Robert Siciliano and former NSA Deputy Director Colonel Cedric Layton discuss a Barclays breach that exposed 27,000 clients' income, bank, medical, and passport data. An insider sold the information, which fuels scam operations. They cover how banks can defend themselves and what customers should monitor.
Chapters
A shocking report making the Target breach look tame. Barclays City traders were allegedly able to buy information on at least 2,000 customers. We are talking income, bank account information, medical information, passport numbers. The damage has been done. But can you stop your life from being sold? Because even when they say it's not, it's always about money. A huge security breach at Barclays has thousands of clients worried their information was sold on the black market to cold callers. An investigation underway to figure out how a possible inside job could have happened. Reports saying this information could have been sold for an enormous amount of— oh wait, $82. That's right. The big question is, if it happened at Barclays, where else did it occur? Joining me now, two men who know all about the cyber fraud industry. Identity theft expert Robert Siciliano, former former Deputy Director of the NSA, Colonel Cedric Layton. Thanks to both of you for joining us. Um, Robert, let me, let me start with you, because what I think is really disturbing about this scandal in particular, if it's all true and is as reported, um, is that this is— it's a new wrinkle. I mean, it's not, um, identity theft. It's really selling your information so that predators can come in and boiler room style try and take advantage of you.
Yeah, this does remind me of the movie Boiler Room, uh, where, uh, they get sucker lists and they call these people with fake investment scams, and over time they bait them and they switch out the opportunity for a scammy investment, and the potential victim loses. And that may be the case here too.
Yeah, Colonel Layton, what do you think about that?
Well, I agree with Robert. There are a lot of issues, Melissa, where you can really take somebody's identity in a case like this and do all kinds of things. For example, what you can do is you can find out exactly how much they've got in their bank account. You You can find out what their medical history is. You can assume their identity. And in many cases, if you're— if they're targeting affluent individuals, they could even go after them for things such as kidnapping and physical crimes like that. So it's a very serious issue.
Robert, how much do you fault Barclays, if all this is true, in all of this? Because it does seem like— I mean, these are predators that were inside the bank, you know, gathering the information on a flash drive, according to the whistleblower. That went to the original newspaper with this report. So they were gathering this information and bringing it out for profit. Is that something that Barclays should have been able to protect customers from?
Well, certainly today there are numerous technologies that monitor who has access to what kind of data and why. And they also can restrict that data as well. And over the past decade, we've learned an awful lot about these insider breaches. And the majority of the banks today more than likely have that type of technology operative. Maybe back then they didn't, but they could have.
Yeah. Colonel Layton, do you think that this has gone on in other places that we don't know about?
Oh, absolutely, Melissa. And I think we're just hearing the tip of the iceberg at this particular point. And it's very unfortunate, but especially when you look at transactions, financial transactions that happened in the past before a lot of protections were put in place, I think you'll see that there will be a lot more breaches that will be announced. And I think also in the future you can see quite a few more that will be coming up just because people will find ways to get into the bank's firewalls. You'll find ways to get into people's accounts, and that's exactly what we have to safeguard ourselves against.
So Robert, how do you protect yourself against something like this?
Yeah, when somebody has access to your, your own information, meaning that they are responsible for it, you are at a disadvantage. So what you need to do is recognize that your information probably already has been breached. I would say that with the close to billion records that have been breached over the past decade, that all of our information has been breached at least 3 or 4 times. That being said, be on the lookout for incoming emails designed to trick you into entering credentials or to get you to click links. Beware of phone calls, any incoming communications designed to extract additional information from you, and monitor existing accounts.
Colonel Layton, do you agree with that? I mean, has this probably happened to everyone somewhere along the way? I mean, that seems to be what Robert Siciliano is saying.
Well, I think if you believe it hasn't happened to you, then you're probably not quite grasping reality. There are a lot of areas where there have been data breaches, and with a billion-plus people being affected by these data breaches—20 million in South Korea the other week, you know, several million in Germany, and the Barclays case now, and, of course, the Target case in the United States—there are so many ways in which data can be breached, and the protections are simply inadequate. And so I agree with what Robert said, and I also think that what we need to do we need to make sure that there are data protection laws in place, not only in the United States, but really all over the world, so that you can really make sure that your data is as secure as it possibly can be.
All right, gentlemen, thanks to both of you. My pleasure.
