Payroll Data Breach of Ministry of Defence of UK

If your systems rely on digital platforms (which is inevitable today) then you cannot be an exception of cyber attacks. If you did not take necessary cybersecurity countermeasures then your end is not difficult to guess.

The cyber victim of this week was the Ministry of Defense of the United Kingdom.

UK Government has confirmed a cyberattack on the payroll system used by the Ministry of Defence (MoD) where hackers have accessed personal information of former armed forces personnel, including names, financial data, and in some cases home addresses.

The affected systems have been pulled offline but there is no indication as to how long the attackers had access to the data.

https://bit.ly/3JWRXAz

"UK Government has confirmed a cyberattack on the payroll system used by the Ministry of Defence (MoD) led to "malign" forces accessing data on current and a limited number of former armed forces personnel.

There is no evidence to suggest that the criminals who broke into the systems actually removed any data, but they did access personal information including names, financial data, and in some cases home addresses."

"The UK isn't formally attributing the activity to any specific individual or group, but sources speaking to Sky, which broke the news, suggested China was behind it."

Vastaamo Hack: Therapy Notes Hacker Jailed for Blackmail

Julius Kivimäki who is (was) one of Europe's most wanted cyber criminals has been jailed for attempting to blackmail 33,000 people whose confidential notes he stole.

He broke the database of Finland's largest psychotherapy company (Vastaamo). We saw once again the well-known but neglected fact: It's not important how big your company is. You can be hacked if you didn't take the necessary countermeasures against cyber attacks.

Investigations found that the databases of the company were vulnerable and open to the internet without proper protections. Yes, it can sound unbelievable but there may be too many similar companies on the world.

It is also worth to mention that the boss of Vastaamo was convicted of failing to protect his customers' sensitive data. (3-month prison) The managers DO have to be aware of that they also have a responsibility to protect the data of their customers. Otherwise they can face a prison sentence.

https://bit.ly/4abmYvl

"In terms of the number of victims, his trial was the biggest criminal case in Finnish history."

"He demanded a 400,000 Euro (£340,000) ransom from the company.

When it refused, he emailed thousands of patients asking for 200 Euros and threatening to publish their notes and personal details on the darknet which he did anyway in full."

"The boss of Vastaamo, Ville Tapio, was also convicted of failing to protect his customers' sensitive data.

Investigations found that the databases were vulnerable and open to the internet without proper protections.

He was given a suspended three-month prison sentence last year.

The company which was once a highly regarded and successful business in Finland collapsed after the hack."

Change Healthcare’s Ransomware Attack

Let's repeat the painful truth once more: Lack of cybersecurity countermeasures can cost you much more than you expected.

The cyber attacks (especially ransomware attacks) on the health sector have been increasing in recent years. Health sector players have to take this fact into consideration in order to avoid being the next cyber victim of the cyber crime market.

UnitedHealth states that the total costs of the February cyber attack for the first quarter of 2024 stands at $872 million. The total cost reached "$1 billion" with the remediation costs, including a $22 million payment to the ALPHV/BlackCat-affiliated ransomware group. (If you hire 20 cyber security experts each for $250,000, it will cost you $5 million per year.)

This attack also had effects on their shares. ($0.74 per share.)

https://bit.ly/3wcOdHF

"It's a charge that eclipsed that of casino group MGM, which didn't pay a ransom following an attack on its systems last year, and which faces recovery costs of $100 million to rebuild its systems and paying for the fallout from outages, operational disruptions, allegedly leaked data and more."

"The company warned that, financially, the total cost of the cyberattack is estimated to be between $1.35 billion and $1.6 billion for calendar year 2024."

Ransomware Gang Stole Health Data of 533,000 People

 Yet another hack and another health service provider: Group Health Cooperative of South Central Wisconsin (GHC-SCW).

The ransomware gang could not encrypt the data this time but they could steal it well.

The BlackSuit ransomware gang claimed to sell patients' MRN numbers, SSN numbers, patient IDs, telephone numbers, residential addresses, medical history, and potentially other sensitive information.

https://bit.ly/3vTq8pi

"According to the attackers' claims, the stolen files also contain affected patients' financial information, employees' data, business contracts, and e-mail correspondence."

About 17,000 Unpatched Microsoft Exchange Servers in Germany

If you are living in Germany and administering some Exchange Servers then you can begin to worry.

The German Fededal Office for Information Security (Bundesamt für Sicherheit in der Informationtechnik - BSI) has identified a critical security concern about the poor state of Microsoft Exchange server patching in the country.

Of these servers in Germany, 12% are running a version which is no longer supported (such as Exchange 2010 or 2013) and around 25% are running Exchange 2016 or 2019 without vital patches. This means that at least 37% of Microsoft Exchange Servers in Germany are vulnerable to cyber attacks.

And this case shows us how vital are vulnerability and patch management systems for a company.

https://bit.ly/3THFk0K

"The government regulator says there are 17,000 or more Exchange Server instances in Germany vulnerable to at least one critical vulnerability, out of around 45,000 public-facing servers in the Euro nation running the software."

"Of particular concern is fixing CVE-2024-21410, an elevation-of-privilege vulnerability that Microsoft patched last month. According to German investigators, it's not clear whether as much as 48 percent or so of the country's Exchange servers have fixed up this hole yet, and Microsoft did warn it's a trickier-than-normal update to apply."

"We're told BSI is now emailing network providers on a daily basis reminding them to shore up any vulnerable system it detects. It warns that criminals are already on the lookout to exploit these reported flaws and 'schools and universities, clinics, doctors' practices, nursing services and other medical facilities, lawyers and tax advisors, local governments and many medium-sized companies are particularly affected.'"