VF Corp., the parent company of the apparel brands Vans, Supreme, and The North Face, reported in an SEC filing that hackers stole the personal data of 35.5 million customers in a December cyberattack.
The filing did not say specifically what kinds of personal data was taken or if any corporate data was stolen but VF Corp said it does not retain consumer Social Security numbers, bank account information, or payment card information for its consumer businesses.
VF said in December, at the time of the incident, that it had experienced operational disruptions and its “ability to fulfill orders” and in its Thursday filing, they said the company is “still experiencing minor residual impacts from the cyber incident,” but that it has caught up on fulfilling orders that were delayed.
Al Martinek, Customer Threat Analyst, Horizon3.ai:
“While accurately predicting the actions of cyber threat actors is challenging, especially during the holiday season, it is imperative to remain vigilant to ensure the security of your systems and networks. Cyber vigilance becomes even more critical in safeguarding personal and financial information, given the increased online activities and festive shopping that create opportunities for cyber threats and scams. As we have seen, no matter how big or small a company is, threat actors will likely continue to focus on targets of opportunity and take advantage of complacent company manning and low staff. Additionally, increased online shopping creates a perfect environment for scammers to mask themselves among the chaos.
“Threat actors steal data, exploit weak credentials, and ultimately find any way possible to disrupt company operations during times of amplified cyber traffic. Adopting a proactive, autonomous approach that involves identifying, addressing, and validating exploitable vulnerabilities serves as the primary defense against cyber threats for any organization. Solutions such as continuous penetration testing not only deliver prompt results for addressing crucial issues but also save valuable time and stress for security teams. This approach allows for timely mitigations and verifications, providing organizations with the necessary peace of mind in keeping sensitive information out of enemy hands and networks hardened against attacks.”
Stephen Gates, Principal Security SME, Horizon3.ai:
“The outcomes noted here are a classic example of human-operated, ransom-based attacks. The likelihood of attackers gaining and maintaining their footholds in the victim’s networks is all too apparent.
“In 2024, organizations must find the weaknesses in their networks that are enabling these attacks to begin, then progress like a tumor. Most of the time, the weaknesses being exploited are not CVEs. Instead, they are easily compromised and reused credentials, effortlessly discovered and unprotected data, software and hardware misconfigurations, poorly implemented security controls, and weak and/or unenforceable security policies.
“These oversights and error conditions are one of the biggest reasons why the SEC new rules also add Regulation S-K Item 106, which will require registrants to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats.
“If you are not continuously assessing your internal, external, and cloud infrastructures, you likely will not be able to identify and manage material risks from cybersecurity threats. The real key is to continuously assess yourself before attackers do it for you.”
Craig Harber, Security Evangelist: Open Systems:
“The company’s filing this week confirms the extent of the December data breach, 3.5 million customers plus the initial disruption of business operations caused by encrypting IT systems. The disruption appears to have been limited to the company’s ability to fulfill orders, but this was the peak delivery season, right before Christmas. The attackers certainly were hoping to take advantage of this.
“Fulfillment uncertainty impacts customer confidence in the company’s ability to deliver items on time during the holiday season. Not surprisingly, VF Corporation’s share price tumbled on the news of the cyberattack based on project revenue losses, erosion of customer confidence, and long-term reputational damage to its brand.
“Cyberattacks are inevitable in today’s environment. Companies must be prepared to respond when it happens. Preparation includes coping with internal efforts to contain, assess, and mitigate active threats while maintaining business operations and adhering to regulatory compliance reporting requirements.
“The SEC Incident Disclosure Regulations that went into effect on Dec. 15th means that waiting until a cyberattack is underway to roll out your incident response plan is no longer an option. Companies must have effective cybersecurity plans in place to prevent cyberattacks, minimize the damage they cause and comply with regulatory requirements to ensure that they are not penalized for non-compliance.”
Mark Cooper, President & Founder, PKI Solutions:
“One method that organizations often overlook in protecting sensitive customer and business information is a strong encryption and identifying process. When information is maintained in an encrypted state, even if hackers steal or re-encrypt the information, the original data is protected from disclosure. As we have seen more and more lately, hackers are releasing information despite payment from their victims. To protect that data, organizations should be leveraging aggressive encryption programs proactively.”
With a count of 35 million people affected, this is a non-trivial event. And seeing as my wife recently bought a North Face jacket, we’ll be checking to see if she’s been affected. Unfortunately that’s now how the world is where you expect your data to leak because of a hack and all you can do is brace for impact. This is why companies and anyone else who has your data must do better to protect it.
Microsoft Pwned By “Midnight Blizzard”
Posted in Commentary with tags Hacked, Microsoft on January 20, 2024 by itnerdMicrosoft has revealed that on January 12, 2024, they were attacked by a nation state. Here’s what happened next:
The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium.
And:
Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. We are in the process of notifying employees whose email was accessed.
The attack was not the result of a vulnerability in Microsoft products or services. To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code, or AI systems. We will notify customers if any action is required.
This attack does highlight the continued risk posed to all organizations from well-resourced nation-state threat actors like Midnight Blizzard.
So this “state sponsored” which in this case the state in question is Russia seeing as “Midnight Blizzard” is a Russian affiliated group were looking for info on themselves. Does that mean that they were worried about what Microsoft knew about them? I say that because this is the first time I have heard of a group hacking someone to find out information on themselves. Second, if you are wondering what a “password spay attack”, it’s defined as follows:
Password spraying is a type of brute force attack. In this attack, an attacker will brute force logins based on list of usernames with default passwords on the application. For example, an attacker will use one password (say, Secure@123) against many different accounts on the application to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.
This attack can be found commonly where the application or admin sets a default password for the new users.
This again highlights why passwords tend to be the one of the weak points when it comes to cybersecurity. But I digress.
The fact that Microsoft was targeted in this manner is pretty brazen on the part of these threat actors. I for one will be interested to see what Microsoft says in terms of what these threat actors did once they got in beyond what Microsoft has said, and what they might have taken.
Stay tuned to this space.
UPDATE: Carol Volk, EVP, BullWall had this comment:
“So how big do you have to be to be secure? The apparent lack of 2FA and/or weak passwords by Microsoft’s senior staff allowed the Russian hacking group Midnight Blizzard to read their emails, and that’s the point here, anyone and everyone is vulnerable. It’s not just the zero-days that get you, it’s just that one hole in your defenses. In this case an old fashioned “password spray attack” worked just fine to let attackers in to read management emails.
“Microsoft is lucky this time, as apparently the gang was searching emails to see what MS was saying about them. They could have just as easily stolen or destroyed the data. Attackers can always find a way into a network, so regular air gapped backups and a rapid response ransomware containment system should be part of the complete defensive stack.”
Mark B. Cooper, President & Founder, PKI Solutions follows with this:
“The continued use of passwords will always lead to more security breaches like Microsoft experienced. This is especially true when test/non-production accounts are expected to be used for a short period of time or won’t be used to access confidential information and are allowed to have weak security controls. A strong identity and encryption standard that covers all identities, temporary or otherwise, is the only way to stem the tide of password breaches. Stronger technology like mutual authentication certificates and security tokens have been around for decades, but it has been traditionally easy to dismiss the complexity or operational challenges as an excuse not to secure an enterprise the way it should.”
2 Comments »