Big Four accounting firm Deloitte, with $37B in annual revenues, found out that it had been hacked in March, and the hackers appear to have been inside its systems (supplied by Microsoft through its Azure cloud) since the previous October or March.
The hackers had access to up to 5 million sensitive company emails and documents from across all the sectors in which Deloitte operates, "the world’s biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies."
Deloitte kept the hack internally secret, only informing "a handful" of senior partners and lawyers, as well as six clients.
The Guardian has been told the internal inquiry into how this happened has been codenamed “Windham”. It has involved specialists trying to map out exactly where the hackers went by analysing the electronic trail of the searches that were made.
The team investigating the hack is understood to have been working out of the firm’s offices in Rosslyn, Virginia, where analysts have been reviewing potentially compromised documents for six months.
It has yet to establish whether a lone wolf, business rivals or state-sponsored hackers were responsible.
Sources said if the hackers had been unable to cover their tracks, it should be possible to see where they went and what they compromised by regenerating their queries. This kind of reverse-engineering is not foolproof, however.
A measure of Deloitte’s concern came on 27 April when it hired the US law firm Hogan Lovells on “special assignment” to review what it called “a possible cybersecurity incident”.
Deloitte hit by cyber-attack revealing clients’ secret emails
[Nick Hopkins/The Guardian]
Wired security reporter Andy Greenberg's latest book is Sandworm (previously), a true-life technothriller that tells the stories of the cybersecurity experts who analyzed and attributed as series of ghastly cyberwar attacks that brought down parts of the Ukrainian power grid, and then escaped the attackers' control and spread all over the world.
Daniel Moghimi, Berk Sunar, Thomas Eisenbarth and Nadia Heninger have published TPM-FAIL: TPM meets Timing and Lattice Attacks, their Usenix security paper, which reveals a pair of timing attacks against trusted computing chips ("Trusted Computing Modules" or TPMs), the widely deployed cryptographic co-processors used for a variety of mission-critical secure computing tasks, from verifying software […]
The privacy-focused web browser Brave has finally launched a 1.0 version, bringing it officially out of beta.
WordPress is a fantastic tool for building web pages – if you know how to use it. Even with all the accessibility, a lot of the deeper features of WordPress are lost in translation to the average user. Enter WP Page Builder, a tool that not only makes WordPress site design easy but also more […]
In this age of ever-shrinking gadgets, it bears reminding that sometimes bigger is actually better. And if you care about audio quality, we can’t think of a better example of this principle than these TREBLAB Z2 Bluetooth 5.0 Noise-Cancelling Headphones. We know tiny Bluetooth earbuds are all the rage right now. But their battery life […]
In this Instagram age, pictures aren’t just worth a thousand words; they can be worth a pretty penny, too, which makes graphic designers a highly sought-after profession. But being a graphic artist takes more than just the ability to draw a picture, and certainly more than the ability to navigate through Photoshop. The School of […]