtual cell carrier that piggybacks off T-Mobile’s network. True’s website says it has raised $14 million in seed funding, and claimed more than half a million users shortly after its launch.
But a dashboard for one of the app’s databases was exposed to the internet without a password, allowing anyone to read, browse and search the database — including private user data."
CRN (October 27, 2020) The $35B AMD-Xilinx Acquisition: 7 Big Things To Know
"In a little over a month after Nvidia announced a $40 billion deal to acquire Arm, its GPU rival, AMD, announced its own mega chip deal with its plan to acquire FPGA maker Xilinx for $35 billion.
AMD, based in Santa Clara, Calif., announced the deal Tuesday morning at the same time the chipmaker released its third-quarter earnings results, where the company reported a $2.8 billion in quarterly revenue that quarter, marking a 56 percent year-over-year increase.
In AMD’s earnings call, AMD CEO Lisa Su (pictured) was joined by Xilinx CEO Victor Peng to discuss the deal and how it will make the combined entity “the industry’s high-performance computing leader.”
'We’re not doing M&A for M&A’s sake,' Su said on the call. 'I mean, this is such a unique opportunity. There actually is no better match in the industry for us than Xilinx.'"
Politico (October 26, 2020) Hacker seeks to extort Finnish mental health patients after data breach
"A hacker is trying to blackmail tens of thousands of Finnish patients after gaining access to their medical records from therapy sessions, in what experts and the country's top politicians called a "shocking" cyberattack.
Police said on Saturday that a hacker had started emailing more than 40,000 patients whose data was stolen from the Vastaamo psychotherapy center, local media reported.
The attacker or attackers — it is unclear who or how many are behind the attack — is threatening to leak mental health records onto the internet unless the patients provide payment in bitcoin. Some of the people whose data has been stolen are underaged."
OTHER INDUSTRY NEWS
How Vulnerable Is Critical Infrastructure to a Cyberattack?
Forrester Predictions 2021: The Path To A New Normal Demands Increased Cybersecurity Resilience
Fake COVID-19 survey hides ransomware in Canadian university attack
WastedLocker ransomware hits Boyne Resorts ski resort operator
The biggest data breach fines, penalties and settlements so far
Police Battle Criminal Abuse of Cryptocurrency, Encryption
Luxembourg: PSD2 Not Incompatible With The GDPR But Attention Required
Like what you’re reading? Head to the Subscriber form in the sidebar to get insightful GlobalSign content delivered directly to your inbox.
