Weekly Cybersecurity Recap November 11
Table of Contents
- By Steven
- Nov 10, 2022
Alright, everyone, it’s official; we’ve found the eye of the hurricane. Just before the holidays begin, we find ourselves in that lull, just before the massive hacks start to spike around Black Friday.
While we didn’t report on many recent hacks this week, practically everyone is being sued. Hospitals, cruise lines, and not even student help sites are safe from the government’s wrath. Some of these breaches happened years ago and are just now getting the attention they deserve from the press, media, and court systems.
Meta Pixel
We’ve reported on bits of the Meta Pixel breach before; some of our recurring readers may remember mention of it in our piece about information leaked from 33 of the top hospitals in the US. Now, months after the breach, we are beginning to see the full repercussions of the violation.
For those unfamiliar with the breach, Meta Pixel used sensitive patient information harvested from hospital websites in a targeted ad campaign. So far, we don’t know how many individuals were affected by the breach. However, we wrote about the recent inclusion of new hospitals on the list of those involved. Now joining the ranks are WakeMed Health and Hospitals and Advocate Aurora Health.
Chegg
Virtually everyone under the age of 20 has heard of or used Chegg. It is a student homework helper often used to cheat with virtual schooling, and it’s so common it’s gotten its own name; “chegging.” High school and college students made up the majority of affected individuals, but employees and the parents of the students are also in harm’s way as a result of the breach.
The leaked information varied depending on the individual to whom it pertained. In most cases, however, the leaked details were emails, passwords, and names. In some instances (when students were using the site’s scholarship finding feature), things like disability, religion, parental income, sexual orientation, and social security numbers were leaked to the hacker(s).
St. Luke’s Health
Unfortunately, St. Luke died in 84 AD, so we can assume his health is not well. His hospital, however, is up and running and just a little bit worse for the wear. In early September 2022, the hospital was alerted to a possible data breach from a third party. An investigation was immediately launched, in which researchers found that over 16,000 patients and employees were affected by the breach.
The personal information involved is incredibly delicate; names, social security numbers, health insurance information, and addresses were all part of the breach. However, there was more listed in our piece on the subject. One massive issue that is not always a problem for hack victims is the inclusion of location information. It puts victims at heightened risk for physical attacks and crimes on top of the online risk associated with the hack.
EyeMed
When looking for a decent job, many of us look for companies that offer health, dental, and vision insurance. EyeMed is one such provider. While it will insure individuals, it specializes in companies. In 2020, EyeMed was hacked – twice. The first time was unauthorized access to an employee’s email. As soon as EyeMed claimed the hack was over, the same compromised email began sending phishing attacks to other emails within the database. 2,000 emails later, EyeMed finally removed the hacker’s access.
The breach penalty in New York alone is 4.5 million dollars. It may have taken two years for anything to come of the breach, but the government has definitely ensured EyeMed its dues.
Carnival Cruise
Carnival Cruise, a Florida-based cruise line, was hacked four times in three years. First, 2019 offered phishing scams to customers and employees alike. 2020 and 2021 gave more emails, only these contained ransomware instead. Last, in 2021 (again), another phishing scam was launched, though this one only affected employees.
2022 has been far kinder to the cruise line; instead of a hack, it got a lawsuit! The NYDFS (New York Department of Financial Services) sued the line for five million dollars and managed to take its producer licenses in New York state.
