Week of January 2, 2023: CISA ICS Advisories, Wabtec Breach, LockBit Port Threat

The week of January 2, 2023 brought CISA's release of three Industrial Control Systems advisories for Hitachi Energy products, a Fortinet fix for a remote-code-execution flaw in FortiADC, and the disclosure of Wabtec's rail-sector data breach spanning four countries. Ransomware pressure also stayed visible as the Port of Lisbon's website remained offline under a LockBit extortion threat while a Deepwatch survey flagged mounting compliance workload tied to breach-reporting rules.

CISA Issues Three ICS Advisories for Hitachi Energy Products

On January 5, 2023, CISA published three Industrial Control Systems advisories covering Hitachi Energy's UNEM, FOXMAN-UN, and Lumada Asset Performance Management products, catalogued as ICSA-23-005-01, ICSA-23-005-02, and ICSA-23-005-03. The agency said the bulletins shared technical detail on current security issues, vulnerabilities, and exploits affecting industrial control environments. CISA encouraged users and administrators operating these systems to review the advisories for mitigations, giving operational technology teams a fresh set of vendor-specific fixes to track at the start of the year. (CISA)

Fortinet Patches Remote Code Execution Flaw in FortiADC

CISA flagged a Fortinet security advisory, FG-IR-22-061, addressing a vulnerability affecting multiple versions of FortiADC that could allow a remote attacker to execute unauthorized code or commands through specifically crafted HTTP requests. CISA's alert, posted January 4, 2023, urged administrators running FortiADC application delivery controllers to apply Fortinet's recommended updates, a reminder to security teams managing internet-facing network appliances to prioritize patching as 2023 got underway. (CISA)

Wabtec Discloses Rail-Sector Breach Spanning Four Countries

Rail equipment maker Wabtec notified individuals across its U.S., Canada, U.K., and Brazil operations that malware had entered its network as early as March 15, 2022, with intruders accessing systems containing personal data including names, dates of birth, national ID and passport numbers, and in some cases NHS and medical record details. The stolen files were later leaked by LockBit. Wabtec said notification letters to affected individuals began going out on December 30, 2022, after forensic review confirmed personal data exposure on November 23, 2022. (Industrial Cyber)

Port of Lisbon Website Remains Down After LockBit Claim

The Port of Lisbon's website stayed offline into the new year after the LockBit ransomware group added the Portuguese port authority to its extortion site and claimed to have stolen financial reports, contracts, cargo information, ship logs, crew details, and customer personal data. Port officials said operational activity was not compromised and that the National Cybersecurity Center and Judiciary Police had been notified. LockBit set a ransom demand of $1,500,000 and threatened to publish all stolen files on January 18, 2023, if payment was not made. (Industrial Cyber)

DoorDash Third-Party Breach Logged in Public Record

Have I Been Pwned added the DoorDash data breach to its public database on January 7, 2023, confirming details of an incident DoorDash had attributed to a third-party vendor compromised through a phishing campaign. The breach, which DoorDash had disclosed the prior August, exposed 367.5k unique email addresses together with names, postal codes, and partial payment card data including card brand, expiry date, and the last four digits. No full card numbers were included among the compromised fields. (Have I Been Pwned)

Survey: Breach-Reporting Rules Seen Adding Workload for Security Teams

A Deepwatch report published January 3, 2023 found that 78% of security professionals expected breach and incident reporting requirements to create more work for their teams, while 77% anticipated added work stemming from privacy requirements. The firm identified digital transformation initiatives and regulatory requirements as the top two cost drivers security leaders expected to face in 2023, with cybersecurity insurance named a concern by 78% of respondents as premiums continued to climb. (Help Net Security)