Categories
Cybersecurity information technology

The Growing Need For A Vendor Risk Assessment Template

Indeed, a vendor risk assessment template is more important than ever. Technology is like a fire. It made our lives much easier. However, that very fire can burn a business into the ground.

Many companies enter a digital relationship with third-party vendors. These vendors increased the opportunity for growth. Yet, they also increase opportunities for cyberattacks. For example, 61% of U.S. companies said they have experienced a data breach. One of their vendors or third parties caused the breach.

Before committing to a third party supplier, it is important to get to know more about them first. A vendor risk assessment template helps us with that goal.

What Is A Vendor Risk Assessment?

This is the process of screening third party suppliers. Business leaders evaluate those suppliers as potential business partners. Furthermore, the screening aims to identify associated risks and hazards. That is with the vendor’s processes and products. 

Moreover, this evaluation helps businesses determine if the supplier is fit for the needs. Additionally, this screening helps businesses see how qualified the supplier is for the organization’s requirements.

What Is A Vendor Risk Assessment Template?

Acquisition officers use this tool to ensure that the vendor complies with regulatory requirements. Some of these requirements are:

  • Data privacy
  • Due diligence
  • Security risks

This process is important to deeply see product cost, software demonstrations, and service delivery.

No two organizations are exactly alike. That fact applies to vendors also. Therefore, do not use the same template across all vendors you’ll assess. You must modify it according to your industry. Likewise, modify the vendor risk assessment template according to each vendor.

What Should The Template Contain?

As we have mentioned earlier, the assessment presents great importance in the process of choosing appropriate partners. Moreover, it helps evaluate a vendor’s portfolio. It also identifies the red flags and risk level of the vendors. Additionally, such screening sees the vendors’ likelihood.

Otherwise, failure to conduct assessments presents damage to the organization. Such damages include reputational and financial losses. Moreover, a company might experience heavy effects such as regulatory sanctions and business closures. Yet, these are avoidable by checking these elements in screening vendors:

Credibility

Conduct a background check to see the ability of a vendor. That is the ability to maintain a high-quality standard. Moreover, that must not cause any risk to both the company and its customers. 

It’s important to see the vendor’s accuracy and reliability. Doing so avoids financial loss and hindrances to business operations. Additionally, check the feedback and reviews from the vendor’s previous clients. Also, take a look at press releases for the vendor, if there are any.

Security and Privacy

A vendor must handle confidential information safely. Moreover, the vendor must have the capability of asset management. Furthermore, take note of the security controls the vendor possesses in case of attacks.

Data Handling and Disaster Recovery

This process evaluates how a vendor manages data documentation. Also, it’s important to check the disaster plans of the vendor. This identifies the vendor’s preparation and recovery capabilities in the event of an attack. See to it that the vendor also has backup plans.

Categories
Cybersecurity News

Houzz Data Breach – What Really Happened?

The Houzz data breach happened in December 2018. The home improvement start-up firm claims it has over 40 million users. Let’s find more about the Houzz data breach in this article. 

Another day, another breach. This may sound old but yes, another data breach occurred. Cyberattacks get even more common each day. It is so common that “if” is no longer the question to ask. It’s a matter of “when”. Every sector experiences it – from government agencies to small businesses with unsecured databases.

In December 2018, another popular company got victimized again – Houzz. The mentioned company serves in the home improvement industry. 

What is Houzz?

This company is a website and an online community. It offers home improvement services to homeowners. Moreover, they cater services to home design aficionados and professionals. One of its tools is the marketplace. The marketplace enables home improvement companies to advertise and sell their products. The company claims it has over 40 million users.

Houzz Data Breach

The company admitted they suffered a data breach. Their announcement stated that unauthorized third-parties accessed files. Those files contain public visible user data. Yet, it is still unclear if hackers accessed the files through a hacked system. Houzz still didn’t say either if a rogue employee started the breach or a database was left unsecured.

Furthermore, the information involved in the breach includes:

  • IP address
  • User logs in Facebook
  • Email addresses
  • User IDs
  • Public information from a Houzz profile (for instance, name and address)
  • City and ZIP code derived from the IP address

Moreover, the company didn’t reveal whether hackers distributed the data or sold on any hacking forums. Fortunately, no payment information or SSNs were involved in the attack. Moreover, the company said that the actual user passwords were not compromised. Instead, hackers had access to scrambled passwords.

Response On Houzz Data Breach

While hackers didn’t have access to actual passwords, the company recommended its users to change their passwords. The company enables users to do this by visiting the “Change Password” page of their website or going to their account settings.

Furthermore, the company sent email notifications to its users about the breach. The home improvement firm promised its users to improve data security. Moreover, they wrote that they started an internal investigation and engaged with law enforcement. Additionally, they retained a leading security forensics firm regarding the matter. 

Yet, it’s not clear if the company will face penalties.

Users affected by the Houzz data breach should immediately change their passwords. Moreover, consider using a password manager in the future.

Precautionary Steps

As we have mentioned earlier, the company experiencing a data breach is inevitable. Here are some suggestions:

  • Beware of phishing scams – this is one of the most common methods hackers use. Hackers use this method hoping to get victims to click on malicious links. 
  • Install strong security software – it is important to protect your gadgets with strong security software. Keep your antivirus updated. This serves as the best defense.
  • Never reuse the same password for multiple online services.
  • Enable two-factor authentication.
  • Frequently check your bank accounts for suspicious activity. 
  • Close accounts that you rarely use.
Categories
Business Intelligence Cybersecurity information technology

What is IT Security Awareness Training and Is It Important?

Hackers don’t spare anyone. They strive to attack any business regardless of its size. However, IT security awareness training minimizes, if not prevents, the drastic effects of a breach. In this article, let’s find out what is IT security awareness training and why you need to implement one.

What Is IT Security Awareness Training?

IT security awareness training educates employees. This is done by covering all aspects of data security and regulatory compliance. This is an ongoing and formal cybersecurity education for your workforce. Furthermore, this program addresses various cyber threats that may affect your company in the future.

Typically, employees are prone to risking security – whether intentional or not. This program prevents employees from risking financial and intellectual property. Furthermore, this program prevents customer trust from declining. Moreover, the training avoids major data losses causing huge losses. In short, this program increases businesses’ cyber strength.

 Why Do We Need An IT Security Awareness Training?

We’ll never know when hackers will attack. Cyberthreats are always connected to work environments. Furthermore, hackers use more complex methods as time passes. Hackers change their methods from time to time.

Hackers commonly use phishing. Many businesses feel that their employees won’t fall into this trap. However, that’s not the case. Cybercriminals still use the phishing method because it continues to be successful. According to a study published by Verizon, 93% of successful breaches start with phishing.

Regular training that includes phishing simulations reduces risks. Moreover, the program helps businesses decrease infections and related help desk costs. This also protects its reputation. This is important to keep in mind because reputational damage might take forever before healing.

What Should The Program Contain

The main goal of educating employees is preparing them in fighting these threats. They are not born knowing what risks exist. Leaders must teach their employees in discerning what is risky or unacceptable. Furthermore, leaders must educate their employees on looking for clues indicating threats. Also, employees must learn how to respond to these threats.

Security is everyone’s responsibility. Do not ignore even small risks or mistakes. Take note even of the seemingly harmless behaviors. Why? Because even seemingly small, they can bring huge consequences. 

Best Education Practices

Moreover, it’s important to take note of how you teach your employees. Otherwise, they might end up forgetting the information. Take a look at some of these practices.

Divide The Information Into Pieces

Training will be more effective if you divide the content into smaller pieces. This method prevents employees from getting overloaded with information.

Avoid Teaching The Same Information Over and Over Again

The training might attract a few employees if you’ll teach the material they already know. Conduct a pre-testing to know what information your people still need. This improves the quality of the training. Furthermore, it prevents redundancy and employees from getting bored.

Use Real-Life Examples

Provide real-world examples and stories to make the training meaningful. One good source to use is the Verizon Data Breach Investigations Report (DBIR). Furthermore, presenting real-life scenarios make the lessons real and not just a list of rules to follow.

Categories
Cybersecurity News

Everything About National Cybersecurity Authority

King Salman of Saudi Arabia set up the National Cybersecurity Authority on October 31, 2017. In this article, we will refer to it as NCA. It aims to enhance Saudi Arabia’s cybersecurity. That includes protecting information technology networks, systems, and data. Besides, another goal of NCA is to improve online security for companies and individuals.

History

King Salman bin Abdul Aziz Al Saud issued a decree to form the NCA on October 31, 2017. Furthermore, Crown Prince Muhammad bin Salman heavily supported the decree. They are ministers responsible for the NCA. 

The king appointed Dr. Musaed bin Mohammed Al-Abain as chairman of NCA. Dr. Al-Aiban is a Harvard graduate. Moreover, he is a member of the Council of Ministers. Dr. Al-Aiban has been a minister of the state since 1992.

Additionally, these notable members of the state serve in the NCA.

  • President of State Security
  • Chairman of the General Intelligence
  • Deputy Minister of Interior
  • Assistant Minister of Defense

Essential Cybersecurity Controls

The National Cybersecurity Authority created the ECC. It means Essential Cybersecurity Controls. ECC will serve as the mandating entity of the government. 

Hence, public and private sectors are now mandated to develop national security policies. ECC measures constitute the minimum security requirements for in-scope national organizations. In summary, public and private sectors are required to comply with the ECC’s regulations.

Goals and Purpose

The Kingdom recognizes it must take appropriate security measures to improve its digital economy. According to the Saudi Press Agency, “the authority will be linked to the King and is created to boost cybersecurity of the state, protect its vital interests, national security and sensitive infrastructure.”

The National Cybersecurity Authority aims to protect the whole country against cyber threats. It includes the privacy of all state data. Furthermore, NCA aims to protect private and public companies’ data. The protection NCA aims also include all individuals.

Also, the NCA aims to establish a national industry in the field of cybersecurity. One of its top priorities is to attract and hire qualified national cadres. Aside from that, NCA also aims to build partnerships. That includes public and private entities. NCA also targets to stimulate innovation and investment. As a result, it will contribute to achieving technological rebirth. Consequently, it serves the future of the Kingdom’s national economy.

Furthermore, the NCA also gives young Saudis a great opportunity to take part in the national effort to strengthen cybersecurity. That is according to DNJ Technologies chief executive Othman Al-Robaish’s statement to Arab News.

Protection

According to Dr. Al-Aiban, the following will be included in the NCA’s protection.

  • Networks
  • IT systems
  • Operating systems
  • Hardware and software components
  • Services and data

Furthermore, he emphasized that the NCA will take into account the increasingly vital importance of cybersecurity in the lives of the public.

Opinion

Naif Al-Rashid, a Saudi journalist in Riyadh, said strengthening cybersecurity would increase the confidence of Internet users, not only individuals but also government entities, security facilities, financial houses, foreign investors, and others who transacted business online.

Please watch the video below to know more.

Categories
Business Intelligence Cybersecurity

How To Have A Cybersecurity Business Strategy

Statistics show that hackers most likely target small businesses. That’s why having a cybersecurity business plan is important. It’s critical to have that regardless of your business size.

Why Small Businesses Need A Cybersecurity Business Strategy

Small businesses must ensure that their data is safe from threats. If you are doubting if hackers will attack your small business, think again! 

Take a look at this study published in 2018. Hackers most likely target small businesses than larger ones. Furthermore, hackers use traditional methods such as email spam, phishing, and malware. The reason why hackers attack small businesses? That is because small businesses invest less in developing a strong cybersecurity business strategy.

How To Setup A Cybersecurity Business Strategy

Wondering where to start? We have compiled this step-by-step guide in developing a cybersecurity business strategy.

Assess potential risks

It’s important to take time in evaluating the location of cyber weaknesses in your business. You have to do that because every business has different weaknesses. Otherwise, it won’t be clear to you how to best protect your business from hackers. 

Moreover, you might end up spending valuable resources on a plan that does not fit your needs. Furthermore, ask these questions to yourself:

  • What sensitive data do you keep?
  • Who can access that data?
  • Where do you store it?

  Those are just some examples. Self-evaluation helps you invest in proper areas.

Educate employees

You need to train your employees on security awareness. That is important because they have access to your network. You must not skip this step. Indeed, good performance and attitude are essential in the workplace. However, your business will take the fall if your network gets breached.

Educate them to recognize suspicious emails. Additionally, tell them to use strong passwords on all work-related devices. Moreover, inform them to not log-in from unsecured locations. There are still many tips to teach your employees. Your employees can act as the first line of defense when properly trained.

Back-up important data

You should have your important business data backed-up on a regular basis. Back those files up on an external location such as cloud storage. Important files to back-up include:

  • Financial data
  • Spreadsheets and databases
  • Designs
  • Plans
  • Blueprints, and etc.

Having your data backed-up is extremely useful in case you suffer from a data breach.

Keep systems and software up-to-date

Many businesses ignore this step. If you regularly click ‘Dismiss’ on that software update, please stop doing that. Furthermore, take the time in updating your system update. Those updates patch the holes hackers may slip through.

Sacrificing five minutes of your time for updating is nothing compared to days or weeks of recovery from a data breach.

Protect your Wi-Fi network

Furthermore, having your Wi-Fi network unprotected gives hackers direct access to your data. There’s no reason to not secure your network. That is because doing so is easy. Make sure that your Wi-Fi is password protected. Moreover, encrypt it and make it undiscoverable to third parties.

Categories
Cybersecurity information technology

Top Network Security Companies To Watch Out In 2020

Is your organization’s data safe and secured? As technology grows every single day, so are the cyber risks it brings. With that in mind, we compiled some of the top network security companies to watch out for this 2020.

Why Do We Need Network Security Companies

Data protection should be the top priority of businesses in this digital age. Also, businesses must do their best to prevent data breaches. Otherwise, the consequences will surely be bad. Examples are a compromise of sensitive data such as clients’ data, the organization’s transactions, and the employees’ information. 

Furthermore, criminals use the COVID-19 crisis to carry out socially engineered attacks. Some of such attacks are phishing emails through spam campaigns. One more example is targeted attempts such as business email compromise (BEC).

What The Statistics Show

Many businesses nowadays react to the need of investing in cybersecurity, statistics show. One example is Gartner’s latest Information Security and Risk Management forecast. It shows that worldwide spending on information security and risk management will reach $131B in 2020. Furthermore, it is projected that it will increase to $174B in 2022.

We can see from the examples we have discussed and the supporting data that it is really important to protect your business’ data. There are tons of network security companies out there. With that in mind, we compiled some of the best network security companies.

Absolute

Absolute serves as an example of cyber resilience, visibility, and control. Even more, it is embedded in over half a billion devices. Absolute has 12,000 customers. This company enables its customers with self-healing endpoint security. Also, this company makes their customers always connected to their own devices, data, users, and applications.

Fidelis Cybersecurity

One of Fidelis’ remarkable projects was mapping applications for a bank. They have offices around the world. Maryland, USA houses their main headquarters. Fidelis started in 2002. Now, they have over 200 employees. They specialize in cybersecurity and IT strategy consulting services. 

Mimecast

Mimecast delivers email protection. As a result, thousands of large and small organizations are now protected from malicious activity, human error, and technology failure. One more good thing about this company is they invest in essential capabilities in its solutions.

Transmit Security

This firm specializes in managing identity across applications while maintaining security and usability. Furthermore, this is a great help for businesses since online authentication has become less effective over the years. 

UnderDefense

This firm is located in Ukraine. Besides, they have a second office in New York. Founded in 2016, UnderDefense has now 28 specialists dedicated to providing cybersecurity services. Furthermore, one notable project that they performed is for a cryptocurrency company. UnderDefense tested vulnerable spots and immediately fixed it.

OSIbeyond

OSIBeyond started in 2004 at Rockville, Md. The firm has now more than 20 employees. Cybersecurity is the main service they provide. Yet, they also provide IT managed services and cloud consulting services. Moreover, they have many small and midmarket nonprofits as clients. Additionally, OSIBeyond also serves business service organizations.

LogicalTrust

Two IT professionals run LogicalTrust in Wroclaw, Poland. They founded LogicalTrust in 2007. This firm works with small, mid-market, and enterprise companies in the financial services, business services, and IT industries. 

Categories
Cybersecurity News

What Is CrowdStrike Trump Mentioned to Ukraine’s President?

On 25th September 2019, the White House published a July call transcript between the U.S. President Donald Trump and Ukraine’s President Volodymyr Zelensky. Whereas, Trump mentioned in the call the company ‘CrowdStrike.’ What is the CrowdStrike Trump mentioned in this call?

Trump requested Zelensky to look after the cybersecurity firm CrowdStrike. Additionally, the company investigated the hack on DNC in 2016. In this article, we will get to know more about CrowdStrike. 

History of CrowdStrike

CrowdStrike has three founders, namely:

George Kurtz (CEO)

Dmiti Alperovitch (CTO) 

Gregg Martson (CFO, retired)

These three co-founded the company in 2011. A year after, the company hired Shawn Henry to lead the sister company, CrowdStrike Services. Thus, the latter focused on proactive and incident services.

More About CrowdStrike

This company is based in Sunnyvale, California. Moreover, it is a provider of endpoint protection and threat intelligence. Furthermore, CrowdStrike also offers pre and post response to cyber threats. The company’s mission is: “To Keep the Bad Guys Out of Your Network.” 

The company investigated several high-profile cyberattacks. For example, the 2014 Sony Pictures hack and the 2015-16 attacks on Democratic National Committee. 

CrowdStrike’s Goal

George Kurtz sums up the company goal. He is the president of the company. He explained:

“We are building software to defeat the human mind. They (attackers) are using their cunning and skill to get into every large company on the planet, and we have to build technology that we know they are trying to defeat. Ultimately, we have to stay ahead of them.”

In other words, the company aims for bad actors. Furthermore, they aim for the root, not their malware.

CrowdStrike’s Falcon

The same CrowdStrike Trump mentioned makes an antivirus-like product. CrowdStrke named it Falcon. Furthermore, this is a cloud-based software that protects computers from malware. Falcon is the main product of CrowdStrike. Moreover, Falcon is being sold to big corporations to protect their data. 

Among its notable customers are MIT, Amazon Web Services, and MIT. Also, Falcon provided threat intelligence and attribution to nation-state actors. It also serves various states and cities.

Falcon is a unified set of cloud-delivered technologies that prevent all types of attacks. Moreover, Falcon’s host is a tiny and lightweight sensor. The sensor has enough intelligence to detect threats and prevent those from happening. Additionally, CrowdStrike installs the sensors on every endpoint.

Afterward, the sensors transmit relevant data to CrowdStrike’s Advanced Threat Intelligence Cloud. Also, many personnel analyzes the data.

Solutions That The Falcon Offer

The CrowdStrike Falcon Platform includes:

Falcon Prevent — Next-Generation Antivirus (NGAV)

This has antivirus capabilities that protect the company’s systems from malware. 

Falcon Insight — Endpoint Detection and Response (EDR)

Insight allows companies to have continuous monitoring of their systems. Moreover, it is real-time comprehensive visibility. Insight ensures that nothing is missed. As a result, the chances of breaches getting detected are very high.

Falcon OverWatch — Managed Threat Hunting

Overwatch is a dedicated team that works for you 24/7. 

Falcon Discover — Security Hygiene

Discover offers network security monitoring and IT hygiene by identifying unauthorized endpoints, credentials, and applications in your organization.

In case you are wondering what’s the story behind this CrowdStrike Trump issue, check the video below.

Categories
CIO CIO Guide

Anthem Data Breach Settlement Report- $39.5 Million Cost

The Anthem data breach settlement is nearly $40 million. This so happened last September 2020. In addition, this pertains to the massive cyberattack against the company last 2015.

Anthem Data Breach Settlement

Anthem Inc., is one of the largest health insurers in the United States. 

The company experienced a data breach in 2015. Moreover, it has been stated that the attack was executed by a state-sponsored criminal group.

In addition, the company excuses itself for violating data security laws. Because they believe that they have done their part. Even done commitments to take high-security measures of data handling. 

Attack Examination

Way back in February 2015, Anthem Inc. disclosed the attack. That is why several examinations were initiated. As a result, the examination shows some 80 million compromised records in the database.

These data belong to its existing employees. Not to mention its past employees, which are also included in the attack.

However, the investigation concludes that this attack is a byproduct of fraud. That is by the FBI and FireEye security entity.

Data Breach Fever

Anthem Inc.’s data breach is only a single account among thousands of data breach reports. This is because not a day goes by without these incidents headlining the news.

Thus, companies need to understand the reasons why an attack takes place. What are the most common causes of a data breach?

Weak Credentials

This is one but of the simplest cause of a data breach. Do you know that 4 in 5 data breaches are caused by a weak or stolen password?

Possible Solutions:

  • Use complex passwords
  • Make use of passwords generator
  • Sign up for Password Managers
  • Strict access control for corporate credentials

Application Vulnerabilities

Weakly designed and developed applications serve as gateways to attack opportunities. That is because these loopholes are attractive to hackers. For instance, poorly written network systems.

Possible Solution:

Update software and hardware applications.

Malware

Malicious software by definition, both in direct and indirect forms. Moreover, malware attacks are one of the best attacks by hackers.

Successful malware launching opens access to almost anything on you. For instance, it can also connect with other computers and networks interconnected.

Possible Solution:

  • Be wary of opening suspicious websites
  • Also, be careful about opening any suspicious emails. For instance, the sender is unknown.
  • When opening emails, be careful of downloading or clicking on attachments.
  • Email security systems are now available. Most especially with corporate users.

Insider Attacks

More attacks are now coming from insiders too. For instance, it could be your innocent-looking employee. Or anyone who gains access from your entity itself. 

Possible Solutions:

  • Document any file transfer
  • There are software-as-a-solution (SaaS) that can serve you well with safety file transfers
  • Make use of biometrics or any security measures for access

Human Errors

This is where proper training should be implemented among all users. Because this is just too inevitable with humans.

Possible Solutions:

  • Connect with security platforms or professionals
  • Handle cybersecurity training and awareness for security practices
Categories
Cybersecurity

Hy Vee Data Breach: Dangers of Malware

In 2019, the Hy Vee data breach happened. The supermarket chain experienced a data breach and the dangers of malware. How so?

Let us know more about that incident in this article. But let us first get to know Hy Vee.

What is Hy Vee?

Hy Vee is an employee-owned supermarket chain in the Midwestern United States. It was founded in Beaconsfield, Iowa in 1930.

Also, the chain has 245 locations in eight different states and six subsidiaries under it.

Further, some of their chains are full-service supermarkets. With bakeries, pharmacies, coffee kiosks, flower shops, and much more.

Then, Hy Vee has gas stations with convenience stores and fitness centers. They also have full-service restaurants in some of its areas.

So, a company this big has cyberattackers looming around. What happened with the supermarket chain last year?

Hy Vee Data Breach

On August 14 of last year, Hy Vee announced that they are looking into a data breach. One that affects their payment systems and card readers.

They learned of the breach by July and reported it in August.

Then, the affected were some of their gas pumps and drive-thru coffee shops.

Also, some in-store restaurants were affected. Like their Market Grilles and Market Grilles Express. Some Wahlburgers were also affected.

But the data breach did not affect other areas of their business. It did not affect cards used at:

  • front checkout lanes
  • pharmacies
  • clinics
  • convenience stores
  • liquor stores
  • customer service counters
  • floral departments
  • other food-service areas

This is because these areas have better encryption security systems. Also, its systems rely on technology designed to defeat card-skimming malware.

Further, there were many locations affected. Including 11 from Omaha, 2 in Council Bluffs, and one in Papillion. Other locations were Lincolns, Columbus, Plattsmounts among others.

So, what did the culprits use? Malware.

Dangers of Malware

After two months of investigation, Hy Vee had a conclusion to the data breach. They learned that a point-of-sale or POS malware was behind the breach.

So, this malware exposed customer payment card information from affected areas. Its design is to tap into the payment card info exchanged at the POS device.

Then, the malware will search for track data read from the card used at the POS device. Some data they can copy are:

  • cardholder name
  • card number
  • expiration date
  • internal verification code

But in some locations, the malware was not on all POS devices. Also, it did not copy all data from payment cards and not all cards were affected.

Then, as per Hy Vee’s investigation, the breach was discovered in July. But was already present since late-2018 starting as early as November 9.

Thus, they asked for the aid of cybersecurity experts. Hy Vee then removed this malware with the help of these experts. And found ways to better the payment security in affected areas.

They also notified the Federal law enforcement and payment card networks.

After, Hy Vee identified customers that may have been affected by the malware. Then, they notified them by mailing a letter or sending them an email.

Categories
Cybersecurity

Exactis Data Breach: One of the Biggest in 2018

Have you heard of the Exactis data breach that happened two years ago? It was one of the biggest breaches that happened in 2018.

But this breach was not done by any elite hackers or identity thieves. It is by the marketing company itself and its lack of firewall for its database.

Thus, it experienced a breach of about 340 million Americans’ personal data. Meaning, it affected about 45% more Americans than the 2017 Equifax breach.

So, let us take a look at some facts about what happened with the Exactis data breach.

What is Exactis?

Exactis is a data broker and marketing firm based in Palm Coast, Florida. Selling premium business and consumer data as one of its main businesses.

These records were of 218 million individuals and 110 million US households.

Also, it boasts of having more than 3.5 billion consumer, business, and digital records. And it is said that these records are updated every month.

Thus, the company boasts of having the largest and most respected data warehouse. In what sector? In all digital and direct marketing sector.

So, Exactis runs on data. Providing hundreds of categories like demographic, geographic, behavioral data, interests, and more.

Discovering the Breach

In June 2018, Vinny Troia tested the security of the database ElasticSearch. Then, he did it with the help of the search tool called Shodan.

With this, Troia found 7,000 databases that were accessible on public servers. And one of these was of Exactis, unprotected by any firewall.

Then, while checking, he noticed Exactis had two versions of its database. And one of them only added while he was observing its servers.

Further, both databases have 340 million records. And it is split into 230 million consumers and 110 million business contacts.

So, he checked for the accuracy of the data then contacted both Exactis and the FBI.

Leaked Information

As said, the Exactis data breach affected 340 million Americans’ data. Also, this data amounted to up to 2 terabytes.

With two-thirds of these data coming from individuals. And the third of it from businesses and companies all over the nation.

But Social Security numbers and credit card numbers were not exposed. But even though that is the case, the data were still very detailed.

Some information leaked are:

  • name
  • age
  • gender
  • phone numbers
  • home address
  • e-mail address

Aside from the basic information, there is also a very specific and wide range of data. Like:

  • interests
  • habits
  • religion
  • whether the person smokes
  • do they have dogs or cats
  • children’s gender

So even though there weren’t any Social Security numbers, it is still very serious. Also, this leak was one of the biggest in the year.

Cybercriminals can use these data to make other forms of social engineering. Also, impersonation and profiling is a very high chance.

But with millions of Americans affected by this data breach, none of them were alerted. Exactis did not give a way for them to check if their data were leaked.

So, this was another lesson learned in 2018. That a lack of regulation around privacy and data collection in the US is very dangerous.