2022 Week 22 Security review
Summary
Hopefully, these will be a bit more regular now that the semester is over.
We are seeing attacks against all infrastructure areas increasing. This week's report has school breaches, SLTT breaches, SCADA news, and several healthcare attacks.
News
SLTT
Texas Department of Transportation had a data breach that impacted over 7,000 records. This included employee information with PII including Social Security Numbers (SSN).
The Texas Department of Insurance (TDI) announced that 1.9 million people in the state who filed claims for compensation had their information publically available from March 2019 to January 2022.
K-12 schools in Fort Sumner New Mexico and Washington Ohio were attacked by CIOp ransomware group. This group is an Eastern European threat actor. In general cyber attacks against schools have been VERY high.
Chicago Public Schools announced a data breach that involved PII of about 500,000 students and 56,000 employees. The breach occurred as part of a larger ransomware attack on a 3rd party supplier Battelle for Kids.
IBM is expanding its free cybersecurity services for k-12 schools. Last year there were 6 schools that received the free services, and that has been increased to 10 schools this year.
Somerset County New Jersey had a ransomware attack that affected several county functions including email. The county said they had active their Emergency Operations Center and were working off their Continuity of Operations of Government Plan.
Data from a Linn County, Oregon data breach was released this week. County officials decided not to pay the ransom as they felt they had sufficient backups and the data was not sensitive in nature. They indicated that they were able to recover from backups by the end of the week at the time of the attack. After working with consultants who contacted the Conti threat actors, it was decided that any data would be considered open records under Oregon law, so there was no harm in its release.
I think it is important to note here, that this seems to signal that Conti has been reorganized and is "back in business" after the actions of the last 2 years caused many to go underground.
General SCADA/ICS
Cisco Talos announced that they have found 8 vulnerabilities in the Open Automation Software version 16.00.0112. This software is used to transfer data between devices and applications in a SCADA system. They are listed as:
DarkReading has a really good summary of the cyber challenges we have with the growth of Industry 4.0. This is one of the areas of research I have written some papers about and it is good to see there is some exposure outside academia. We as a society are going to have to embrace security as we build smarter more automated production or all the gains can become a HUGE Trojan Horse.
Healthcare
The United States Senate Health, Education, Labor, and Pensions Committee held a hearing on how the federal government can assist health and education sectors with their cyber security posture. This comes as attacks against Health and Education have taken a raise over the last couple of years.
Almost 200,000 patients have been notified of a breach from Regional Eye Associates which is in West Virginia. It appears to be tied to several other provider notices due to a ransomware attack on a cloud-based electronic medical record vendor.
Greenland health services are severely limited due to a cyberattack. There is some belief that this might be tied to a previous attack in April.
The UK's central cyber center the National Cyber Security Centre (NCSC) released a report that indicated vaccine-related Phishing is a big attack vector. This makes sense given the importance of vaccines right now.
Aerospace
SpiceJet, India's 2nd largest air carrier, announced it was the victim of an attack, but was able to successfully defend its servers prior to full take-over. Customers saw flight delays and were not able to book online for several hours
Legislative actions
The U.S. House and Senate have both passed a bill that seeks to help the federal and SLTT governments work together to combat cybercrime by directing the Cybersecurity and Infrastructure Security Agency (CISA) to develop a strategy to set baseline objectives for SLTT cyber efforts. It also establishes a $500 million cost-sharing grant to increase cyber funding to SLTT's.
Comments
Post a Comment