Weekly Cybersecurity Recap February 2

This week started with a cyber event targeting a Californian insurance brokerage, Keenan & Associates; the assailants garnered over 1.5 million records from the attack. GEICO also announced data from their organization was compromised, although the breach didn’t happen through them; one of their vendors was hit by the global MOVEit event, exposing the data of over 70k employees and associates. A retirement solution provider—Bankers Life and Casualty Company—also announced a breach event, though it happened through a sophisticated SIM swapping scheme. We also featured LockBit’s Citrix Bleed this week after it compromised the data of nearly 200k Planet Home Lending borrowers. Finally, we featured dangers that small businesses face; experts predict that in 2024, business leaders must respond to the call of action to protect their clients, businesses, employees, and themselves. Read a synopsis of each event below.

Keenan & Associates

A cross-industry insurance brokerage, Keenan suffered a significant breach in 2023. According to the public information, the attack came from an unauthorized actor; they accessed Keenan’s systems and began disrupting their network. The stolen data may include consumers’ names, birthdays, Social Security Numbers (SSNs), passport numbers, driver’s license numbers, health insurance data (like provider names or group numbers), and general health information (like diagnosis and treatment details). Victims of this breach have an increased risk of fraudulent data misuse and further victimization through potential credential-stuffing events. 

Planet Home Lending

PHL is a national mortgage lender. They work with software vendors to produce their clients’ best financial and estate solutions. In 2023, officials found one of their vendors, Citrix Systems, vulnerable; this weakness allowed LockBit, a globally recognized ransomware gang, to access the networks of Citrix’s clients. Dubbed the “Citrix Bleed,” some PHL borrowers and associates have been exposed to the event. Exposures potentially include names, addresses, SSNs, loan information, and financial account details. Victims of this breach have an increased risk of fraud, impersonation, and extortion; subsequently, they must act immediately to safeguard their information from misuse. 

Identity Theft Resource Center Report

The ITRC released an impact report concerning small businesses (SMBs) and their cyberattacks in 2023. According to their report, 2024 SMB leaders are heading in the right direction, but half remain unprotected and unprepared for the consequences of a breach. ITRC suggests that SMB leaders take up active cybersecurity policies like multi-factor authentications and employee-only access permissions. We suggest individuals (employees and consumers) take data precautions like utilizing reputable password managers, multi-factor authentications on all accounts, and using caution whenever speaking with strangers online, in-person, or via tech devices.

Bankers Life and Casualty Company

A nationwide retirement solutions provider, Bankers offers programs for retirees and their families to make the most of retirement. According to the notices the Maine Attorney General published, a high-ranking official had his cellphone number swapped with a cybercriminal’s after going to a wireless retailer. The breach was coordinated with the retailer, prompting attention from the FBI. Those with information involved in this event may have had their names, SSNs, policy numbers, and dates of birth compromised. 

GEICO via Delta Dental of California 

The last breach featured for this week came from GEICO—though not directly. GEICO offers their employees and affiliates dental insurance through DDC, which had systems accessed by the global MOVEit event. The event was made possible by a zero-day vulnerability that allowed malicious actors to access DDC’s network (and the servers of thousands of other organizations). The consumer notices published with the event filing suggest victims consider identity, financial, and account monitoring services.