Data breaches/IT security failures at Sellafield, the British Library, the Guardian and UK businesses

[teqniq]

Oh dear oh dear oh dear:

Sellafield nuclear site hacked by groups linked to Russia and China

Exclusive: Malware may still be present and potential effects have been covered up by staff, investigation reveals

www.theguardian.com

And, to make matters worse it would seem that management have been involved in covering all this up and it's been like this since at least 2015. Further data breaches are outlined in links provided by ska invita

 

[TopCat]

Covering things up is their forte.

 

[pesh]

can they just rename it again?

 

[farmerbarleymow]

That sounds very bad.

 

[ska invita]

Ive been thinking of starting a thread about cyber attacks in Britain as theres been a few big ones, British Library....The Guardian....KFC....I expect others, and I wonder how much state warfare is behind this, even if "just" ransomware

British Library hack: Customer data offered for sale on dark web

The library urges users to change their passwords after earlier saying only employee data was leaked.

www.bbc.co.uk

I think British Library still down for about a month now

Guardian hit by serious IT incident believed to be ransomware attack

Incident has hit parts of media company’s technology infrastructure, with staff told to work from home

www.theguardian.com

KFC owner suffers ransomware-related data breach

Personal data including driver's license number were stolen during an attack on KFC and Pizza Hut owner Yum! Brands

www.cshub.com

 

[teqniq]

Ive been thinking of starting a thread about cyber attacks in Britain as theres been a few big ones, British Library....The Guardian....KFC....I expect others, and I wonder how much state warfare is behind this, even if "just" ransomware

British Library hack: Customer data offered for sale on dark web

The library urges users to change their passwords after earlier saying only employee data was leaked.

www.bbc.co.uk

I think British Library still down for about a month now

Guardian hit by serious IT incident believed to be ransomware attack

Incident has hit parts of media company’s technology infrastructure, with staff told to work from home

www.theguardian.com

KFC owner suffers ransomware-related data breach

Personal data including driver's license number were stolen during an attack on KFC and Pizza Hut owner Yum! Brands

www.cshub.com

Could still start it and then this could be merged with it.

 

[ska invita]

Could still start it and then this could be merged with it.

No I think this will definitely do! Not sure how much there is to talk about.... I doubt any of us have the necessary information to know more. Though Id be interested if people have heard of other big cyberattacks against British targets.
Supposedly the British Library thing is being kept very secret, no one who works there is being told anything as to the nature of what has really happened. The user info being sold isnt the half of it.... you basically cant look anything up there at the moment (true as of quite recently)

 

[teqniq]

No I think this will definitely do! Not sure how much there is to talk about.... I doubt any of us have the necessary information to know more. Though Id be interested if people have heard of other big cyberattacks against British targets.
Supposedly the British Library thing is being kept very secret, no one who works there is being told anything as to the nature of what has really happened. The user info being sold isnt the half of it.... you basically cant look anything up there at the moment (true as of quite recently)

i have altered the thread title to reflect your additions.

 

[Boris Sprinkler]

None of this comes as any surprise. Due to the hierarchical nature of most organizations it is very difficult for Information Security Programs to be comprehensive. Particularly in public institutions wherein security gets a much lauded and responsible role yet no budget to match this.

 

[equationgirl]

That sounds very bad.

Doesn't it just...

 

[equationgirl]

None of this comes as any surprise. Due to the hierarchical nature of most organizations it is very difficult for Information Security Programs to be comprehensive. Particularly in public institutions wherein security gets a much lauded and responsible role yet no budget to match this.

My experience is that often plans are clearly laid out to budget holders who then reveal there is no budget and keeping fingers crossed has worked so far, can't we keep doing that...

 

[StoneRoad]

From the outside my thoughts are that equationgirl has it about right.

Sticking head in sand appears to be the standard response.
My cynical thoughts are that is because the bigwigs don't want to find the budget in case doing so impacts upon their bonuses / jollies ....

 

[Boris Sprinkler]

Very often it’s an absolute disconnect from actual technical skills or understanding of Security from upper management. Audits often conducted by people with little technical IT knowledge who are more interested in written policies and procedures than double checking statements. You don’t even want to think of computer security in other public sectors. Hospitals would be a good one, all that ICS and scada equipment running default MIBS on snmp, insecure routing, and dozens of suppliers running proprietary software. And it often just goes to one person to head up, rather than a dedicated team of necessary specialists.
I would also really question the validity of the consulting companies who are presumably tasked with signing off on required operating certifications, and undoubtedly collect big bucks for their work, I’ve had a few in my time and rarely have I been impressed.

 

[Boris Sprinkler]

.

 

[Serge Forward]

can they just rename it again?

Windfail?

 

[ska invita]

Just remembered these from this year

Northern Ireland police data breach is second in weeks, force reveals

Admission that document with names of 200 staff was stolen in July follows revelation of ‘monumental’ data breach on Tuesday

www.theguardian.com

Greater Manchester police officers’ data hacked in cyber-attack

Details of thousands of officers may have been taken in ransomware attack on third-party supplier

www.theguardian.com

---
I expect this is true

Russia-linked cyber attack groups want to 'destroy' UK, minister warns

Firms have urged to beef up their cyber security to protect the country from "ideologically motivated, rather than financially motivated" enemies who have started to target the UK.

news.sky.com

"Firms have urged to beef up their cyber security to protect the country from "ideologically motivated, rather than financially motivated" enemies who have started to target the UK."...there is a war on after all

 

[hash tag]

I'm hearing the British Library is unlikely to be fully back up and running this year
Don't forget, "Royal" hospital attacked.

Hackers threaten to release Royal Family's private medical records

The hospital notably treated the Princess of Wales, Kate, and the hackers have claimed they have 'X-rays, letters from consultants, registration forms, handwritten clinical notes, and pathology forms.'

metro.co.uk

 

[farmerbarleymow]

Not British, but quite a few accounts compromised following an earlier breach

23andMe: Profiles of 6.9 million people hacked

Hackers were able to gain access because some customers reused old passwords, biotech company 23andMe said.

www.bbc.co.uk

 

[equationgirl]

Not British, but quite a few accounts compromised following an earlier breach

23andMe: Profiles of 6.9 million people hacked

Hackers were able to gain access because some customers reused old passwords, biotech company 23andMe said.

www.bbc.co.uk

I saw that. Another reason not to have one's DNA on file...

 

[farmerbarleymow]

I saw that. Another reason not to have one's DNA on file...

Agree. I'm wary of those sites.

 

[BusLanes]

I keep reading articles that basically say that a lot of DNA ancestry reports are not far from guess work

 

[teqniq]

And here's more:

UK accuses Russia’s FSB of meddling in democratic processes since 2015

 

[Boris Sprinkler]

Speaking as a conspiracy theorist loonspud of the highest order, I first worked alongside the CIA and Mandiant back in 2011 when the Chinese APT28 hacked the company I worked for stealing bioethanol recipes. It would be another 3 years until the fsb raided the offices of another company I worked for ( wasn’t that long after Erdogan visited with his armed bodyguards situated on every floor), but they were concerned on shipments out of the Ukraine. I’ve spoken with Israeli and Us defense companies. It’s quite amazing, they come to you with problems you’re not even aware about.
The amusing thing is about those that are conspiracy minded is how close they often are. Whilst those that decry conspiracy merely highlight their fear of their own ignorance. And those that have seen what’s happening, get cussed out as conspiracy theorists. I know the world is fucked. I know how power works. I’ve given up trying to explain, they only think you’re mental anyway. Middle class ignorance is a thing. Trying to explain it here, is like trying to explain to someone sitting in Trafalgar Square why they can’t see England.

 

[hash tag]

News reaches me that the British Library is in a "mess".

 

[CNT36]

I've had no problems since I changed my password from "password" to "Password".

 

[Nine Bob Note]

I've had no problems since I changed my password from "password" to "Password".

That's not very secure.

P@ssw0rd, that's what you want

 

[muscovyduck]

Password1!

 

[wemakeyousoundb]

p455\/\/0rD!
ffs

 

[Nine Bob Note]

p455\/\/0rD!
ffs

You're too cool. I feel awkward in your presence.

 

[CNT36]

Thanks I feel foolish now perhaps someone could be employed to produce one perfect password that we could all use from now on.