<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Here We Go Again: Vendor Cybersecurity Breaches Keep Wreaking Havoc

author Michael Berman
2 min read
Aug 10, 2017

Another day, another third-party data breach. Actually, two of them.

Earlier this month we learned that data from at least 6 million Verizon Wireless users was leaked online, including phone numbers, names, and PIN numbers to access accounts. Cybersecurity firm UpGuard discovered the leak, which was caused by NICE Systems, a vendor Verizon Wireless was using to manage customer service phone calls. Ironically, the software company bills itself as a firm that helps companies, including financial institutions, “ensure compliance and fight financial crime.”

The source of the problem, according to CNN, was an Amazon S3 storage server that was set to public instead of private. Anyone with a link could access data on the server until the problem was fixed—more than a week after it was discovered.

How often do mistakes like this result in breaches? The 2017 Verizon Data Breach Investigations Report found that errors are responsible for 14 percent of cybersecurity breaches and that 27 percent of breaches are discovered by third parties.

Our second incident comes courtesy of some of the most high-end hotel chains in the country, including Four Seasons, Trump Hotels, Hard Rock Hotels & Casinos and Loews Hotels. Guest data, including credit card and contract information, was exposed for about eight months.

The common thread the hotels shared: Sabre Hospitality Solutions SynXis Central Reservation system. More than 36,000 properties use the system.

Sabre owned up to the issues in the company’s quarterly SEC filing in May, mentioning “unauthorized access to payment information contained in a subset of hotel reservations.” Now hotels are informing guests that their information may have been stolen.

How vigilant is your institution when it comes to vendors? The Verizon Report reports that 24 percent of cybersecurity breaches affect financial organizations. More than half of victims have fewer than 1,000 employees. Vendors are often targeted instead of the institution itself if it’s viewed as having potentially weaker security, the report notes, calling some “a soft target useful as a stepping stone to their partners’ systems.”

Are your vendors training their staff to be on guard for phishing emails? Are they keeping their systems up to date with patched and updates? Do they monitor employee data use? Are they on top of the latest threats? Do they carefully follow detailed policies and procedures?

A good vendor management program will ensure that vendors tell you all this and more, helping you put the controls in place to prevent your institution from making the next headline.

 

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Artificial Intelligence Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
How Well is Your Board Managing Risk?
Risk & Compliance

How Well is Your Board Managing Risk?

Jul 10, 2018 4 min read
Déjà vu: Wells Fargo Can't Stay Out of Trouble
Risk & Compliance

Déjà vu: Wells Fargo Can't Stay Out of Trouble

Aug 15, 2017 2 min read
Don’t Let Heartbleed Lead to Vendor Management Heartbreak
Risk & Compliance

Don’t Let Heartbleed Lead to Vendor Management Heartbreak

Feb 16, 2017 1 min read