This Week in Breach – Carnival can’t sail out of a ransomware attack

Risk to Business: 1.972 = Severe

Attackers claimed to have used REvil ransomware on July 4 in a ransomware attack on the Cooke County Sheriff’s Office (CCSO). In the resulting in a data breach, cybercriminals snatching personal identification information from an internal database. The compromised data came from either CCSO reports or cases going back several years. The gang posted their typical announcement about the hack showing data folders with filenames that appeared to reflect archived case files as well as current cases, including a threat that the files would be uploaded in seven days.

Individual Risk: 2.201 = Severe

While no financial information was reported as stolen, PII was involved in the breach – not to mention potentially damaging or embarrassing legal records.

Risk to Business: 2.077 = Severe

Netwalker ransomware appears to be the culprit in a data breach at the University of Utah. The school reportedly paid a ransomware gang $457,059 in order to avoid having student information released online. The hack occurred on July 19, and the cybercriminals gained access to the network of the university’s College of Social and Behavioral Science [CSBS].

Individual Risk: 2.224 = Severe

Even when a ransom is paid, there’s never proof that the gang really did destroy the stolen data, instead of copying it or selling it. Students should be aware of this data being used in spear phishing attempts.

Risk to Business: 1.775 = Severe

In a statement posted to its website, Instacart has announced that it has suffered another data breach, less than a month after a breach that was widely reported in the media containing user account data. This time, two employees at a third-party service provider accessed accounts that they shouldn’t have, exposing customer information again.

Individual Risk: 2.821 = Moderate

Instacart’s forensic investigation did not find any evidence the two support agents had downloaded or digitally copied data from its systems. The company’s contract with the third-party vendor has been terminated, and impacted accounts have been notified via email.

Individual Risk: 2.782 = Moderate

Potentially affected users have been notified via email the company reports that impact varies per account. Not all users had passwords associated with their accounts. The company estimates that number at 4.5 million users who used federated logins (Google, Facebook, or Twitter) to log into their accounts. For the remaining 3.77M users the attacker got their email address and a hash of their password. For 3.55M of those users, the method to hash the password was bcrypt. For 229K users, the method was salted MD5. Since the attack, all users have been updated to bcrypt.

Individual Risk: 2.312 = Severe

The investigation into exactly what data and what kind of data was stolen is ongoing. Carnival expects that both passenger and employee data has been impacted, but has offered no specifics. Anyone who has traveled on a Carnival cruise and staffers should be wary of phishing and identity theft attempts.