It has been reported today that thousands of customers’ financial details held by one of Britain’s biggest estate agents are being freely accessed on the dark web. Foxtons Group was victim to a malware attack in October last year when hackers targeted the company, with it closing down its web portal for home sellers, renters, and landlords. The company said that Alexander Hall, its mortgage broking business, was affected and that no “sensitive data” had been stolen. It reported itself to the Information Commissioner’s Office (ICO), the data watchdog. But when the firm was informed in January that financial and personal information was freely accessible on the dark web from an attack on ‘Foxtons Group plc.’ customers, it did not take any action.
Experts Comments
The latest revelations about Foxton clearly look like a 'he said, she said' moment with a lot of finger-pointing. At the same time, it is a sobering reminder that cyber criminals are stealing sensitive data from consumers on a daily basis and yielding massive profits by selling the information on the dark web. To Foxton, I encourage more transparency and hope they will further come clean on what happened and disclose the preventive measures they are taking to tighten security and limit further
.....Read More
Like(
This is about as worrying as it gets. Identify and card fraud are big business for malicious actors and up-to-date card details belonging to those unaware of the breach are worth a huge amount on the black market. When the financial data leaked is connected to mortgages it can be that much more impactful, as the large amounts of money being exchanged create a more tempting and lucrative target for criminals. With this data having been viewed thousands of times on the dark web I would be highly
.....Read More
Foxtons Group customers will want to invest in credit monitoring services, keep a close eye on all of their accounts, and stay alert for phishing emails, texts, and phone calls. Unfortunately, these customers have been exposed since last October, so in some cases, the damage may have already been done.
This is an example of what not to do when the victim of a cyber-attack. It appears the company at the centre of this breach just ticked the boxes in notifying the authorities that they were victim here, but either did not go any further in investigating the types of data stolen or kept the results of that investigation from their customers. Failure to notify its customers who may have been affected flies against best practices and ethics, and is an out-dated attitude that will affect the trust
.....Read More
It looks like Foxtons could be held liable for negligence if it failed to inform customers that their data had been compromised. When it comes to stolen data, absence of evidence is not evidence of absence. We should always assume and prepare for the worst if it can't be determined whether data was actually exfiltrated. Whether an oversight or neglect, Foxton's certainly could have taken a more cautious, transparent approach.
While the full scope of this security incident is not yet clear, it is still recommended that any customers of Foxtons contact their bank to immediately cancel any cards linked to your Foxtons account. However, since these details have potentially been available for over three months, it is also worthwhile looking through bank statements to identify any suspicious activity. It is also important to change passwords for Foxtons’s accounts and any other sites that use the same password, as well
.....Read More
When we hear reports of data breaches such as the one concerning Foxtons Group in the UK, we can use the incident as a cautionary tale for the procedural steps to take in the event it happens to our organization. Unfortunately, with the precipitous rise in attacks, breaches, and data leaks, the chances are that more and more businesses—despite best defensive efforts—will face the situation in the future.
The smart organization is the one that has prepared for this type of event by documenting
.....Read More
With businesses holding sensitive data on thousands of individuals, it’s historically been difficult to detect breaches and leaks from those customer datasets. It’s therefore important to routinely monitor for exposed data outside the organisation’s network as it is critical to know it’s happened as soon as possible – and then act immediately. Early breach detection is a fundamental expectation of GDPR and companies who take a lax approach can expect to face growing regulatory fines.
Speed is
.....Read More
Financial data is subject to both regulatory and compliance requirements. The fundamental security requirement for all industries storing financial data is to understand who and what is trying to access the technology environments that the financial data is stored in. This breach further highlights the importance of identity and access management to support all businesses through digital transformation delivering to security, compliance, and privacy requirements.
It is safe to assume the worst and Foxton customers should look to protect themselves from identity fraud and card fraud as a result of this breach. With both personal information and payment card information lost, Foxtons customers should take some time to validate payments and potential credit history interactions since October and flag anything suspicious to their bank. Even though a subset of the entire customer data has been leaked with the attackers claiming they have the entire data and
.....Read More
Criminals are continually evolving their methods and ways in which they can extort victims or cause embarrassment. Anyone can publish details on the dark web claiming it comes from a breach, but people should be careful before jumping to conclusions.
However, if someone suspects their details could have been exposed in any breach, they should ensure that any passwords that may have been compromised are changed, not only on the impacted service but also on any other sites which may have used
.....Read MoreDot Your Expert Comments
Only for registered and approved experts. Please register before providing comments. Register here
The recent news about the Foxtons data breach shows, again, the need for organisations to take security seriously and consider ways in which they can further protect their customer’s data. Despite falling victim to a malware attack back in October 2020, Foxtons did not know they had a data breach until a month ago which means these cyber attackers were likely moving laterally throughout their network to find valuable information for a long time prior to the data being dumped on the dark web.
.....Read MoreThe recent news about the Foxtons data breach shows, again, the need for organisations to take security seriously and consider ways in which they can further protect their customer’s data. Despite falling victim to a malware attack back in October 2020, Foxtons did not know they had a data breach until a month ago which means these cyber attackers were likely moving laterally throughout their network to find valuable information for a long time prior to the data being dumped on the dark web.
With attackers becoming ever more opportunistic, it is critical that security operations teams have the ability to pervasively detect and respond to attacks and unauthorised access wherever it happens. Typically a large percentage of these breaches start from phishing emails or credential theft from SaaS applications like Office 365. Companies must have a complete view of their attack surface. Detecting and responding to indicators of possible malware lurking on a network can make the difference between a contained incident or a damaging organisation-wide outage, breach, or significant financial loss– something Foxtons are likely to experience due to this attack.
Read LessLinkedin Message
@Garry Veale, Regional Director , provides expert commentary for "dot your expert comments" at @Information Security Buzz.
"Companies must have a complete view of their attack surface...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-reaction-on-hackers-steal-foxtons-customer-data
Facebook Message
@Garry Veale, Regional Director , provides expert commentary for "dot your expert comments" at @Information Security Buzz.
"Companies must have a complete view of their attack surface...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-reaction-on-hackers-steal-foxtons-customer-data