Data Breaches

Unfortunately, there’s lots to talk about in this week’s Data Breaches and Exposures. First up, Discover has issued new cards to some of its members, due to a data breach at one of its merchants from August of 2018.

Airbus has announced a cyberattack has breached its commercial aircraft business and exposed employee information to attackers.

France-based video-sharing site Dailymotion has reset passwords of an unknown number of users after a large-scale credential stuffing attack. Credential stuffing means taking many usernames and passwords from breached sites and trying to see if they work different sites. This often proves effective because many users recycle passwords.

Minnesota’s Department of Human Services started sending letters on Wednesday about a data breach resulting from an employee falling for a phishing email on September 28 of last year. There aren’t any details about how many records were affected, but the employee had access personally identifiable information of both employees and clients.

Two successful phishing attacks against Verity Health System and Verity Medical foundation have resulted in data breaches. One breach occurred in November, the other in Mid-January, the full scope isn’t yet known, but they are certain both PII and PHI were compromised in the attacks.

Singapore’s Ministry of Health reported that it doesn’t know who, it doesn’t know how, but someone got hold of personal health records for about 14,000 HIV positive people. 5,400 locals and 8,800 foreigners who were diagnosed with HIV were exposed in this breach. These records were published online and have since been removed, but since Singapore doesn’t know who did it, they can’t delete all copies of the records.

Colorado-based Critical Care, Pulmonary & Sleep Associates notified 23,000 patients that their data may have been breached during a phishing attack this week.

Integrity House, a New Jersey-based addictions recovery provider, was physically broken into and had devices stolen containing protected health information of its clients. Approximately 7,000 patients were impacted.

Ontario, Canada-based Belleville General Hospital fired a nurse for accessing hundreds of patient records without permission. The nurse accessed names, dates of birth, and health information for an unspecified period.

A ransomware attack on a Florida-based OB-GYN specialist has resulted in some protected health information being lost. Fortunately, this data wasn’t lost due to exposure, but because the clinic refused to pay the ransom. Most of the data was restored from back up after the infected servers were cleaned.

This week also brings with it another breach of smart home devices. This time a self-described “smart home aficionado” heard a deep male voice talking to his child through his Nest baby monitor. In addition, the attacker had also turned the home’s Nest thermostat up to 90 degrees. The home owner had been using a recycled password.

While we’re on the topic of recycled passwords, last week’s Collection 1 data dump of hundreds of millions of user names and passwords has now been followed up by Collections 2-5. Supposedly totaling more than 2 billion passwords, these collections aren’t just one website breach but hundreds or even thousands of breaches all stockpiled into larger collections. Keep your eyes on Have I been Pwned dot com. That’s Owned with a P replacing the O.

Of course, you’re not still recycling passwords and ignoring two-factor authentication in 2019, are you? If you are, it’s time to protect yourself online with LastPass. LastPass works on your computers, phones, and tablets and is more than just a secure password vault, it also creates random passwords for you. No more having to remember which variation of your mother’s maiden name and your dog’s birthday you used for a password.

Better than that, LastPass also includes a simple, easy to use, two-factor authentication app. Enable two-factor authentication on your accounts for that extra layer of security and know that it’s safe and secure. Start your free trial today using my affiliate link raytec.co slash LastPass, that’s r-a-y-t-e-c- dot c-o slash L-a-s-t-P-a-s-s. More about affiliate links at raytec.co slash affiliate.

Thankfully, that’s it for Data Breaches and Exposures. Moving on to Privacy News.