State of (in)security - Week 24, 2023
Take action: Monitor your third party suppliers. They are a very dangerous vector of exposure, confirmed by the entire series of disasters via MOVEit and GoAnywhere cascade of data breaches. And when an incident occurs, don't try to play dumb and deny it. It just looks pathetic and you will lose even more trust.
Learn More
In the week between June 12, 2023, midnight and June 19, 2023, midnight we witnessed a total of:
- 8 advisory/vulnerability events
- 32 incident/data breach events
We also shared 1 practical knowledge items
Total impacted individuals via the events of the week
There were a total of 7,898,888 impacted individuals across 11 incidents, with the largest breach being the Louisiana drivers data exposed in yet another MOVEit breach incident exposing 4,000,000 individuals. Since not all incidents report a number of impacted individuals, the real number is definitely higher than that.
Industry breakdown of incidents
| Industry | Number of incidents |
|---|---|
| healthcare | 8 |
| government | 8 |
| finance | 5 |
| education | 3 |
| military | 2 |
| energy | 1 |
| nonprofit | 1 |
| recruitment | 1 |
| social media | 1 |
| Software development | 1 |
Read the Event Details of the Week
Knowledge
Vulnerabilities
- critical vulnerability | MOVEit reports another SQLi flaw, advises systems lockout from internet.
- critical vulnerability | Bitwarden releases new fix a serious vulnerability on their Windows version
- critical vulnerability | The Windows June 2023 Patch Tuesday 4 critical vulnerabilites, ends patches for 21H2
- critical vulnerability | Critical Vulnerability in Google Chrome Payments Security Patched
- critical vulnerability | VMware low severity zero day used to hack defence and tech companies
- critical vulnerability | Critical Vulnerability reported in WooCommerce Stripe Gateway Plugin
- critical vulnerability | SAP Patches XSS Vulnerabilities
- critical vulnerability | Siemens, Schneider Electric collaborate to fix over 200 vulnerabilities
Incidents
- critical vulnerability | MOVEit breach victims now include Department of Energy
- data breach | P.E.O. Sisterhood reports Data Breach impacting over 290,000
- data breach | Oregon DMV exposes 3.5 million driver IDs through MOVEit vulnerability exploit
- data breach | Shell reports they were impacted by the MOVEit vulnerability and attack
- data breach | Data breach of Zacks Research exposed on hacking forums, impacting 8 million
- data breach | Louisiana drivers data exposed in yet another MOVEit breach
- data breach | The US Department of Agriculture is investigating a possible MOVEit related data breach
- data breach | India COVID vaccine CoWIN portal leaks data; data of vaccine recipients exposed
- data breach | Atrium Wake Forest Baptist reports data breach affecting patient records
- data breach | EpiSource LLC reports Data Breach via Unauthorized Access to AWS resources
- data breach | Pioneer Valley Ophthalmic Consultants report Data Breach
- data breach | Johns Hopkins impacted by the MOVEit data breach
- data breach | Ofcom victim of ransomware attack through MOVEit vulnerability
- data breach | Data breach exposes Medicaid Beneficiaries at Idaho Department of Health and Welfare
- data breach | Leidos reports Data Breach caused by Vulnerability in Software Provided By Diligent Corp
- data breach | FIIG Securities investigating breach by BlackCat exposing 6000 investors
- data breach | Pearland Independent School District reports data breach dating back to 2014
- data breach | University of Georgia Likely Victim of MOVEit vulnerability Data Breach
- data breach | Maimonides Medical Center reports Data Breach after Recent Cyberattack
- data breach | Data leak at Ireland Recruitment Provider exposing 15,000 people
- data breach | UPMC hospital informs of data breach of 25000 patients via the GoAnywhere vulnerability and Intellihartx
- data breach | Adur and Worthing Councils contractor impacted by MOVEit data breach
- data breach | Prudential Malasya reports MOVEit related data breach exposing agent and customer data
- DDoS | Swiss Government Targeted by DDoS after the Ransomware from last week
- ransomware | LockBit claims successful attack on pharma company Granules India
- ransomware | Ransomware attack hits Argentinian National Securities Commission
- ransomware | Development Bank of Southern Africa suffers ransomware
- ransomware | Cyberattack on German University brings down IT infrastructure
- ransomware | Health Service Ireland impacted by MOVEit vulnerability
- ransomware | BlackCat Group Claims To Have Stolen 80GB From Reddit
- ransomware | Eftpos provider Smartpay reports ransomware attack
- ransomware | Rhysida hacker group leaks documents of Chilean Army
