Data breaches and cyber attacks in May 2022 affect 49.8 million records
June 4, 2022 |
May was hardly a banner month for cyber security 2022. It governance has identified 77 security breaches in May 2022 resulting in 49,782,129 compromised records, a polite term for hackers accessing information.
The highlights are:
- hackers stole records of 22.5 million Malaysians from the National Registration Department and are looking to sell the data for $10,000 US;
- a successful phishing attack at the Australian Pension provider Spirit Super affected 50,000 victims. The attack was made through an employee’s email account. The information involved included names, addresses, ages (as at 2019 and 2020), email addresses, telephone numbers, member account numbers, and member balances (as at 2019 and 2020).
- Chicago Public School was hit with a data breach exposing 4 years worth of records, involving 560,000 students and employees.
- Breastcancer.org, a breast cancer charity suffered a data breach which exposed 350,000 files totaling 150 GB of data. The compromised data included sensitive images of website users.
- The National Population Commission of Nigeria suffered a theft of birth certificates.
- in South Australia more than 90,000 public servants had their personal information stolen.
- IKEA Canada had a data breach involving personal information of 95,000 customers.
In a related matter security researchers have found that ,200 cloud-based Elasticsearch databases had been wiped out with hackers leaving a ransom note. All told there werre 450 individual requests for ransom payment totaling over $280,000. It is relevant to note that the databases were located in the cloud. That is possible by using a tool like Shodan to identify data strings. Then the hacker can run those searches automatically then delete indices and insert ransom notes. Meanwhile Turkish airlines Pegasus, left an AWS S3 bucket without password protection which resulted in a leak of sensitive flight data. PegasusEFB’s open bucket left data in more than 23 million files accessible to anyone, while also exposing EFB software’s source code, which contained plain-text passwords and secret keys that could be used to tamper with the sensitive files.
The Ukraine has had nearly 14 million cyber incidents in the first quarter of 2022. Of these, 78,000 were treated as critical and that 63% of the suspicious events were detected within ministries and organisations and another 35% affected regional government administrations. Most recently the Russians have cyber attacked the Southern Ukrainian city of Kherson disrupting communications.
In the United States a company specialising in facial recognition technology which has a contract with the US Government worth $7.2million had dozens of peoples data exposed in a breach. The information that was unsecured included birthdays, home addresses and driver licence data.
The New South Wales Government insurance agency, Icare, sent private details of 193,000 injured worker to the incorrect employer. The information was contained on spreadsheets in email attachments. This is a depressingly famiiar type of breach for which government agencies have a particular specialty. Just to show that government mistakes are not confined to the Southern Hemisphere in the UK the Central Bedforshire Council leaked details of dozens of special need pupils but publishing those details, unredacted on a public website. The Council will have to contend with the UK Information Commissioner’s Office, a far more assertive regulator than exists in Australia.