-
Dear readers, jumping and crying out in surprise - 6 mins ago
-
Kamala Harris Lands Fifth Polling Win in 24 Hours - 36 mins ago
-
Varga: EU supports G20 financial targets - 38 mins ago
-
O.J. Simpson property auction approved to pay off civil claims - 42 mins ago
-
It’s all Love: Packers’ success is now in Jordan Love’s hands - 44 mins ago
-
Szijjarto: EU’s weak interest representation ‘historic sin of Brussels bureaucrats’ - about 1 hour ago
-
Mets’ Kodai Senga Exits First Start of Season With Injury - about 1 hour ago
-
Fresno County man sentenced for sexually assaulting children, dog - about 1 hour ago
-
Austin FC's Gyasi Zardes finds the back of the net in 45' to take a 2-0 lead over Pumas - about 1 hour ago
-
Gulyas: Ukraine ‘blackmailing’ countries in favour of peace talks - 2 hours ago
Nissan data breach exposed Social Security numbers of thousands of employees
Nissan suffered a data breach last November in a ransomware attack that exposed the Social Security numbers of thousands of former and current employees, the Japanese automaker said Wednesday.
Nissan’s U.S.-based subsidiary, Nissan North America, detailed the cyberattack in a May 15 letter to affected individuals. In the letter, Nissan North America said a bad actor attacked a company virtual private network and demanded payment. Nissan did not indicate whether it paid the ransom.
“[U]pon learning of the attack, Nissan promptly notified law enforcement and began taking immediate actions to investigate, contain and successfully terminate the threat,” the car maker said in the letter, adding that “Nissan worked very closely with external cybersecurity professionals experienced in handling these types of complex security incidents.”
Nissan told employees about the incident during a town hall meeting in December 2023, a month after the attack. The company also told staffers that it was launching an investigation and would notify employees privately if their personal information had been compromised. Nissan said it’s providing free identity theft protection services to impacted individuals for two years.
Nissan North America also notified state officials across the U.S. of the attack, noting that data belonging to more than 53,000 current and former workers was compromised. But the company said its investigation found that affected individuals did not have their financial information exposed.
Nissan North America “has no indication that any information has been misused or was the attack’s intended target,” the automaker said in its letter.
Ransomware attacks, in which cybercriminals disable a target’s computer systems or steal data and then demand payment to restore service, have become increasingly common. One cybersecurity expert said someone likely got a password or multi-factor authentication code from an existing Nissan employee, enabling the hacker to enter through the company’s VPN.
“It is unfortunate that the breach ended up involving personal information, however Nissan has done the right thing by continuing to investigate the incident and reporting the update,” Erich Kron, a cybersecurity awareness advocate at KnowBe4, told CBS MoneyWatch in an emailed statement. “In this case, targeting the VPN will often help bad actors avoid detection and bypass many of the organizational security controls that are in place.”
Source link