The Next Big Data Breach You Need to Know About

The recently reported Cineverse data breach could be a hidden nightmare. This was a supply chain third-party type of attack that targeted specific data, likely the content of SMS text messages being sent to the phones of millions of global users, potentially exposing hundreds of billions of messages to threat actors. Now, Syniverse was the company that was hacked, and it processes over 740 billion text messages each year. And it does this for some of the biggest wireless carriers like AT&T and Verizon, T-Mobile, Telefónica, China Mobile, and many others. In fact, Syniverse is— it's a big player. It covers a lot of the services, calling 95 of the top 100 mobile carriers, its customers. Okay, so what happened? Well, we ended up finding all of this through an SEC filing that Cineverse did as part of a merger, uh, that they're working to get approved. And Cineverse indicated in this document to the SEC that they became aware of a hack in May of this year, 2021, and determined that access was originally gained in May of 2016. Yes, you heard that right. They were compromised for 5 years. Millions, perhaps billions of users are potentially affected by this, and it's interesting that it was noticed right around the time they were looking to take part in this merger, a merger that's valued at $2.8 billion. That's a big business deal, and it's also another reason M&A security is so important, but we'll talk about that later. Um, contents of the messages were exposed, and as what appears to be— well, at least to me— as personally identifiable information of the end users, unique identifiers or, or, or communications for specific users. So that combination is a privacy concern, obviously. And out of all of this, I've got 3 big concerns. First off is that privacy concern, right? This is a massive amount of data that is lost, hundreds of billions of messages with sender and receiver unique identifiers. And of course, the message content And arguably most of that content is probably trivial, but in aggregation it could be really important. Just like creating profiles of people, what they like, who they talk to, you know, what their position is on certain topics, what kind of humor they have, whatever. But in addition to that, there is likely other really sensitive information that's included in there, because there is surely contained in those texts second-factor authentication codes. Okay, and we use those as part of security. So I, I'm worried about the privacy, but having a malicious attacker be able to access second-factor authentication codes, especially at this scale, could potentially undermine strong online security authentication at a global scale. Think bank accounts, crypto exchanges, secure work logins, healthcare records sites, government services, plus your mobile phone account security itself, and also all sorts of different secure data repositories. Many of them use these second factor authentication codes to access. So that's concerning because again, access to the most secure sites and processes and technologies are often secured with second factor authentication. And many of those are taking advantages, uh, advantage of SMS messages to a trusted device. Now SMS is not the only way to do second factor authentication, but it was one of the earlier ones and it's probably one of the most widely adopted of all the second factor authentication that's out there. And this type of data breach, this type of access could undermine all that security. All right, my third concern is this attack has all the classic indicators of a nation-state attack. Compromise the target quietly, go after a third party or a supplier, remain persistent in the environment for long periods of time, don't make any noise or obvious signs of harm, yet gather vast amounts of data, especially on targeted individuals that could assist you with precision attacks against those downstream users. This screams nation state. And again, nation state having access to second factor authentication, that's very, very concerning. I mean, you want to gain access to an executive's email that's protected by second factor authentication. Now it's possible. How about access to a sizable yet well-protected account on a cryptocurrency exchange? Yep, that too. Um, what about remote login to a government services or national critical infrastructure? Yes, it's much easier now with that second factor code available to the attackers. Okay, let's keep it real though here. A second factor authentication, well, it's just that, it's a second factor, but we have to understand the First factor is often just a password, which is fairly easy to acquire, right, through social engineering or other means. Second factor is supposed to be the difficult technical control that protects important additional layers, right? And it's often more trusted than just a password. In fact, many password resets are enabled and protected with second-factor authentication. So having access to the temporary authentication codes that get sent through SMS could enable a hacker to reset the user's password. It's that important. Overall, I'm also concerned with some ethical ramifications of what we're seeing. And potential legal non-compliance. So this was discovered during the time of a merger, which may indicate that the other party in this merger might have been doing their due diligence, which precipitated the discovery of this breach. And that's fantastic news for them. I've been advocating for the need for inclusion of proper cybersecurity and M&A activities for many, many years. For this exact reason. And this discovery probably just made a huge difference in the deal negotiations. So there is great reasons to be able to do this type of vetting and understand the security posture of, of M&A partners, whether they're mergers or acquisitions, even divestitures. Yes. Now, the SEC filing itself Well, it highlighted 3 kind of terrible points in my mind. First, the forensics investigation determined that they had been hacked and exposed for 5 years. And that's a really long time. I mean, a really long time to have access to second factor authentication codes. Very concerning. Plenty of time for the attackers to plan attacks, target people, figure things out, and do some really dastardly things. Okay, second, they admitted to identifying the breach in May of 2021, May of this year, yet only now it's coming to light to the public. We're in October, right? Somehow through this chain, end users should have been notified based upon the myriad of different breach laws that exist. And I'm not an attorney, but this seems like somewhere in that chain there was non-compliance to regulations like GDPR out of the European Union, uh, CCPA out of here in California, and again, the multitude of other privacy regulations that require data breach notification. I don't know if it was Cineverse's responsibility or that of their customers, the carriers. I am assuming the big mobile carriers, they should have done the notifications, but I don't know, right? There's a lot of factors in there that really need to be uncovered. If they did in fact falter though, this, this chain starting with Cineverse, um, that would be a major ethical violation to keep the fact that consumers' data may have been compromised for 5 years including second-factor authentication information. That's huge. And that is, at least in my mind, that would be— if, if that's true, that would be a huge ethics violation. Um, trust would go out the window. Now, the third thing that I found in these filings, in the SEC filing, is it's written in a way that downplays the exposure of data and it calls it, you know, the, the incident not significant or important. And that's truly disturbing. Again, if SMS text messages that could be used for second factor authentication were in fact compromised, that screams a cybersecurity issue. Right? And that either means they have a lack of cybersecurity common sense or that their security is run by a tag team of lawyers and marketing folks and they're the ones who wrote this SEC filing and say a real security person wasn't even in the mix. But either way, it's very, very concerning, right? Companies should not be downplaying and trying to smooth over an event like this. Because again, if second factor is compromised, that is a major red flag. Now, I suspect there may be some serious litigation and regulatory investigations starting up because of this. If I were the company looking to merge with Syniverse, I would tap that pause button until all of this is resolved and the ramifications and financial impacts and reputation issues are all understood at least, because that does play definitely into the negotiation and you'd wanna know what you're getting as part of this business deal. So if I were them, I would definitely pause that until everything kinda comes to light. And although we are still early on in this, I suspect much more data will be emerging about this breach, and heads may roll on this as well. We've seen executive— executives fired for much less than this. And if GDPR, the European Union privacy regulation, if that's been violated, Ooh, then Cineverse and their clients, well, if you tabulate up the numbers, right, um, they may be the largest target to date for the European regulators who have been fervent in pursuing massive penalties against companies intentionally thumbing their nose at the privacy rights of their citizens. In the US, worst case would be all 50 states rally together to jointly sue those who knowingly failed to comply with state regulations. And specifically to California, it may be a violation of the citizens' rights as provided by the state constitution. Only California actually, um, identifies privacy as a right within the state for the citizens. Again, just more hot water. I think the attorneys are going to have a heyday with this. It is not every day that a data breach might impact upwards of 300 million Americans and potentially billions worldwide. In fact, this breach likely exposed every one of us. So let's be diligent and and patient and stay tuned to see how all of this unfolds. Thanks for watching. If you like these cybersecurity videos, please click the like button, leave a comment, and subscribe to the Cybersecurity Insights channel. I put out a video about every week on various cybersecurity topics, risks, ideas, events, and best practices. Let's continue to communicate and collaborate together. That's how we make cybersecurity strong. In protecting the global digital ecosystem.