Category Archives: Monthly Data Breaches

June 2024 Data Breach Round Up

june 2024 data breach round up

The month of June has been marked by a series of significant data breaches impacting various industries. From retail giants to healthcare services, these incidents highlight the ongoing vulnerability of even the most robust systems. Here’s a detailed look at the notable breaches and vulnerabilities discovered in the past month of June 2024.

Panera Bread Informs Employees of Data Breach

Panera Bread has informed its employees about a data breach that occurred in March, resulting in the theft of personal information, including names and Social Security numbers. The company disclosed the breach through notification letters filed with the Office of California’s Attorney General, revealing that a cybersecurity firm had been engaged to investigate the incident. Although Panera asserts that there is no evidence of the stolen information being publicly accessible, it is offering a one-year membership to CyEx’s credit monitoring and identity theft resolution service. Despite not detailing the breach’s nature or the perpetrators, some researchers suspect a ransomware attack that disrupted Panera’s ordering system, mobile apps, and loyalty program in March.

Keytronic Confirms Data Breach and Cyber Attack Impact


Keytronic, a major manufacturer of printed circuit board assemblies, experienced a significant data breach following a May 6, 2024, cyberattack by the Black Basta ransomware gang, which leaked 530GB of stolen data. The breach caused substantial disruptions in the US and Mexico, halting operations for two weeks and affecting business applications and corporate functions like financial reporting. An investigation revealed the exfiltration of personal information, prompting Keytronic to notify affected parties and regulatory agencies. The incident has already cost the company approximately $600,000 in cybersecurity expenses and is expected to impact its financial results for the fourth quarter ending June 29, 2024. Black Basta, linked to former Conti ransomware members and notorious for breaching 500 organizations and extorting over $100 million in ransoms, claimed responsibility and shared sensitive employee and corporate data online.

Qilin Ransomware Attack Disrupts London Hospitals

A ransomware attack attributed to the Qilin ransomware gang has disrupted pathology services at Synnovis, affecting several major NHS hospitals in London, including Guy’s and St Thomas’ and King’s College Hospital. The attack, identified by Ciaran Martin, former CEO of the UK’s National Cyber Security Centre, locked Synnovis out of its systems, causing significant service disruptions and the postponement or cancellation of some medical procedures. Despite these issues, urgent and emergency services remain operational. The NHS England cyber incident response team is assessing the full impact on patient and employee data. Qilin, previously known as Agenda, has been active since 2022, using advanced techniques to infiltrate networks, steal data, and deploy ransomware, demanding ransoms ranging from $25,000 to millions of dollars.

Advance Auto Parts Confirms Data Breach

Advance Auto Parts has confirmed a data breach after a threat actor, ‘Sp1d3r’, attempted to sell stolen data on a hacking forum. The breach, involving a third-party cloud database, exposed personal information of current and former employees, job applicants, and potentially customers. Data leaked includes social security numbers, government identification numbers, full names, and email addresses. Advance Auto Parts is notifying affected individuals and offering free credit monitoring and identity restoration services. The breach, discovered on May 23, 2024, has resulted in $3 million in expenses for the company. Law enforcement has been notified, and an investigation with cybersecurity experts is ongoing.

Neiman Marcus Confirms Data Breach

Neiman Marcus has confirmed a data breach affecting 64,472 individuals, following the unauthorized access to its Snowflake database platform between April and May 2024. The breach, detected in May, exposed personal information including names, contact details, birth dates, and gift card numbers (without PINs). The retailer has since disabled the compromised database, engaged cybersecurity experts, and notified law enforcement. The breach is linked to a broader series of Snowflake data theft attacks by a threat actor known as “Sp1d3r,” who attempted to sell Neiman Marcus’ data for $150,000 on a hacking forum. This attack, part of a campaign targeting at least 165 organizations, exploited stolen credentials from accounts lacking multi-factor authentication.

Crown Equipment Cyberattack Disrupts Manufacturing

Crown Equipment, a major forklift manufacturer, confirmed a cyberattack that disrupted its manufacturing operations since June 8, 2024. The attack, attributed to an “international cybercriminal organization,” led to the shutdown of IT systems, preventing employees from clocking hours, accessing service manuals, and delivering machinery. Initial reports suggest the breach resulted from a social engineering attack where an employee allowed unauthorized access. Despite earlier communications suggesting employees use PTO or file for unemployment, the company later decided to provide regular pay as an advance. Crown, working with cybersecurity experts and the FBI, emphasized that existing security measures limited data access and found no evidence of compromised employee personal information. While not explicitly confirmed, the attack likely involved ransomware, raising concerns about potential data theft and leakage. The company is gradually restoring systems and resuming normal operations.

Vulnerability in Hotel Check-In Terminals Exposes Guest Information

A vulnerability in Ariane Systems’ self-check-in terminals, used in hotels worldwide, exposed guests’ personal information and enables unauthorized access to room keys. These terminals handle bookings, payments, invoice printing, and RFID transponder provisioning for room access. In March, security researcher Martin Schobert from Pentagrid discovered that entering a single quote character in the reservations lookup screen caused the application to hang, granting access to the Windows desktop when touched again. This exposed guest details, reservation entries, and invoices, potentially allowing attacks on the hotel network or unauthorized room key creation. Despite multiple attempts to alert Ariane Systems, Schobert received minimal response, with the vendor briefly claiming the issues were fixed. Details about the firmware version addressing the flaw and the extent of vulnerable installations remain unclear. Hotel operators using these terminals are advised to isolate them from critical systems and contact the vendor to ensure they are running a secure version. This vulnerability highlights the importance of maintaining updated security measures to protect sensitive guest information.

Highlighting the Need for Vigilant Cybersecurity

The data breaches and vulnerabilities uncovered in June emphasize the critical importance of robust cybersecurity measures across all industries. From healthcare to retail, no sector is immune to cyber threats, and the impacts can be far-reaching. Companies must prioritize timely updates, comprehensive response strategies, and continuous monitoring to safeguard sensitive information and maintain operational integrity. These incidents serve as a stark reminder of the evolving nature of cyber threats and the necessity for constant vigilance and proactive security measures. By learning from these breaches, organizations can better protect themselves and their customers, ensuring a more secure digital landscape.

Supply Chain Risk Monitoring as a Service
Join us today
Supply Chain Risk Monitoring as a Service
Join us today

Let's Tackle Compliance Together

Waitlist signup

Welcome to Findings

Let's go over some details to setup your tailor-made account


Please fill your details below and click "Next" to create your account:

Payment

Feature
Startup
Business
Enterprise
Price
$10 / Month
$10 / Month
$25 / Month
VDPaaS
Alerts
Assessments
Integrated Apps
API
Join today and scan ALL YOUR VENDORS for FREE*
* FREE VENDOR SCAN for all of your vendors during your first month.
Feature
Startup
Business
Enterprise
Price
$25 / Month
$200 / Month*
Contact Us
Free vendors scan for 1 month
Findings search engine
Rapid security and compliance profile
Profile/showcase engagements per year
5
40
Unlimited
Multi/unlimited showcase use cases
Showcase compliance badge for your website
Best practice self-assessment
1 Findings or 1 BYOC
Assessment response automation
Personalizable, branded security & compliance showcase page
File/evidence repository
OKTA
DKIM
Out-of-the-box TPRM
20 vendors +
20 rating scans
50 vendors +
50 rating scans
Support
Email
Priority via Phone / Email
Internal Workflows (SO/BO)
Onboarding and customization account setup
*Price for every 40 engagements
Automate assessment response and showcase your cybersecurity posture
Supply Chain Risk Monitoring as a Service
Join us today
.
.
.
.

Thank you for signing up!

Supply Chain Risk Monitoring as a Service
Join us today
.
.
.
.

Thank you for signing up!