The numbers and analyses are coming out for cybersecurity incidents in Q1 of 2017 and they really aren’t so surprising. In fact, for the most part, it’s just more of the same from last year. Risk Based Security’s Data Breach Quickview Report for the first quarter tells it like it is and 2017 is on the way to being the worst year yet for data breaches. All told, there were over 1,200 breaches exposing more than 3.4 billion records in the first quarter alone.
The three main contributors are phishing for W-2 details, theft of large datasets, and misconfiguration of databases.
Business email compromise (BEC) has been gaining traction of late, despite multiple warnings from the FBI and others. W-2 theft in particular is a thorn in the sides of many. This occurs when someone poses as a colleague or executive asking for W-2s to be sent or the information from them to be sent off to the poser. Unfortunately, this was the preferred scheme for Q1. Likely, that is due to tax season being in full swing at that time. Often, the information gained in BEC or W-2 fraud is used to file fraudulent tax returns. Over 60 organizations fell victim to this type of scheme last year. In the first quarter of this one, according to the report, that number skyrocketed to 2,700.
The sale of large datasets was also prevalent in Q1. One rather enterprising seller offered up for sale username and password combinations from 11 different organizations totaling over 1.5 billion records. Although the validity of the data has yet to be independently verified, no one has proved otherwise.
The report noted that, “as long as organization rely on the traditional username and password combination for authentication, datasets like these will continue to have value for malicious actors.”
Implementing multifactor authentication (MFA) is becoming a necessity and should be pushed toward the top of the priority list. These days, the theft of login credentials without it is just too easy, as phishing continues to thrive.
Misconfigured databases caused a lot of trouble too. MongoDB was again targeted in Q1 and while the contents stolen from such breaches was formerly used for extortion, the preferred tactic is now to just sell it on the Dark Web.
The misconfiguration mistake resulting in the accidental exposure of over 1.3 billion records is so far, the largest single breach disclosed through Q1.
So what’s on tap for Q2 and beyond? Likely, it’s more of the same. Administrators are encouraged to review their security plans and address these issues. Train staff on the dangers of phishing and to look for signs. Put policies into place that will stop W-2 or BEC fraud such as having multiple people approve sending of such information. Secure databases and make sure they are properly configured. And of course, ensure all systems are patched and kept up to date at all times.
Last, but certainly not least: Don’t forget to do regular backups. Those can save your organization a lot of time, money, and frustration.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
