Week of October 7, 2024: American Water discloses a cyberattack, and the FTC settles with Marriott

What mattered to security leaders in the week of October 7, 2024? American Water Works, the largest US water and wastewater utility, told the SEC it had disconnected systems after an intrusion, and the FTC announced a proposed order requiring Marriott and Starwood to build a full security program after breaches affecting more than 344 million customers. In Europe the Council adopted the Cyber Resilience Act, and the Internet Archive lost data on some 31 million users.

American Water disconnects systems after a network intrusion

In an 8-K filed October 7 under Item 8.01, American Water Works said it learned of unauthorized activity in its networks on October 3 and determined it was a cybersecurity incident. It brought in outside experts, notified law enforcement and disconnected or deactivated certain systems. The company believed none of its water or wastewater facilities or operations had been harmed and did not expect a material effect. Its MyWater customer portal was taken offline and the call center ran with limited functionality, with the company promising no late fees or service shutoffs meanwhile. (American Water Works (SEC EDGAR))

FTC orders Marriott and Starwood to overhaul data security

On October 9 the FTC announced a proposed settlement requiring Marriott International and its Starwood subsidiary to implement a robust information security program, resolving charges that weak data security led to three large breaches between 2014 and 2020 affecting more than 344 million customers worldwide. The order bars misrepresenting how the companies protect personal data, imposes data minimization, and lets US customers request deletion of data tied to their email or loyalty number. In a parallel settlement, Marriott agreed to pay a $52 million penalty to 49 states and the District of Columbia. (US Federal Trade Commission)

The EU Council adopts the Cyber Resilience Act

The EU Council adopted the Cyber Resilience Act, Help Net Security reported on Friday, October 11. The law sets EU-wide cybersecurity requirements for products with digital elements, from smart appliances and toys to wearables. Lower-risk products face a basic conformity assessment, while higher-risk ones need stricter third-party assessment, and sectors already covered by other EU law, such as medical devices and cars, are exempt. The regulation enters into force twenty days after publication in the Official Journal and applies 36 months later, with some provisions earlier. Manufacturers selling into Europe gained a firm timeline for secure-by-design obligations. (Help Net Security)

Internet Archive breach exposes 31 million accounts amid DDoS

On the afternoon of Wednesday, October 9, the Internet Archive's website displayed a JavaScript pop-up announcing a breach, as data on about 31 million users was loaded into Have I Been Pwned. The exposed records included email addresses, screen names and bcrypt password hashes. The site then went down under a DDoS attack claimed by self-described hacktivists, which kept many users from changing their passwords. Nonprofits holding large user bases face the same credential exposure risks as commercial platforms. (Help Net Security)

October Patch Tuesday fixes two exploited Windows zero-days

Microsoft's October 8 release fixed 117 vulnerabilities, two of them under active exploitation: CVE-2024-43573, a spoofing flaw in the Windows MSHTML platform, and CVE-2024-43572, a remote code execution bug in the Microsoft Management Console triggered by loading a malicious snap-in file. Trend Micro's Dustin Childs suggested the MSHTML fix may indicate that the July patch for a related flaw was insufficient. Both bugs need user interaction, so phishing controls matter alongside patching. (Help Net Security)

Mozilla ships an emergency fix for an exploited Firefox zero-day

Mozilla released Firefox 131.0.2 and Firefox ESR 115.16.1 and 128.3.1 to fix CVE-2024-9680, a use-after-free flaw in Animation timelines that had been exploited for code execution in the content process. ESET researcher Damien Schaeffer reported it, and Mozilla said the fixed builds shipped within 25 hours. Tor Browser was also updated. Enterprises that disable automatic browser updates have to push this kind of fix themselves. (Help Net Security)

Fortinet and Ivanti appliance flaws added to the KEV catalog

On October 9 CISA added three actively exploited vulnerabilities to its catalog: a format string bug affecting multiple Fortinet products (CVE-2024-23113) and two flaws in Ivanti's Cloud Services Appliance, a SQL injection (CVE-2024-9379) and an OS command injection (CVE-2024-9380). Edge appliances again dominated the list of bugs attackers were using. (CISA)