The Week in Cyber Security and Data Privacy: 19 – 25 February 2024

18,267,244 known records breached in 94 newly disclosed incidents

Welcome to this week’s global round-up of the biggest and most interesting news stories.

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks.

Publicly disclosed data breaches and cyber attacks: in the spotlight

loanDepot reports an extra 324,071 victims

In January, the mortgage lender loanDepot announced in an SEC filing that an unauthorised third party had gained access to the sensitive personal information of about 16.6 million individuals in its systems.

In a new breach notification to the Maine Attorney General this week, it reported that an extra 324,071 individuals were affected. The breached data includes names, addresses, emails, phone numbers, dates of birth, and financial account and Social Security numbers.

Data breached: 16,924,071 individuals’ data.

The Colorado Department of Health Care Policy & Financing reports a further 473,936 victims

Last October, the Colorado Department of Health Care Policy & Financing notified the Maine Attorney General of a breach affecting 4,187,732 people. The incident was caused by the MOVEit Transfer vulnerability.

This week, the Department informed the Maine regulator that an additional 474,936 individuals were impacted. The breached data may include names, Social Security numbers and health insurance information.

Data breached: 4,662,668 individuals’ data.

2,350,236 individuals’ health data compromised in American Vision Partners breach

Medical Management Resource Group, L.L.C. (doing business as American Vision Partners), an eye care practitioner with more than 100 eye care centres across the US, reported a data breach affecting 2,350,236 people.

For all individuals, the breached data included names, contact details, dates of birth and medical information. For some victims, the stolen data also included Social Security numbers and health insurance information.

Data breached: 2,350,236 individuals’ data.

Publicly disclosed data breaches and cyber attacks: full list

This week, we found 18,267,244 records known to be compromised, and 94 organisations suffering a newly disclosed incident. 86 of them are known to have had data exfiltrated, exposed or otherwise breached. None definitely haven’t had data breached.

We also found 4 organisations providing a significant update on a previously disclosed incident.

Note 1: ‘New’/‘Update’ in the first column refers to whether this breach was first publicly disclosed this week, or whether a significant update was released this week. The updated data point is italicised in the table.

Note 2: For incidents where we only know the file size of the data breached, we use the formula 1 MB = 1 record. Given that we can’t know the exact numbers, as it depends on the types of records included (e.g. pictures and medical histories are considerably larger files than just names and addresses), we err on the side of caution by using this formula. We believe that this underestimates the records breached in most cases, but it is more accurate than not providing a number at all.

Enforcement

ICO orders leisure centre to stop using facial recognition technology to monitor staff

The ICO (Information Commissioner’s Office) has ordered Serco Leisure and several associated community leisure trusts to stop using facial recognition technology to monitor employee attendance as this is “neither fair nor proportionate under data protection law”, according to the UK Information Commissioner.

On the same day the ICO issued this enforcement notice, it published new guidance for using biometric data.

New US Executive Order issued to strengthen US port security

The Biden-Harris administration is issuing an Executive Order to strengthen the security of US ports. Cyber incidents that endanger “any vessel, harbor, port, or waterfront facility” must be reported. The US Coast Guard is also given the authority to respond to “malicious cyber activity”.

Other news

LockBit ransomware group recovers from law enforcement disruption

Last week, we reported that law enforcers disrupted the LockBit ransomware group. Four days later, the group recovered. Its blog has now reappeared, as well as a leak page containing folders for “dozens” of victims.

NSA announces retirement of director of cyber security

The US NSA (National Security Agency) has announced the retirement of its director of cyber security, Rob Joyce. He’ll be succeeded by David Luber.

Key date

31 March 2024 – PCI DSS v4.0 transitioning deadline 

Version 3.2.1 of the PCI DSS (Payment Card Industry Data Security Standard) is being retired on 31 March, to be replaced by version 4.0 of the Standard. There are more than 50 new requirements in PCI DSS v4.0. You can find out more about them on the PCI Security Standards Council’s website.

That’s it for this week’s round-up. We hope you found it useful.

We’ll be back next week with the biggest and most interesting news stories, all rounded up in one place.

In the meantime, if you missed it, check out last week’s round-up. Alternatively, you can view our full archive.

Security Spotlight

To get news of the latest data breaches and cyber attacks straight to your inbox, subscribe to our weekly newsletter: the Security Spotlight.

Every Wednesday, you’ll get a 4-minute email with:

• Industry news, including this weekly round-up;
• Our latest research and statistics;
• Interviews with our experts, sharing their insights and expertise;
• Free useful resources; and
• Upcoming webinars.