Imagine this: you’re at home, recovering from a recent surgery, when suddenly you receive a letter from your healthcare provider. They inform you that your personal health information has been compromised due to a cyberattack. This nightmare scenario recently became a reality for some patients of mobile medical care firm, DocGo.

DocGo’s Cybersecurity Breach: What Happened?

DocGo is a healthcare provider offering mobile health services, ambulance services, and remote monitoring for patients in 30 US states and across the United Kingdom. In a recent filing with the SEC, DocGo confirmed that it had suffered a cyberattack when threat actors breached its systems and stole patient health data.

Upon detecting unauthorized activity, DocGo promptly took steps to contain and respond to the incident. They launched an investigation with the assistance of leading third-party cybersecurity experts and notified relevant law enforcement.

The Aftermath: How DocGo Responded

Although DocGo did not share specifics about how they responded to the incident, organizations typically shut down their IT systems after detecting a breach to prevent the attack from spreading. As part of DocGo’s investigation, it was determined that the hackers stole protected health information from a “limited number of healthcare records” for the company’s US-based ambulance transportation business.

DocGo is now actively reaching out to individuals whose data was compromised in the attack. They stress that no other business units have been affected, and they have found no evidence of continued unauthorized access. Additionally, DocGo does not believe that the attack will have a material impact on the company’s operations and finances.

Who’s Responsible and What’s Next?

No threat actors have claimed responsibility for the breach. However, if it was a ransomware attack and a ransom is not paid, it’s likely that the stolen data will be used as leverage in the future to extort DocGo. We contacted DocGo to learn how many people were affected by the breach, but a reply was not immediately available.

Stay Informed, Stay Protected

This recent cyberattack on DocGo is a stark reminder of the importance of cybersecurity – not just for businesses, but for individuals as well. As personal information becomes more interconnected and accessible through technology, it’s crucial to stay informed about potential threats and take necessary precautions to safeguard your data.

If you want to learn more about cybersecurity and how to protect yourself and your information, don’t hesitate to contact our IT Services team for expert advice and assistance. And remember – knowledge is power. Keep coming back to stay informed and stay protected.

Imagine the world as a giant web, with each organization connected to one another through the flow of data. This flow is essential as it drives decision-making, collaboration, customer engagement, and operations optimization. In fact, by 2024, it’s estimated that the global volume of data created, consumed, and stored will reach 147 zettabytes – a number that’s almost too large to comprehend.

But there’s a catch: the more connected we are, the more connected we are in terms of risk. A data breach in one part of the network can have ripple effects throughout the entire system. So, even if your organization has top-notch cybersecurity, a breach elsewhere could still impact your data’s security, privacy, and integrity.

Feeling a bit helpless? Don’t worry – there are practical ways to reduce your risk from third-party breaches. Let’s dive in!

How a third-party breach can affect you

In a third-party breach scenario, the initial breach happens within the network or system of a third-party entity that your organization has a business relationship with. Hackers then use this breach as a springboard to gain unauthorized access to sensitive data or systems of other organizations in the supply chain.

Take this example: a financial institution partners with a software provider to manage customer data. If the software provider’s network is compromised by hackers, the customer data of the financial institution could be exposed too.

Third-party breaches can lead to:

• Exposure of sensitive data, such as customer information, intellectual property, financial records, or trade secrets.
• Financial losses from investigating and remediating the breach, notifying affected parties, fines by regulatory authorities, and potential legal settlements.
• Operational disruptions, resulting in downtime, loss of productivity, and the need for additional resources to address the breach and restore systems.
• Reputational damage, leading to a loss of customer confidence and potential business opportunities.
• If the breached third-party vendor is a critical part of the organization’s supply chain, other businesses’ ability to deliver products or services to customers could be impacted.
• Exposure of vulnerabilities in other organizations’ own systems and infrastructure, as hackers may use the compromised third-party as a stepping stone to gain access to further targets.

An infamous example: The SolarWinds hack

SolarWinds, a software company providing IT management and monitoring solutions, experienced a notorious third-party breach. Hackers gained unauthorized access to SolarWinds’ systems and inserted malicious code into their software updates, which were then distributed to customers, including numerous government agencies and organizations worldwide.

Consequently, the hackers infiltrated the networks of many of these customers, compromising their systems and gaining access to sensitive data. The SolarWinds hack demonstrated the risks associated with third-party vendors and the potential for supply chain attacks, where attackers target a trusted vendor to gain access to multiple organizations across its global supply chain.

Passwords: The key to third-party breaches

Passwords play a significant role in third-party breaches. One major issue is password reuse. Many people reuse passwords across multiple accounts, including personal and professional ones. When a third-party vendor experiences a data breach and user credentials (including passwords) are compromised, hackers can use those credentials to gain unauthorized access to other accounts where the same password is used.

Hackers often use automated tools to test compromised credentials from one breach against multiple online services, a technique known as credential stuffing. This relies on the fact that many people reuse passwords across different accounts.

If a user’s credentials from a breached third-party vendor are successfully used to gain access to other accounts, it can lead to unauthorized access, data theft, and potential financial loss.

To help combat this issue, consider using a tool like Specops Password Policy, which continuously monitors your Active Directory for passwords that have been compromised elsewhere.

Manage your attack surface and protect your organization

External Attack Surface Management (EASM) can help your organization prevent and mitigate the impact of third-party breaches. EASM solutions can scan and identify all internet-facing assets connected to your organization, including those associated with third-party vendors.

Having this visibility allows organizations to understand the true extent of their attack surface and identify potential vulnerabilities or weak points introduced by third-party vendors. Some benefits of using EASM include:

• Risk assessment: EASM platforms can assess the cybersecurity posture of your organization’s attack surface, including third-party assets. By evaluating factors such as misconfigurations, vulnerabilities, exposed databases, and weak encryption, EASM helps identify potential risks before they’re exploited by attackers.
• Continuous monitoring: Real-time monitoring of your organization’s attack surface, including third-party assets, allows IT teams to detect changes or new vulnerabilities introduced by third-party vendors. By quickly identifying and addressing these risks, organizations can prevent or minimize the impact of third-party breaches.
• Vendor risk management: EASM platforms can integrate with vendor risk management programs, allowing organizations to assess and monitor the cybersecurity posture of third-party vendors. This enables organizations to make informed decisions about which vendors to onboard and implement appropriate security controls.
• Incident response: In the event of a third-party breach, EASM solutions can provide valuable insights and data to support incident response efforts, minimizing damage and reducing the time to remediation.

Ready to better understand your own attack surface, including third-party risks? Request a free attack surface analysis from Outpost24 – we’ll map your current situation and help you stay ahead of potential breaches.

Sponsored and written by Outpost24.

Dropbox Sign eSignature Platform Breached: What You Need to Know

Cloud storage giant Dropbox recently revealed that hackers managed to breach its Dropbox Sign eSignature platform, getting their hands on authentication tokens, multi-factor authentication (MFA) keys, hashed passwords, and customer information. If you’re not familiar with Dropbox Sign (previously known as HelloSign), it’s a service that enables customers to send documents online for legally binding signatures.

When and How Did the Breach Occur?

We discovered unauthorized access to Dropbox Sign’s production systems on April 24, prompting us to launch an investigation. Our findings showed that the threat actors gained access to a Dropbox Sign automated system configuration tool, which is part of the platform’s backend services. This configuration tool allowed the attacker to execute applications and automated services with elevated privileges, ultimately enabling them to access the customer database.

What Data Was Compromised?

Upon further investigation, we found that the threat actor accessed data such as Dropbox Sign customer information, including emails, usernames, phone numbers, and hashed passwords. Additionally, they got their hands on general account settings and certain authentication information, such as API keys, OAuth tokens, and multi-factor authentication. Unfortunately, even users who used the eSignature platform without registering an account had their email addresses and names exposed.

Was Any Other Data or Services Affected?

While this breach is undoubtedly concerning, the silver lining is that we found no evidence that the threat actors gained access to customers’ documents or agreements. Furthermore, they did not access the platforms of other Dropbox services.

What Measures Have Been Taken to Address This Issue?

In response to the breach, we’ve reset all users’ passwords, logged out all sessions to Dropbox Sign, and restricted how API keys can be used until they are rotated by the customer. We’ve also provided additional information in our security advisory on how to rotate API keys to regain full privileges.

What Should Dropbox Sign Customers Do Now?

If you utilize MFA with Dropbox Sign, you should delete the configuration from your authenticator apps and reconfigure it with a new MFA key retrieved from the website. We’re currently emailing all customers impacted by the incident.

Moreover, be on the lookout for potential phishing campaigns using this data to collect sensitive information, such as plaintext passwords. If you receive an email from Dropbox Sign asking you to reset your password, don’t follow any links in the email. Instead, visit Dropbox Sign directly and reset your password from the site.

Stay Alert and Informed

As cyber threats continue to evolve and become more sophisticated, it’s essential to stay informed and proactive in protecting your data. Remember that in 2022, Dropbox disclosed a security breach after threat actors stole 130 code repositories by breaching the company’s GitHub accounts using stolen employee credentials.

Keep Coming Back to Learn More

With cybersecurity being a top priority for individuals and businesses alike, we encourage you to stay up-to-date on the latest threats and best practices for keeping your data secure. Keep coming back to IT Services to learn more and stay informed about the ever-changing landscape of cybersecurity.