Cyber security news round-up

The latest Digital Health cyber security round-up includes news that Dixons Carphone has been hit by yet another cyber-attack, as well as a report from Symantec that suggests a Chinese espionage group may have breached the control systems of a satellite operator. Meanwhile, Yahoo UK has paid the price for an infamous security breach dating back to 2014.

Not again, Dixons Carphone?

In perhaps one of the biggest cyber security stories of the month, retailer Dixons Carphone has been subjected to another major cyber-attack after it noticed attempts to breach customer data leading as far back as July 2017.

The retailer, which has been hit by two large-scale data beaches in the past three years, revealed that the details of almost six million bank cards had been compromised, as well as some 1.2 million personal data records.

However, it claimed that there was no evidence that customers’ payment cards or personal data had been used fraudulently in the wake of the attack.

Alex Baldock, CEO of Dixons Carphone, said in a statement that the company had “fallen short” in its ability to protect customer data.

“We are extremely disappointed and sorry for any upset this may cause,” said Baldock.

“We’ve taken action to close off this unauthorised access and though we have currently no evidence of fraud as a result of these incidents, we are taking this extremely seriously.

“We are determined to put this right and are taking steps to do so; we promptly launched an investigation, engaged leading cyber security experts, added extra security measures to our systems and will be communicating directly with those affected.”

Dixons Carphone, which owns Currys PC World and Carphone Warehouse, was also hit by a massive cyber-attack in 2014 when personal details of 2.4 million Carphone Warehouse customers were stolen.

Research reveals which mobile apps are most susceptible to malicious malware

As the implementation of the general data protection regulation (GDPR) act approaches its one-month anniversary, a survey of IT professionals and cyber security experts has revealed that confusion still exists.

A survey of 500 global IT and cyber security professionals by Manchester-based security software firm Avecto, found that just over half (56%) of professionals in North America and two-thirds of respondents from UK and Germany are aware that the GDPR impacts any company with European customers, employees and partners.

At the same time, 47% of those surveyed felt that the new regulations do not go far enough. In North America, only 31% of professionals said current GDPR laws were sufficient.

The results of the survey suggested that organisations in the UK and Germany were taking necessary steps to prepare for the GDPR; however, North America was found to be “lagging”, potentially putting firms at risk of “significant fines.”

Simon Langton, VP of professional services at Avecto, said: “With GDPR coming into effect, companies are facing a new era of compliance and transparency when it comes to managing and storing their personal data.

“While some see this as detrimental to business operations, we see this as a positive change. GDPR is creating a culture of accountability, and it will force companies to review policies, procedures and best practices to protect the privacy of those with whom they do business.”

China hacking satellites

A Chinese espionage group has been targeting satellites communications and defence operators as part of state-sponsored attacks on companies in the US and southeast Asia, researchers claim.

According to security firm Symantec, the “sophisticated” group, which has been tied to the Thrip hacking outfit, has been targeting communications and defence networks using a combination of custom malware and legitimate software tools.

In one of the most worrying instances, Thrip hackers were found to have targeted the systems responsible for monitoring controlling satellites in orbit, Symantec claimed.

The group was found to be employing so-called “living off the land tactics”, whereby hackers use “operating system features or legitimate network administration tools” in order to blend into the network and hide any malicious activity.”

Symantec wrote in its report: “We’ve been monitoring Thrip since 2013 when we uncovered a spying campaign being orchestrated from systems based in China. Since our initial discovery, the group has changed its tactics and broadened the range of tools it used.

“Initially, it relied heavily on custom malware, but in this most recent wave of attacks, which began in 2017, the group has switched to a mixture of custom malware and living off the land tools.”

Yahoo-ouch

The UK arm of Yahoo has been slapped with a £250,000 by the UK Information Commissioner’s Office (ICO) as the result of a high-profile cyber security attack dating back to 2014.

The attack, which occurred four years ago but was only reported by Yahoo in September 2016, led to the personal data of at least 500 million users being compromised.

Amongst the personal data stolen by “state-sponsored” hackers included names, email addresses, dates of birth and encrypted passwords.

The ICO said Yahoo had failed to take appropriate measures to protect users’ information and highlighted “inadequacies” in its security protocols.

This included its ruling that Yahoo UK failed to take appropriate action to ensure Yahoo complied with data protection standards.

James Dipple-Johnstone, deputy operations commissioner of the ICO, said: “People expect that organisations will keep their personal data safe from malicious intruders who seek to exploit it.

“The failings our investigation identified are not what we expect or will accept from a company processing significant volumes of personal data. [Yahoo UK] had ample opportunity to implement appropriate measures, and potentially stop UK citizens’ data being compromised.

“The failings our investigation identified are not what we expect or will accept from a company processing significant volumes of personal data. [Yahoo UK] had ample opportunity to implement appropriate measures, and potentially stop UK citizens’ data being compromised.”