Week of December 25, 2023: First American's Cyber Incident Update and MFA Bypass Warnings

Security leaders closed out 2023 watching First American Financial Corporation file an amended SEC disclosure on a cybersecurity incident that forced it to isolate systems from the internet, while SE Labs warned CISOs about three tactics attackers were using to bypass multi-factor authentication. Fresh research released during the week also quantified rising healthcare breach costs, documented first responders' mounting ransomware fears, and found that many CTOs and CIOs were deprioritizing security behind AI adoption for 2024.

First American Financial Updates SEC on Cybersecurity Incident

On December 29, 2023, First American Financial Corporation filed an amended Form 8-K with the SEC describing a cybersecurity incident that led it to isolate systems from the internet on December 20, 2023. The company said it had retained outside experts, worked with law enforcement, and notified certain regulators. It stated the perpetrator accessed certain systems and exfiltrated and encrypted data on certain non-production systems, and that it believed the incident was contained while it continued restoring normal operations. (U.S. Securities and Exchange Commission (EDGAR))

Capgemini Finds Data Security Still Blocks Bank Cloud Adoption

A report from Capgemini, covered by Help Net Security on December 27, 2023, found that 91% of banks and insurance companies had started a cloud journey, up from 37% in 2020, yet most had moved only a limited portion of core applications to the cloud. Sixty-eight percent of financial services executives named data security as a barrier to further cloud adoption, while 51% cited high operational and transformation costs. The report also noted the EU's Digital Operational Resilience Act required financial institutions to maintain resilient systems. (Help Net Security)

Healthcare Breach Costs Climbed to $4.99 Million, Research Shows

A roundup published by Help Net Security on December 28, 2023 compiled 2023 healthcare cybersecurity survey data showing the average total cost of a cyberattack on a healthcare organization reached $4.99 million, a 13% increase from the previous year. Among organizations hit by cloud compromise, ransomware, supply chain, or business email compromise attacks, an average of 66% reported disruption to patient care. Separate findings showed ransomware attacks against healthcare organizations declined from 66% in 2022 to 60% in the data cited. (Help Net Security)

First Responders Report Rising Fear of Ransomware, Mark43 Finds

A survey from Mark43, reported by Help Net Security on December 29, 2023, found that 82% of first responders worried their agency's data could be stolen or hit by ransomware, a 6-percentage-point rise over the prior year's survey. The research also found 91% of first responders had experienced phishing, scam calls, or malware in the past year, and 93% believed the public would feel reassured if public safety agencies were required to follow federal cybersecurity standards such as FedRAMP. (Help Net Security)

CTOs and CIOs Rank Security Below AI for 2024, Survey Finds

A survey from Exclaimer, published by Help Net Security on December 28, 2023, found that improving security did not rank among the top three 2024 priorities for CTOs and CIOs, who instead placed adopting AI, enhancing automation, and reducing repetitive IT work ahead of it. IT managers, by contrast, named security their top priority at 42%. The survey also found that 40% of IT leaders said their organizations had experienced at least two security breaches in the past year. (Help Net Security)

IT Leaders Rank Cybersecurity Above Recession as Top External Risk

A survey from Digitate, covered by Help Net Security on December 28, 2023, found that 54% of IT decision-makers viewed cybersecurity as the biggest external risk facing their organization over the next 12 months, ahead of recession at 36%. Despite that ranking, only 38% had deployed automation to address cybersecurity risks, while 49% planned to implement some form of automation within six months to help close the gap between perceived risk and actual defensive investment. (Help Net Security)