Posted on July 22, 2018 at 11:28 AM
1.5 Million Suffer Singapore Personal Data Hack
A company which provides human resources functionality to businesses, ComplyRight, has started intimating persons of breaches in data. This breach may have had an effect on them by having their names, phone numbers, address as well as social security number. This data was culled from the employee tax forms which were processed by the said company.
ComplyRight has come out to say that the company with well over 76,000 customers. However, it did not reveal how many of them were involved in the said breach.
KrebsOnSecurity which made known the information back on Wednesday has come out to say that the breach appears targeted at the website itself rather than against customer communication via the website. The investigation by KrebsOnSecurity indicated that there was no single ComplyRight employee which has a security title on LinkedIn.
How did the systems get hacked?
It appears to be that one of the computers which belongs to SingHealth which is one of the main Government health groups of the state has attacked. It was said to have been infected with a malware through which the said hackers got access to the database.
Jeannie Warner who is a security manager at WhiteHat Security said that ComplyRight been a human resources organization deals with forms that contain a number of personal information which includes W2s and 1099s. Therefore, the fact that not even one of the employees has a security title makes it quite worrisome and as such cause one to question their trust.
Lab scan by Qualys SSL labs indicates a score of B, capped owing to the fact that their server doesn’t support AEAD cipher routes or forward secrecy. It must, however, be noted that this was actually a scan of the site. The customers who are carrying out businesses using the company may be re-routed to some other servers after been authenticated.
However, the reality of the fact that the page still appears to carry protocols that are outdated. This includes TLS 1.0 for the purpose of signing in shows that there might be some other vulnerabilities in terms of the legacy which are still in place on the application code of the site.
On the webpage which made known the breach, ComplyRight indicated that the breach happened back in the month of May. The disclosure, however, happened on the 18th of July. The vice president of customer success at NuData, Ryan Wilk, came out to say that one of the major danger of breaches is the fact that it takes a while for the company as well as the end users to know. Starting from when a breach occurs, Hackers have all the time to ensure the brokerage of the stolen names as well as tax data and social security number on the dark web thus leaving employees and customers vulnerable to the effects of identity theft.
Why are health services been targeted?
The main reason for this is that they usually contain a number of important information to the government. It is no longer news that the governments collect information that is valuable to everyone by taking advantage of every single technology we make use of in our daily routine.
