During the analysis of the Samsung Germany data breach, a wide range of sensitive information was found to be compromised, including customer names, addresses, email addresses, order history, and internal communications, among other sensitive data. Those findings were contained in a report released by cybersecurity firm Hudson Rock, which examined the breach and the reasons that led to it thoroughly.
Spectos GmbH, a third-party IT service provider, is believed to have been compromised in 2021 when an infostealer malware infection occurred on an employee's computer. Hudson Rock explains that this is an initial point of compromise dating back to 2021.
By using the domain samsung-shop.spectos.com, Spectos' software solutions for monitoring and improving service quality are directly integrated with Samsung Germany's customer service infrastructure.
It was found that access to Samsung Germany's systems was gained using credentials that had previously been compromised as a result of the Racoon Infostealer malware. It is well known that the specific strain of malware is capable of harvesting a large amount of sensitive data from infected machines, including usernames, passwords, browser cookies, and auto-fill information.
As it transpired, the credentials in this case came from the device of an employee of Spectos GmbH in 2021 that was stolen.
Although there were no security practices in place, such as the rotation of passwords or revocation protocols, the login information was valid and exploitable for nearly four years after the lapse occurred. Cybercriminals exploited outdated credentials and gained unauthorized access through this lapse, further emphasizing the ongoing risks posed by improperly managed third-party access in the future.
It was not until approximately four years after the login information was inactive, that it was exploited by a threat actor operating under the name "GHNA," which had remained inactive for nearly four years. Through the use of these long-abandoned credentials, the attacker gained access to a Spectos client-Samsung Germany-linked system resulting in approximately 270,000 customer service tickets becoming visible to the public and subsequently being leaked out.
In light of this incident, there are significant cybersecurity risks associated with third-party access to information. Thus, the importance of regular credential audits, access reviews, and robust identity management practices cannot be overstated. As a result of this breach, the investigation is ongoing, with a particular focus on determining the extent of the breach and implementing remedial measures to prevent similar incidents in the future.
A growing trend in cyberattacks is to exploit valid credentials which have been poorly managed by malicious actors, so that they may be able to infiltrate systems and escape detection. It is particularly concerning that the compromised credentials have been valid for such a long time in this case, suggesting that access governance and credential lifecycle management may not have been effective enough. Hudson Rock stated in their report that if proactive measures had been taken, “this incident would not have occurred.”
Because outdated credentials were still active after several years of inactivity, a serious lapse in security hygiene is evident.
A chance to mitigate this threat was missed, but the damage has been considerable because of the damage that has already been done. This incident serves as a cautionary example of how vital it is to regularly update login credentials, conduct access reviews, and implement strong practices to manage third parties' risks.
In his recent interview with Deepwatch's Chief Information Security Officer, Chad Cragle stressed the importance of protecting credentials from compromise, calling compromised credentials “a time bomb” that can be exploited at any moment if not addressed proactively.
The warning comes following the recent data breach involving Samsung Germany, which raised serious concerns about identity security and the ability to access third-party systems.
Experts in the industry are emphasizing the importance of implementing enhanced security controls, especially when it comes to managing external partner access to systems. It has become increasingly evident that organizations need to implement stricter oversight to mitigate the threat posed by outdated or exposed login credentials, which is evident in the ongoing investigation into the breach. Organizations need to develop more resilient frameworks to mitigate these threats.
With the rapid adoption of artificial intelligence-driven technologies and cloud infrastructure, the cybersecurity landscape continues to be compounded. While these technological advancements offer significant operational benefits, they also introduce complex vulnerabilities which cybercriminals are increasingly adept at exploiting to gain an advantage over their adversaries.
Specifically, the development of artificial intelligence has enabled threat actors to manipulate leaked data even more effectively, and this puts a greater burden on organizations to strengthen their security systems and safeguard customers' data.
In recent years, Samsung has been subjected to greater scrutiny when it comes to its cybersecurity posture.
A significant amount of attention was focused on Samsung in 2023 after the company accidentally leaked sensitive internal code by utilizing generative AI tools like ChatGPT. Such incidents demonstrate a persistent lack of security governance in Samsung and are an indication that the company needs to implement a more rigorous and forward-looking approach to data protection in the future.
A multi-layered security strategy is essential for businesses to prevent similar breaches from happening in the future, including regular credential audits, an identity access management system that is robust, continuous monitoring, and secure integration practices for third-party vendors. In his opinion, likely, Spectos GmbH did not have adequate monitoring mechanisms in place to identify anomalous activity that might have been linked to the compromised credentials, as indicated by Heath Renfrow, Co-Founder and Chief Information Security Officer of Fenix24.
Many organizations emphasize detecting external threats and suspicious behaviours when conducting risk assessments, but they often underestimate the risks associated with valid credentials that have been silently compromised, according to him. When credentials are associated with routine or administrative operations, such as service monitoring or quality management, unauthorized access can blend in with the expected activity and can be difficult to detect, since it blends in with what is expected.
It was pointed out by Renfrow that cybercriminals are often extremely patient and may even delay taking action until conditions are optimal.
It might be necessary to observe the network for changes in structure, evidence privileges over time, or even identify opportune moments—such as during broader security incidents—in which their actions are most likely to be noticed or will be of maximum impact.
The Samsung Germany support services are warning its customers to take extra care when receiving unsolicited messages, particularly if they have previously interacted with Samsung Germany's customer service.
Generally, security professionals recommend avoiding unfamiliar links, monitoring users' accounts for unusual activity, and following best practices to make sure their online safety is enhanced. These include using strong, unique passwords and enabling two-factor authentication.
This incident highlights a persistent weakness in cybersecurity strategy, which is not properly managing and rotating login credentials. In his remarks, Hudson Rock founder Alone Gal highlighted that organizations can avoid attacks of this kind when they follow a strong credential hygiene policy and monitor access to their systems continuously.
“Infostealers do not have to break down the doors,” Gal stated.
According to reports from the cybersecurity community, artificial intelligence could lead to an accelerated process of exploiting such breaches due to its potential to speed up the process. There are some tools which can be integrated into AI-driven systems that can be used to identify valuable data within leaked records, prioritize targets at high risk, and launch follow-up attacks more rapidly and accurately than ever before. This breach has over the last few weeks also brought the threat of freely circulating sensitive data being weaponized in a very short period, amplifying the threat for Samsung and its affected customers.
