Reference no: EM133197702

Discussion 1.

T-Moblie acknowledged earlier this year that they did fall victim to a data breach performed by Lapsus$. Though, the stolen credentials that they used to get into T-Mobile's network did come to be nothing and nothing that the bad actors could use to extort anything. However, with that being said the VPN credentials that were attained were bought from a Russian black website, and in addition to gaining customer information, Lapsus$ also was able to download over 30,000 slack messages from internal employees. I definitely think this was a data breach to extort, and with that many messages from internal employees worldwide there is bound to be some information in there. Lapsus$ has been in the news recently a lot for their extorting methods and I think they just showed T-Moblie, one of the biggest phone companies in the world what they can do.

When there is a security breach regardless of the attack vectors, regulatory agencies such as e Federal Trade Commission (FTC) impose severe penalties on affected organizations that fail to properly protect consumer data. In some cases, reputation and credibility are also impacted. With your understanding of some of these consequences of a single breach, could the breach have been avoided and why?

London, England recently arrested a 16-year-old and 17-year-old with ties to this Lapsus$ group. With that being said, there are literal kids that can do these types of hacks and are usually a bit savvier than older people. Breaches are never expected without intel and there is no telling what these organizations that are made to be silent can do. T-Mobile specifically could have not known someone's VPN conditionals were being sold on the black market from a Russian website. I think most companies still to this day do not acknowledge breaches, but T-Mobile acknowledged it and dealt with it, and ensured no one's sensitive information was breached. Sometimes, that is all you can do when you are dealing with these types of explosive issues.

Discussion 2.

In July 2021 SuperCare Health fell victim to a network breach in which unauthorized user(s) maintained access to SuperCare systems for a period of five days (23-27 July 2021). SuperCare reported the incident to the US Department of Health and Human Services as impacting 318,379 former and current patients. The compromised data was personally identifiable information in limited cases including social security numbers of individuals. It is likely that the data was obtained for identity theft operations or to run larger scam marketing on paitents of SuperCare.

When there is a security breach regardless of the attack vectors, regulatory agencies such as e Federal Trade Commission (FTC) impose severe penalties on affected organizations that fail to properly protect consumer data. In some cases, reputation and credibility are also impacted. With your understanding of some of these consequences of a single breach, could the breach have been avoided and why?

I would say that it could not have been avoided all together as nefarious computer users evolve as rapidly as the technology. That being said SuperCare is being sued in the US District Court for Central California for negligence. The plaintiff alleges SuperCare could have done more to prevent the incident.