Tag Archive for: Costs

Social Engineering Gains Lead to Spiraling Breach Costs

/in


A full three-quarters of data breaches in the last year (74%) involved the human element, mainly caused by employees either falling for social engineering attacks or making errors, with some misusing their access maliciously.

Social engineering incidents have almost doubled since last year to account for 17% of all breaches, according to Verizon’s 2023 Data Breach Investigations Report (DBIR) released June 6 (which analyzed more than 16,312 security incidents, of which 5,199 were confirmed data breaches). The report noted that this preponderance of human fallacy within incidents comes along with findings that the median cost of a ransomware attack has doubled since last year, reaching into the million-dollar range. The evidence taken together points to a gaping need for organizations to get in control of the security basics — or else face a spiraling cycle of inflation when it comes to data breach costs.

Chris Novak, managing director of cybersecurity consulting at Verizon Business, noted that in order to rein in the trend, organizations need to focus on three things: employee security hygiene, implementing true multifactor authentication, and collaboration across organizations on threat intelligence. The first is perhaps the most impactful issue, he said.

“The fundamentals need to improve, and organizations need to be focusing on cyber hygiene,” he said, during a press event in Washington DC. “It’s probably the least sexy recommendation I can give you, but it is one of the most fundamentally important things that we see organizations still missing, and of all shapes and sizes. And it’s usually because they want to focus on the new flashy technology in the industry, and they forget the basics.”

Financially Motivated External Attackers Double Down on Social Engineering

In addition to social engineering growing in volume, the median amount stolen from these attacks hit $50,000 this past year, according to the DBIR. Overall, there were 1,700 incidents that fell into the social media bucket, 928 with confirmed data disclosure.

Phishing and “pretexting,” i.e. impersonation of the sort commonly used in business email compromise (BEC) attacks, dominated the social engineering scene, the…

Source…

Twitter to charge for a basic security feature that costs nothing on other platforms

/in


What you need to know

  • Twitter’s SMS-based two-factor authentication will now cost you a monthly subscription fee.
  • The security feature will be restricted only to Twitter Blue subscribers starting March 20.
  • Accounts with SMS 2FA still enabled will automatically lose this feature after that date.

After locking some of its longstanding features, such as the blue check mark, behind a monthly subscription, Twitter will now charge you for SMS-based two-factor authentication.

The social networking platform surprised users by announcing (opens in new tab) that only Twitter Blue subscribers will be able to secure their accounts using this security option after March 20. After that date, the feature will automatically be disabled, assuming you haven’t done so by then.

Source…

Ransomware attack costs school board more than $300K

/in


Huron-Superior Catholic District School Board is projecting a deficit due to cyberattack; board also doling out cash for credit monitoring, cybersecurity measures

SAULT STE. MARIE — The Huron-Superior Catholic District School Board will operate with a $325,000 deficit for its 2022-2023 budget due to a ransomware attack that crippled the board’s information systems in mid-December and compromised personal information belonging to a number of its employees. 

“This deficit is a result of the cyber incident,” said business superintendent Justin Pino in an email to SooToday Monday. “Before the incident the board was projecting a balanced budget.”  

Additional expenses related to the Dec. 15 cyberattack covered by the board’s cyber insurance are not being disclosed. 

The English Catholic school board is also spending USD $69,212 annually for three years on software from SentinelOne, a California-based cybersecurity company, in order to protect it from potential cyberattacks. 

A two-year credit monitoring service for affected school board employees through TransUnion will run the board $30,000 following the Royal ransomware attack, which resulted in the theft of personal information — including social insurance numbers and banking information — for staff members employed by the board between 2019 and 2022. 

Board officials are not disclosing whether or not the school board paid a ransom to the attackers. 

 

 

 

 

 

 

Source…

Ireland’s Cleanup Costs Hit $48 Million

/in


Business Continuity Management / Disaster Recovery
,
Critical Infrastructure Security
,
Cybercrime

Healthcare Hit: $110 Million May Be Full Recovery Cost for Health Service Executive

Mathew J. Schwartz (euroinfosec) •
February 24, 2022    

Ransomware Attack: Ireland's Cleanup Costs Hit $48 Million
Timeline of the attack against HSE, which began on March 18, 2021, after which systems were crypto-locked on May 14, 2021 (Source: PwC)

What’s the price of a ransomware attack that disrupts a nation’s critical infrastructure?

See Also: Case Study: The Road to Zero Trust


Ireland’s Health Service Executive tells Information Security Media Group that the cleanup cost of the Conti ransomware attack against it last May has so far hit $48 million. But it “forecasts that the overall cost could be in the region” of $110 million.


So far, the costs have included an additional $14 million spent on IT infrastructure, $6 million on cybersecurity and strategic support, $17 million on vendor support for applications and $9 million on Office 365, Irish broadcaster RTE reports.


Beyond the overall cost of cleanup, additional costs will be incurred as the HSE implements recommendations from PwC, also known as PricewaterhouseCoopers. The consultancy was brought in to investigate the incident and found the HSE had “a very low level of cybersecurity maturity,” as judged against the U.S. National Institute of Standards and…

Source…