Questions around Liberty breach

Financial services provider Liberty became the latest high-profile victim of a data breach, when cyber criminals took control of information of Liberty’s top clients last Thursday (June 14).  The cyber criminals demanded a ransom in order to not release the information.

Andrew Chester, MD of technology and security specialist firm Ukuvuma Cyber Security, has asked a few critical questions following the incident.

“Why did Liberty have unstructured email data and attachments that were left unmonitored and, more importantly, why was this sensitive data not encrypted? When doing threat-hunting or a security analysis for any company, the first thing one looks for is how easy it is to extract data without being detected.

“Additionally, how did the hackers know where to find the data? If it was an inside job, they might have been tipped off, but if it wasn’t, it means that they spent enough time on the infrastructure to know where to look, which is very alarming,” he says.

Chester says another point to consider is how the hackers gained access. “It most likely happened in one of two ways: it was either an inside job or someone with the appropriate privileges was hacked, which means that they could have used that person’s permissions to get into the system.”

This could have been avoided simply by applying general data-security practices, such as always encrypting sensitive data, segregating it from vulnerable systems, and building in rigorous access control and monitoring systems.

“It’s also quite alarming that that no-one detected the breach until the hackers themselves informed Liberty. There’s a common saying that you sometimes don’t know you’ve been hacked until law enforcement comes knocking at your door, but in this case Liberty only found out once the criminals had contacted them,” he adds.

This could be the first South African incident subject to the General Data Protection Regulation (GDPR) since its inception on May 25. The GDPR, to which Liberty must conform, because of the involvement of its European stakeholders, states that companies must send out breach notifications to their clients.

“How many big corporate data breaches are we unaware of that occurred before the implementation of GDPR? If client personal data leaks onto the dark or public web, a lot of personal liability issues become a reality for Liberty,” he states.

“I think the unfortunate truth is that Liberty will be raked over the coals for this, and it could end up costing them millions in real and reputational damage.”