Philadelphia City Reveals Personal Data Was Compromised in May Email Hack
- Written by Shipra Sanganeria Cybersecurity & Tech Writer
On October 20, 2023, the City of Philadelphia disclosed a security incident, wherein unknown threat actors had gained access to the city’s email accounts containing personal information of several individuals.
The breach was first discovered on May 24, 2023, when officials noticed suspicious activity in the city’s email environment. Following which, an investigation in partnership with third-party cybersecurity vendors was conducted. The ongoing investigation revealed that for two months since the first breach discovery, unauthorized actors may have not only gained access to compromised email accounts but also the information within it.
‘’We launched an investigation, [..]. However, to date, the investigation determined that between May 26, 2023, and July 28, 2023, an unauthorized actor may have gained access to certain city email accounts and certain information contained therein,’’ the notice states.
The ongoing investigation on August 22 further revealed that the compromised account may have contained protected healthcare information of the said individuals.
According to city officials, the stolen information which may vary by individual but could include demographic information like, names, address, date of birth, social security number, and other contact information. In addition it could include, health data like diagnosis and other treatment-related information, limited financial data, and claims information.
In the notice, the city also stated that upon confirmation of identity and contact information, impacted individuals would be notified via city officials. Moreover, it also revealed the implementation of several mitigation measures to prevent similar incidents in the future, including reporting the incident to the U.S. Department of Health and Human Services.
‘’As part of our ongoing commitment to information security, we are also reviewing our existing policies and procedures, implementing additional administrative and technical safeguards to further secure information in our care, and providing additional training on how to safeguard information in our email environment,’’ the notice continued.
Moreover, impacted individuals have been advised to stay vigilant and report any suspicious activity to concerned healthcare and financial organizations.
Okta Breach: Threat Actors Use Stolen Credentials to Access Its Support System
- Written by Shipra Sanganeria Cybersecurity & Tech Writer
San Francisco-based identity and access management firm Okta disclosed a new security breach incident by unknown threat actors. Using stolen employee credentials, the hackers accessed its support management system to steal sensitive user information.
Okta’s Chief Security Officer (CSO), David Bradbury in an advisory revealed few details about the incident, including customer browser files accessed by the hacker. ‘’The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases,’’ Bradbury stated .
‘’It should be noted that the Okta support case management system is separate from the production Okta service, which is fully operational and has not been impacted,’’ he continued.
Bradbury further revealed that Okta’s case management system, Auth0/CIC was not impacted by this incident, and it had notified customers whose Okta environment or support tickets were exposed during the breach.
The advisory also revealed few details about the type of information stored in the support case management system. ‘’Okta support will ask customers to upload an HTTP Archive (HAR) file, which allows for troubleshooting of issues by replicating browser activity,’’ the advisory explained. These HAR files contain sensitive information like cookies and session tokens, which can be used to hack valid accounts.
To stem the adverse impact resulting from the incident, Okta is working with its customers, including revocation of embedded session tokens.
Although, the company did not disclose the scale of impact or number of affected customers. BeyondTrust, Cloudflare and 1Password are some of the customers that were impacted by this support system breach.
BeyondTrust, an identity security platform revealed that it had first notified Okta on October 2, about the security breach; however, Okta did not confirm the incident until October 19.
In the past two years, Okta has been on the radar of various threat actors, owing to its clientele that includes some of the largest companies in the world.
