Leave a Comment
Cybersecurity professionals continue to be a hot commodity, with demand for them straining talent availability, according to cybersecurity workforce analytics platform CyberSeek.
Developed in partnership with National Initiative for Cybersecurity Education at NIST, Lightcast and CompTIA, CyberSeek in a new study says there were nearly 770,000 openings for cybersecurity jobs for the 12-month period ending in September 2022. Employer demand for these jobs is growing 2.4 times faster than the overall rate across the U.S. economy.
In fact, nine of the 10 top months for cybersecurity job postings in the past 10 years have occurred in 2022, CyberSeek found.
“The data should compel us to double-down on efforts to raise awareness of cybersecurity career opportunities to youth and adults, especially during Cybersecurity Career Awareness Week which is an international campaign to inspire individuals to explore the variety of types of cybersecurity-related roles that are needed in both the public and private sectors,” said Rodney Petersen, Director of the National Initiative for Cybersecurity Education (NICE).
Despite a slight pullback in hiring activity in the most recent months from the record volumes earlier this year, cybersecurity job postings for Q3 2022 tracked 30% higher than the same period in 2021 and 68% higher than 2020, the data shows.
There are about 65 cybersecurity workers in the labor market for every100 job postings, a supply-demand ratio that has largely held steady over the last 12 months.
Perhaps exacerbating the cybersecurity jobs crisis, requirements for job postings have increased dramatically over the last 12 months, with the industry expanding into specialized fields such as penetration testing and threat analysis.
There is a similar expansion of cybersecurity skills requirements in adjacent positions such as auditor (+336%), software developer (+87%), cloud architect (+83%) and technical support engineer (+48%), according to CyberSeek.
“The CyberSeek data reaffirms the critical importance of feeder roles and thinking more creatively about on-ramps and career pathways,” says Ron Culler, vice president cyber learning officer, CompTIA. “It is clear from the CyberSeek data that cybersecurity’s importance and impact reaches all levels of the tech workforce. We see this trend continuing and are committed to ensuring that cybersecurity professionals are prepared for the current and future challenges this will bring.”
“Demand for cybersecurity talent has been accelerating for years, and employers are showing no signs of taking their foot off the gas,” says Will Markow, vice president of applied research at Lightcast. “That’s why it is more important than ever to build robust talent pipelines to ensure a safer digital world. We can’t accept leaving holes in our cybersecurity defenses simply because we don’t have enough trained workers to plug them.”
Learn about four key technologies we identified as critical to your IT organization’s success in 2023, as well as how to invest in new innovations emerging from each.
Your email address will not be published.
Learn about four key technologies we identified as critical to your IT organization’s success in 2023, as well as how to invest in new innovations …
Choosing the best solutions for messaging, branding, and communicating in today’s content-everywhere landscape
Download this free resource to learn about how IT leaders can effectively manage and implement a hybrid work model.
Learn More About the
Windows Collaboration Display
Get the latest news about AV integrators and Security installers from our sister publications:
FREE Downloadable resources from TechDecisions provide timely insight into the issues that IT, A/V, and Security end-users, managers, and decision makers are facing in commercial, corporate, education, institutional, and other vertical markets
Get your latest project featured on TechDecisions Project of the Week. Submit your work once and it will be eligible for all upcoming weeks.
© 2023 Emerald X, LLC. All rights reserved.
Author: rescue@crimefire.in
-
Demand for Cybersecurity Jobs Remains Strong – TechDecisions
-
Australian Government Announces Cybersecurity Coordinator Position – The National Law Review
Not content with merely implementing broad-scale privacy reform, the Government has announced a new position, the Coordinator for Cyber Security to be added to the Department of Home Affairs as a step towards their aim of “making Australia the most cyber secure nation by 2030“. This would seem to be a rather aspirational target!
The Coordinator will be supported by a National Office for Cyber Security, and their role will be to oversee steps to prevent future cyber security incidents and to help manage cyber incidents as they occur.
An advisory board led by former Telstra boss Andy Penn has published a discussion paper on Australia’s cyber security strategy for the remainder of this decade. The discussion paper raises Australia’s increased reliance on digital technologies since the COVID-19 pandemic, the growing significance of the cyber market to Australia’s domestic economy, and the lack of appropriate government powers to respond to recent data breaches as the impetus for revisiting cyber security with a fresh strategy.
Key talking points include the suggestion of a new Cyber Security Act to codify cyber security obligations from various legislative instruments and standards used in industry and government. The discussion paper also suggests including customer data and “systems” as critical assets under the Security of Critical Infrastructure Act (2018) to empower the Department to give directions and gather information in response to data breaches like those that occurred last year.
Reform that strengthens and simplifies Australia’s convoluted cyber security laws is certainly welcome, though the government should be careful to avoid adding to the cost of regulatory compliance without Australia’s cyber security benefitting from practical, effective, improvements. The government’s ambition for Australia should be a defence against malicious cyber actors more cost effective than a digital Maginot Line. Submissions on the discussion paper are open via webform until 15 April 2023.
Dadar Ahmadi-Pirshahid also contributed to this article.
About this Author
Mr. Abbott is a corporate lawyer who focuses on technology, telecommunications and broadcasting transactions. He assists corporations and vendors in managing their technology requirements and contracts, particularly large outsourcing and technology procurements issues including licensing terms for SAP and Oracle and major system integration transactions.
Mr. Abbott partners with his clients to ensure market leading solutions are implemented in to their businesses. He concentrates on managing and negotiating complex technology solutions, which…
Rob Pulham is an experienced corporate advisory and transactional lawyer with an active technology and privacy practice representing companies in the energy, manufacturing, mining, retail, health and financial services sectors, as well as government and not for profit organisations. He has extensive experience advising customers and vendors in the technology industry, with particular focus on software licensing, data privacy and protection, and systems integration projects. In his role as a senior corporate lawyer, Mr. Pulham reviews organisational policies and practices…
You are responsible for reading, understanding and agreeing to the National Law Review’s (NLR’s) and the National Law Forum LLC’s Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on www.NatLawReview.com are intended for general information purposes only. Any legal analysis, legislative updates or other content and links should not be construed as legal or professional advice or a substitute for such advice. No attorney-client or confidential relationship is formed by the transmission of information between you and the National Law Review website or any of the law firms, attorneys or other professionals or organizations who include content on the National Law Review website. If you require legal or professional advice, kindly contact an attorney or other suitable professional advisor.
Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. The National Law Review is not a law firm nor is www.NatLawReview.com intended to be a referral service for attorneys and/or other professionals. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional. NLR does not answer legal questions nor will we refer you to an attorney or other professional if you request such information from us.
Under certain state laws the following statements may be required on this website and we have included them in order to be in full compliance with these rules. The choice of a lawyer or other professional is an important decision and should not be based solely upon advertisements. Attorney Advertising Notice: Prior results do not guarantee a similar outcome. Statement in compliance with Texas Rules of Professional Conduct. Unless otherwise noted, attorneys are not certified by the Texas Board of Legal Specialization, nor can NLR attest to the accuracy of any notation of Legal Specialization or other Professional Credentials.
The National Law Review – National Law Forum LLC 3 Grant Square #141 Hinsdale, IL 60521 Telephone (708) 357-3317 or toll free (877) 357-3317. If you would ike to contact us via email please click here. -
Best and worst data breach responses highlight the do's and don'ts of IR – CSO Online
By Neal Weinberg
Contributing writer, CSO |
In theory, enterprises should not only have security measures in place to prevent a data breach but should also have detailed plans for a response in the event of a breach. And they should periodically conduct drills to test those plans.
Industry-wide best practices for incident response are well established. “In general, you want breach responses to be fairly timely, transparent, communicate with victims in a timely manner, prevent further harm to victims as best as they can do that, and tell stakeholders what they are doing to mitigate future attacks,” says Roger Grimes, data-driven defense evangelist at KnowBe4.
However, as former heavyweight fighter Mike Tyson once said, “Everyone has a plan until they get punched in the mouth.” In other words, when a company gets hit with a serious data breach, the best-laid plans often go out the window.
Over the past few years, there have been numerous examples of high-profile data breaches that severely impacted the company’s fortunes. Think Equifax, Sony, and SolarWinds. Here are some recent examples of the best and worst responses to data breaches, based on the criteria cited above.
It’s bad enough when you fail to enforce basic cybersecurity practices such as cutting off an employee’s access to sensitive customer data when that employee leaves the company. But how about discovering a breach in December 2021 and not disclosing that fact until it comes out in an April 2022 filing with the US Securities and Exchange Commission (SEC)?
That was the scenario at Block, the financial services company that owns mobile payment vendor Cash App. The SEC filing said an employee who had regular access to customer account data while employed at the company, accessed those reports “without permission after their employment ended.”
According to Block, the downloaded data of 8.2 million customers did not include usernames, passwords, Social Security numbers, or bank account information. It did include full names and brokerage account numbers, which are used to identify a user’s stock activity on Cash App Investing. The breached information “included brokerage portfolio value, brokerage portfolio holdings and/or stock trading activity for one trading day.” Block hasn’t fully explained how the breach happened or why it took so long to go public.
Not surprisingly, investors filed a class-action lawsuit in August 2022 seeking damages due to Block’s “negligent” behavior. The suit alleges that some customers have had unauthorized charges made against their accounts and points out that Cash App’s delay in notifying users of the breach caused additional harm to customers that “they otherwise could have avoided had a timely disclosure been made.”
The suit goes on to assert that the notice to data breach victims was “not just untimely but woefully deficient.” The allegations have not been proven in court. Block didn’t offer details regarding how the former employee was able to access customer information, whether the data was encrypted, or how Block learned about the breach. Block has also failed to offer any credit or identity theft monitoring services to those whose information was compromised.
We’ve become accustomed to hackers targeting schools and hospitals, but cybercriminals hit a new low when they conducted a sophisticated attack against the Red Cross in late 2021. The attackers accessed a database that contained names, addresses, and contact information for 515,000 people separated from their families by war and natural disasters.
The Red Cross responded with outrage. Robert Mardini, ICRC’s director-general, called the attack an “affront to humanity.” The agency publicly pleaded with the hackers not to use the information. Beyond that, the Red Cross response was swift, transparent, and comprehensive.
The agency quickly posted a lengthy FAQ on its website that described the hack and the response. The Red Cross immediately took the compromised servers offline and only relaunched the Restoring Family Links service after deploying enhanced security measures such as two-factor authentication and advanced threat detection, then conducting external penetration tests.
In addition, the Red Cross made extraordinary efforts to contact people who might have been affected, including phone calls, hotlines, public announcements, letters, and in some cases sending teams to remote communities to inform people in person.
The agency posted a detailed description of the hack itself, which was first discovered by a cyber security consultant working for the agency, who spotted an anomaly on ICRC servers. An investigation determined that the breach occurred on November 9, 2021, so hackers were inside the agency’s systems for more than two months before being detected.
Essentially, the attackers exploited an unpatched critical vulnerability in an authentication module. This enabled the hackers to compromise administrator credentials, conduct lateral movements, and exfiltrate registry hives and Active Directory files. The hackers disguised themselves as legitimate users or administrators, which allowed them to access the data, which was encrypted.
“We determined the attack to be targeted because the attackers created a piece of code designed purely for execution on the targeted ICRC servers. The tools used by the attacker explicitly referred to a unique identifier on the targeted servers (its MAC address),” according to the Red Cross. The agency also fessed up to its mistake: “The timely application of critical patches is essential to our cyber security, but unfortunately, we did not apply this patch in time before the attack took place.”
The Red Cross has continued to issue updates and according to the latest information: “We have not had any contact with the hackers and no ransom ask has been made. To our knowledge, the information has not been published or traded.”
When it comes to data breaches, is there a sliding scale? In other words, if a tiny school district gets hit with a ransomware attack, do we give the IT team a partial pass because they probably lack the resources and skill level of a more tech-savvy company? On the other hand, if a company whose entire business model is based on protecting user passwords gets hacked, do we judge them more harshly?
Which brings us to LastPass, which experienced an embarrassing breach that was first announced in August 2022 as simply a minor incident confined to the application development environment. By December that breach had spread to customer data including company names, end-user names, billing addresses, email addresses, telephone numbers, and IP addresses.
LastPass gets high marks for transparency. The company continued to issue public updates following the initial August announcement. But each update raised questions about the accuracy of prior statements and called into question some basic security processes employed by LastPass.
The saga began on August 25, 2022, when LastPass CEO Karim Toubba announced that the company detected unusual activity within the LastPass development environment, but added, “We have seen no evidence that this incident involved any access to customer data or encrypted password vaults.” LastPass said the attacker stole some source code but assured customers that the breach was contained and that there was “no further evidence of unauthorized activity.”
On November 30, LastPass issued an update saying the hacker, using information gained in the August incident, was in fact able to gain access to customer information stored in a backup cloud service. Again, LastPass assured customers that passwords were safely encrypted.
Then it got worse. On December 22, LastPass had to admit that the attacker used information stolen in August to target another employee in order to obtain credentials and keys which were used to access and decrypt customer data stored in the cloud-based backup. LastPass also had to admit that website URLs visited by customers were not encrypted.
LastPass assured customers that if they used the default master password that controls access to all of their other passwords, it would be virtually impossible for hackers to conduct brute-force attempts to discover it.
However, if a customer did not use the default password, then all bets are off. LastPass explained, “If your master password does not make use of the defaults, then it would significantly reduce the number of attempts needed to guess it correctly. In this case, as an extra security measure, you should consider minimizing risk by changing passwords of websites you have stored.” LastPass also told customers that the threat actor may also target customers with phishing attacks, credential stuffing, or other brute force attacks.
The company continued to keep customers informed about its mitigation efforts. LastPass decommissioned the hacked development environment and built a new one from scratch. It added additional logging and alerting capabilities to help detect any further unauthorized activity including a second line of defense with a leading managed endpoint detection and response vendor.
The damage may have been done, Grimes says. “LastPass had always said they protected customers’ stored data, but when that data was breached, it was revealed that while LastPass did possibly protect customers’ stored passwords, they did not protect customer login names, website links, and other customer-specific private information. This gives the hacker in possession of the information a complete map of the sites the user visits and what their logon names are. At the very least it could lead to customized spear phishing attacks that appear to be from websites the victim frequents. On top of that, the breach revealed that LastPass was still allowing weak master passwords.”
Managed cloud services provider Rackspace announced in December 2022 that it had been hit with a clever ransomware attack perpetrated by the PLAY cybercrime group. The attack locked up the hosted Microsoft Exchange accounts of 30,000 customers, who were unable to access their emails for several weeks.
The Rackspace response was swift. When the company became aware of the issue, it powered down and disconnected its Exchange environment. The company hired an external team from security vendor CrowdStrike to investigate what happened. Rackspace then announced that it was exiting the hosted Exchange business for good, and would help its customers migrate to Office 365. That’s pretty dramatic.
The CrowdStrike investigation revealed that Rackspace had installed one patch recommended by Microsoft to combat the ProxyNotShell exploit, but there was some confusion about whether a second patch was necessary. Rackspace did not install the second patch and the hackers were able to chain together two vulnerabilities in order to access the Exchange servers.
In an analysis of the breach, industry veteran Paul Robichaux said: “To their credit, Rackspace did pretty much everything right: they went public with the incident, hired a very well-known security firm (CrowdStrike) to help them clean up, and then published a postmortem discussing what happened.”
Here’s the timeline of the Zacks Investment Research breach that affected 820,000 customers: the breach lasted nine months, from November 2021 to August 2022. The company didn’t discover the breach until late December and didn’t notify customers until the end of January 2023.
To date, the company has not disclosed much, except to say that the breach involved names, addresses, phone numbers, email addresses, and passwords used for its website Zacks.com. Zacks did explain that the information comes from an older database of customers who signed up for a Zacks service between 1999 and 2005. The company said it blocked access to accounts with the compromised passwords, so customers would need new passwords. Zacks added that if customers use the same passwords on other websites, they should change those as well. The company will not be providing credit monitoring services to affected customers.
“A month to notify affected customers that their current passwords, which are often shared with other unrelated sites and services, seems a bit excessive,” Grimes says. “You would hope any breached company would notify affected customers within days and not take weeks to make an official announcement.”
Neal Weinberg is a freelance technology writer and editor.
Copyright © 2023 IDG Communications, Inc.
Copyright © 2023 IDG Communications, Inc. -
DISH Network, LLC Files Notice of Data Breach with the SEC – JD Supra
On February 28, 2023, DISH Network, LLC filed a notice with the Securities and Exchange Commission reporting that a recent “cyber-security incident” may have compromised confidential information in the company’s possession. News of the DISH Network breach only recently surfaced, and the company appears to be in the midst of the investigation; however, the SEC notice confirms that the incident involved a successful ransomware attack that resulted in certain information on the DISH Network IT system being compromised.
If you are a customer or employee of DISH Network, news of the recent data breach is certainly cause for concern. As we’ve reported in previous posts, ransomware actors organize these attacks to obtain sensitive information that they can then use to extort a company, hoping to secure a hefty ransom payment. If the company refuses to pay a ransom, the hackers will often post the stolen information on the Dark Web for anyone to access. This greatly increases the likelihood of victims being targeted by identity thieves and other criminal actors. However, victims of ransomware attacks may have a legal claim against a company that negligently stored their sensitive information.
The available information regarding the DISH Network breach comes from the company’s filing with the SEC as well as secondary news reports. According to these sources, on February 23, 2023, DISH Network experienced a network outage affecting the company’s internal servers and IT system. In response, the company secured its systems and began working with cyber-security experts and outside advisors to determine the scope of the incident.
While the DISH Network investigation is still underway, on February 27, 2023, the company confirmed that the outage was due to a cybersecurity incident, which DISH Network described as a ransomware attack. However, because the investigation is ongoing, the company has not yet confirmed what data types were compromised in the recent breach.
On February 28, 2023, DISH Network filed an SEC form 8-K describing the incident. That same day, the company also posted notice of the incident on its website.
Founded in 1980, DISH Network, LLC is a television and cable company based in Englewood, Colorado. The company’s main service is satellite television; however, DISH also owns Boost Mobile, Sling TV, and Dish Wireless. DISH Network is publicly traded on the NASDAQ under the ticker symbol “DISH.” DISH Network employs more than 14,500 people and generates approximately $18 billion in annual revenue.
See more »
DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Console and Associates, P.C. | Attorney Advertising
Refine your interests »
Back to Top
Explore 2023 Readers’ Choice Awards
Copyright © JD Supra, LLC -
Cybercrime spiked in 2022 — and this year could be worse – Digital Trends
Last year saw a massive spike in cybercrime, with some types of malicious digital activity rising by as much as 87%. It doesn’t bode well — but there were a couple of relative bright spots.
That information comes from a new report published by cybersecurity firm SonicWall. It makes for interesting reading, especially since one of the biggest rises came from an unusual source — and one of the most feared types of malware saw a hefty drop.
Among the statistics, SonicWall notes that there were 112.3 million attacks on Internet of Things (IoT) devices in 2022. That’s up from 60.1 million attacks in 2021 — an 87% increase. Worse, that figure is just an average, and SonicWall’s report explains that some regions were hit even harder, with North America experiencing a 145% explosion in IoT attacks last year. That large increase suggests cybercriminals are increasingly turning to IoT devices where they may have preferred other attack types in the past.
Another notable upsurge came to zero-day vulnerabilities. These are attacks that have been discovered by attackers before the exploited software vendor even knows about them, making them especially dangerous.
The number of zero-day threats active in the wild rose 150% in 2022, according to SonicWall; while the actual number does not seem huge (an increase from 14 to 35), each one could be potentially devastating since the vendor is not even aware of them, slowing down the time until a patch can be released.
There were a handful of more positive notes sounded in the report. For instance, encrypted attacks — those hidden using secure networks — fell 28%, from 10.1 million to 7.3 million. But that disguises some eyebrow-raising figures, including the claim that encrypted attacks on governments spiked an enormous 887%. While the number of governmental attacks may be low overall (helping to produce the massive percentage rise), the increasing sophistication of those malware strikes is concerning.
What about ransomware? The good news is that usage of this notorious tactic dropped 21% compared to 2021. The bad news is that the 493.3 million ransomware attacks were higher than the figures recorded in 2017, 2018, 2019, and 2020, meaning it is far from irrelevant.
While there were drops in some areas, the overall picture is of an increasing threat level from cybercrime. Most categories of attack, from cryptocurrency-related PC hijacking to intrusion attempts, grew in number. The overall number of malware attacks hit 5.5 billion, up 2% from last year.
If those trends continue, 2023 could be a record-busting year for cybercrime. That means it’s more important than ever to outfit your computer with one of the best antivirus apps you can find and ensure you practice good digital security. Cybercrime may be on the rise, but you don’t have to fall victim to it.
It’s been a bad few months for password managers — albeit mostly just for LastPass. But after the revelations that LastPass had suffered a major breach, attention is now turning to open-source manager KeePass.
Accusations have been flying that a new vulnerability allows hackers to surreptitiously steal a user’s entire password database in unencrypted plaintext. That’s an incredibly serious claim, but KeePass’s developers are disputing it.
Hackers are well known to nab customer data held by companies, but obtaining the personal data of pretty much all of the residents of a single nation in one fell swoop takes the nefarious practice to a whole new level.
The remarkable feat was allegedly performed by a 25-year-old Dutch hacker who, when arrested by police, had in his possession personal data linked to pretty much every resident of Austria — about nine million people.
The cybersecurity breach that LastPass owner GoTo reported in November 2022 keeps getting worse as new details are revealed, calling into question the company’s transparency on this serious issue.
It has been two months since GoTo shared the alarming news that hackers stole the usernames, passwords, email addresses, phone numbers, IP addresses, and even billing information of LastPass users. In GoTo’s latest blog update, the company reported that several of its other products were compromised as well.
Upgrade your lifestyleDigital Trends helps readers keep tabs on the fast-paced world of tech with all the latest news, fun product reviews, insightful editorials, and one-of-a-kind sneak peeks. -
WVU Today | WVU provides notice of data breach involving limited … – WVU Today
West Virginia University recently was alerted of a data breach involving a limited amount of personal information being available on a public-facing website.
On Nov. 25, 2022, WVU was notified that a website that was set up in December 2021 and used for software development contained WVU information that was inadvertently publicly accessible. Almost immediately, as of Nov. 28, 2022, all information on the website was deleted from public view.
On Jan. 4, 2023, during the course of the University’s investigation, it was discovered that a document containing a listing of patient file names also was inadvertently accessible on the website and downloaded by external parties.
No Social Security numbers, personal financial information, dates of birth, home addresses, account numbers, passwords or any other information that could be used for identity theft purposes were involved.
The unsecured information in the document was limited to a file name with patients’ first and last names and one of the following:Only the file name was disclosed and not the contents of the file or patient medical records.
The document did not link back to patients’ actual medical files, which are maintained and protected in an encrypted file server accessible only by authorized individuals who provide clinical, academic or administrative services to patients.
WVU is conducting a thorough review of its information security and privacy policies to ensure incidents such as this one do not happen in the future. At this time, the University has no indication that the personal information of patients has been misused.WVU is providing notifications, including additional resources and instructions for safeguarding information, to the individuals personally affected by this data breach.
Although no sensitive financial or personal information was disclosed, patients involved in this incident are encouraged to monitor their personal records to ensure there is no suspicious use or misuse of their information.
Additional information can be found at go.wvu.edu/HSC-Data-Incident.
Patients who have questions or concerns about this incident are asked to contact the WVU Health Sciences Risk Management and Privacy Office toll-free at1-888-825-1401 (8:15 a.m. to 4:45 p.m.).
-WVU-
bb/03/01/23MEDIA CONTACT: Shauna Johnson
Director of News Communications
University Relations304-293-8302; sjohns13@mail.wvu.edu
Call 1-855-WVU-NEWS for the latest West Virginia University news and information from WVUToday.
Follow @WVUToday on Twitter.
© 2023 West Virginia University. WVU is an EEO/Affirmative Action employer — Minority/Female/Disability/Veteran. Last updated on March 1, 2023. -
Tickets AudienceView Security Breach – SUNY Oswego
SUNY Oswego has been made aware that our third-party vendor for campus event ticketing “AudienceView” (formerly known as “University Tickets”) has experienced a security breach. If you used a credit card to purchase tickets through tickets.oswego.edu during February 2023, this message contains important information and action for you to take.
AudienceView has shared that this breach, which is being felt nationwide (including at many higher education institutions), is impacting individuals who used the system to purchase tickets online for university-sponsored events since early February 2023. Ongoing investigation into the matter reveals that information breached from AudienceView’s system includes personal credit card payment information.
In response to this nationwide breach that is affecting the SUNY Oswego community, Campus Technology Services (CTS) and the SUNY Oswego ticket office have initiated an information security incident to evaluate the scope of the third-party data breach and its impact on members of our campus community. Our team is actively working with AudienceView, along with other partners, to investigate this matter. Out of an abundance of caution, SUNY Oswego has suspended all ticket sales via tickets.oswego.edu, effective immediately.
If you purchased tickets for university events through tickets.oswego.edu this month, please be aware that you may receive a communication from AudienceView. AudienceView will be notifying those impacted by this breach via email with information and instructions. Please review this email carefully.
In addition, we strongly encourage anyone who has purchased tickets through tickets.oswego.edu since early February 2023, to check your credit card statements immediately; contact your banking institution regarding any suspicious transactions; and report the suspicious transactions to University Police or your local police department.
Further details will be provided as they become available.
7060 State Route 104
Oswego, NY 13126-3599
315.312.2500
7060 State Route 104
Oswego, NY 13126-3599
315.312.2500
© State University of New York at Oswego -
2 of the Worst Healthcare Data Breaches in US History Happened … – Dark Reading
Is Healthcare Cybersecurity Getting Worse?
Despite a minor decrease in the number of attacks against healthcare organizations from 2021 (715 breaches) to 2022 (707 breaches) the severity of attacks by records compromised, continued to increase.
The breach of OneTouchPoint Inc. saw 4,112,892 records compromised. It was the largest healthcare data breach of 2022 and the 9th largest of all time. The breach of Advocate Aurora Health saw more than 3 million patients’ data compromised. It was the 2nd largest healthcare breach of 2022 and the 10th largest of all time.
Other study results indicated that:
Third-party Vendors a Primary Cause of Healthcare Data Breaches
The report found that insecure third party vendors were a consistent cause of high impact data breaches. Both the worst healthcare breach of 2022, and the second worst of all-time came as a result of Business Associates failing to properly secure patient information.
Dark Web Incentivizing Healthcare Cyberattackers
The report found that patients healthcare data obtained through cyberattacks is most commonly sold. On the dark web, an individual healthcare record can be worth as much as $250. According to the report’s author Aaron Weissman, “A complete medical record contains all of a someone’s personal identifying information. That information can be used to register identification documents or apply for credit cards. Even incomplete medical records can be aggregated with other stolen information to create a complete individual identity profile.”
Basic Cybersecurity Practices Lacking in Healthcare
The report challenges the narrative that the increasing severity of cyberattacks is a result of the increasing sophistication of malicious actors. In many of the worst data breaches on record, investigators found that even basic cybersecurity practices were lacking.
In the worst healthcare breach of all time, investigators cited “a lax credential management policy and a lack of a risk management program” as a causal factor in the attack. The second largest healthcare data breach of all time, was “determined to have occurred because of the lack of a cybersecurity program.”
To see the complete findings, including a full breakdown of the largest healthcare breaches by records stolen, and damage incurred, with full color charts, please see visit the study here.
About Network Assured
Network Assured is a free, independent advisory that helps businesses price cybersecurity services, perform due diligence, and find better vendors. Learn more at www.NetworkAssured.com.
Copyright © 2023 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG.