Malware

How SMBs Can Significantly Reduce Their Risk of Devastating Cyberattacks and Data Breaches

Explore vital steps SMBs can take to reduce the risk of cyberattacks and data breaches, including securing remote access, training employees, and implementing incident response plans. Stay ahead of cyber threats and safeguard your business with these essential cybersecurity measures.

Published

10 months ago

February 8, 2024

zendzipr

A group of SMBs sitting at desks in an office, working together to reduce the risk of cyberattacks.

The Akira ransomware group has been targeting small to medium-sized businesses (SMBs), with 80% of its victims since March 2023 being SMBs. According to Arctic Wolf, the group’s ransom demands range from $200,000 USD to over $4 million USD.

If organizations refuse to pay, the gang threatens to expose names and data. Most intrusions leverage compromised credentials to obtain initial access, according to the same source.

Akira is just one example of the growing security problem for SMBs. While breaches at large enterprises may make the news, 56% of SMBs experienced cyberattacks last year.

Why ransomware groups target SMBs

SMBs are attractive targets for cybercriminals. They typically have fewer resources like IT support and lack robust security procedures, such as employee cybersecurity training.

Hackers also target SMBs to find entry points to larger enterprises. Many of the biggest breaches in recent years resulted from third-party attacks that started with a smaller company that was digitally connected to another.

In 2023, several breaches of SMBs turned into large-scale attacks on major companies, including AT&T, Chic-fil-A, and 1Password.

The impact of cyberattacks on SMBs

A successful breach can cause significant damage. Globally, the average cost to recover from a data breach is $4.45 million, according to IBM’s Cost of a Data Breach Report 2023—a 15% increase over the past three years. For SMBs, the average cost of a data breach is nearly $150,000.

Indirect costs can also be significant. Breaches can undermine customer trust and damage reputations. Data may be lost forever. Even when the ransom is paid, nearly 40% of companies are unable to restore their data.

What can SMBs do to mitigate their risks?

Businesses should use best practices for cybersecurity, such as adopting the cybersecurity framework for SMBs developed by the National Institute of Standards and Technology (NIST). According to the framework, SMBs can mitigate risks by:

Controlling who can access your network and data

Having formal policies for use

Encrypting sensitive data, both at rest and in transit

Using network firewalls with integrated security

Monitoring for unauthorized access

Backing up data regularly

Creating plans for responding and recovering from attacks

These best practices can help reduce unauthorized access. However, 98% of cyber attacks start with some form of social engineering. If threat actors get their hands on an end-user’s valid passwords, they can bypass many of these security measures.

So, it is not only crucial to pay close attention to password policies, but to also block known compromised passwords.

Go beyond complex passwords

Enforcing a password policy that helps end-users create stronger passwords and blocks the use of weak and common phrases will make it more difficult for hackers. However, this must go beyond requiring basic password compliance requirements.

IT Services’ data shows that 83% of compromised passwords satisfied both length and complexity requirements of regulatory password standards.

Password attacks are often successful because users are predictable. They tend to reuse passwords and use similar patterns when creating passwords and trying to meet the complexity requirements.

For example, starting with a common word and then following it with a number or special character.

Robust password policy enforcement can help users create easy-to-remember, but hard-to-crack passphrases.

Use Multi-Factor Authentication

MFA reduces the risk of account takeovers by adding an additional layer of protection.

Even if passwords are compromised, unauthorized users can’t access your network without the second authorization, such as a push notification sent to mobile devices or third-party identity verification providers.

This helps mitigate the risk of stolen credentials and brute-force password hacking.

Block compromised passwords

The easiest way for cybercriminals to access networks is by using compromised credentials. At any one time, more than 24 billion user names and passwords are for sale on the dark web.

You can significantly reduce your risk by blocking the use of known compromised passwords with Specops Password Policy with Breached Password Protection.

Audit Active Directory accounts

Conduct password audit scans of your Active Directory with Specops Password Auditor to check end-user accounts against 950 million compromised passwords and other password-related vulnerabilities.

This is a free read-only scan that can help your organization proactively identify password vulnerabilities in multiple reports.

End-user awareness training

88% of data breaches can be traced back to human error, according to a joint study between a Stanford University researcher and Tessian. The World Economic Forum’s Global Risk Report puts that figure at 95%.

SMBs should require end-user training to help them better understand the importance of following cybersecurity policies and recognizing the signs of phishing, smishing, and other attacks aimed at stealing their credentials and falling victim to ransomware.

Improve cybersecurity with better password protection

SMBs can start enhancing their security posture by protecting their frontline.

Specops Password Policy protection helps enforce compliance requirements by automatically blocking the use of over 4 billion compromised passwords.

Learn more about Specops Password Policy solution to mitigate your cyber risks. Get a demo or free trial today.

Sponsored and written by Specops Software.

Up Next

Critical Leak: Mercedes-Benz Source Code Vulnerability due to Improper GitHub Token Management

Don't Miss

Keenan Alert: 1.5 Million People at Risk from Data Breach after Devastating Summer Cyberattack

Click to comment

Malware

Massive Cyberattack at French Hospital: Health Data of 750,000 Patients Compromised

A cyberattack on a French hospital exposed the health data of 750,000 patients. The incident highlights the growing risk of cyber threats targeting healthcare organizations, with sensitive patient information being increasingly sought by hackers. Ensure your organization’s data is protected with robust cybersecurity measures and stay informed on the latest threats.

Published

2 days ago

November 23, 2024

zendzipr

People walk in front of a brightly lit modern building adorned with a red cross sign, signaling it as a French hospital. Amidst whispers of a recent cyberattack targeting health data,

A data breach at a French hospital has led to the exposure of 750,000 patients’ medical records. The culprit, a threat actor going by the name ‘nears’, claims to have attacked multiple healthcare facilities in France, potentially gaining access to over 1.5 million patient records.

This attacker claims to have breached MediBoard, an Electronic Patient Record (EPR) solution by Softway Medical Group. The group has confirmed that a MediBoard account was indeed compromised, but it was not due to a software vulnerability or misconfiguration. Instead, the breach occurred through stolen hospital credentials.

How did this happen?

Softway Medical Group explained that the exposed data was not directly managed by them but was hosted by the hospital. They emphasized that their software was not responsible for the breach. Instead, a privileged account within the hospital’s infrastructure was compromised.

This situation highlights the importance of ensuring that all staff members, especially those with privileged access to sensitive systems, follow strict security protocols to prevent unauthorized access.

What’s at stake?

The threat actor began selling what they claimed was access to the MediBoard platform for multiple French hospitals. This access allegedly allowed the buyer to view sensitive healthcare and billing information, patient records, and even the ability to schedule and modify appointments or medical records.

To prove their claim, the hacker put the records of 758,912 patients from an unnamed French hospital up for sale. These records contain sensitive information, including full names, dates of birth, contact information, and even health card history.

The data was offered for purchase to three users, and currently, no buyers have been declared on the sale listing. However, even if the data isn’t sold, there’s always a risk of it being leaked online for free, making it accessible to the broader cybercrime community.

The dangers of exposed data

The type of data exposed in this incident raises the risk of phishing, scamming, and social engineering for impacted individuals. As a result, it’s crucial for healthcare providers to prioritize cybersecurity and invest in proper security measures to protect their patients’ sensitive information.

For patients, it’s essential to be vigilant and aware of potential scams and phishing attempts. Be cautious with any communication that seems suspicious or requests sensitive information, and never hesitate to verify the authenticity of a message.

What can you do to protect yourself?

With cyber threats constantly evolving, it’s essential to stay informed about cybersecurity best practices. As an IT Services company, we’re dedicated to helping people like you understand the risks and take appropriate action to protect your personal information and online security.

Don’t leave your cybersecurity to chance. Keep coming back to learn more about the latest threats, best practices, and how to keep yourself and your loved ones safe online. Together, we can build a more secure digital world for everyone.

Malware

Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan

Fintech firm Finastra is probing a potential data breach following a hacking incident involving its SFTP server. The breach, which may have exposed sensitive user data, has prompted the company to bolster its security measures and notify affected customers.

Published

3 days ago

November 22, 2024

zendzipr

Did you know that even the largest and most successful financial software companies can fall victim to cyberattacks? Recently, Finastra, a company that serves over 8,000 institutions across 130 countries, experienced a cybersecurity incident that put their customers’ sensitive data at risk.

The Incident at Finastra

Finastra is a global financial software company that counts 45 of the world’s top 50 banks and credit unions among its clients. With over 12,000 employees and a revenue of $1.7 billion last year, it’s a major player in the finance sector. On November 7, 2024, a cyber attacker managed to access one of Finastra’s Secure File Transfer Platform (SFTP) systems using compromised credentials.

So far, the company’s investigation, supported by external cybersecurity experts, has not found evidence that the breach extended beyond the SFTP platform. But the attack has raised concerns about the security of the company’s software services, which include lending solutions, payment processing, cloud-enabled retail and banking platforms, and trading risk management tools.

How We Learned About the Breach

Brian Krebs first reported the security breach after seeing a data breach notification sent to an impacted person. The attack appears to be linked to a post on a hacking forum, where a threat actor named “abyss0” claimed to be selling 400GB of data stolen from Finastra.

When we asked Finastra about the forum post, they wouldn’t confirm or deny if the data belonged to them. However, they did acknowledge a limited-scope security breach and are currently evaluating its impact. They also stressed that the compromised SFTP platform was not used by all their customers and was not their default file exchange platform.

What’s Next for Finastra and Its Customers?

The exact impact and scope of the breach are still under investigation. It may take some time to determine who has been affected, but Finastra has assured that those who are deemed impacted will be contacted directly. As a result, public disclosures from the company are not expected.

Interestingly, the threat actor who published the data samples earlier this month has since deleted the post. It’s unclear whether the data was sold to a buyer or if “abyss0” became concerned about the sudden publicity.

A History of Cybersecurity Incidents

This isn’t the first time Finastra has experienced a cybersecurity incident. In March 2020, the company was hit by ransomware actors and forced to take parts of its IT infrastructure offline, causing service disruptions. At the time, reports highlighted Finastra’s lackluster vulnerability management strategy, as they were using older versions of Pulse Secure VPN and Citrix servers.

What Can We Learn From This?

The Finastra breach is a stark reminder that no organization is immune to cyber threats. As technology continues to evolve, so do the tactics and techniques used by cybercriminals. It’s crucial for companies, large and small, to prioritize cybersecurity and invest in the latest security measures to protect their customers’ data.

And for you, as a reader and potential customer, it’s important to stay informed about the latest cybersecurity news and best practices. That’s where we come in. We’re committed to providing you with the most up-to-date information on cybersecurity, so you can stay one step ahead of the bad guys. So why not reach out to us and keep coming back to learn more about how you can protect yourself and your business from cyber threats?

Malware

Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure

Ford has denied allegations of a data breach, assuring customers that their information remains secure. The automaker responded to claims made by a security researcher who discovered a vulnerability in their systems, stating that no sensitive data was accessed or exposed. Ford is working closely with the researcher to investigate and resolve the issue.

Published

4 days ago

November 21, 2024

zendzipr

As someone who cares about cybersecurity, I can’t help but feel concerned about the recent news that Ford is investigating allegations of a data breach. A threat actor going by the name ‘EnergyWeaponUser’ claimed on a hacking forum to have leaked 44,000 customer records. They also implicated another hacker, ‘IntelBroker,’ who supposedly took part in the breach back in November 2024.

What’s in the leaked data?

The leaked information includes Ford customer records containing personal details such as full names, physical locations, purchase details, dealer information, and record timestamps. While this data might not be extremely sensitive, it still contains personally identifiable information (PII) that could be used in phishing and social engineering attacks targeting the affected individuals.

What’s interesting is that the threat actors didn’t try to sell the dataset. Instead, they offered it to registered members of the hacker forum for eight credits, equivalent to just a little over $2.

Ford’s response and investigation

We reached out to Ford to validate the claims, and a spokesperson confirmed that they are actively investigating the allegations. They stated, “Ford is aware and is actively investigating the allegations that there has been a breach of Ford data. Our investigation is active and ongoing.”

Is there credibility to these allegations?

The involvement of IntelBroker in the breach lends some credibility to the threat actor’s allegations. This hacker has a track record of confirmed breaches, including recent ones at Cisco’s DevHub portal, Nokia (through a third party), Europol’s EPE web portal, and T-Mobile (via a vendor).

The data samples leaked by the threat actors include locations from around the world, with the United States being one of them.

How to protect yourself from potential risks

In light of this potential data exposure, it’s crucial to treat unsolicited communications with caution and reject requests for revealing more information under any pretense. Keep an eye out for any suspicious emails, messages, or phone calls that might use this leaked information to manipulate or deceive you.

An important update from Ford

After our initial report, Ford provided us with an additional statement based on new findings from their ongoing investigation. They said, “Ford’s investigation has determined that there was no breach of Ford’s systems or customer data. The matter involved a third-party supplier and a small batch of publicly available dealers’ business addresses. It is our understanding that the matter has now been resolved.” – A Ford spokesperson

Stay informed and stay safe

Keeping up to date with cybersecurity news and best practices is crucial in today’s digital world. Continue to check back with us for the latest information and advice on protecting yourself and your data. Remember, knowledge is power, and staying informed is the first step in defending against potential threats.