Imagine the world as a giant web, with each organization connected to one another through the flow of data. This flow is essential as it drives decision-making, collaboration, customer engagement, and operations optimization. In fact, by 2024, it’s estimated that the global volume of data created, consumed, and stored will reach 147 zettabytes – a number that’s almost too large to comprehend.

But there’s a catch: the more connected we are, the more connected we are in terms of risk. A data breach in one part of the network can have ripple effects throughout the entire system. So, even if your organization has top-notch cybersecurity, a breach elsewhere could still impact your data’s security, privacy, and integrity.

Feeling a bit helpless? Don’t worry – there are practical ways to reduce your risk from third-party breaches. Let’s dive in!

How a third-party breach can affect you

In a third-party breach scenario, the initial breach happens within the network or system of a third-party entity that your organization has a business relationship with. Hackers then use this breach as a springboard to gain unauthorized access to sensitive data or systems of other organizations in the supply chain.

Take this example: a financial institution partners with a software provider to manage customer data. If the software provider’s network is compromised by hackers, the customer data of the financial institution could be exposed too.

Third-party breaches can lead to:

• Exposure of sensitive data, such as customer information, intellectual property, financial records, or trade secrets.
• Financial losses from investigating and remediating the breach, notifying affected parties, fines by regulatory authorities, and potential legal settlements.
• Operational disruptions, resulting in downtime, loss of productivity, and the need for additional resources to address the breach and restore systems.
• Reputational damage, leading to a loss of customer confidence and potential business opportunities.
• If the breached third-party vendor is a critical part of the organization’s supply chain, other businesses’ ability to deliver products or services to customers could be impacted.
• Exposure of vulnerabilities in other organizations’ own systems and infrastructure, as hackers may use the compromised third-party as a stepping stone to gain access to further targets.

An infamous example: The SolarWinds hack

SolarWinds, a software company providing IT management and monitoring solutions, experienced a notorious third-party breach. Hackers gained unauthorized access to SolarWinds’ systems and inserted malicious code into their software updates, which were then distributed to customers, including numerous government agencies and organizations worldwide.

Consequently, the hackers infiltrated the networks of many of these customers, compromising their systems and gaining access to sensitive data. The SolarWinds hack demonstrated the risks associated with third-party vendors and the potential for supply chain attacks, where attackers target a trusted vendor to gain access to multiple organizations across its global supply chain.

Passwords: The key to third-party breaches

Passwords play a significant role in third-party breaches. One major issue is password reuse. Many people reuse passwords across multiple accounts, including personal and professional ones. When a third-party vendor experiences a data breach and user credentials (including passwords) are compromised, hackers can use those credentials to gain unauthorized access to other accounts where the same password is used.

Hackers often use automated tools to test compromised credentials from one breach against multiple online services, a technique known as credential stuffing. This relies on the fact that many people reuse passwords across different accounts.

If a user’s credentials from a breached third-party vendor are successfully used to gain access to other accounts, it can lead to unauthorized access, data theft, and potential financial loss.

To help combat this issue, consider using a tool like Specops Password Policy, which continuously monitors your Active Directory for passwords that have been compromised elsewhere.

Manage your attack surface and protect your organization

External Attack Surface Management (EASM) can help your organization prevent and mitigate the impact of third-party breaches. EASM solutions can scan and identify all internet-facing assets connected to your organization, including those associated with third-party vendors.

Having this visibility allows organizations to understand the true extent of their attack surface and identify potential vulnerabilities or weak points introduced by third-party vendors. Some benefits of using EASM include:

• Risk assessment: EASM platforms can assess the cybersecurity posture of your organization’s attack surface, including third-party assets. By evaluating factors such as misconfigurations, vulnerabilities, exposed databases, and weak encryption, EASM helps identify potential risks before they’re exploited by attackers.
• Continuous monitoring: Real-time monitoring of your organization’s attack surface, including third-party assets, allows IT teams to detect changes or new vulnerabilities introduced by third-party vendors. By quickly identifying and addressing these risks, organizations can prevent or minimize the impact of third-party breaches.
• Vendor risk management: EASM platforms can integrate with vendor risk management programs, allowing organizations to assess and monitor the cybersecurity posture of third-party vendors. This enables organizations to make informed decisions about which vendors to onboard and implement appropriate security controls.
• Incident response: In the event of a third-party breach, EASM solutions can provide valuable insights and data to support incident response efforts, minimizing damage and reducing the time to remediation.

Ready to better understand your own attack surface, including third-party risks? Request a free attack surface analysis from Outpost24 – we’ll map your current situation and help you stay ahead of potential breaches.

Sponsored and written by Outpost24.

Dropbox Sign eSignature Platform Breached: What You Need to Know

Cloud storage giant Dropbox recently revealed that hackers managed to breach its Dropbox Sign eSignature platform, getting their hands on authentication tokens, multi-factor authentication (MFA) keys, hashed passwords, and customer information. If you’re not familiar with Dropbox Sign (previously known as HelloSign), it’s a service that enables customers to send documents online for legally binding signatures.

When and How Did the Breach Occur?

We discovered unauthorized access to Dropbox Sign’s production systems on April 24, prompting us to launch an investigation. Our findings showed that the threat actors gained access to a Dropbox Sign automated system configuration tool, which is part of the platform’s backend services. This configuration tool allowed the attacker to execute applications and automated services with elevated privileges, ultimately enabling them to access the customer database.

What Data Was Compromised?

Upon further investigation, we found that the threat actor accessed data such as Dropbox Sign customer information, including emails, usernames, phone numbers, and hashed passwords. Additionally, they got their hands on general account settings and certain authentication information, such as API keys, OAuth tokens, and multi-factor authentication. Unfortunately, even users who used the eSignature platform without registering an account had their email addresses and names exposed.

Was Any Other Data or Services Affected?

While this breach is undoubtedly concerning, the silver lining is that we found no evidence that the threat actors gained access to customers’ documents or agreements. Furthermore, they did not access the platforms of other Dropbox services.

What Measures Have Been Taken to Address This Issue?

In response to the breach, we’ve reset all users’ passwords, logged out all sessions to Dropbox Sign, and restricted how API keys can be used until they are rotated by the customer. We’ve also provided additional information in our security advisory on how to rotate API keys to regain full privileges.

What Should Dropbox Sign Customers Do Now?

If you utilize MFA with Dropbox Sign, you should delete the configuration from your authenticator apps and reconfigure it with a new MFA key retrieved from the website. We’re currently emailing all customers impacted by the incident.

Moreover, be on the lookout for potential phishing campaigns using this data to collect sensitive information, such as plaintext passwords. If you receive an email from Dropbox Sign asking you to reset your password, don’t follow any links in the email. Instead, visit Dropbox Sign directly and reset your password from the site.

Stay Alert and Informed

As cyber threats continue to evolve and become more sophisticated, it’s essential to stay informed and proactive in protecting your data. Remember that in 2022, Dropbox disclosed a security breach after threat actors stole 130 code repositories by breaching the company’s GitHub accounts using stolen employee credentials.

Keep Coming Back to Learn More

With cybersecurity being a top priority for individuals and businesses alike, we encourage you to stay up-to-date on the latest threats and best practices for keeping your data secure. Keep coming back to IT Services to learn more and stay informed about the ever-changing landscape of cybersecurity.

Image: Coolcaesar (CC BY-SA 4.0)

Imagine this: you’re enjoying a delicious meal at your favorite Panda Express restaurant, blissfully unaware that a data breach just occurred within the parent company, Panda Restaurant Group. This breach affected not only Panda Express, but also Panda Inn, and Hibachi-San, compromising their corporate systems in March and stealing the personal information of an unknown number of associates.

As the largest Chinese fast food chain in the United States, with over $3 billion in sales and 47,000 associates working in 2,300 branches, Panda Express is a household name. So when they discovered a data security breach on March 10, 2024, which only impacted their corporate systems and left in-store systems, operations, and guest experience unaffected, they took immediate action.

Thankfully, the incident only impacted current and former associate data, leaving guest data untouched. As soon as the breach was detected, Panda Restaurant Group secured its environment, activated remediation and recovery efforts, and initiated a thorough investigation with the help of third-party cybersecurity experts and law enforcement agencies to establish the nature and extent of the breach.

After a thorough investigation, it was determined that certain information maintained on their corporate systems was accessed by unauthorized actors between March 7-11, 2024. With the support of third-party experts, Panda Restaurant Group then began a thorough review of the affected data to identify the specific information and individuals impacted.

Unknown number of affected people

While the exact number of individuals affected by the breach has yet to be disclosed, information filed with the Office of the Maine Attorney General reveals that the exposed data includes affected peoples’ names or other personal identifiers, as well as their driver’s license numbers or non-driver identification card numbers.

Panda Restaurant Group continues to work with law enforcement, who are conducting an active investigation into the unauthorized actors responsible for this incident. In response to the breach, Panda has implemented additional technical safeguards to further enhance the security of information in their possession and to help prevent similar events from happening in the future.

As of now, a Panda Restaurant Group spokesperson has yet to reply to requests for additional details regarding the incident, including the total number of affected people and if the attackers have made any ransom demands.

So, what does this all mean for you? It’s a stark reminder that cybersecurity is an ever-present concern in today’s digital world. Every organization, no matter how big or small, must take the necessary steps to protect their data and the personal information of their employees and customers.

Let this be a wake-up call: don’t wait until it’s too late to take action. Contact us today to learn more about how you can safeguard your organization from cyber threats and keep coming back for more valuable insights and advice.