The IT Nerd

The Clop ransomware gang has been pwning organizations right, left and centre via vulnerabilities in the MOVEit file transfer software. And with the scale of these attacks growing by the day, you knew it was a matter of time to before a lawsuit was filed. And now we have a class action lawsuit:

On June 20, three Louisiana individuals headed up a class-action lawsuit filed in a Massachusetts district court against Progress Software, the Bedford, Massachusetts, makers of the MOVEit file Transfer and Cloud file transfer service that are used by thousands of entities and have been exploited over the past month to compromise an ever-growing list of companies and government agencies.

The plaintiffs represent more than 100 individuals who say Progress Software’s security practices were negligent, resulting in their personal data being exposed and stolen through the hack. The complaint characterizes this information as “a gold mine for data thieves” and the victims are seeking damages in excess of $5 million.

One of the lead plaintiffs, Shavonne Diggs, reportedly received “numerous phishing calls” following the breach from scammers who claimed she had signed up to attend different academic institutions, as well as an unauthorized charge on one of her payment cards.

“Armed with the Private Information accessed in the Data Breach, data thieves can commit a variety of crimes including … opening new financial accounts in Class Members’ names, taking out loans in Class Members’ names, using Class Members’ names to obtain medical services, using Class Members’ information to obtain government benefits, filing fraudulent tax returns using Class Members’ information, obtaining driver’s licenses in Class Members’ names but with another person’s photograph, and giving false information to police during an arrest,” lawyers for the plaintiffs wrote.

The company hasn’t really addressed this lawsuit. Instead they said that they are focused on helping those affected by these attacks. But I think it’s a safe bet that this will never go trial. Instead Progress will likely settle this out of court. Having said this, the repetitional damage to Progress will be huge.

Zoetop, the parent company behind retailers Romwe and Shein, have been ordered by the State of New York to pay $1.9 million over a data breach which affected millions of customers. Zoetop was found guilty of failing to secure customers’ data, not properly notifying customers and trying to keep the extent of the data leak under wraps. This penalty comes after an investigation by the New York Attorney General into a 2018 cyber attack in which credit card and personal information was stolen.

Before I give my thoughts on this, let’s hear from John Stevenson, Product Director at Cyren on this:

“Testament to the scale of the unsolved nature of social engineering attacks, every single of the millions of victims successfully targeted here now face phishing scams abusing their exposed PII in the pursuit of more valuable credentials. 

It is likely many customers’ credentials have already been sold to the highest bidder and may now be used to target their place of work. However, because employees are so busy, they cannot feasibly be expected to detect all fraudulent emails every time. Therefore, organisations must implement additional layers of technology and processes to continually hunt for targeted email attacks like spear phishing and business email compromise to automatically eliminate the threats once identified. 

A silver lining, however, is that hopefully expensive retributions for such failures to responsibly disclose and appropriately respond to a data breach is a step in the right direction towards creating a culture of compliance.”

My $0.02 worth. I am glad that the State of New York held Zoetop accountable for this and I hope that we see more of this going forward. Because if companies know that if they screw up they will get punished, they will take the steps required to make sure that they don’t get pwned.

This is the sort of story that I like writing about as it illustrates that companies who don’t seriously protect their customer’s data will be held to account. In this case Cafe Press who I’ve written about before has been fined $500,000 for a data breach that affected 23 million customers. You can read about it here, but I’ll hit the highlights for you:

• Residual Pumpkin and PlanetArt who now own Cafe Press have to implement multi-factor authentication
• They have to minimize the amount of collected and retained data
• They have to encrypt all stored Social Security numbers.
• PlanetArt is being ordered to alert buyers and sellers whose personal info was accessed or stolen during the security breaches and provide them with information on how they can protect themselves

All of this centers around a February 2019 breach of CafePress’ servers where unknown attackers gained access to, stole, and later put up for sale on the dark web personal information belonging to 23,205,290 CafePress users. Then CafePress tried to cover this up until it was reported by Bleeping Computer. And to top it all off, the company knew they had issues but didn’t do anything about it. And they also didn’t investigate any of the attacks. Which makes it pretty clear that dealing with Cafe Press is a bad idea. Though this fine may have them rethink how they handle customer data going forward.