The Week in Breach News: 09/20/23 – 09/26/23

Risk to Business: 1.376 = Extreme

Virginia’s Department of Medical Assistance Services (DMAS) has admitted that it has suffered a data breach that impacts 1,229,333 people. DMAS said that one of its servers had been hacked by bad actors, resulting in the exposure of confidential personal data, although DMAS has not specified exactly what data was taken. DMAS also said that it began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

Risk to Business: 2.203 = Moderate

Lakeland Community College in Ohio is notifying 290,000 people of a data breach that may have compromised their personal, financial and health information. The attack occurred between March 7 and March 31, 2023, and the Vice Society ransomware group has claimed responsibility. The college said that the stolen data includes individuals’ full names plus one or more of the following: Social Security numbers, birth dates, driver’s license numbers or state identification numbers, financial account information, credit or debit card information, passport numbers, medical information and/or health insurance policy information.

Risk to Business: 2.873 = Moderate

A cyberattack has left a small city in Kansas without government email, phone and online payment systems. Officials in Pittsburg, KS, population 20,000, said that the cyberattack was discovered over the weekend. They were quick to reassure citizens that the city’s emergency services and 911 capabilities were not impacted. City officials said that their IT personnel reacted quickly and took proactive measures to protect city data and network systems. The incident remains under investigation.

Risk to Business: 1.710 = Severe

Canada’s flagship air carrier, Air Canada, has announced that it has experienced a data breach as the result of a hacking incident. The airline said in a statement that an unauthorized group briefly obtained limited access to an internal Air Canada system related to limited personal information of some employees and certain records. The airline was quick to reassure the public that all systems are fully operational, including flight operations systems and customer-facing systems, Air Canada said. However, 36,000 Air Canada employees’ personal information may have been compromised.  

Risk to Business: 1.673 = Severe

French defense and aerospace contractor Exail Technologies is in the spotlight after a data breach. The company specializes in advanced technologies and autonomous robotics. Exail was quick to fix the problem after it was brought to its attention. The file left open was an environment file containing database credentials. This type of file serves as a set of instructions for computer programs. The company has not commented publicly on the incident.  

Risk to Business: 1.612 = Severe

Hackers breached the security of the International Criminal Court last week. Officials at the International Criminal Court said that their IT personnel detected anomalous activity affecting its information systems and took immediate action to limit the damage. ICC did not release any information about data that may have been stolen. The body said that the incident is under investigation with the assistance of Dutch authorities.

Risk to Business: 2.802 = Moderate

Pizza Hut has informed Australian consumers that it has experienced a data breach that impacts 193,000 customers. The company said that bad actors gained access to its customer database, including names, delivery address and instructions, email addresses and contact numbers. For registered accounts, the cybercriminals may have accessed encrypted credit card numbers and encrypted passwords. Pizza Hut said that its operations had not been affected by the hack. The breach has been reported to the Office of the Australian Information Commissioner and remains under investigation. 

Risk to Business: 1.882 = Severe

New Zealand’s third-largest university has experienced a cyberattack. The University said that bad actors were able to gain access to the school’s IT environment. The Monti ransomware group has added the university to its dark web leak site. The group says that they snatched 60GB of data from New Zealand’s third-largest university, giving them a deadline of October 9 to pay an undisclosed ransom.