In September 2024, American Addiction Centers (AAC) experienced a significant cyberattack that exposed the personal and health-related information of 422,424 individuals. The breach involved sensitive data such as Social Security numbers and health insurance details, prompting AAC to take immediate action to address the situation and support those impacted.
The cyberattack occurred over three days, from September 23 to September 26, 2024. AAC identified the breach on September 26 and quickly launched an investigation. The organization engaged third-party cybersecurity experts and notified law enforcement to assess the extent of the attack. By October 3, investigators confirmed that unauthorized individuals had accessed and stolen data during the breach.
Data Compromised
The stolen information included:
AAC assured clients that no treatment information or payment card data was compromised during the incident. While the exposed data could be exploited for identity theft, the company emphasized that there is no evidence linking the breach to fraudulent activity at this time.
Response and Notifications
In December 2024, AAC began notifying affected individuals, with official letters sent out just before the holiday season. These notifications outlined the breach details, the steps AAC had taken to address the incident, and the measures implemented to prevent future occurrences.
To mitigate risks, AAC offered affected individuals complimentary credit monitoring services for 12 months. The organization partnered with Cyberscout, a TransUnion company, to provide identity protection services, including:
Affected individuals are encouraged to enroll in these services by March 31, 2025, to ensure their data remains protected.
Beyond immediate support, AAC implemented enhanced security protocols to strengthen its cybersecurity defenses. The organization collaborated with leading cybersecurity experts to fortify its systems and continues to review and update its measures regularly. Additionally, AAC established a dedicated hotline to assist individuals with inquiries and provide guidance on protective measures.
Proactive Recommendations
Although AAC has found no evidence of identity theft linked to the breach, it urged affected individuals to take the following proactive measures:
AAC’s notification letters include detailed instructions on these steps to help individuals safeguard their personal information against potential threats.
AAC emphasized its dedication to protecting personal information and maintaining transparency with its clients. “We regret that this incident occurred and the concern it may have caused,” the company stated. “We take the confidentiality and security of personal information very seriously and will continue to take steps to prevent a similar incident from occurring in the future.
As investigations into the incident continue, AAC remains focused on strengthening its cybersecurity measures and rebuilding client trust. For further information, individuals can contact AAC’s dedicated hotline at 1-833-833-2770, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern Time.
This incident highlights the importance of robust cybersecurity measures and proactive data protection strategies to safeguard sensitive information in the digital age.
A huge data security breach has come to light, with the data platform Builder.ai. It's a service that lets organizations build their own proprietary, custom software applications, which don't need heavy programming. According to a blog post by a security researcher, sensitive information from more than three million users' accounts was inadvertently leaked to the internet, leaving an open question of what now?
Jeremiah Fowler, a cybersecurity expert known for discovering unsecured online databases, found a Builder.ai archive with over 3 million records. This archive reportedly contained 1.29 terabytes of data, including very sensitive materials such as invoices, NDAs, email screenshots, and tax documents.
Worryingly, files contained access keys and configurations of two cloud storage systems. These keys, in the wrong hands, could grant hackers access to even more sensitive data.
What Was Exposed
The exposed database included the following:
337,434 invoices: The documents comprised transactions between Builder.ai and its clients.
32,810 master service agreements: Most agreements included user names, e-mail addresses, IP details and project estimations of the cost associated with a particular project giving a holistic overview of their sensitive information.
Such data left unprotected poses grave risks. This information could be used for phishing scams, identity theft, or even financial fraud by criminals. Phishing is the art of making people give up their personal information by claiming to be a trusted person. The presence of cloud storage keys in the database further increases the worry, as this may also open access to more sensitive files elsewhere.
Fowler quickly notified the company, Builder.ai. However, the company, in its defense, showed that it could not tighten the database security due to "complexities with dependent systems." It is already a month, and nobody knows if the problem persists.
Misconfigured databases are one of the constant problems of the digital era. Companies don't realize they have a shared responsibility to secure the data when it comes to cloud services, leaving large repositories of information exposed unintentionally.
For businesses, this is an important wake-up call regarding comprehensive cybersecurity practices- periodic checks and ensuring the databases are properly secured for users' data protection.
For users, vigilance is key. Anyone who's interacted with Builder.ai should keep an eye out on their accounts for anything weird and be on their toes for phishing scams.
And in this hyperconnected world, security breaches such as this remind us that vigilance is key, too, for companies as much as it is for their users.
A new report by cybersecurity firm Semperis reveals that ransomware gangs are increasingly launching attacks during weekends and holidays when organisations are less equipped to respond. The study found that 86 percent of ransomware incidents occurred during off-peak times as companies often scale back their security operations centre (SOC) staffing. While most organisations claim to run 24/7 SOCs, 85% admit to reducing staff by up to half on weekends and holidays, leaving critical systems more exposed. According to Dan Lattimer, an area vice president at Semperis, many organisations cannot afford the high cost of maintaining full SOC coverage each day. He noted, for example, that some organisations assume they are less exposed to risk during weekends because fewer employees are online to fall prey to phishing attacks. Others perceive their exposure being low because they have never had a threat in the past, further reducing the monitoring effort.
Why Cybercriminals Prefer Off-Peak Hours
Attackers leverage these openings to elevate the chances of their success. Performing attacks during weekends or holidays gives them a relatively longer timeframe to conduct an operation secretly so they can encrypt files and steal sensitive information with little hope of interfering soon. According to Lattimer, this tactic increases the chances of receiving ransom money because the organisations are willing to regain control at any critical downtime.
The report also showed that finance and manufacturing were among the most often targeted sectors, with 78 percent and 75 percent of organisations in the respective sectors reporting attacks on weekends or holidays. Furthermore, 63 percent of respondents said the ransomware related to major corporate events such as mergers or layoffs, which often cause additional diversion for IT teams.
Identity Security Lapses Continue
Another concerning result of the report is that too many companies feel too confident about their identity security. While 81% said to have sufficient defences against identity-related attacks, 83% experienced successful ransomware incidents in the past year. This discrepancy is largely due to lack of budget and resources to properly protect identity systems like AD, a part of core infrastructure.
Semperis noted that without proper funding for identity threat detection and response (ITDR), many organisations are leaving themselves open to attacks. Around 40% of companies either lacked the resources or were unsure about their ability to secure these systems.
Takeaway
SEMPERIS 2024 RANSOMWARE HOLIDAY RISK REPORT states that businesses must immediately address the vulnerability of weekends. Strengthening cybersecurity measures over holidays, investing in such robust identity protection, and maintaining consistent monitoring can help mitigate such growing risks for organisations. Cybercrime has become so dynamic, and hence organisations must adapt constantly to stay one step ahead.