Deloitte, which ranks among the world's Top 100 Managed Security Services Providers for 2017, was hit by a major email system breach it reportedly discovered last March but kept publicly under wraps. Intruders may have been inside its network as far back as October or November, 2016, the Guardian first reported earlier today.
Updated October 10, 2017: The hack may have been far larger than originally reported -- potentially including communications with 350 customers, the Guardian now says.
Hackers are thought to have made away with confidential emails and strategic documents belonging to some of the $37 billion consultant’s top clients spanning banks, media organizations, multinational corporations and government agencies, the report said. So far, nobody is publicly suggesting who may be behind the theft but the likely suspects range from an individual to a competitor to a state-sponsored actor.
Deloitte said today that the break-in affected “only a very few clients,” based on an internal review of its systems, Reuters reported. However, as many as five million Deloitte emails were stored in the cloud and perhaps vulnerable to the hack, the Guardian said. The accounting firm has not revealed the clients involved in the caper.
“No disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers,” the company said. Still, as cybersecurity attack history is repeatedly showing us, the fallout from these types of things tends to scattershot wider than at first glance. We’ll keep you updated as Deloitte assesses the damage.
Deloitte Email Breach
Here’s what else you need to know (via the Guardian):
Cybersecurity Expert and MSSP Reaction
Reaction about the hack is pouring in from the cybersecurity sector. “Deloitte is perhaps one of the more cyber-savvy organizations. Unfortunately, the myriad of different ways in which an enterprise may be breached is very large, and even a robust investment in traditional security technologies and incident response is not enough,” said Gaurav Banga, Balbix founder and CEO, in an email to MSSP Alert.
Rich Campagna, CEO, Bitglass, points to the need to move beyond static passwords. Dynamic identity management solutions that can detect potential intrusions, require multi-factor authentication, and integrate with existing systems for managing user access can be much more effective than basic password protection, he noted.
The MSSP sector has also weighed in. John Christly, global CISO at Netsurion (a provider of managed security services for multi-location businesses) and EventTracker (a SIEM company) pointed to growing risks in the financial sector.
"The financial sector is getting an unprecedented wake-up call in case any had grown complacent – with targets in just a matter of weeks being one of the ‘big four’ accountancy firms, one of the ‘big three’ credit monitoring agencies, and the U.S. Securities and Exchange Commission," he noted.
As it the case with any data breach, vigilant monitoring, effective threat and anomaly detection, and rapid response is a must, he added. Pushing beyond two-factor authentication, Christly called for a policy of ‘least privilege’ and rigorous patching.
Deloitte ranks among the world's Top 100 MSSPs, according to MSSP Alert research that will debut on Thursday, September 28, 2017.
Additional reporting by Joe Panettieri.
