There but for the grace...
The UK data protection regulator has announced a £4.4 million fine against a construction company that fell victim to a phishing attack. The formal announcement from the Information Commissioner's Office is well worth a read because it provides a handy summary of what not to do. Among Interserve Group's many issues, it;
- Failed to respond to an initial alert of suspicious activity
- Used unsupported software systems and protocols
- Used out of date antivirus software (despite warnings)
- Failed to provide appropriate training
- Lacked effective risk assessments
- Failed to follow its own policies and standards
Personal data of up to 113,000 current and former employees were encrypted, including contact and banking details, national insurance numbers, as well as special category data such as ethnic origin, religion, disability details, sexual orientation, and health information. The breach occurred when an employee forwarded a phishing email (which Interserve’s systems failed to block or quarantine) to another employee who opened it, extracted the attached ZIP file and ran the content. The employee was working from home and using a split tunnel VPN. This meant that when the employee clicked on the link in the email, it did not go through Interserve's gateway system. Interserve went into administration in 2019 and so the fine is unlikely to be paid.
Time and again, major breaches have minor causes. A recent incident at business publication, Fast Company, happened after hackers exploited an easily guessed default password ("pizza123"). The password was reused across multipleWordPress accounts. DARKReading has an analysis of the notorious Equifax hack, the lessons from which are still relevant five years on. And the recent breach at Microsoft was caused by a misconfiguration. It affected 150,000 companies from 123 countries and included sales strategies, proof of concept documents and emails.
