It's all in the family tree; including the data!

 

The latest craze has been with finding out about one’s history. This does not refer to those events that have molded our life, but to where we and our families originated. This may be in the UK, Europe, Africa, or another part of the globe. Once DNA testing became reasonably priced, this market opened up. We’ve seen the tests with the swab. While these are non-intrusive physically, these are able to tell much about you. This can show your relative who has also taken the test with the same service, health disposition, and much more.

               One such manufacturer is The Family Tree maker software. Their software, first released in 1989, has gone through many corporate owners over the years. These include Broderbund, The Learning Company, Mattel, Ancestry.com, and finally to McKiev, who presently is tasked with managing the code.

Oops!

               These services hold a large amount of data, accumulated from each person. This information has value and needs to be protected. By the company accepting this, they are responsible for its safekeeping. The issue in this instance, much like too many others, was a misconfigured cloud server. This was found by a team from WizCase led by Avishai Efrat. The Elastic Search server was not configured correctly. This allowed the server, along with all its data, to be insecure and accessible by anyone who wanted to check it. If the data would have at least been encrypted, it would have been a little bit better, however, this was not even the case.

               The cloud server had 25 GB of data available with 60,000 users data. This included a nice selection of data for people to view and download. This included the user’s email addresses, geolocation data, IP addresses, system user IDs, support messages, technical data (e.g. error logs), refunds (if applicable), and subscription type and status. Imagine what you could do with a credential stuffing attack with this data!

               This is also very useful for a phishing attack. With this data, the attackers would be able to create more and better content for their phishing attacks. This data is also perfectly usable for spam. Interestingly enough, competitors could also use this for their business. They could use a script to filter for keywords of unhappy customers or subscription status and target them as clients.

Post-Detection

               This was unfortunately was not a surprise. There have been too many of these being noticed. WizCase did notify the company of the oversight. WizCase did not receive a response from the company. They must have received this though since the company closed the cloud server after the email was sent.

Recurring

               The misconfigured cloud servers are not new, unfortunately. Many of these have been found and successfully attacked. Many of these attacks have been published showing the extent of the issue. When you read through a handful of these, it makes you wonder if the engineers just threw it up there and hoped for the security through obscurity. It never ceases to amaze how the misconfigured cloud servers keep happening. There are so many resources available, this really shouldn’t happen this often. This is not even considering the secondary person the engineers have looking at the build prior to signing off on the cloud server being in production.

Affected

               If you know someone who was affected by this, or for general information, there are a few helpful hints. On the bright side, at least they did not collect the user’s social security numbers. Going forward, users should continue to watch what they share online. People want to share everything on social media. If possible, they should share as little as possible. This is not the popular route to take these days, but I prudent.

               With phishing emails, the email service stops most of these. Generally the filter is dialed in well so this is not an issue. A handful will make it through though. The users should not open just any attachment or link unless they are expecting it. UPS is not going to send the same notice of delivery with the same shipping number to 30 people. Your bank is not going to send you an email with their link.

 

Resources

IT Security News. (2020, July). Unsecured server leaks family tree maker customer details-Experts’ comments. Retrieved from https://www.itsecuritynews.info/unsecured-server-leaks-family-trees-maker-customer-details-experts-comments/

Muncaster, P. (2020, July 21). Genealogy software maker exposes data on 60,000 users. Retrieved from https://www.infosecurity-magazine.com/news/genealogy-software-maker-exposes/

RT. (2020, July 21). Not keeping it in the family: Personal data of 60,000 genealogy software users LEAKED. Retrieved from https://www.rt.com/news/495417-genealogy-software-users-leaked/

Terabitweb. (2020, July 21). Gealogy software maker exposes data on 60,000 users. Retrieved from https://www.terabitweb.com/2020/07/21/genealogy-software-maker-exposes/

Williams, C. (2020, July 30). Family history search software leaks users private data. Retrieved from www.wizcase.com/blog/mackiev-leak-research/

Oh (NO!) Canada: CRA targeted

 

 

Governments, local and federal, provide certain services to the people they represent. These may consist of snow removal, unemployment insurance, defense, assistance during disasters, and other services. Canada is clearly no different providing a vast number of services to its citizens. All of these services require data for processing and record-keeping. This data and the computer systems processing and storing these are certainly viable targets for the attackers.

Attack

To access these services, Canadian citizens need to login to the service portal. This was set-up much like any other login screen where the user puts in their username and password into the website. Normally, this runs very smoothly as the user puts their credentials in. The problems start when the user has the same password across many domains. There have been so many breaches, most people’s passwords are for sale and probably has been sold many times. These passwords provide the basis for the credential stuffing attack. The attackers use the passwords per person across many domains in the hope the user has used the same password several times. This makes the attacker’s job much easier since they already the sample passwords to begin their work with.

This is what happened in this case. The attackers used prior used passwords on other domains to check if the users have the same password across many different services. The attack was detected on August 7^th. While this occurred in Canada, this form of attack could occur anywhere. The successful attack is indicative of a systemic issue with user passwords. Using the same password is an incredibly bad idea for several reasons. The attack is a clear and shining example of this.

The attack, per the Office of Chief Information Officer for Canada affected 9,041 GC Key accounts and approximately 5,500 Canadian Revenue Agency (CRA) accounts. The GC Key accounts were used in a fraudulent manner in an attempt to access government services. Once this was detected the GC Key accounts were canceled.

Mediation

Fortunately, the attack was contained. The users should really not re-use the passwords, since this is the requirement for the attack. Each website or service really should have its own password. If the users have too many passwords to remember, there is always a password manager to handle the issue. The users should also use MFA. This severely reduces the potential for this type of attack to remotely occur. Post-attack, the affected users should monitor their online accounts. Once detected the citizens were contacted after the accounts were deleted. The users were informed on how to receive a new GC Key. Granted this was a hassle for the users, however, if the same password was not used across multiple domains this would not have been a problem. The CRA accounts access was disabled also. The Canadian agency is working with people to restore access to the CRA MyAccount.

From a law enforcement aspect, the Royal Canadian Mounted Police (RCMP) was contacted on August 11^th. The office of the Privacy Commission was contacted to alert them of a possible breach also.

This issue provided many lessons for users to use different passwords, and not use the same for several domains.

 

Resources

Breen, K. (2020, August 15). Hackers targeted thousands of cra, government service accounts in credential stuffing attacks. Retrieved from https://globalnews.ca/news/7278345/canada-hackers-credential-stuffing-attack/

Bronskill, J. (2020, August 18). CRA expects online services restored Wednesday following cyberbreaches. Retrieved from https://www.nationalobserver.com/2020/07/18/news/cra-expects-online-services-restored-wednesday-following-cyberbreaches

Coop, a. (2020, August 16). Thousands of government service and CRA accounts hit by credential stuffing attack. Retrieved from https://www.itworldcanada.com/article/thousands-of-government-service-and-cra-accounts-hit-by-credential-stuffing-attack/434578

Government of Canada. (2020, August 15). Statement on GC key credential service and recent credential stuffing attack. Retrieved from https://cybergc.ca/en/news/statement-gckey-credential-service-and-recent-credential-stuffing-attack

Government of Canada. (2020, August 15). Statement from the office of the chief information officer of the government Canada on recent credential stuffing attack. Retrieved from https://www.canada.ca/en/treasury-board-secretariat/news/2020/08/statement-from-the-office-of-the-chief-information-officer-of-the-government-canada-on-recent-credential-stuffing-attack.html 

IT World Canada. (2020, August 16). Thousands of government service and cra accounts hit by credential stuffing attack. Retrieved from https://o.canada.com/techology/tech-news/thousands-of-government-services-and-cra-accounts-hit-by-credential-stuffing-attack/wcm/

Jones, R.P. (2020, August 17). Cyberattacks targeting cra, canadian’s COVID-19 benefits have been brought under control: officials. Retrieved from https://www.cbc.ca/news/policies/cra-gckey-cyberatack

Kilpatrick, S. (2020, August 17). CRA resumes online service with new security features after cyberattacks. Retrieved from https://o.canada.com/personal-finance/cra-resumes-online-services-with-new-security-features-after-cyberattacks/

Kirk, J. (2019, December 31). How can credential stuffing be thwarted? Retrieved from https://covid19.inforisk.today.com/interviews/how-credential-stuffing-be-thwarted-i-4551

Muncaster, P. (2020, August 17). Canadian citizens lose #COVID19 funds after government account hijacking. Retrieved from https://www.infosecurity-magazine.com/news/canadian-citizens-credential/

Net News Ledger. (2020, August 17). Credential stuffing of government of Canada computers update. Retrieved from https://www.netnewsledger.com/2020/08/17/credential-stuffing-of-government-of-canada-computers-update/        

Rautmare, C. (2020, August 17). Credential-stuffing attacks affect canadian services. Retrieved from https://www.inforisktoday.com/credential-stuffing-attacks-affect-canadian-services-a-/4839

Rubins, A. (2020, August 19). Cyber-attack target 1,000s of canadian tax, benefits accounts. Retrieved from https://www.cybernewsgroup.co.uk/cyber-attacks-target-1000s-of-canadian-tax-benefits-accounts/

Security Info Watch. (2020, August 18). ‘Credential stuffing’ attacks wreak havoc on government accounts in Canada. Retrieved from https://www.securityinfowatch.com/cybersecurity/information-security/news/21150744/credential-stuffing-attacks-wreak-havoc-on-government-accounts-in-canada

TH Author. (2020, August 18). Canadian government issues statement on credential stuffing attacks. Retrieved from https://www.threatub.org/blog/canadian-government-issues-statement-on-credential-stuffing-attacks/

The Canadian Press. (2020, August 19). CRA resumes online services with new security features after cyberattack.

 

GDPR is perfectly applicable to vehicle cybersecurity

 

May 25, 2018, will certainly be in the mind of CISOs and data managers around the world for some time to come. At this point in time, the companies had to be compliant with the EU General Data Protection Regulation (GDPR). The focus of the act is for persons who are citizens of the European Union (EU) to have greater control over their data. As applied this provides for much greater accountability for the businesses handling, processing, managing, and storing a person’s data. The act is far-reaching, as it follows your data. Your data can be the obvious (e.g. name, address, username, ID number, race/ethnicity, genetic data, phot, and banking details). This also covers any data that can be used to directly or indirectly trace you. For the latter, this may be your IP address, cookie identifier, and other data points.

There are volumes of articles on GDPR, the fines, and how this applies to the enterprise. The issue not explored nearly as much is the application to embedded systems. These are present in equipment and machinery used globally in vehicles, trucks, farm equipment, and many other uses. These also use various apps for the user’s experience.

Data

For this article, we will not be focusing on who or which entity owns the data. This topic is reserved for law review journals. The GDPR is rather clear in the data created from the vehicle is the property of the owner. While this appears clear, there still may be issues. The connected vehicles connect a mountain of data now. This is going to increase substantially as time passes and the vehicles become more complex. This will apply to the user’s data within the vehicle’s infrastructure, managed by the processes, and uploaded to the cloud. While the data collected is rather substantial, the only data collected per the GDPR relates directly to the vehicle’s operation. This data is vital with many uses, including predictive analysis. With the data being pertinent for the vehicle’s operations, along with the analysis, there is a value held here. To keep the environment secure, the infrastructure would need to be secured and data encrypted, in the least.

Why is this important?

 The data not related or identifiable to a person is their private data. This describes their life. The data could be used for malicious purposes, to track people who have done nothing wrong, for predicting future activities (i.e. where they probably will be at a certain day and time), and other inappropriate uses. This data, while held at the company, would continue to be the target of the attackers. While this would not be ethical, there is a more direct dis-incentive for companies involved with this type of behavior. For every data or GDPR breach, there could be a fine of up to €20M or 4% of the annual worldwide turnover (revenue), whichever is greater. Recent fines, include $840k to BKR, $600k to Google (Belgium) and $50m to Google,  €99M to Marriott International, and £183m to British Airways. These amounts are significant. If a portion of these fines is paid, the amounts are still enough to get the attention of any person in finance and the Board.

Vehicle Application

Vehicles collect and hold an enormous amount of data. This data partially consists of the user’s data. This data is private and confidential. This extra data, which may be collected by the vehicle, also could be used to identify the user. Based on what is currently done with the vehicle’s operations, the GDPR does apply. The next step is to determine the responsible party. *This article should not be used as legal advice; please seek your own legal advice from a qualified, licensed attorney.* For a clearer understanding, we need to clarify a few aspects. We need to know the purpose of the data collected, how the data is collected and does one party or several control the data. These questions are designed to bring the broad issue to a reasonable level of analysis.

 

Resources

 Feldman, B. (2020, July 24). How to think about GDPR as a vendor. Retrieved from https://securityboulevard.com/2020/07/how-to-think-about-gdpr-as-a-security-vendor/

GDPR.edu. (n.d.). What is GDPR, the EU’s new data protection law? Retrieved from https://www.gdpr.edu

Jung, M.M. (n.d.). Why is data protection so important in the context of connected and autonomous vehicles? Retrieved from https://www.dotmagazine.online/issues/on-the-road-mobility-connected-car/making-connected-cars-safe/data-protection-for-connected-cars

Lydian. (2020, May 14). Connected vehicles and GDPR-A status update after the public consultation. Retrieved from https://www.lexology.com/library/

Scaldis-Conseil. (n.d.). The impact of GDPR on ownership of connected data.

Valerio, P. (2018, June 7). GDPR: A security headache for connected car makers & OEMs. Retrieved from https://www.tu-auto.com/channels/services/

 

They learn hacking early these days

 

These are certainly interesting times we are living in. In particular, schools are either having virtual classes, in-person classes, or a mixture of these. This has seriously taxed the systems that were already under financial pressure. One area historically under-funded has been cybersecurity, s the focus of the K-12 and university systems has been to teach the students. Bearing this in mind, the systems may not have the budget to fully defend against cybersecurity attacks. A recent target was the Miami-Dade Public Schools System, which has approximately 275k students. This school system is the fourth largest in the country.

Attack

The Miami-Dade County Public school’s students began attending classes again this school year. To facilitate the return, the public school district was using an online learning system (MySchool online), which makes sense of all things considered. For some reason, a 16-year-old high school student, who happens to attend the targeted school system (a junior at the South Miami Senior High School), believed DDoSing the school’s e-learning system, crippling its functions, was a good idea. The high school student did this several times, shutting down access for several days. These attacks were clearly malicious and disrupted the teaching and student learning across the state.

Post-Attack

The student, while using a lower-level form of attack forgot one important thing-to cover his tracks. The investigators were able to locate him from the IP address the attacks originated from. A portion of the attacks did originate from outside of the US. This is such a basic step, it was even addressed in the iconic movie Hackers from the 1990s.

The FBI, Secret Service, and the Florida Department of Law Enforcement was involved with the investigation. The student, when questioned, admitted to eight DDoS attacks beginning on that Monday. The student didn’t code an app for this but instead used an online resource. There may be others involved with this set of attacks. This is not new, as the public school district has experienced more than a dozen of these since the 2020-2021 school year has started.

The student was arrested, as noted, and charged with Computer Use in an Attempt to Defraud. This is a third-degree felony. The student also was charged with Interference with an Educational Institution. This charge is a second-degree misdemeanor.

In Closing

Defending against certain attacks is not an overly complex set of operations. You may need to only contract with a third party to use their apps or services to protect your system. When you don’t plan for the inevitable, this seems to find you rather quickly.

 

Resources

850 WFTL. (2020, September). 16-year-old arrested for hacking miami dade school system. Retrieved from https://www.850wft.com/16-year-old-arrested-for-hacking-miami-dade-school-system/

Allen, K. (2020, September 3). 16-year-old arrested for hacking miami dade school system. Retrieved from https://abcnews.go.com/US/16-year-arrested-hacking-miami-dade-school-sytem/

Ampgoo.com. (2020, September 3). 16-year-old student arrested for allegedly crippling miami school system with cyberattack. Retrieved from https://www.ampgoo.com/16-year-old-student-arrested-for-allegedly-crippling-miami-school-system-with-cyberattack

L33T Dawg. (2020, September 3). 16-year-old arrested for cyberattacks on school’s online learning system.

Miller, M. (2020, September 3). Teen arrested for alleged cyber attacks on miami-data schools. Retrieved from https://thehill.com/policy/cybersecurity/514998-teenager-arrested-for-alleged-cyberattacks-on-miami-dade-school-district

NBC News. (2020, September 4). Miami high schooler charged with cyberattacks that stopped online learning. Retrieved from https://pressfrom.info/us/news/science-and-technology/-527945-miami-high-schooler-charged-with-cyberattacks-that-stopped-online-learning.html

News & Guts. (2020, September). 16-year-old charged with cyber attack that brought down miami public schools. Retrieved from https://www.newsandguts.com/16-year-old-charged-with-cyber-attack-that-brought-down-miami-public-schools/

Odzer, A., Pipitone, T., & Hamacher, B. (2020, September 3). Student arrested in connection with cyber attacks on miami-dade public schools. Retrieved from https://www.nbcmiami.com/news/local/student-arrested-in-connection-with-cyber-attacks-on-miami-dade-public-schools/2287613/

Life isn't always a carnival!

 

At this point in time, a majority of the nations are not focused on leisure. At some point in the future, society will get back to some form of normal. At that point, we may look to recreational activities to assist with our decompression after being isolated for our extended time. One activity that increases in activity may be the cruise industry. One of the largest companies in the sector is Carnival Corporation. The business operates more than 100 vessels and is based in Florida. The vessels have brands that we all recognize, such as Carnival Cruise Lines, Princess Cruises, Costa Cruises, and AIDA.

Issue

The corporation holds a massive amount of data from operations (revenue, accounts receivable, accounts payable, vendor lists, banking information, etc.) and clients (name, address, credit card numbers, when their cruise will be, etc.). This made the cruise corporation a prime target. The attack was detected on August 15, 2020. The company notified law enforcement and began to investigate. To fill their expertise gaps, they contracted with other incident response persons. The corporation was required to notify the U.S. Securities and Exchange Commission (SEC) since this is publicly traded.

Breach

As this was a successful attack, their defenses were breached. The attackers were able to access and encrypt a portion of the data on their servers. This should sound unfortunately familiar as this is yet another successful ransomware attack. The attackers also downloaded files. This data likely included the personal data of guests and employees. The curious wrinkle with this is there may be a greater issue than just with the SEC if the guests and/or employees were EU citizens, with the GDPR in effect.

The odd part of this is they are not sure how far the breach went. The corporation believes this only affects one brand. Seemingly, they should know if more than one brand’s data was accessed. There are logs for the SIEM to examine, unless the attacker modified these.

Pattern

This is not Carnival’s first experience with a breach. Two of their brands, Holland America Line and Princess Cruises, appear to have been breached in 2019.

Ransomware has become such a mountain of a nightmare over the last four years. This is another example of what can happen with a simple error on the part of an employee.

 

Resources

BNP Media. (2020, August 18). Carnival corporation hit by ransomware.

Grieg, J. (2020, August 19). Carnival cruises hit with a costly ransomware attack. Retrieved from https://www.techrepublic.com/article/carnival-cruises-hit-with-costly-ransomware-attack/

Maritime Executive. (2020, August 17). Carnival corporation reports ransomware attack accessed data. Retrieved from https://www.maritime-executive.com/article/carnival-corporation-reports-ransomware-attack-accessed-data

Mogg, T. (2020, August 18). World’s largest cruise line operator hit by cyber attack. Retrieved from https://www.digitaltrends.com/computing/worlds-largest-cruise-line-operator-hit-by-cyberattack/

Norton, T. (2020, August 19). Carnival corp brand hit by ransomware attack. Retrieved from https://www.travelpulse.com/news/cruise/carnival-corp-brand-hit-by-ransomware-attack.html

Travolution. (2020, August 19). Carnival corporation cruise line brand his by ransomware attack. Retrieved from https://www.travolution.com/articles/116486/carnival-corporation-cruise-line-brand-his-by-ransomware-attack

Vigayan, J. (2020, August 18). Ransomware attack on carnival may have been its second compromise this year. Retrieved from https://www.darkreading.com/attacks-breaches/ransomware-attack-on-carnival-may-have-been-its-second-compromise-this-year/d/d-id/1338696

Oregon State University Ecampus breached!

 

 

Oregon State University (OSU)  is located in Corvallis, OR. As with most universities and schools, there is a virtual option for the students, so they don’t have to attend full time. OSU is no different. The university has in place its own Ecampus, the online education program.

Attack

The attack occurred this summer and was detected on July 27, 2020. The attackers were able to breach and compromise a server on the OSU Ecampus. After this was detected, OSU began its investigation. The university also contacted state and federal authorities on this matter. As part of the process, the FBI was also contacted. The hope is with all this assistance the university and law enforcement are able to find the attackers and also decipher how this happened.

Data

The breach affected approximately 1,700 students and faculty members. The server had their personal information, which was accessed. The records accessed contained names, and OSU email addresses. While this is not optimal, this would not be classified as critical. With other instances, the person’s personal mailing addresses, and phone numbers may have been exposed. This brings the issue to a new level. Fortunately, there was no social security numbers or financial data involved.

Post-Breach

OSU immediately had begun to mitigate the security issues detected so this would not happen in the same way again. The compromised server was updated to remove the cybersecurity issues and placed back online. The university has notified the affected students and staff. They are offering free credit monitoring and other services. Oddly, this is not the first time there has been a breach in recent history with the university. The last breach was in May 2019 and affected 630 records. While the details of the attack method were not disclosed, this is another example of why cybersecurity is so important.

 

Resources

Albany Democrat-Herald. (2020, September 3). Computer breach at OSU exposes personal info of 1,700 students and faculty.

New Haven Register. (2020, September 4). Computer breach at OSU exposes personal info of 1,700. Retrieved from https://www.nhregister.com/news/article/Computer-breach-at-OSU-exposes-personal-info-of=15542681.php

The Associated Press. (2020, September 5). Computer breach at OSU exposes personal info of 1,700. Retrieved from https://www.kezi.com/content/news/computer-breach-at-OSU-exposes-personal-info-of-1700-572.330491.html, https://www.usnews.com/news/best-states/oregon/articles/2020-09-04/computer-breach-at-osu-exposes-personal-info-of-1-700, and https://www.seattletimes.com/seattle-news/northwest/computer-breach-at-osu-exposes-personal-info-of-1700/

Of all places to steal from...

 

 

Non-profits, as indicated by their name, are not designed to profit from their activities. They provide services, goods (e.g. clothing or food), and other items to those who can’t afford them. By design, there is not the profit motive in work with these organizations.

               When you are planning an attack, one of the first areas you can look at are the crown jewels, or what the attack is focused on. The attackers may also have the mission of simply being malicious. However, with how the attacks have been operationalized, generally, there is something (e.g. money or data) the attackers want.

Target

               A recent breach has been no exception to this. The Jewish Federation of Greater Washington was recently targeted and breached. This organization is a non-profit located in Maryland. The not-for-profit has 52 employees.

Attack

               There are cybersecurity dangers regardless of where you are working. To resolve these, the user needs awareness as a general baseline of what to and not to do. Their systems, if not using the business’ equipment, have to be up-to-date. Having outdated, unpatched apps and programs creates an opportunity for attackers and allows for an easier attack. This is analogous to leaving the front door shut, but unlocked.

               In this learning experience, a staff member, working from home on their system, was successfully attacked. The compromise led to the attacker stealing $7.5M. The attack and theft was possible due to one person’s oversight and the organization not maintaining a proper level of cybersecurity for the staff.

               The attack was not known to the organization until August 4^th. This was detected by a security contractor and not the organization. The red flag in this instance was an anomalous amount of activity with a staff member’s email account.

Post-Attack

               After this was detected, the FBI was contacted. As the investigation continues, there is no comment as to who may have accomplished this. While this is an issue, the CEO, Gil Preuss, did announce the compromise from a virtual conference call with the employees.

               The organization also investigated the breach. The data indicated the attacker had access long before the issue was detected by the cybersecurity contractor. The time period for the unauthorized access was estimated to have started early in the summer. The investigation continues on the systems and servers as these are being analyzed for other cybersecurity issues. Wisely, the organization is no longer allowing the staff to use personal computers for the workplace. The issues abound with allowing this at any time, and especially now with the pandemic forcing most people to work from home. The organization appears to be reviewing what other controls to put in place to mitigate the potential for this to occur again.

Discussion

               In our current situation working from home, for the most part, is not an option. This has taken the form of necessity. The users may feel a little more at ease working from home, and let their guard down. They may also not have the same level of defensive measures in place. For the measures in place, the apps and programs may not be patched or up-to-date. All of these create the potential vulnerability the attackers look for. Unfortunately, all it takes is one person in the right department or with access to other systems, and there’s a breach.

               Cybersecurity does not take a break from the office. This is a 24 hour a day, everyday task. The users still have to be vigilant. There is no vacation or sick day for cybersecurity.

               On a the last point, please push for more training for the users. They do not need to be cybersecurity experts. They do however need to be aware of what to look for, and what not to click on. A stranger is not going to send you a link for their cousin’s hilarious birthday party or a picture of their kitten that you have to open to see the details in the kitten’s fur.

               From the finance administrative side, there should have been controls or alarms in place to monitor any large transfers at once or in a short period of time. This may have also limited the depth of the attack.