The IT Nerd

Prudential Financial has disclosed that its network was breached last week, with the attackers accessing/stealing employee and contractor data before being blocked from compromised systems one day later.

The company is the second-largest life insurance company in the U.S. and employs 40,000 people worldwide managing roughly $1.4 trillion in assets. Prudential had reported revenues of more than $50 billion in 2023.

In a 8-K form filed with the SEC this week, Prudential said a “threat actor… had accessed Company administrative and user data from certain information technology systems and a small percentage of Company user accounts associated with employees and contractors.”

The breach is said to have occurred on February 4^th and was detected one day later, on Feb 5^th, whereupon the company immediately shut systems down and began remediation. The company reported the breach to law enforcement agencies and notified all relevant regulatory authorities of the event.

“… we believe that the threat actor, who we suspect to be a cybercrime group, accessed Company administrative and user data from certain information technology systems and a small percentage of Company user accounts associated with employees and contractors,” Prudential said.

“As of the date of this Report, the incident has not had a material impact on the Company’s operations, and the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations,” the company said.

Craig Harber, Security Evangelist: Open Systems had this to say:

    “Prudential Financial disclosed its network was breached last week by cyber criminals. It did not provide any specific details of how the threat actor breached the system, nor did it give details on the extent of the compromised data beyond the fact it was contractor and employee user data, not non-employee customer data.

   “The threat actors accessed the company network from what they described as “information technology systems.” The company did not disclose whether this system was a Prudential-managed system or whether this system was third-party-managed. Prudential notified law enforcement agencies and regulatory authorities of the breach in accordance with the new Cyber Incident Reporting for Critical Infrastructure Act and other regulatory requirements, such as the SEC’s new rules on cybersecurity disclosure.

   “Based on all available reporting, incident response teams blocked the threat actor within the first 24 hours of breach detection. This type of response requires investment in preventing cyber-attacks and preparedness in case of an inevitable cyber event. 

   “Prevention includes everything from investing in backup and recovery systems to patching operating systems and applications to deploying robust, proactive cyber defense technologies to actively threat hunt within the network to fortify business operations from cyber threats and attacks. 

   “Preparation involves developing policies and a playbook for handling incidents and exercising these plans under simulated attack scenarios to ensure teams can assess, contain, and mitigate an active threat while maintaining business operations.

   “The key takeaway from this data breach is cybercrime is a complex and evolving challenge that impacts individuals, organizations, and societies globally. Vigilance, cybersecurity measures, including incident response preparedness, and international cooperation are crucial in combating this digital menace.’

Dave Ratner, CEO, HYAS follows with this comment:

   “While it’s a good thing that the breach and attack is not expected to affect company operations or financials, it still highlights the rampant onslaught of breaches that expose data, putting employees, contractors, and others at risk.  Without appropriate proactive intelligence and cyber resiliency strategies, these events will unfortunately continue.”

The good news is that the threat actors were detected quickly and it looks like Prudential regained control in short order. Swift detection is one of the tools in the toolbox that has to be present to make sure that threat actors cannot set up shop and start to move within a victim’s environment.

Yesterday, in a breach notification letter seen by Reuters, the U.S. Government Accountability Office said that one of its IT contractors, CGI Federal, notified the agency of a data breach last month affecting the PII of about 6,000 GAO employees that worked between 2007 to 2017.

CGI Group, the information systems and management consultancy, has shifted to cybersecurity in recent years, and said in a congressional testimony that it provides IT protection for “100 participating agencies” including the State, Justice, Commerce, and Labor departments, as well as the FCC and the US Agency for International Development.

The notification letter said that the threat actor exploited a “vulnerability in an externally provided platform” and the data exposed included:

• Names
• SSNs
• Addresses
• Banking information

A GAO spokesperson said the agency was notified about the breach on Jan. 17 but provided few other details.

Emily Phelps, VP, Cyware had this comment:

   “Public sector breaches facilitated through IT contractors, demonstrate the multifaceted nature of cybersecurity threats that the public sector faces. It highlights the urgent need for a modernized and proactive defense strategy, where collaboration and information sharing between agencies and their partners are paramount. The concept of collective defense becomes particularly relevant here, emphasizing the idea that protecting one agency effectively contributes to the security of the entire public sector network.”

Dave Ratner, CEO, HYAS follows with this comment:

“Criminals will often go after a link in the chain, which means they may extract information about government employees not from the agency directly but from targeted contractor company. It’s just one more reason why everyone should be implementing cyber resiliency strategies immediately as part of their 2024 initiatives as these kinds of breaches, and worse, will continue to occur.”

When a cybersecurity company gets pwned, that’s bad. But when a customer gets pwned, that’s worse. This truly isn’t a great day for CGI Federal.

Bank of America is warning customers of a data breach exposing their personal information after Infosys McCamish Systems (IMS), one of its service providers, was pwned last year:

On or around November 3, 2023, IMS was impacted by a cybersecurity event when an unauthorized third party accessed IMS systems, resulting in the non-availability of certain IMS applications. On November 24, 2023, IMS told Bank of America that data concerning deferred compensation plans serviced by Bank of America may have been compromised. Bank of America’s systems were not compromised.

In response to the security incident, IMS retained a third-party forensic firm to investigate and assist with IMS’s recovery plan, which included containing and remediating malicious activity, rebuilding systems, and enhancing response capabilities. To date, IMS has found no evidence of continued threat actor access, tooling, or persistence in the IMS environment. 

When someone who clearly has access to the Bank of America network gets pwned, everything downstream is pwned. Or at least it should be. John Gunn, CEO, Token comments on why that appears not to have happened here:

You can be certain that Bank of America has the highest level of security and imposes incredibly stringent cybersecurity requirements on their third-party partners, with the latter being legendary. With large global organizations that have thousands of service providers, these events are nearly impossible to prevent. Cybercriminals have stepped up their attacks on outsource service providers knowing they cannot directly defeat the cybersecurity of a major bank. The silver lining is that this event impacted less than 1/1000^th of their customer base.

In this case, Bank of America might have dodged a major bullet. But that doesn’t mean that they will continue to do so. Thus I hope they look at their processes and security and make sure that they give themselves the best chance of avoiding pwnage.

UPDATE: I have additional commentary. Starting with Paul Valente, CEO & Co-Founder, VISO TRUST:

    “Bank of America’s breach involving IMS is a stark reminder that even the strongest security fortresses can be undermined by exploiting the expanded attack surface connected third party ecosystems represent. CISOs know it’s all too common that companies invest millions in top-notch security only to entrust their data to lesser-known vendors with questionable defenses. Questionnaires won’t cut it – we need a thorough understanding of a vendor’s security program maturity. Time for a reality check in the world of data protection.”

Next up is Craig Harber, Security Evangelist: Open Systems:

   “The Bank of America (BoA) data breach highlights the importance of companies implementing third-party risk management. To protect their customers, companies must implement consistent security standards across their entire business ecosystem to help mitigate cyber-attacks originating through partner and supplier systems.

   “Third-party partners like IMS are critical to most modern businesses, including the financial sector. Unfortunately, these partnerships introduce inherent risks because the resulting interconnected IT/business systems do not deliver the critical trust relationship to prevent supply chain attacks, data breaches, and reputation damage. The notorious ransomware gang LockBit, who claimed responsibility for this attack, exploited this known weakness.

   “To prevent further occurrences, security teams must implement consistent security standards across the entire business ecosystem, including all its subsidiaries’ IT/business systems, not just IMS. Consistent security practices include requiring prompt and regular patching of system vulnerabilities, implementing multi-factor authentication to prevent exploitation of weak credentials, and deploying comprehensive monitoring tools to identify and neutralize cybersecurity threats.”

Finally here’s a comment from Jason Keirstead, VP of Collective Threat Defense, Cyware:

   “Because suppliers have access to sensitive or proprietary information that attackers want to exploit, they need effective cybersecurity controls in place to protect their own systems and data as well as those of their customers. A collective defense approach enhances the cybersecurity posture of both large institutions and their third-party vendors by sharing information and best practices across the supply chain. By working together as a team against common threats, both parties can achieve greater resilience and security than they could individually.”

Dave Ratner, CEO, HYAS:
 
   “Criminals will often go after a link in the chain, which means they may extract information and data not from the company directly but from targeted contractor agencies. It’s just one more reason why everyone, from enterprises to MSSP and MSP providers, should be implementing cyber resiliency strategies immediately as part of their 2024 initiatives as these kinds of breaches, and worse, will continue to occur.”