Security Leftovers
-
Security updates for Friday
Security updates have been issued by Debian (tryton-server), Fedora (youtube-dl), SUSE (clamav and krb5), and Ubuntu (cjose and fastdds).
-
Rackspace’s costs to deal with ransomware attack top $10 million
Rackspace Technology Inc. spent $10.8 million on expenses related to a ransomware attack in December that blocked thousands of customers from accessing their emails and related data, according to regulatory filings.
The San Antonio-based cloud computing company paid for costs to “investigate and remediate, legal and other professional services, and supplemental staff resources that were deployed to provide support to customers,” according to filings with the U.S. Securities and Exchange Commission.
-
Data breach at French govt agency exposes info of 10 million people
Pôle emploi, France’s governmental unemployment registration and financial aid agency, is informing of a data breach that exposed data belonging to 10 million individuals.
-
Thousands have SSNs leaked after ransomware attack on Ohio state archive org
One of the oldest historical societies in the state of Ohio was hit with a ransomware attack that leaked the sensitive information of thousands, according to a statement the organization released this week.
The Ohio History Connection is a statewide history nonprofit chartered in 1885 that manages more than 50 sites and museums across the state. It houses the State Historic Preservation Office as well as the official state archives.
-
What the SEC’s Investigation of SolarWinds Means for CISOs and Cybersecurity Disclosures
In sending a Wells Notice to SolarWinds’s CISO, the SEC has put CISOs generally on high alert that the agency is focused on how such professionals may be involved in company missteps concerning cybersecurity issues. Managing cybersecurity at a large company often involves multiple layers of personnel involved in different aspects of complex processes, and the SEC may face challenges in investigating, and possibly charging, future CISOs. CISOs and their companies—working with counsel—should take care to design processes to detect cyber incidents and have appropriate governance around evaluating and escalating them, so that the people who are responsible for making disclosure decisions can receive timely and accurate information.