Deloitte Hit By Cyberattack That Compromised Client Information & Decided To Basically Tell Nobody At All
from the ostrich-style dept
In the wake of the Equifax breach, there has been some discussion about just how quickly companies should publicly disclose when they have been victims of security breaches that reveal client information. In the case of Equifax, the company had essentially been sitting on the knowledge that it was attacked since July before going public in early September. Something like two months, in other words. While most people agree that victim companies should have some time to get their houses in order before opening the window shades, two months seemed like a lot, given the severity of the attack and the number of potential victims among Equifax’s clients.
But two months is nearly lightning quick compared with Deloitte, the enormous accounting firm that discovered it was the victim of an attack in March and only bothered to tell the public, along with most of its clients, this week.
One of the largest private firms in the US, which reported a record $37bn (£27.3bn) revenue last year, Deloitte provides auditing, tax consultancy and high-end cybersecurity advice to some of the world’s biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies.
The Guardian understands Deloitte clients across all of these sectors had material in the company email system that was breached. The companies include household names as well as US government departments. So far, six of Deloitte’s clients have been told their information was “impacted” by the hack. Deloitte’s internal review into the incident is ongoing.
Now, Deloitte may have discovered the breach in March, but there have been whispers that the attackers may actually have pulled all this off in October of last year. The attack was pulled off by accessing an administrator account that lacked anything resembling two-factor authentication, all hosted on Microsoft’s Azure cloud service, and potentially exposing every sort of client data ranging from passwords and IP addresses to health information. The decision was made within Deloitte to only inform a few partners and legal staff within the company and a total of six Deloitte clients that the breach had even occurred. Most Deloitte staff and customers had no idea until these past few days.
And that decision could amount to a very real problem for the company, given that most US states and territories have security breach notification laws mandating when companies must tell clients when these sorts of attacks occur. If Deloitte has customers outside of the six it has informed in any of those states or territories, which is a virtual certainty, and those clients’ information was exposed by this attack, Deloitte could be in violation of all kinds of state laws for failing to inform those customers what had happened. Most of these laws frustratingly rely on ambiguous language as to how quickly clients or residents of the state should be informed of the breach — there is all kinds of “in the most expedient time possible” and “without unreasonable delay” language in these laws –, but it would be patently absurd for Deloitte to suggest that 6 months time meets any of those requirements.
In fact, Deloitte won’t even acknowledge if it has ever contacted law enforcement about the breach.
Deloitte declined to say which government authorities and regulators it had informed, or when, or whether it had contacted law enforcement agencies.
Now, for its part, Deloitte is making much of its ability to perform an internal review of the breach and the contracted security firms its engaged, all while stating that it has allowed them to pinpoint exactly what data was accessed and what wasn’t, and that the amount actually accessed is very small. Except it’s hard to take on faith the cyber-sleuthing capabilities when the firm has been so opaque about the breach thus far, and at least some of the notification laws require notification upon breach, not upon actual data acquisition.
If nothing else, it should be clear that covering this stuff up and trying to pretend it never happened is no way to do security.
Filed Under: cyberattack, data leak, disclosure, hack, leak
Companies: deloitte, equifax
Comments on “Deloitte Hit By Cyberattack That Compromised Client Information & Decided To Basically Tell Nobody At All”
Deloitte is lying
This is far worse than they’re admitting.
Re: Deloitte is lying
As is par for the course really, Mike mentioned it in the Equifax that these are always worse than first reported, I forsee this being fairly bad, I wouldn’t be surprised if this is someone acting out a real life version of “Mr Robot”, first Equifax, now Deloitte, I wouldn’t be surprised if this has massive implicatons on the economy and/or the populous.
Re: Re: Deloitte is lying
A conspiracy bigger than all of us. There’s a powerful group of people out there that are secretly running the world. I’m talking about the guys no one knows about, the ones that are invisible. The top 1% of the top 1%, the guys that play God without permission.
Re: Re: Re: Deloitte is lying
Same as it ever was
Re: Re: noah fence
but it’s populace.
Re: Re: Deloitte is lying
and as if by magic!
But we have laws saying we can put an ice cream cone in a pocket, or we can’t offend elected officials…
You’d think companies responsible for billions of dollars or critical information that’s gonna cause untold losses would have a law requiring them to report these things.
But then corporations are special & need to be treated with kid gloves. Goldman Sachs – we have emails showing they knew the shit was toxic, but we declined to prosecute because it would be hard. Abacus – hardly anything wrong but the only bank we took on for sub-prime mortgage wrong doing.
From what I read, they were the only ones to do anything right, they fired the employee that was breaking the rules and reported it to the officals straight away, that really is a case of small enough to prosecute, it does send a signal that if your big enough you pretty much can do what you want, Like the banks giving the CEO’s and whatnot big bonus’ after being bailed out.
>And that decision could amount to a very real problem for the company, given that [laws]
LOL! Laws. Affecting large corporations! Hohoho, you little scamps with your humour.
Laws are for little people
There’s always a way around the law – if you have money, of course. For example, those reports states require when a breach occurs? Do they say exactly HOW the report should be? Maybe it’s enough to mail a post card with “U be hakked, Dudez!!” on it, which then gets tossed in the trash at the destination.
Deloitte? Isn’t that one of those things that time travels at 88 MPH?
Am I just dreaming?
Deloitte has some pretty powerful & wealthy clients. Will those clients make those creatures in Washington DC squirm. Or am I just dreaming.
Of course, any hypothetical squirming won’t help us nobodies. I’m not dreaming that much!
Re: Am I just dreaming?
Nah, they’ll just make the gov bail them out… again, then give themselves big bonuses for a job well-done.
/wish I were being sarcastic, but I’m not
They provide cybersecurity? I guess that doesn’t mean what they (or their clients) think it means…
absurd for Deloitte to suggest that 6 months time meets any of those requirements.
It all depends on who you are. For little people, it would probably be like 6 minutes. For big shots, 6 months will probably be considered “fast”.