In recent articles, we\u2019ve warned that people are the weakest link in your IT security<\/a>. We\u2019ve also warned that any business is a target. No one is immune.<\/strong><\/p>\n Tech companies like us are especially cautious because, in order to do our job, we have access not just to our data but also to our customers\u2019 data. That\u2019s why Kinetics has invested in an SOC2 compliant password vault (the highest levels of security), and we\u2019re tracking and auditing access to these. We will shortly be able to extend access to this same password vault to our KARE for Security client so you can have the same levels of security.\u00a0<\/strong><\/p>\n Even a huge corporate with extensive controls can be compromised.<\/strong> Microsoft recently got caught, (April 2019) when a Microsoft \u2018support agent\u2019 had their credentials compromised. Microsoft have advised<\/a> industry website ]\u2018TechCrunch\u201d<\/a>\u00a0that these were used for three months to gain access to customer information!<\/p>\n It seems that access was limited to the free email services they operate \u2013 MSN, Hotmail. Commercial tools like Office 365 were NOT compromised.<\/p>\n Microsoft reported:<\/p>\n \u201cMicrosoft recently became aware of an issue involving unauthorized access to some customers\u2019 web-based email accounts by cybercriminals.\u202fWe addressed this scheme by disabling the compromised credentials to the limited set of targeted accounts, while also blocking the perpetrators\u2019 access. A limited number of consumer accounts were impacted, and we have notified all impacted customers. Out of an abundance of caution, we also increased detection and monitoring to further protect affected accounts.\u201d<\/em><\/p>\n <\/p>\n If you use these accounts, we recommend you change your password \u2013 NOW!<\/strong><\/p>\n We know that Microsoft take these events seriously and they have extensive systems to protect data. This will be hugely embarrassing to them. We\u2019d just point out that it could have happened to anyone. Under new legislation like GDPR, they are now required to advise you if your data may have been impacted, so we\u2019re likely to see more transparency of these events.<\/p>\n We\u2019ve packaged up what we think are the new \u2018reasonable\u2019 steps and called it \u201cKARE for Security<\/a>\u201d.<\/strong>\u00a0<\/strong>A large number of our clients have taken this up, and they can take comfort \u2013<\/p>\n but it is vital that all staff are taking security seriously and taking up the training we offer.<\/p>\n Certainly, we think every business needs to consider, at a minimum:<\/p>\n Above all, protect your passwords.<\/strong> Make sure they are kept secret and not shared with anyone. Most hacks seem to come about from user-ids and passwords being compromised<\/strong>, so make sure you aren\u2019t the one.<\/p>\n Unfortunately, this list will grow and change as the hackers become even more sophisticated.<\/p>\n <\/p>\n For what\u2019s it\u2019s worth, the letter from Microsoft to affected users follows:<\/p>\n Dear Customer<\/em><\/p>\n Microsoft is committed to providing our customers with transparency. As part of maintaining this trust and commitment to you, we are informing you of a recent event that affected your Microsoft-managed email account.<\/em><\/p>\n We have identified that a Microsoft support agent\u2019s credentials were compromised, enabling individuals outside Microsoft to access information within your Microsoft email account. This unauthorized access could have allowed unauthorized parties to access and\/or view information related to your email account (such as your e-mail address, folder names, the subject lines of e-mails, and the names of other e-mail addresses you communicate with), but not the content of any e-mails or attachments, between January 1st<\/sup> 2019 and March 28th<\/sup> 2019.<\/em><\/p>\n Upon awareness of this issue, Microsoft immediately disabled the compromised credentials, prohibiting their use for any further unauthorized access. Our data indicates that account-related information (but not the content of any e-mails) could have been viewed, but Microsoft has no indication why that information was viewed or how it may have been used. As a result, you may receive phishing emails or other spam mails. You should be careful when receiving any e-mails from any misleading domain name, any e-mail that requests personal information or payment, or any unsolicited request from an untrusted source (you can read more about phishing attacks at https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/intelligence\/phishing).<\/em><\/p>\n It is important to note that your email login credentials were not directly impacted by this incident. However, out of caution, you should reset your password for your account.<\/em><\/p>\n If you require further assistance, or have any additional questions or concerns, please feel free to reach out to our Incident Response Team at ipg-ir@microsoft.com. If you are a citizen of European Union, you may also contact Microsoft\u2019s Data Protection Officer at:<\/em><\/p>\n EU Data Protection Officer Microsoft regrets any inconvenience caused by this issue. Please be assured that Microsoft takes data protection very seriously and has engaged its internal security and privacy teams in the investigation and resolution of the issue, as well as additional hardening of systems and processes to prevent such recurrence.<\/em>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" Guess who got hacked? In recent articles, we\u2019ve warned that people are the weakest link in your IT security. We\u2019ve also warned that any business is a target. No one is immune. Tech companies like us are especially cautious because, in order to do our job, we have access not just to our data but […]<\/p>\n","protected":false},"author":5,"featured_media":3492,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"[header2 text=\"Guess who got hacked?<\/strong>\" align=\"left\" color=\"#336A40\" margintop=\"\"]\n\nIn recent articles, we\u2019ve warned that [wow_colorme]people are the weakest link in your IT security<\/a>[\/wow_colorme]. We\u2019ve also warned that any business is a target. No one is immune.<\/strong>\n\nTech companies like us are especially cautious because, in order to do our job, we have access not just to our data but also to our customers\u2019 data. That\u2019s why Kinetics has invested in an SOC2 compliant password vault (the highest levels of security), and we\u2019re tracking and auditing access to these. We will shortly be able to extend access to this same password vault to our KARE for Security client so you can have the same levels of security.\u00a0<\/strong>\n\n[header2 text=\"Microsoft?!<\/strong>\" align=\"left\" color=\"#336A40\" margintop=\"\"]\n\nEven a huge corporate with extensive controls can be compromised.<\/strong> Microsoft recently got caught, (April 2019) when a Microsoft \u2018support agent\u2019 had their credentials compromised. [wow_colorme]Microsoft have advised<\/a>[\/wow_colorme] industry website [wow_colorme]\u2018TechCrunch\u201d<\/a>[\/wow_colorme] that these were used for three months to gain access to customer information!\n\nIt seems that access was limited to the free email services they operate \u2013 MSN, Hotmail. Commercial tools like Office 365 were NOT compromised.\n\n \u201cMicrosoft recently became aware of an issue involving unauthorized access to some customers\u2019 web-based email accounts by cybercriminals.\u202fWe addressed this scheme by disabling the compromised credentials to the limited set of targeted accounts, while also blocking the perpetrators\u2019 access. A limited number of consumer accounts were impacted, and we have notified all impacted customers. Out of an abundance of caution, we also increased detection and monitoring to further protect affected accounts.\u201d<\/em><\/p>\n[wow_spacing size=\"15px\"]\n\nIf you use these accounts, we recommend you change your password \u2013 NOW!<\/strong>\n\nWe know that Microsoft take these events seriously and they have extensive systems to protect data. This will be hugely embarrassing to them. We\u2019d just point out that it could have happened to anyone. Under new legislation like GDPR, they are now required to advise you if your data may have been impacted, so we\u2019re likely to see more transparency of these events.\n\n[header2 text=\"What should you do?<\/strong>\" align=\"left\" color=\"#336A40\" margintop=\"\"]\n\nWe\u2019ve packaged up what we think are the new \u2018reasonable\u2019 steps and called it [wow_colorme]\u201cKARE for Security<\/a>\u201d.<\/strong>[\/wow_colorme]\u00a0<\/strong>A large number of our clients have taken this up, and they can take comfort \u2013\n\nbut it is vital that all staff are taking security seriously and taking up the training we offer.\n\nCertainly, we think every business needs to consider, at a minimum:\nMicrosoft?!<\/strong><\/h2>\n
![\"\"](\"http:\/\/kinetics.co.nz\/wp-content\/uploads\/2019\/04\/philipp-katzenberger-1313574-unsplash.jpg\")
<\/p>\nWhat should you do?<\/strong><\/h2>\n
\n
\nMicrosoft Ireland Operations Ltd
\nOne Microsoft Place,
\nSouth County Business Park,
\nLeopardstown, Dublin 18, Ireland
\ndpoffice@microsoft.com<\/em><\/p>\n\n\nMicrosoft reported:\n\n \t