Professional services giant CBIZ Benefits & Insurance Services (CBIZ), a management consulting company specializing in tax, financial, benefits, HR services and insurance services, has confirmed a data breach in which a threat actor accessed client information in certain data bases by exploiting a vulnerability in a CBIZ web page. CBIZ has 120 U.S. offices employing 6,700 people, with $1.59 billion in revenue in 2023:
On June 24, 2024, CBIZ learned that an unauthorized party may have acquired information from certain databases. CBIZ promptly launched an investigation with the assistance of cybersecurity professionals. CBIZ’s investigation determined that an unauthorized party was able to exploit a vulnerability associated with one of its web pages, and acquired information from certain databases between June 2, 2024 and June 21, 2024.
CBIZ conducted a review of the data acquired and determined that individuals associated with multiple CBIZ clients were impacted by the incident. Beginning on July 24, 2024, CBIZ began notifying its clients of the incident and the data involved for each client. The information varied by CBIZ client and included information related to retiree health and welfare plans which, depending on the individual, may have included their name, contact information, Social Security number, date of birth, and/or date of death.
On August 28, 2024, CBIZ began mailing letters with information about the incident to individuals on behalf of CBIZ’s clients. CBIZ has offered two years of complimentary credit monitoring and identity theft protection services for individuals whose Social Security number was involved.
Stephen Gates, Principal Security SME, Horizon3.ai had this comment:
A seemingly harmless vulnerability in a public-facing website – that has access to downstream databases – can be the enabler of data breaches. Critical vulnerabilities like remote code execution and/or arbitrary code execution in web applications can enable these sorts of outcomes. Improper input sanitization would also be high on the list of being a likely culprit.
Evan Dornbush, former NSA cybersecurity expert follows with this:
The lack of transparency surrounding the CBIZ data breach is alarming.
Despite the mandatory SEC 8-K filing for material events, it appears that CBIZ has yet to disclose this significant incident. The company’s silence on the technical details of the vulnerability not only fails to help the community understand and take action but also undermines trust at a time when cybersecurity initiatives like CISA KEV are gaining prominence. As concerns grow, there are already law firms soliciting potential plaintiffs for a suit against CBIZ.
This is all sorts of problematic, which honestly requires the relevant authorities to investigate further as the lack of transparency along with the sorts of data that were swiped make me wonder if there’s more to this than we know.
Equinix Issues More Than $750 Million in Green Bonds to Drive Sustainability Initiatives
Posted in Commentary with tags Equinix on September 5, 2024 by itnerdEquinix, Inc., the world’s digital infrastructure company, today announced that it issued more than $750 million in green bonds across two completed offerings. The green bonds will enable Equinix to advance on its sustainability initiatives and drive improvements in the operational eco-efficiency of its business. With these latest issuances, Equinix will have issued a total of approximately $5.6 billion of green bonds, making it one of the top 10 largest U.S. corporate issuers in the investment-grade green bond market.
Equinix issued €600 million principal amount of 3.65% senior green notes due 2033. This follows the issuance of Swiss Franc 100 million principal amount of 1.5575% senior green notes due 2029. Equinix used rate locks to hedge a significant portion of the interest rate risk associated with the issuance of both the Euro and Swiss Franc green bonds. Accounting for such hedges, the Euro and Swiss Franc green bonds are expected to carry an effective coupon of 3.62% and 1.67%, respectively. The Euro offering closed on September 3, 2024, and the Swiss Franc offering closed on September 4, 2024.
Equinix intends to allocate an amount equal to the net proceeds from the green bonds to finance or refinance, in whole or in part, recently completed or future Eligible Green Projects. Equinix’s allocation strategy includes covering project expenditures up to two years before the issuance of the green bonds and three years following the green bond issuance. These projects, which form the backbone of the company’s sustainability mission, span a wide range of impactful categories—from green building development and renewable energy innovations to advanced energy efficiency, resource conservation and cutting-edge decarbonization solutions.
Highlights/Key Facts
Additional Resources
2023 Equinix Sustainability Report and Global Reporting Initiative (GRI) Metrics
Leave a comment »