The IT Nerd

I was alerted late yesterday to this post that was put up by the Toronto Public Library. Apparently the are currently dealing with some sort of “cybersecurity incident” which is code for the fact that they have likely been pwned by hackers. Here’s the salient information:

We are actively addressing a cybersecurity incident that came to our attention on Saturday, October 28. 

As a result of the incident, the following services are unavailable: tpl.ca, “your account”, tpl:map passes and digital collections. Public computers and printing services at our branches are also unavailable.

Branches are open as scheduled. Wifi is available in library branches, and branch telephone lines are working. Materials can be borrowed and returned in branches until further notice.

As of now, there is no evidence that the personal information of our staff or customers has been compromised.

TPL has proactively prepared for cybersecurity issues and promptly initiated measures to mitigate potential impacts. We have engaged with third-party cybersecurity experts to help us in resolving this situation. We do anticipate though that it may take several days before all systems are fully restored to normal operations.

We will update this page as more information becomes known. We appreciate your patience and understanding while we do everything we can to resolve this matter as quickly as possible.

It will be interesting to find out what happened, and more importantly how library patrons are affected by this. Because I would not be surprised if those patrons along with their staff have been affected despite what they say.

Watch this space.

News has surfaced that the infamous LockBit ransomware gang is claiming to have pwned aircraft manufacturer Boeing:

Boeing said on Friday it was assessing a claim made by the Lockbit cybercrime gang that it had “a tremendous amount” of sensitive data stolen from the aerospace giant that it would dump online if Boeing didn’t pay ransom by Nov. 2.

The hacking group posted a countdown clock on its data leak website with a message saying, “Sensitive data was exfiltrated and ready to be published if Boeing do not contact within the deadline!”

“For now we will not send lists or samples to protect the company BUT we will not keep it like that until the deadline,” the hacking group said.

The hacking group typically deploys ransomware on a victim organization’s system to lock it up and also steals sensitive data for extortion.

“We are assessing this claim,” a Boeing spokeswoman said by email.

The claim by LockBit was also posted on Twitter:

IF this is true, this is likely the biggest victim that LockBit has had.

Ken Westin, Field CISO, Panther Labs had this to say:

This is another example of a Russian based threat group gaining access to potentially sensitive data.

Ransomware groups have been increasing their level of sophistication and capabilities, so no organization is safe from a potential ransomware incident. Even organizations with the best security posture and following best practices are still at risk. This compromise, along with the recent compromise of DC voter data via DataNet Systems by RansomVC, raises national security concerns as often times these groups not only encrypt the data, but also exfiltrate it. LockBit is a predominantly Russian speaking ransomware group believed to be operating out of Russia with ties to the Russian government. Data from Boeing can be very valuable to foreign governments, particularly their “Defense, Space & Security” division. The scope of the breach has not been announced so it’s not clear if data from this division was compromised, but it could be a threat.

This is a story to keep an eye on because I am sure that we will find out what the truth is in the coming days.

Three weeks after the fifth largest school district in the country became aware of a “cybersecurity incident” and a week after they informed parents and employees, hackers have started leaking 200,000 students’ information and numerous other files with personal information.  

 Since Monday, Nevada’s Clark County School District parents have expressed frustrations about the district’s lack of transparency and have become increasingly concerned about the breach after receiving emails supposedly from the hackers with their children’s personal information. One parent described an email received as:

“Warning me that my children’s information was released or hacked into and it had three PDF files. Each one had my children’s picture, all of their contact information, email addresses, student ID numbers, my information, our address.”  

The files that appeared to be from the district were leaked on a file-sharing site earlier this week, but have since been removed. Student personal information observed in the leaks included:

• Name
• Student ID
• DOB
• Email addresses
• Picture
• Household members
• Cellphone numbers
• Race
• Attendance records
• Incident reports
• Medical information

The Clark County School District released a statement saying that it is cooperating with the FBI following a recent cyberattack. This is the district’s second breach in 4 years.

Emily Phelps, Director, Cyware had this comment:
 
   “Securing sensitive data is complex even under the best conditions. With limited resources, expertise, and support, it becomes daunting. School districts often lack the level of resourcing needed to modernize security programs, but as one of our most critical areas, education must not only begin prioritizing strong security practices, they must be transparent in their communities to build and maintain trust.”

Corey Sinclair, Cyber Threat Intelligence Analyst, Horizon3.ai follows with this:
 
   “Schools, and subsequently their students, are the perfect target because they house sensitive personally identifiable information (PII) like names, social security numbers, and medical histories, while largely being underfunded and understaffed in terms of IT infrastructure and expertise.
 
   “What is done with the PII after it is sold on the black market will largely depend on the age of the students targeted and the time horizon of the cyber threat actors and other criminals. The younger the student, the more time criminals have to build a fake persona that may contain numerous bank accounts, credit cards, passports, &c. When it comes time for the student to actually set up their own bank accounts or apply for credit, they may be unable to do so given the number of actions that have already been completed on their behalf.”

The fact that this school board has been pwned twice in four years should send chills down the spines of parents. Yes it is true that other than health care, education is a prime target for threat actors. But one would have thought that given that this is not a new message, more effort would have been put into making sure that education doesn’t remain a prime target. Clearly based on this example, that’s not the case.