Week of December 26, 2022: LastPass Fallout and CPRA Takes Effect

Security leaders closed out 2022 watching CISA add two actively exploited TIBCO JasperReports flaws to its Known Exploited Vulnerabilities Catalog, LastPass continue to withhold details of its vault-data breach, and Copper Mountain Mining disclose a ransomware attack on its corporate IT systems. The week also brought a published study quantifying healthcare ransomware's growth and the January 1 start of California's Consumer Privacy Rights Act obligations.

CISA Adds Two TIBCO JasperReports Flaws to KEV Catalog

On December 29, 2022, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The entries covered CVE-2018-5430 and CVE-2018-18809, both affecting TIBCO JasperReports software. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the flaws by set deadlines, while CISA urged all organizations to prioritize patching to reduce exposure to ongoing attacks. The addition gave security teams a fresh, concrete patch priority to close out the year. (CISA)

LastPass Breach Fallout Continued Through the Holiday Week

Days after LastPass disclosed that intruders had copied encrypted customer vault backups, the company still had not told its 25.6 million users how many vaults or accounts were affected. By December 28, 2022, security professionals were telling LastPass customers to migrate to alternative password managers and to rotate every stored credential, citing the firm's silence on breach scope and timing as grounds for lost confidence heading into the new year. (WIRED)

Study Quantifies Growth in Healthcare Ransomware Attacks

A JAMA Health Forum study published December 29, 2022 documented 374 ransomware attacks against U.S. health care delivery organizations between 2016 and 2021, exposing the personal health information of nearly 42 million patients. The researchers found annual attack counts more than doubled over the period and that incidents increasingly disrupted care delivery, including system downtime and cancelled appointments, giving CISOs in the sector fresh data to justify ransomware defenses and backup investment going into 2023. (JAMA Health Forum)

Copper Mountain Mining Hit by Ransomware Attack

On December 27, 2022, Copper Mountain Mining Corporation's IT systems at its corporate office were hit by a ransomware attack that encrypted several servers and business applications, according to a breach notification decision later published by Alberta's privacy regulator. The company determined that the threat actor likely gained unauthorized access to and exfiltrated certain data from its systems, including personal information, adding a mining-sector ransomware case to the week's incident log. (Office of the Information and Privacy Commissioner of Alberta)

California's CPRA Took Effect January 1, 2023

The California Privacy Rights Act took effect on January 1, 2023, amending the existing California Consumer Privacy Act with expanded opt-out rights, a new "sensitive personal information" category covering health, genetic, and biometric data, and a dedicated state privacy enforcement agency. For CISOs overseeing data handling in organizations with California customers, the effective date marked the start of new classification and access-control obligations that needed to be reflected in data inventories and vendor contracts. (Pathlock)