The Australian Securities and Investments Commission (ASIC) is suing RI Advice Group for being hacked multiple times over a year’s time that includes 155 hours of undetected hacker activity.
If you are the victim of ransomware once, it’s probably inevitable. But if you’re a ransomware victim again, and then hacked on a third occasion, you’re probably not paying attention to the need to properly secure your environment.
According to a notice filed earlier this month in Australian federal court, RI Advice Group was the victim of two remote access-turned-ransomware attacks in December 2016 and May 2017, and a third successful attack on a server containing sensitive financial information and client identification documents in December of 2017. The last one’s the kicker: in a port-mortem analysis, it was determined there were nearly 28K logon attempts – none, of which, were detected – and the hacker stayed logged in using compromised credentials for a total of 155 hours over a period of months leaving behind cryptomining software, a peer-to-peer sharing application, hacking tools, and brute-force password-cracking software. To add insult to injury, a trojan malware attack also occurred in May of 2018.
This company either isn’t paying attention or doesn’t care about their cybersecurity stance.
Because RI Advice Group is a financial services firm, they are subject to the ASIC, who are suing them for failing to establish and maintain compliance measures that include security controls.
I write a lot about the monetary impacts cyber attacks have on organizations, such as paying ransoms. But it’s important to note that there are additional repercussions – like being sued for non-compliance – that can put an organization out of business.
Pay attention – and when the first cybersecurity incident happens, take note, do an analysis of your security controls, and take steps to implement stronger measures that will ensure you’re less vulnerable in the future.
SOURCE: KnowBe4
