Liberty claims that it is in control of its technology and data infrastructure after a massive data breach, but the fact that hackers could extract data undetected is alarming.
Cybercriminals are now claiming a ransom to not release the information of Liberty’s top clients and this news has sent panic alarms through the insurance and finance industries.
Following the incident, Andrew Chester, MD of Ukuvuma Cyber Security, asks a few critical questions. Ukuvuma Cyber Security is a technology and security specialist firm with world-class skills and experience in assisting organisations affected by such breaches.
Why did Liberty have unstructured email data and attachments that were left unmonitored and, more importantly, why was this sensitive data not encrypted? When doing threat hunting or a security analysis for any company, the first thing one looks for is how easy it is to extract data without being detected.
“Additionally, how did the hackers know where to find the data? If it was an inside job they might have been tipped off, but if it wasn’t, it means that they spent enough time on the infrastructure to know where to look, which is very alarming,” he explains.
Chester says another point to consider is how the hackers gained access. “It most likely happened in one of two ways, it was either an inside job or someone with the correct privileges was hacked, which means that they could have used that person’s permissions to get into the system.”
This could have been avoided simply by applying general data security practices such as always encrypting sensitive data, segregating it from vulnerable systems, and building in rigorous access control and monitoring systems.
“It’s also quite alarming that that no-one detected the breach until the hackers themselves informed Liberty. There’s a common saying that you sometimes don’t know you’ve been hacked until law enforcement comes knocking at your door, but in this case Liberty only found out once the criminals had contacted them,” he adds.
This could be the first South African incident subject to the General Data Protection Regulation (GDPR) since its inception on 25 May 2018. The GDPR, which Liberty has to conform to because of its European stakeholders, states that companies must send out breach notifications to their clients.
“How many big corporate data breaches are we unaware of that occurred before the implementation of GDPR? As a Liberty client, I am very worried. Should client personal data leak onto the dark or public Web, a lot of personal liability issues become a reality for Liberty,” he states.
“I think the unfortunate truth is that Liberty will be raked over the coals for this, and it could end up costing them millions in real and reputational damage,” Chester says.