Latest

Breach Notification

DNA Test Firm: 2.1 Million Affected by Legacy Database Hack

Marianne Kolbasuk McGee  •  November 30, 2021

An Ohio-based DNA testing company reported to regulators that the information of more than 2.1 million individuals contained in a legacy database was accessed and acquired in a hacking incident detected in August. The archived database contained personal information collected more than a decade ago.

►

Fraud Management & Cybercrime

Why Today's Security Rhetoric is Harmful and Must Change

Anna Delaney  •  November 30, 2021

In her latest book, "Rhetoric of InSecurity: The Language of Danger, Fear and Safety in National and International Contexts," academic Victoria Baines questions the imagery and rhetoric we use to communicate safety and security issues, and details their unwelcome impact on the workforce.

3rd Party Risk Management

Japanese Electronics Giant Panasonic Discloses Data Breach

Dan Gunderman  •  November 30, 2021

Japanese multinational conglomerate Panasonic has disclosed a security breach that it says involved unnamed threat actors accessing servers on its network. The company says it detected the breach on Nov. 11. It was determined that some data on a file server had been accessed during the intrusion.

3rd Party Risk Management

FDA Playbook Aims to Bolster Medical Device Threat Modeling

Marianne Kolbasuk McGee  •  November 30, 2021

A new playbook, commissioned by the Food and Drug Administration, aims to help medical device manufacturers in developing and evolving threat modeling as an approach to strengthening the cybersecurity and safety of their products.

Breach Notification

Pfizer Alleges Worker Took COVID Vaccine, Trade Secrets

Marianne Kolbasuk McGee  •  November 29, 2021

Pfizer has sued a former employee, alleging she uploaded to her personal devices and accounts thousands of files containing confidential information and trade secrets pertaining to the company's vaccines and medications, including its COVID-19 vaccine, to potentially provide to her new employer.

►

Cybercrime

The Best Gift for the Holidays? An Incident Response Plan

Anna Delaney  •  November 26, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including why security teams are still unprepared for cyberattacks over weekends and holidays, which experts warn is when attackers love to strike.

Endpoint Security

Medical Data Exposed in Breach at True Health New Mexico

Jeremy Kirk  •  November 26, 2021

A health insurer in New Mexico is warning of a data breach that exposed customers' personal and medical information. True Health New Mexico reports that nearly 63,000 individuals' personal details were exposed in the "early October" incident. It's offering all victims prepaid credit monitoring services.

3rd Party Risk Management

Essential Preparations for the Holiday Season Attack Surge

Anna Delaney  •  November 26, 2021

The latest edition of the ISMG Security Report features an analysis of how organizations can reduce risk especially over holidays and weekends, when attackers are most likely to strike. Also featured: Highlights from Ireland's IRISSCON 2021 cybercrime conference; what's ahead for COVID-19 and the workplace?

COVID-19

UK Legislation Seeks Mandatory Security Standards for IoT

Prajeet Nair  •  November 25, 2021

Could the internet of things be made more secure? A draft law in Britain would impose stronger cybersecurity regulations for manufacturers, importers and distributors of smartphones, TVs, toys and other "connected" digital devices, backed by the threat of fines of up to $13 million for noncompliance.

►

Cybercrime

Ransomware: Best Practices for Negotiating a Ransom Payment

Mathew J. Schwartz  •  November 25, 2021

No ransomware victim ever wants to pay a ransom. But if for whatever reason they choose to do so, multiple tactics can help them negotiate down initial demands by 50% or more. So say two researchers at NCC Group's cybersecurity division Fox-IT, based on their review of over 700 ransomware negotiations.

Cybercrime

Ukraine's Secret Service Busts 5 Alleged 'Phoenix' Hackers

Mihir Bagwe  •  November 25, 2021

The Secret Service of Ukraine has arrested five Ukrainian citizens on suspicion of being part of a cybercrime group called Phoenix, which it says has been tied to hacking hundreds of mobile devices, stealing personal data and also selling "hacking as a service" to others.

3rd Party Risk Management

Apple Sues NSO for Product and Service Abuse

Mihir Bagwe  •  November 24, 2021

The NSO Group is the target of a lawsuit filed by Apple, which alleges that the spyware maker abused Apple's products and services to carry out spying operations. The news follows the NSO Group's blacklisting by the U.S. government, a score downgrade by Moody's, and a reportedly failed deal with France.