Summary from the OIG: Objective The objective of this audit was to determine whether the DoD effectively controlled access to health information of well-known DoD personnel. Background The DoD maintains millions of electronic health records on its DoD beneficiaries, [REDACTED] DoD personnel who are granted access to health information to perform their official duties…
Category: Commentaries and Analyses
Nigerian hacker and a repeat offender sentenced to federal prison for unemployment fraud and tax fraud scheme
Bamidele Muraina, a Nigerian national who hacked into tax preparation firms and filed fraudulent unemployment benefit claims and tax returns using stolen personally identifiable information, and Gabriel Kalembo, a previously convicted fraudster who laundered the fraudulent assets, have both been sentenced to federal prison. The sentencing was announced today by the U.S. Attorney’s Office for…
SEC fines three companies over hacked employee email accounts
Catalin Cimpanu reports: The US Securities and Exchange Commission has fined three brokerage firms on Monday for neglecting to secure employee accounts, incidents that led to the exposure of their customers’ data. Cetera Advisor Networks LLC, Cetera Investment Services LLC, Cetera Financial Specialists LLC, Cetera Advisors LLC, and Cetera Investment Advisers LLC (collectively, the Cetera entities); Cambridge…
VaxiCode flaw: Quebec refused to give immunity to the whistleblower
Thomas Gerbet reports (machine translation follows): Contrary to what the Minister of Digital Transformation, Eric Caire, said, the Quebec government has never offered immunity to the computer scientist who discovered the security flaw in the VaxiCode health passport application. Exchanges of emails obtained by Radio-Canada reveal the underside of this affair and show that the…
Singapore adds a third bug bounty program – this time to fortify government digital services
Laura Dobberstein reports: Singapore’s governmental digital services arm, GovTech, has launched a “rewards programme” to further crowdsource tests of the nation’s cybersecurity. The Vulnerability Rewards Programme (VRP) joins the Government Bug Bounty Programme (GBBP) and the Vulnerability Disclosure Programme (VDP), all of which work alongside the government’s own security checks. Read more on The Register.
Indian companies go scot-free despite breach of customer data
Vishal Raghavan has an opinion piece in The Leaflet about the failure of Indian firms to notify customers of breaches or to be held accountable and fined monetarily by regulators. He begins by reviewing a number of high-profile breaches reported in the last year or so, and the notes that all of the companies didn’t…