Hackers Seek Riches: Protect Your Data

Data security is often a matter of national security.  A cyber intrusion against the US Marshals Service demonstrates nothing less.  Describing it as a major incident, the agency announced ransomware had targeted a system that subsequently had to be disconnected.  “The affected system contains law enforcement sensitive information, including returns from legal process, administrative information, and personally identifiable information pertaining to subjects of USMS investigations, third parties, and certain USMS employees,” according to an agency spokesman.

Classifying this as a major incident seems apt; despite the fact that the hackers didn’t gain access to the organization’s Witness Security Files Information System, the stolen data did include the aforementioned personally identifiable information (PII).  his is not the first major breach for USMS, having previously reported on a 2019 incident in which details of 387,000 former and current inmates were exposed, including Social Security numbers.

If hackers don’t go after this data in the employ of a government agency looking for a leg up in information warfare, the reason often boils down to the simple profit motive (Verizon’s annual data breach report puts this figure at 86%).  Based on research from the Dark Web Price Index, a person’s personal data is worth on average around $1,010.  Whether it’s stolen bank logins that can be had for $50 per record, credit card details for around $120, or a hacked Netflix or Uber account for $40, all the bits and pieces can add up to a motivational windfall for cyber criminals.  Healthcare breaches net especially major sums: the value of protected health information (PHI) is worth about 50 times more than credit card information

Keep your organization’s critical data secure via the recommended methods of data encryption, staff training, and strong access controls.  When a breach does occur, however, whether it involves critical infrastructure, or just stealing data from video game companies…well, don’t be like one of the many  companies that fails in its response on every level.  When an Activision Blizzard employee fell for a phishing scheme, exposing all sorts of personal data, the organization neglected to disclose the breach not only publicly, but the employees themselves didn’t find out until months after the fact, and on Twitter of all places. 

This incident might not rise to the level of national security, but it is a particularly egregious example of how not to handle a data breach once it has occurred.  If you fail to have sufficient safeguards to keep the bad actors out, at least don’t drop the ball on the incident response.