Sophos Announces a Data Leak

Sophos, a giant cybersecurity firm in the UK, recently warned customers about a possible data leak due to a misconfigured internal security system. 

Who is Sophos?

Sophos is a global cybersecurity vendor that sells products and software that protects more than 400,000 organizations in over 150 countries. They use SophosLabs, which is cloud-based AI-enhanced solutions to evaluate and adapt their products and services as the threats evolve. 

Sophos regularly posts press releases on their website to keep customers, and the public apprized about new threats along with blogs to instruct clients how to stay safe. 

Some of their business product offerings include firewalls, managed threat services, endpoint protection using AI, and products and services to keep email, mobile devices, and servers protected 24/7. They also offer products for home users for both Macs and PCs.

On their website, Sophos offers a host of available FREE tools such as:

• Sophos Home for PCs and Macs.
• Intercept X for Mobile for iOS.
• HitmanPro - Malware Removal Tool.
• Intercept X for Mobile for Android. 
• Sophos XG Firewall Home Edition.
• Virus Removal Tool.
• Sophos UTM Home Edition. 

What Happened?

On November 27, DataBreach Today reported that last Tuesday, Sophos sent out a memo to its customers reporting that an “access permission issue in a tool used to store information on customers who have contacted Sophos Support” may have leaked personal data. ZDNet, who first reported on this issue, says exposed information includes “customer first and last names, email addresses, and phone numbers (if provided).”

Sophos was quick to reassure the public that only a “small subset” of their customers were affected. A security researcher identified this misconfigured security issue and alerted Sophos. 

When questioned, Sophos replied, “At Sophos, customer privacy and security are always our top priority. We are contacting all affected customers.” Additionally, we are implementing additional measures to ensure access permission settings are continuously secure.”

Earlier this year, hackers twice found and abused a zero-day vulnerability in Sophos’ XG firewall and attempted to deploy ransomware using the Asnarok trojan. They were unsuccessful, however. 

Who is to Blame?

Experts agree that misconfigured servers, databases, and other IT equipment are the reason for most data breaches across the globe. IBM quoted the figure of $5 trillion that was lost between 2018 and 2019 due to data breaches and misconfigured systems. 

UW Medicine in Washington exposed patient data in February or 2019 due to a misconfigured database. That data breach alone affected 974,000 patients,

In November 2019, Texas Health Resources exposed data through a misconfigured billing system affecting 83,000 patients and 15 hospitals. 

Misconfigurations are a problem that could be avoided. 

How to Safeguard Corporate Systems

The best way to avoid these costly data breaches and leaks are to safeguard against them ahead of time. It’s always easier to prevent something than to clean up the mess afterward. Some tips to protect corporate digital systems are:

1. Any company that collects, stores, or uses customer data is responsible for keeping it safe. One of the best ways to do this is to hire a private cybersecurity team to come in and do a full threat assessment looking for vulnerabilities. Experts can identify shortcomings with hardware, software, and even team processes and data handling and management. Just by tightening up security in all areas, the risk of a potential data breach, leak, or hacking incident is reduced considerably. 
2. Another huge factor regarding cybersecurity is team training. If companies fully train each employee on proper security measures, strong passwords, cybersecurity best practices, and things to watch out for, like phishing emails, the more protected they will be as a whole. Dozens of incidents have begun with an unsuspecting employee clicking on an email link that infected their computer with malware before the hacker took over. 
3. Taking an inventory of data flow and evaluating access is critical to keeping things safe. Then adjusting access to only those individuals necessary further reduces the risk. If only one or two people has access to a server with patient data, then that information is less likely to be accessed by an outside source, especially if both staff members are adequately trained in how to watch out for threats and the proper steps to take if they encounter anything suspicious. 
4. Install specialized tools on your network to monitor emails (looking for malware attachments or suspicious links), protecting against ransomware and encrypting all data for an added layer of protection. 

The best defense against hackers and cybercriminals is common sense and preparedness. You cannot be too careful or take things too far when safeguarding your trade secrets, vendor and customer data, and your corporate assets.