Join our subscribers
Defaced Website of Law Enforcement Supply Firm, Possible Data Wipe Follows Breach of App Used To Coordinate Police Raids
Monday, January 23, 2023
More information is definitely needed, as this breach already has the potential to be one of the biggest and most damaging of the year if it does indeed go beyond a simple defaced website in terms of threat actor access. Law enforcement personnel around the country may have had private contact information exposed, investigation suspects may have had deeply sensitive personal information leaked, and the “bad guys” may have even been aware of this weakness and made use of it to anticipate raids or identify undercover officers. At least some of the police departments involved appear to have been tantalized into giving SweepWizard a spin by some sort of free trial period offered for the mobile app.
Dr. Ilia Kolochenko, Founder/CEO and Chief Architect at ImmuniWeb, notes that this is a call for law enforcement to realize that they are a prime target for hackers and are not above cybersecurity concerns: “Third-party vendors and suppliers are actually the Achilles’ heel of law enforcement agencies. Per se, a website defacement is a low-risk security incident, mostly carrying out reputational consequences. In this case, however, there are various indicators that the website defacement may be just the tip of the iceberg of a major data breach … If law enforcement intelligence data ends up in hands of organized crime, it may lead to tragic consequences for police officers and undercover agents. This is not to mention that years of complex and resource-consuming police investigations may be wasted and criminals eventually go unpunished. I would, however, refrain from making conclusions before ODIN Intelligence comments on the scope and nature of the incident. All law enforcement agencies that the breach could have impacted should urgently audit what kind of their data could have been stolen to understand and respond to the broad spectrum of possible implications, as well as rapidly notify concerned third parties.” Read Full Article
IT World Canada: Compromised API led to data theft of 37 million T-Mobile customers
Computing: PayPal: 35,000 customers breached in credential stuffing attack
