Article Name: NIST Awards $3.6 Million for Community-Based Cybersecurity Workforce Development
This article from NIST announces a new partnership with their program NICE, NICE is a cooperative effort between government agencies, academia and NIST personnel to facilitate more robust cybersecurity education programs. To further assist in these efforts, NIST is awarding 3.6 million in grants spread across multiple institutions to ensure a new generation of cybersecurity professionals are adequately trained and experienced. This article stood out to me, as it details much of what we as students are experiencing. Seeing organizations like NIST adequately invest in cybersecurity education ensures that students like us are given the tools we need to combat the new and changing developments in our fields as we move from education to the workforce and use what we’ve learned in the real world
Title: Some Data Lost in East Baton Rouge Sheriff’s Cyber Attack
The East Baton Rouge Sheriff’s Office is reorganizing its network security measures after an attempted cyber attack resulted in hackers gaining access to some data, according to the Sheriff’s Office. Investigators believe the intrusion was halted quickly, but a limited amount of information, including screenshots of file folders and video files, was obtained. There is currently no indication that the hacker(s) still has access to the network. As a precautionary measure, the Sheriff’s Office has shut down compromised computers’ network access while collaborating with state and federal agencies to investigate the incident. This breach follows other cyber-attacks on Louisiana agencies and universities in recent years, like the one where Southeastern Louisiana University took its systems offline in response to a cybersecurity attack.
Major data leak hits 700,000 Estonians
Almost half of the population in the Baltic nation of Estonia had their personal data leaked after the system of the popular pharmacy chain Apotheca was breached. The authorities have established after the investigation that the stolen information contains nearly 700,000 personal identification codes, more than 400,000 emails, almost 60,000 home addresses, and about 30,000 phone numbers.
A backup copy of a database from the years 2014 to 2020 was breached and did not contain real-time information, fortunately, Information on prescription medicine, banking details, and passwords were not leaked. Investigators also suggested that Allium UPI, the operator of the breached system, did not put enough security measures in place. They noted that it only took several minutes for cybercriminals to download the information after breaching the system. https://cybernews.com/news/data-leak-hits-700000-estonians/
Home Depot has confirmed a data breach after one of their SaaS vendors accidentally exposed a small sample of limited employee data, which could propagate targeted phishing attacks. With over 2,300 stores in North America and over 475,000 employees, a small amount of 10,000 Home Depot employees’ information was confirmed to be leaked by a threat actor, IntelBroker, on a hacking forum on Thursday.
A third-party SaaS vendor accidentally exposed information including corporate IDs, names, and email addresses. Although not particularly sensitive information, this leak could lead to carefully crafted phishing emails targeting specific employees and Home Depot has warned their employees to be aware of potentially malicious emails in the near future.
Hackers are exploiting a critical vulnerability in Magento e-commerce platforms to steal payment information. This bug allows malicious code to be injected, enabling attackers to steal credit card details. Again, please patch your systems. A patch to fix the Magento bug was released on February 13, 2024.
A hacktivist group dubbed Anonymous for Justice, claimed to have retrieved over 300 gigabytes of data from the Israeli Justice Ministry. The attack was reported on April 5th and the Justice ministry is looking into the scope of the damage determining what type of data was stolen.
Another cyber attack looms as Vans warns customers of data leak.
On December 13, 2023, Vans announced that it had detected unauthorized activity on its IT systems, which it attributed to “external threat actors.” An investigation indicated that the violation involved personal information from Vans customers. The affected information may include:
Email Address, Full Name, Telephone number, Billing Address, Shipping address.
In some situations, the compromised data may also contain order history, total order value, and payment method information for the purchases. Vans observes that the payment method does not include data such as an account number, only “credit card”, “Paypal”, or “bank account payment”, with no more information connected.
This article goes over how the department of energy is seeking 70 million in R&D that would protect delivery infrastructure against cyber related attacks. A majority of the money would also go to the “operational” side of the house”. They are looking to produce a zero-trust architecture in an electrical or oil and natural gas environment. The DOE is actually offering up to 5 million in funds to universities, tribal nations, companies etc. that would help protect energy infrastructure from all cycler threats. The DOE is acknowledging that the “growing digital landscapes” put the existing energy stations at risk for attacks. That is scary when you think about it. I’m glad the federal side of the government is offering this money to and also asking for protection against these systems but feel that there is a bigger problem out there happing if the DOE is asking for this, then what are companies in general seeing as far as cyber issues?
Link: https://thehackernews.com/2024/04/the-drop-in-ransomware-attacks-in-2024.html
Summary: In 2023, ransomware attacks surged with a 55.5% increase, hitting 5,070 victims globally, but Q1 2024 showed a 22% decrease compared to Q4 2023, with 1,048 cases. This drop could be attributed to increased law enforcement intervention, such as the arrests of LockBit affiliates and the disruption of ALPHV by the FBI. Despite this, LockBit quickly re-emerged, indicating persistent challenges in combating cybercrime. Additionally, decreased ransom payments may be prompting some ransomware groups to seek alternative sources of income, although new groups are emerging and may potentially fill the gap left by the decline in attacks.
CISA’s Cyber Safety Review Board Report on 2023 Microsoft Exchange Online Intrusion
(March 20, April 2 & 3, 2024)
The US Cybersecurity and Infrastructure Security Agency’s (CISA’s) Cyber Safety Review Board (CSRB) has released a report on the Microsoft Exchange Online intrusion that occurred last summer. The threat actor accessed Microsoft Exchange mailboxes of high-level officials in the US government “using authentication tokens that were signed by a key Microsoft had created in 2016.“ Microsoft does not know how the threat actor obtained the key. CSRB report finds that the intrusion was preventable, and “concludes that Microsoft’s security culture was inadequate.”
New research disclosed multiple security vulnerabilities in LG webOS, impacting smart TVs. These vulnerabilities allow attackers to bypass authorization and gain root access. LG addressed the flaws reported in November 2023 by releasing updates on March 22, 2024. The vulnerabilities affect certain versions of webOS. Despite the vulnerable service being intended for LAN access, over 91,000 devices exposing this service to the internet were identified by Shodan.
This article is similar to the one I did previously, but it builds upon the issue at hand. The article talks about how because of the incident with Microsoft, customers are beginning to have doubts about Microsoft and look at other potential competitors. This is interesting to me because I think this shows no matter how big a company is, people could still consider looking at other options, such as Amazon Web Services and Google Cloud. This is evidence to me that we should always work to the best of our ability and be precise in everything that we do. Because all it takes is one slip up and it could cost the company’s reputation.
Andrew Young says
Article Name: NIST Awards $3.6 Million for Community-Based Cybersecurity Workforce Development
This article from NIST announces a new partnership with their program NICE, NICE is a cooperative effort between government agencies, academia and NIST personnel to facilitate more robust cybersecurity education programs. To further assist in these efforts, NIST is awarding 3.6 million in grants spread across multiple institutions to ensure a new generation of cybersecurity professionals are adequately trained and experienced. This article stood out to me, as it details much of what we as students are experiencing. Seeing organizations like NIST adequately invest in cybersecurity education ensures that students like us are given the tools we need to combat the new and changing developments in our fields as we move from education to the workforce and use what we’ve learned in the real world
Link: https://www.nist.gov/news-events/news/2024/04/nist-awards-36-million-community-based-cybersecurity-workforce-development
Chidiebere Okafor says
Title: Some Data Lost in East Baton Rouge Sheriff’s Cyber Attack
The East Baton Rouge Sheriff’s Office is reorganizing its network security measures after an attempted cyber attack resulted in hackers gaining access to some data, according to the Sheriff’s Office. Investigators believe the intrusion was halted quickly, but a limited amount of information, including screenshots of file folders and video files, was obtained. There is currently no indication that the hacker(s) still has access to the network. As a precautionary measure, the Sheriff’s Office has shut down compromised computers’ network access while collaborating with state and federal agencies to investigate the incident. This breach follows other cyber-attacks on Louisiana agencies and universities in recent years, like the one where Southeastern Louisiana University took its systems offline in response to a cybersecurity attack.
Link – https://www.govtech.com/security/some-data-lost-in-east-baton-rouge-sheriffs-cyber-attack
Mariam Hazali says
Major data leak hits 700,000 Estonians
Almost half of the population in the Baltic nation of Estonia had their personal data leaked after the system of the popular pharmacy chain Apotheca was breached. The authorities have established after the investigation that the stolen information contains nearly 700,000 personal identification codes, more than 400,000 emails, almost 60,000 home addresses, and about 30,000 phone numbers.
A backup copy of a database from the years 2014 to 2020 was breached and did not contain real-time information, fortunately, Information on prescription medicine, banking details, and passwords were not leaked. Investigators also suggested that Allium UPI, the operator of the breached system, did not put enough security measures in place. They noted that it only took several minutes for cybercriminals to download the information after breaching the system.
https://cybernews.com/news/data-leak-hits-700000-estonians/
Kenneth Saltisky says
Home Depot has confirmed a data breach after one of their SaaS vendors accidentally exposed a small sample of limited employee data, which could propagate targeted phishing attacks. With over 2,300 stores in North America and over 475,000 employees, a small amount of 10,000 Home Depot employees’ information was confirmed to be leaked by a threat actor, IntelBroker, on a hacking forum on Thursday.
A third-party SaaS vendor accidentally exposed information including corporate IDs, names, and email addresses. Although not particularly sensitive information, this leak could lead to carefully crafted phishing emails targeting specific employees and Home Depot has warned their employees to be aware of potentially malicious emails in the near future.
https://www.bleepingcomputer.com/news/security/home-depot-confirms-third-party-data-breach-exposed-employee-info/
Ikenna Alajemba says
An American aviation executive has had British judgments worth more than $4 million against him thrown out after a judge ruled that his legal opponent had covered up its use of hackers to steal the businessman’s emails in order to win the case.
https://www.reuters.com/world/uk/us-executive-gets-uk-judgments-thrown-out-after-showing-hackers-swayed-his-case-2024-04-01/
Kelly Conger says
https://thehackernews.com/2024/04/hackers-exploit-magento-bug-to-steal.html
Hackers are exploiting a critical vulnerability in Magento e-commerce platforms to steal payment information. This bug allows malicious code to be injected, enabling attackers to steal credit card details. Again, please patch your systems. A patch to fix the Magento bug was released on February 13, 2024.
Erskine Payton says
Erskine Payton
In the News Article- Unit 12
MIS 5214
Temple University
Israel’s Justice Ministry reviewing ‘cyber incident’ after hacktivists’ claim breach
https://www.reuters.com/world/middle-east/israels-justice-ministry-reviewing-cyber-incident-after-hacktivists-claim-breach-2024-04-05/
A hacktivist group dubbed Anonymous for Justice, claimed to have retrieved over 300 gigabytes of data from the Israeli Justice Ministry. The attack was reported on April 5th and the Justice ministry is looking into the scope of the damage determining what type of data was stolen.
Samuel Omotosho says
Another cyber attack looms as Vans warns customers of data leak.
On December 13, 2023, Vans announced that it had detected unauthorized activity on its IT systems, which it attributed to “external threat actors.” An investigation indicated that the violation involved personal information from Vans customers. The affected information may include:
Email Address, Full Name, Telephone number, Billing Address, Shipping address.
In some situations, the compromised data may also contain order history, total order value, and payment method information for the purchases. Vans observes that the payment method does not include data such as an account number, only “credit card”, “Paypal”, or “bank account payment”, with no more information connected.
https://www.malwarebytes.com/blog/news/2024/03/vans-warns-customers-of-data-breach
Jeffrey Sullivan says
Energy Department has cyber threats to infrastructure in mind with $70 million funding offer | FedScoop
https://fedscoop.com/energy-department-cybersecurity-infrastructure-funding/
This article goes over how the department of energy is seeking 70 million in R&D that would protect delivery infrastructure against cyber related attacks. A majority of the money would also go to the “operational” side of the house”. They are looking to produce a zero-trust architecture in an electrical or oil and natural gas environment. The DOE is actually offering up to 5 million in funds to universities, tribal nations, companies etc. that would help protect energy infrastructure from all cycler threats. The DOE is acknowledging that the “growing digital landscapes” put the existing energy stations at risk for attacks. That is scary when you think about it. I’m glad the federal side of the government is offering this money to and also asking for protection against these systems but feel that there is a bigger problem out there happing if the DOE is asking for this, then what are companies in general seeing as far as cyber issues?
Alex Ruiz says
Link: https://thehackernews.com/2024/04/the-drop-in-ransomware-attacks-in-2024.html
Summary: In 2023, ransomware attacks surged with a 55.5% increase, hitting 5,070 victims globally, but Q1 2024 showed a 22% decrease compared to Q4 2023, with 1,048 cases. This drop could be attributed to increased law enforcement intervention, such as the arrests of LockBit affiliates and the disruption of ALPHV by the FBI. Despite this, LockBit quickly re-emerged, indicating persistent challenges in combating cybercrime. Additionally, decreased ransom payments may be prompting some ransomware groups to seek alternative sources of income, although new groups are emerging and may potentially fill the gap left by the decline in attacks.
Michael Obiukwu says
CISA’s Cyber Safety Review Board Report on 2023 Microsoft Exchange Online Intrusion
(March 20, April 2 & 3, 2024)
The US Cybersecurity and Infrastructure Security Agency’s (CISA’s) Cyber Safety Review Board (CSRB) has released a report on the Microsoft Exchange Online intrusion that occurred last summer. The threat actor accessed Microsoft Exchange mailboxes of high-level officials in the US government “using authentication tokens that were signed by a key Microsoft had created in 2016.“ Microsoft does not know how the threat actor obtained the key. CSRB report finds that the intrusion was preventable, and “concludes that Microsoft’s security culture was inadequate.”
https://mail.google.com/mail/u/0/?pli=1#search/LATEST+CYBER+NEWS/FMfcgzGxSbpcHSWrSpCHKMgJhZHTnXvc
Akintunde Akinmusire says
Researchers Discover LG Smart TV Vulnerabilities Allowing Root Access
https://thehackernews.com/2024/04/researchers-discover-lg-smart-tv.html
New research disclosed multiple security vulnerabilities in LG webOS, impacting smart TVs. These vulnerabilities allow attackers to bypass authorization and gain root access. LG addressed the flaws reported in November 2023 by releasing updates on March 22, 2024. The vulnerabilities affect certain versions of webOS. Despite the vulnerable service being intended for LAN access, over 91,000 devices exposing this service to the internet were identified by Shodan.
Hashem Alsharif says
https://accelerationeconomy.com/cloud-wars/microsoft-cybersecurity-disaster-triggers-customer-doubt-competitor-opportunity/
This article is similar to the one I did previously, but it builds upon the issue at hand. The article talks about how because of the incident with Microsoft, customers are beginning to have doubts about Microsoft and look at other potential competitors. This is interesting to me because I think this shows no matter how big a company is, people could still consider looking at other options, such as Amazon Web Services and Google Cloud. This is evidence to me that we should always work to the best of our ability and be precise in everything that we do. Because all it takes is one slip up and it could cost the company’s reputation.