Cyber security criminals and hackers pose a large risk however how insider threats can cause big data breaches should be an important consideration for organizations.
Some of the largest cyber security risks come from within and organization. These cyber security incidents tend to involve not just personally identifiable information (PII), but some of the most sensitive data an organization produces and handles including secret recipes, sensitive financial information, patents, and mission-critical infrastructure.
Here is a list of some of the most recent examples of how insider threats can cause big data breaches.
Manufacturing: GE
Type of Incident: IP theft, fraud
Incident Date: 2011-2012
Publicly Disclosed: 2019
The FBI disclosed that a pair of former GE employees had stolen intellectual property and trade secrets. The GE performance engineer committed the initial theft back in 2011 while supporting a customer operations of highly complex turbines manufactured by the firm.
Using their existing network account privileges, the GE employee not only downloaded GE trade secrets about how to run those turbines but they also convinced an employee in the IT department to grant them access to documents about cost models, proposals, and contracts related to that performance consulting.
The former GE employee saw an opportunity to undercut GE and ran the company for years while the FBI investigated the data theft. The FBI subpoenaed emails and cloud storage accounts including searching a laptop from the employee they found on a layover in the US.
Telecom: AT&T
Type of Incident: Bribery-fueled malware installation, $200 million fraud
Incident Date: 2012-2017
Publicly Disclosed: 2019
An internal AT&T employee caused insider threats with access to the organizations IT infrastructure systems was bribed as part of a organized criminal operation to unlock pricey iPhones for use outside the AT&T network. It appears that among the bad guys’ tactics was the payment of call center employees to install malware on AT&T systems so that they could gain access and eventually compromise the company’s infrastructure with automated unlocking of iPhones. AT&T suffered a $200 million loss in subscriptions across 2 million unlocked phones as part of the cyber phone scheme. The US District Courts sentenced the employee to 12 years in prison for the crime.
Financial: Capital One
Type of Incident: Breach of 100 million credit card applications and accounts
Incident Date: 2019
Publicly Disclosed: 2019
A former software engineer for Amazon Web Services (AWS) was accused of causing a massive breach at Capital One that was a client of Amazon Web Services (AWS). The former employee abused their knowledge of the cloud deployments of client. The US Department of Justice charged the former employee with computer fraud, abuse and access to the device. The fraud in connection with the 2019 incident in which the former employee allegedly exploited Capital One’s misconfigured firewalls to extract privileged account credentials and steal 100 million credit card applications and account holders’ information.
Technology: Vertafore
Type of Incident: Exposure of 27.7 million PII records
Incident Date: 2020
Publicly Disclosed: 2020
When Vertafore inadvertently stored data files on an unsecured external storage service, it exposed sensitive information for over 27.7 million Texas drivers. The organization created features for its software based on driver’s license information. The data and files contained information from millions of license holders. The organization exposed itself to human error in the age of the cloud. Storage errors have posed a risk to organizations like this for many years. Vertafore still had to deal with the expense of breach response despite not having financial information or Social Security numbers. A class action lawsuit is potentially pending as a result of the cyber security incident.
Technology: Amazon
Type of Incident: Insider trading aided by access to confidential information
Incident Date: 2016-2018
Publicly Disclosed: 2020
A former employee at Amazon had her family profit through insider trading by using the access she had to financial information for the preparation of quarterly statements according to senior management in Amazon’s tax department. The US Attorney’s Office, stated the former employee provided her husband with information about Amazon’s revenues and earnings. He then used to it to make illegal stock and options trades ahead of 11 straight earnings announcements. A plea agreement that was finalized this summer resulted in the former employee sentenced to 26 months in prison and a fine of over $2.6 million. The family profited $1.4 million in the process.
365 iT SOLUTIONS is federally certified by the Canadian federal government under the CyberSecure Canada program.
Let our complimentary data breach scan investigate if your credentials have been compromised by hackers.
365 iT SOLUTIONS is a leading IT consulting firm in Toronto that offers Managed IT Services, Tech Support Services, Cloud Services, Managed Security Services, IT Support Services, IT Outsourcing Services, Business continuity and disaster recovery (BCDR), and Cyber Security Training and Dark Web Monitoring.
We Make IT Simple!
