Deloitte Hit By Cyberattack That Compromised Client Information & Decided To Basically Tell Nobody At All

from the ostrich-style dept

In the wake of the Equifax breach, there has been some discussion about just how quickly companies should publicly disclose when they have been victims of security breaches that reveal client information. In the case of Equifax, the company had essentially been sitting on the knowledge that it was attacked since July before going public in early September. Something like two months, in other words. While most people agree that victim companies should have some time to get their houses in order before opening the window shades, two months seemed like a lot, given the severity of the attack and the number of potential victims among Equifax’s clients.

But two months is nearly lightning quick compared with Deloitte, the enormous accounting firm that discovered it was the victim of an attack in March and only bothered to tell the public, along with most of its clients, this week.

One of the largest private firms in the US, which reported a record $37bn (£27.3bn) revenue last year, Deloitte provides auditing, tax consultancy and high-end cybersecurity advice to some of the world’s biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies.

The Guardian understands Deloitte clients across all of these sectors had material in the company email system that was breached. The companies include household names as well as US government departments. So far, six of Deloitte’s clients have been told their information was “impacted” by the hack. Deloitte’s internal review into the incident is ongoing.

Now, Deloitte may have discovered the breach in March, but there have been whispers that the attackers may actually have pulled all this off in October of last year. The attack was pulled off by accessing an administrator account that lacked anything resembling two-factor authentication, all hosted on Microsoft’s Azure cloud service, and potentially exposing every sort of client data ranging from passwords and IP addresses to health information. The decision was made within Deloitte to only inform a few partners and legal staff within the company and a total of six Deloitte clients that the breach had even occurred. Most Deloitte staff and customers had no idea until these past few days.

And that decision could amount to a very real problem for the company, given that most US states and territories have security breach notification laws mandating when companies must tell clients when these sorts of attacks occur. If Deloitte has customers outside of the six it has informed in any of those states or territories, which is a virtual certainty, and those clients’ information was exposed by this attack, Deloitte could be in violation of all kinds of state laws for failing to inform those customers what had happened. Most of these laws frustratingly rely on ambiguous language as to how quickly clients or residents of the state should be informed of the breach — there is all kinds of “in the most expedient time possible” and “without unreasonable delay” language in these laws –, but it would be patently absurd for Deloitte to suggest that 6 months time meets any of those requirements.

In fact, Deloitte won’t even acknowledge if it has ever contacted law enforcement about the breach.

Deloitte declined to say which government authorities and regulators it had informed, or when, or whether it had contacted law enforcement agencies.

Now, for its part, Deloitte is making much of its ability to perform an internal review of the breach and the contracted security firms its engaged, all while stating that it has allowed them to pinpoint exactly what data was accessed and what wasn’t, and that the amount actually accessed is very small. Except it’s hard to take on faith the cyber-sleuthing capabilities when the firm has been so opaque about the breach thus far, and at least some of the notification laws require notification upon breach, not upon actual data acquisition.

If nothing else, it should be clear that covering this stuff up and trying to pretend it never happened is no way to do security.

Filed Under: , , , ,
Companies: deloitte, equifax

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Deloitte Hit By Cyberattack That Compromised Client Information & Decided To Basically Tell Nobody At All”

Subscribe: RSS Leave a comment
XcOM987 (profile) says:

Re: Deloitte is lying

As is par for the course really, Mike mentioned it in the Equifax that these are always worse than first reported, I forsee this being fairly bad, I wouldn’t be surprised if this is someone acting out a real life version of “Mr Robot”, first Equifax, now Deloitte, I wouldn’t be surprised if this has massive implicatons on the economy and/or the populous.

That Anonymous Coward (profile) says:

But we have laws saying we can put an ice cream cone in a pocket, or we can’t offend elected officials…

You’d think companies responsible for billions of dollars or critical information that’s gonna cause untold losses would have a law requiring them to report these things.

But then corporations are special & need to be treated with kid gloves. Goldman Sachs – we have emails showing they knew the shit was toxic, but we declined to prosecute because it would be hard. Abacus – hardly anything wrong but the only bank we took on for sub-prime mortgage wrong doing.

XcOM987 (profile) says:

Re: Re:

From what I read, they were the only ones to do anything right, they fired the employee that was breaking the rules and reported it to the officals straight away, that really is a case of small enough to prosecute, it does send a signal that if your big enough you pretty much can do what you want, Like the banks giving the CEO’s and whatnot big bonus’ after being bailed out.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...