This month in security: August 2020

1 in 6 Australians fell victim to cybercrime during COVID lockdown

A new report found that every sixth Australian has fallen for an online scam during the quarantine. As people spend more time on their screens, cybercriminals are uncovering new opportunities to target their victims.

Perspective
Cybercriminals are opportunistic creatures by nature. They feed on the heightened sense of uncertainty and anxiety people experience in times of crisis. And in lockdown, people are spending far more time on their screens, opening them up to even more cyberattacks. Australians are currently experiencing a big wave of tax scams, fake online stores selling personal protective equipment and phishing scams, and most of us still don’t practice basic cyber hygiene. It’s a great time to brush up on your scam-busting skills and protect yourself from scammy profiteers. 

Australia’s Cyber Security Strategy 2020 pledges billions to strengthen nation’s cyber defences

In light of growing cyber threats, the government has rolled out a cybersecurity plan designed to safeguard national interests.

Perspective
It’s no secret that all levels of the government organisations, political bodies, essential service providers and operators of critical infrastructure are seeing a sharp surge in malicious cyber activity. We’re overdue for a major security overhaul, and it’s heartening to see some positive steps in that direction. All businesses are digital businesses now, and even if we can’t get all the technological bells and whistles, just fostering some healthy cyber habits can do wonders for our cybersecurity posture.

HealthEngine hit with $2.9m penalty over data misuse

The healthcare app admitted to sharing the names, phone numbers, email addresses, and dates of birth of over 135,000 patients without their knowledge or consent.

Perspective
HealthEngine admitted to sharing patient information with up to nine different third-party private health insurance brokers without informing the patients themselves. Since online reviews are now an important part of how patients choose healthcare providers, HealthEngine also chose not to publish 17,000 negative patient reviews of medical practices. We’ve commented before on how our healthcare system needs new cyber-protections to keep functioning safely. At least public awareness about the issue is growing, which should help shape cyber policies in the healthcare sector.

Regis Healthcare loses data in Maze ransomware attack

The ACSC has raised a warning of a broader campaign that is specifically targeting Australian aged care and healthcare sectors.

Perspective
Regis Healthcare owns and operates around 50 aged care facilities with over 5880 operational locations, and was targeted by an overseas attacker who stole some data. Fortunately, Regis Healthcare said it had been able to move to “backup and business continuity systems” to recover from the incident. Good for you, Regis! Hats off to whoever had the foresight to make and maintain a backup. That’s cyber resilience in action, and it absolutely needs to be a part of any cybersecurity plan, especially in areas as critical as aged care and healthcare.
 

Cruise operator Carnival PLC hit by ransomware attack

In a huge blow to a struggling industry, the world's largest cruise operator, Carnival, suffered a data breach and may have lost some customer data to the attackers.

Perspective
The company welcomes around 13 million guests each year and also owns Princess Cruises, which operated the Ruby Princess liner that disembarked in Sydney in March with hundreds of COVID-19 positive passengers. The attack occurred on the 15th of August, but the company hasn’t revealed what data, if any, was actually stolen. The travel industry as a whole is an extremely attractive target to cybercriminals. The industry routinely collects and stores personally identifiable information (PII) on billions of passengers every year, including everything from passport numbers, credit card information, to email addresses and much more.

Hackers exploit universities’ digital exam tool

Australian universities are investigating the data breach of popular remote invigilation tool, in which the details of 444,000 users were allegedly stolen.

Perspective
In response to the coronavirus pandemic lockdown, many universities were forced to quickly transition to online learning and exam methods and relied on remote invigilation software to conduct student exams online. Schools and universities already have lax cybersecurity in general, so it’s not surprising they’d be targeted by bad actors. The hackers exploited a vulnerability in the software to gain access to the data across multiple universities, which contained usernames, unencrypted passwords, legal names and residential addresses of staff and students. No matter how much of a rush you’re in, taking shortcuts in your digital transformation is always a bad idea.