It has been reported that the San Francisco Employees’ Retirement System (SFERS) said it suffered a data breach after an unauthorised person gained access to a database hosted in a test environment. In a data breach notification filed yesterday, SFERS stated that one of their vendors had set up a test environment that included a database containing the information for approximately 74,000 SFERS members. While SFERS states that no Social Security Numbers or bank account information was contained in the breach, there was enough personal information exposed that could be used by threat actors in attacks. The leaked information for all members includes a member’s name, address, date of birth, and beneficiary information.
Experts Comments
June 04, 2020
A breach like this is interesting, both because it leads to almost guaranteed identity theft (if the information actually was accessed and downloaded), since it’s a treasure trove of financial information, identifying information, and security questions. Security questions, in particular, typically uses information that people *feel* is non-public, even if it usually is; wife’s name, where you met, etc., are often accessible with a quick social media search. But for an attacker to have.....Read More
Like(
June 04, 2020
The SF Employee’s Retirement System breach is a good reminder that even applications on test systems need to be secured against threats, whether they are internal (bad actors in the organization and its partners) or external (coming from hackers trying to exploit vulnerabilities). Vulnerabilities, misconfigured servers, and misused credentials are among the top reasons systems get breached.
June 04, 2020
Test environments are usually not secured or monitored to the same level as production environments, and it is never advisable to use real data in test cases. Rather, dummy data, or heavily redacted data should be used so that even if it is leaked or breached, it does not impact any real customers.
Anyone impacted by this breach should keep a close eye on their credit rating, and be wary of unsolicited emails which may appear to originate from official bodies relating to this breach.
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Brian Higgins, Security Specialist, provides expert commentary at @Information Security Buzz.
"This incident highlights the vital importance of data ownership and supply chain security...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-on-san-francisco-retirement-program-suffers-data-breach
Facebook Message
@Brian Higgins, Security Specialist, provides expert commentary at @Information Security Buzz.
"This incident highlights the vital importance of data ownership and supply chain security...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-on-san-francisco-retirement-program-suffers-data-breach