Tag: Georgia

School Nutrition Vendor Sued for Compromise of 867,209 K-12 Student Records

Posted on by BeAware4lways

PCS Revenue Control Systems, Inc. (PCS) was hit with a proposed class action lawsuit last week alleging that it discovered a data breach from a hacking attack in December 2019 but failed to notify the affected students until March of 2021.

According to the lawsuit, student information was collected by PCS’s predecessor, Advanced Business Technologies (ABT), which provided food, nutrition, and technology services for K-12 schools. The information alleged to have been collected by ABT and in the possession of PCS after the acquisition included the names, dates of birth, Social Security numbers, and student identification numbers of 867,209 students who attended K-12 schools in Alabama, Florida, Georgia, and Texas. It is unclear why a nutrition vendor needs Social Security numbers of students to provide services.

Although the incident was allegedly discovered in December 2019, PCS sent notification letters to affected students and parents only in March 2021, offering one year of free credit monitoring.

Vehicle Inspections in Multiple States Disrupted by Malware

Posted on by BeAware4lways

Applus Technologies, Inc., a vendor of multiple state Departments of Motor Vehicles that assists states with vehicle inspections, recently announced that its systems have been affected by malware, disrupting motor vehicle inspections in Connecticut, Georgia, Idaho, Illinois, Massachusetts, New York, Texas, and Utah. As a result of the outage, vehicle inspections have not been able to be completed since March 30, 2021.

This is obviously very inconvenient for those individuals whose inspection stickers have or will expire shortly, as they are at risk of being issued a citation for an expired inspection sticker, on top of having to take time off to take their car to get inspected.

To address this concern, the Massachusetts Registry of Motor Vehicles (RMV) said, “[R]ecognizing the inconvenience Applus’ outage is causing, the RMV has been in communication with law enforcement to request cooperation and discretion in citing those with an expired sticker who may have attempted to visit a station this week.” The RMV has extended a grace period of one month to drivers who were unable to get their inspection stickers because of the outage.

After inspections were delayed a week, on April 7, 2021, Applus forwarded a software patch to service stations to try to fix the problem. However, it is being reported that Applus forwarded the patch to service stations on flash drives! Flash drives are notorious for being used to plant malicious malware and ransomware in users’ systems. Sending a patch on a flash drive is completely contradictory to security best practices.

Applus has stated that it does not believe that any customer (i.e., service station) financial information has been compromised, but is working with a forensic expert.

Lesson learned: get your inspection sticker in plenty of time before it expires.

Ransomware Attack Affects Georgia County Election Administration System

Posted on by BeAware4lways
Binary Check Ad Blocker Security News

Hall County, Georgia reported on October 7, 2020, that it was the victim of a ransomware attack that disrupted some of its systems, including email and telephone services in public buildings and the sheriff’s offices. Last week, the county indicated that in addition to telephone and email services, the ransomware attack also affected the county’s election administration system that verifies voters’ signatures on absentee ballots.

The county states that the ransomware attack (believed to be DoppelPaymer malware) will not affect voters’ ability to cast ballots, but it could slow down the county’s ability to process absentee ballots. According to public reports, there have been 13,703 absentee ballots cast in Hall County as of October 23. This incident is being reported as the first example of a ransomware attack affecting the 2020 election.

The ransomware attack will not completely thwart the ability of election clerks to count valid ballots. The County is able to use a statewide signature database in the event that it is not able to get the County signature matching system up and running, and as a last resort, they can go back to the old days and match signatures with voters’ registration cards.

Predictions are that hackers will be increasing the frequency and mode of attacks until election day, and that they believe that the closer the attack is to election day, the higher the chance is to score a payment.