Note posted to LockBit's darknet data-leak site in August claiming responsibility for the Accenture attack and threatening to leak stolen data

Accenture: Ransomware Attack Breached Proprietary Data

Mathew J. Schwartz • October 18, 2021

Accenture says an online attack against it that it first disclosed in August resulted in "the extraction of proprietary information by a third party, some of which was made available to the public by the third party." The LockBit 2.0 ransomware operation has taken credit for the attack and dumping data.

Cybercrime

Democratic Lawmakers Urge Agencies to Act on Ransomware

Profiles in Leadership: Dr. Frances Undelikwo, Fidelity Bank

Latest

Breach Notification

Sinclair TV Stations Targeted in Weekend Ransomware Attack

Dan Gunderman • October 18, 2021

Sinclair Broadcast Group, Inc., which owns or operates 186 television stations across 87 U.S. markets, has been hit with a ransomware attack that has disrupted operations. The company says the attack has impacted its ability to deliver advertisements and certain programming.

Breach Notification

Thingiverse Breach: 50,000 3D Printers Faced Hijacking Risk

Jeremy Kirk • October 18, 2021

A data breach affecting MakerBot's Thingiverse 3D printing repository website is far bigger than what the company has acknowledged, a former employee claims. Upwards of 2 million users may have been affected by the breach, which left their 3D printers at risk of being hijacked.

Anti-Money Laundering (AML)

Treasury Dept. to Crypto Companies: Comply with Sanctions

Dan Gunderman • October 16, 2021

The U.S. Department of the Treasury unveiled additional steps to curb the illicit use of cryptocurrencies on Friday, warning enterprises not to engage with sanctioned entities exploiting the financial system - particularly to launder ransomware proceeds.

3rd Party Risk Management

ISMG Editors' Panel: Are Our Systems Too Complex to Secure?

Anna Delaney • October 15, 2021

In this update, four editors discuss key cybersecurity issues, including addressing the complexity of security, the rising number of victims targeted by double extortion ransomware and the Information Commissioner's Office's recent consultation on creating an international data transfer agreement.

Access Management

Missouri Refers Coordinated Bug Disclosure to Prosecutors

Jeremy Kirk • October 15, 2021

A newspaper reporter in Missouri who responsibly reported the exposure of Social Security numbers on a state government website has been accused of malicious hacking by the state's governor. The governor alleged the publication of the vulnerability after it was fixed was part of a "political vendetta."

Account Takeover Fraud

Teenage Cybercrime: Giving Young Hackers A Second Chance

Anna Delaney • October 15, 2021

The latest edition of the ISMG Security Report features an analysis of attempts made by European law enforcement to encourage young cybercriminals to channel their skills in more ethical ways. Also featured: Fraud detection and response; inspiring behavioral change.

Endpoint Security

Australia Plans Ransomware Attack Reporting Requirement

Jeremy Kirk • October 14, 2021

Australia plans to require businesses with more than $10 million in revenue to report ransomware attacks to the government, part of a comprehensive strategy to fight the attacks that also includes new criminal penalties and assistance to victims. The plan would need to be passed by Parliament.

3rd Party Risk Management

Profiles in Leadership: John O'Driscoll, State of Victoria

Jeremy Kirk • October 14, 2021

John O'Driscoll is the first CISO for the Australian state of Victoria, a job that has purview over 1,900 entities with 340,000 public servants. He's an expert in risk and audit, and that has subsequently lead to interesting conversations about who is accountable for risk and how to manage risk.

3rd Party Risk Management

To Repel Supply Chain Attacks, Better Incentives Needed

Mathew J. Schwartz • October 14, 2021

The breach of text message routing giant Syniverse revealed yet another supply chain attack involving a key supplier, exacerbated by outdated communications protocols desperately in need of a security revamp and better incentives for improvement, says mobile telephony security expert Karsten Nohl.

Critical Infrastructure Security

CISA to Access Agencies' Endpoints, Help Enhance Security

Dan Gunderman • October 12, 2021

In an effort to bolster endpoint protection within the U.S. government, the White House is ordering federal agencies to allow CISA to access existing deployments. It is also setting timelines for improving the protection of workstations, mobile phones and servers.

Application Security & Online Fraud

Fraud Transformation: Balancing Business and Customer Needs

Tom Field • October 11, 2021

More than two-thirds of survey respondents say they take a balanced approach - business, customers and compliance - investing in fraud prevention technology. So, why do they also report customer friction among their top challenges? BioCatch's Raj Dasgupta analyzes the results of the new Fraud Transformation Survey.

Advanced SOC Operations / CSOC

Profiles in Leadership: Peter Van Lierde, CISO, Sibelga

Mathew J. Schwartz • October 11, 2021

Criminal hackers don't break for lunches, weekends or holidays. Of course, that's just one of many challenges facing information security teams, as they attempt to maximize visibility and minimize complexity while protecting their business around the clock, says Peter Van Lierde, the CISO of energy firm Sibelga.