Experts Reaction On Staples Data Breach

Staples has informed some customers that data relating to their orders has been accessed without permission, but dubbed the data as ‘Non-sensitive” according to researcher Troy Hunt. Cybersecurity experts reacted below.

Subscribe
Notify of
guest

3 Expert Comments
Most Voted
Newest Oldest
Inline Feedbacks
View all comments
Laurence Pitt
Laurence Pitt , Global Security Strategy Director
InfoSec Expert
September 16, 2020 12:39 pm

Many people will see this as a relief that ‘only names, email addresses, and phone numbers’ were shared – their credit cards are safe and their transactions remain a secret. However, this is not the case. These pieces of PII still have value on the black market and can be used in order to gain access to other, and perhaps more sensitive, information. The combination of ‘email address and telephone number’, for example, would be a great start for anyone attempting takeover attacks on personal data.

It’s about time that we stopped ranking personal data theft on perceived severity. Any breach in which personal data is stolen needs to be treated as highly serious and punishable. Then, maybe people will be more careful about what databases are left around for people to find.

Last edited 2 years ago by Laurence Pitt
Chloé Messdaghi
Chloé Messdaghi , VP of Strategy
InfoSec Expert
September 15, 2020 9:14 am

For Staples to say that customer order data is non-sensitive is ridiculous. Any social engineer attacker can use that type of data for a phone phishing campaign like this: ‘When you bought (name of purchased product) under xxxxxxxxxxxx confirmation number, we seem to have overcharged you. Can you please provide your full details of the credit card on file with the xxxx last four digits, so I can get that refund for you?’

We don’t know how the breach happened but we do know that this is the exact kind of data that can be used maliciously.

Last edited 2 years ago by Chloé Messdaghi
Saryu Nayyar
Saryu Nayyar , CEO
InfoSec Expert
September 15, 2020 8:56 am

While the Staples breach appears to be \”low impact\” in that no sensitive customer information was released, even supposedly non-sensitive information can be leveraged by a savvy attacker. Knowing what a person or business has ordered, and when, can be just the hook an threat actor needs to formulate an effective phishing email or other social engineering attack. In this day and age, there is very little information that can\’t be leveraged in some way for nefarious purposes.

Last edited 2 years ago by Saryu Nayyar
Information Security Buzz
3
0
Would love your thoughts, please comment.x
()
x