ReportWire

Tag: Malware

  • North Korean hackers extorted health care organizations to fund further cyberattacks, US and South Korea say | CNN Politics

    North Korean hackers extorted health care organizations to fund further cyberattacks, US and South Korea say | CNN Politics

    [ad_1]


    Washington
    CNN
     — 

    North Korean government-backed hackers have conducted ransomware attacks on health care providers and other key sectors in the US and South Korea and used the proceeds to fund further cyberattacks on government agencies in Washington and Seoul, US and South Korean officials warned Thursday.

    Some of those follow-on hacks have specifically targeted Pentagon networks and US defense contractors, according to the advisory from US and South Korean intelligence and security agencies.

    It’s the latest in a drumbeat of warnings from US officials that North Korea is adopting cybercriminal tactics to fund dictator Kim Jong Un’s ambitions, including the regime’s pursuit of nuclear weapons.

    The statement from the US Federal Bureau of Investigation, US National Security Agency, South Korean National Intelligence Service and others does not mention Kim’s weapons programs, but US officials have previously warned that a portion of the money Pyongyang steals through hacking can go to weapons development.

    North Korea’s use of stolen cryptocurrency to fund its weapons programs is part of the regular set of intelligence products presented to President Joe Biden, a senior administration official told CNN this week.

    “They need money, so they’re going to keep being creative,” the official said. “I don’t think the North Koreans are ever going to stop looking for illicit ways to glean funds because it’s an authoritarian regime … under heavy sanctions.”

    The news comes as North Korea displayed nearly a dozen advanced intercontinental ballistic missiles at a nighttime military parade on Wednesday.

    The new US-South Korea advisory did not identify hospitals that the North Korean hackers had allegedly victimized. The Justice Department has previously accused Pyongyang-backed hackers of hitting a medical center in Kansas in 2021, encrypting computer systems the facility relied on to operate key equipment, and another medical provider in Colorado.

    The advisory follows a similar warning from US agencies in July that North Korean hackers had used ransomware to disrupt services at health organizations for “prolonged periods.”

    In the statement released Thursday, US and South Korean officials accused North Korean hackers of taking pains to try to hide their identities – even posing as a notorious Russian ransomware gang. The North Koreans are also emulating non-state criminals in dumping online the private data of victims who do not pay, officials said.

    The hackers have used a popular software used in small and medium-sized hospitals in South Korea to spread their malicious code with the aim of locking up computers, according to the advisory.

    In addition to hacking, suspected North Koreans have posed as other nationalities to apply for work at IT firms and send money back to Pyongyang, US agencies have publicly warned. A CNN investigation found at least one cryptocurrency entrepreneur who unwittingly paid a North Korean tech worker tens of thousands of dollars.

    [ad_2]

    Source link

  • Apparent cyberattack forces Florida hospital system to divert some emergency patients to other facilities | CNN Politics

    Apparent cyberattack forces Florida hospital system to divert some emergency patients to other facilities | CNN Politics

    [ad_1]



    CNN
     — 

    An apparent cyberattack has forced a network of Florida health care organizations to send some emergency patients to other facilities and to cancel some non-emergency surgeries, the health care network said Friday.

    Tallahassee Memorial HealthCare, which operates a 772-bed hospital and multiple specialty care centers, said an “IT security issue” late Thursday night forced it to take down its computer system.

    “We are also diverting EMS [emergency medical services] patients and will only be accepting Level 1 traumas from our immediate service area,” the hospital system said in a statement. Level 1 trauma refers to the most acute injuries and illnesses.

    Tallahassee Memorial HealthCare spokesperson Tori Lynn Schneider told CNN “some” emergency patients were being diverted to facilities outside of the organization’s network, but declined to say how many patients. All non-emergency and elective procedures scheduled for Monday were canceled because of the hacking incident, Schneider said.

    It’s the latest in a series of cyberattacks that have continued to hit resource-strapped US health care providers in the nearly three years of the Covid-19 pandemic. In another case, hackers accessed the personal data of nearly 270,000 patients in an attempted ransomware attack on a Louisiana health care system in October.

    The FBI last month shut down the computer infrastructure used by a notorious ransomware gang to attack multiple US hospitals, according to the bureau. But the threat remains as multiple ransomware groups are known to target the health sector.

    It’s unclear who was responsible for the apparent hack of Tallahassee Memorial. Tallahassee Memorial did not specify whether it had suffered a ransomware attack, but the organization’s statement described activity, including the need to shut down computer networks, consistent with a ransomware attack.

    Staff have been unable to access digital patient records and lab results because of the shutdown, a hospital source told CNN.

    Mark O’Bryant, Tallahassee Memorial’s CEO, notified staff in person Friday morning that the system had suffered a “cyberattack,” according to the source.

    “To help us contain the issue, please completely turn off all PCs connected to TMH’s network immediately and leave them off until notified otherwise,” Tallahassee Memorial leadership said in a memo sent to employees Friday morning and obtained by CNN.

    Max Henderson, a Tallahassee native and cybersecurity specialist who focuses on health care, said the effects of a shutting down a hospital’s computer network can last for weeks or months.

    “Immediate, unplanned shutdowns can lead to a loss of recently gathered data regarding diagnosis, clinical notes, shift handovers and other various setbacks for the medical staff,” Henderson, who is senior manager for incident response at security firm Pondurance, told CNN.

    “Nearly all hospitals rely on the internet for connectivity with vendors and remote offices for processing information in critical departments such as radiology, pharmacy, medical device maintenance, patient document scanning and payment processing,” Henderson added.

    [ad_2]

    Source link

  • Ransomware attack closes schools in Nantucket | CNN Politics

    Ransomware attack closes schools in Nantucket | CNN Politics

    [ad_1]



    CNN
     — 

    A ransomware attack forced the closure Tuesday of four public schools serving 1,700 students on the island of Nantucket, Massachusetts, the school district’s superintendent said in an email to parents.

    The hacking incident shut down all student and staff devices, as well as safety and security systems at Nantucket Public Schools, forcing an early dismissal at noon on Tuesday, Superintendent Elizabeth Hallett said in the email, which she shared with CNN.

    The news came as Tucson Unified School District (TUSD), which calls itself the largest pre-K-12 school district in southern Arizona, also suffered a ransomware attack in recent days, according to local news reports. Representatives of TUSD did not respond to emails seeking comment. There was no evidence that the two incidents were related.

    Ransomware – malicious software that locks computers and holds them for ransom – has for years plagued US schools and other organizations that can be short on money and personnel to defend themselves from hacks.

    The hacks often force schools to temporarily close, further disrupting learning during the coronavirus pandemic. The lack of cybersecurity budgeting at primary schools is a “major constraint to implementing effective cybersecurity programs across all K–12 entities,” the federal US Cybersecurity and Infrastructure Security Agency warned in a report this month.

    Nantucket Public Schools includes an elementary, middle and high school, and serves Nantucket, which is about 30 miles south of Cape Cod, Massachusetts.

    Athletic events at the school were still scheduled to proceed. “No school issued devices should be used at home until further notice, as it could compromise home networks,” Hallett said in her email to parents.

    “We do not have any updates yet on when we will return,” Hallett told CNN in a separate email.

    There have already been five ransomware attacks on US school districts in January, according to a tally from Brett Callow, threat analysts at cybersecurity firm Emsisoft. Forty-five US school districts operating 1,981 schools were hit by ransomware in 2022, according to Emsisoft.

    A year ago, New Mexico’s largest public school district had to close temporarily after a cyberattack hit computer systems that could affect learning and student safety.

    “The ransomware attacks on school districts across the country are a stark reminder that as a country we need to ensure our citizens are cyber literate,” Kevin Nolten, vice president of Cyber Innovation Center, a not-for-profit supported by federal grant money that promotes cybersecurity curricula in K-12 schools, told CNN.

    “Cybersecurity education is a national security issue and we must educate our country on protecting our most critical infrastructure from malicious attacks,” Nolten said in an email pointing to the high demand for cybersecurity skills in the workforce.

    [ad_2]

    Source link

  • New US ransomware strategy prioritizes victims but could make it harder to catch cybercriminals | CNN Politics

    New US ransomware strategy prioritizes victims but could make it harder to catch cybercriminals | CNN Politics

    [ad_1]


    Washington
    CNN
     — 

    US and European law enforcement’s disruption last week of a $100-million ransomware gang is the clearest public example yet of a new high-stakes strategy from the Biden administration to prioritize protecting victims of cybercrime – even if it means tipping off suspects and potentially make it harder to arrest them.

    The extent to which the FBI and Justice Department can carry out similar operations on other ransomware groups – and get the balance right between when to collect intelligence on hackers’ operations and when to shut down computer networks – could affect how acute the threat of ransomware attacks is to US critical infrastructure for years to come.

    In the case revealed last week, the FBI says it had extraordinary access for six months to the computer infrastructure of a Russian-speaking ransomware group known as Hive, which had extorted more than $100 million from victims worldwide, including hospitals. That covert access, officials said, allowed the FBI to pass “keys” to victims so that they could decrypt their systems and thwart $130 million in ransom payments.

    Justice officials are still trying to arrest the people behind Hive and know where some of them are located, a senior Justice Department official told CNN. But sometimes waiting for an arrest before seizing hacking infrastructure “may mean waiting for a very long time – perhaps an unacceptably long time,” the official said in an interview granted on the condition of anonymity to discuss the case.

    The decision to go public with a splashy news conference, fronted by FBI Director Christopher Wray and Attorney General Merrick Garland, before making any arrests is evidence of a new approach to ransomware attacks which cost the US hundreds of millions of dollars, if not billions, annually.

    The strategy shift toward doing more to help victims of cybercrime – announced a year ago – is loosely based on the US government’s approach to counterterrorism, which centers around disrupting plots and thwarting attacks.

    “I was preparing for this to be public long, long ago and was kind of surprised that we were able to do this for this long,” the senior Justice Department official said of US officials’ covert access to Hive computer servers.

    After multiple ransomware attacks hobbled US critical infrastructure firms in 2021, pressure grew on US law enforcement from Congress, the White House and the public to do more to disrupt the hackers’ operations.

    Still, the FBI announcement raised questions about why the bureau decided to go public with the action now rather than continuing to lurk in the Hive hackers’ networks and collect intelligence. And it is possible or even likely, US officials concede, that Hive’s operators will set up new infrastructure to try to resume their extortion attempts.

    One law enforcement source told CNN the timing made sense because US officials may have exhausted the intelligence they were going to glean from Hive’s servers.

    The senior Justice Department official explained the decision this way: “We saw significant value in the reputational damage we were going to incur against Hive by announcing this.”

    Like in other businesses, customers of ransomware gangs have a choice of who they buy hacking tools from. One goal of the operation, the senior Justice official said, was to “discredit” Hive in the eyes of other ransomware criminals and have a psychological effect on their operations.

    “Other [ransomware] groups will watch this and have to spend more time and money securing their infrastructure,” said Bill Siegel, CEO of Coveware, a cybersecurity firm that works closely with victims and the FBI.

    The spate of significant ransomware attacks in the US in 2021 brought more scrutiny to how quickly the FBI and its partners can mitigate the impact the attacks.

    After a July 2021 ransomware attack on a Florida-based software firm compromised up to 1,500 businesses, multiple US government agencies, including the FBI, deliberated about how and when to get the decryptor to victims. At least one victim organization, a Maryland tech firm, complained that they could have used the decryption key earlier to save on recovery costs, the Washington Post reported.

    US officials weigh a number of factors when considering law enforcement operations to disrupt cybercriminal groups, a senior FBI official told CNN, including how the disruption will impact the broader cybercriminal ecosystem, how the FBI can help victims of the hackers recover, and the long-term “pursuit of justice” for the victims.

    “Each case is different as far as what access [to the hackers’ infrastructure] looks like … what can be done quietly versus noisily,” the senior FBI official said. “Those all go into it.”

    John Riggi, a former senior FBI official who is now national adviser for cybersecurity and risk at the American Hospital Association, applauded the disruption of Hive and hoped the crackdown on ransomware groups would continue. But ransomware attacks on health care organizations will likely continue as long as the hackers are getting paid off and are willing to tolerate the risk of carrying out the attacks, Riggi said.

    Some cybercriminals “still view their attacks on hospitals as primarily data and financially motivated,” he told CNN.

    One lingering problem for the FBI: Not enough victims are reporting ransomware attacks, leaving the bureau in the dark about the scope of the threat. Just 20% of Hive’s victim reported an incident to the FBI, Director Christopher Wray said last week.

    “I still think that people have concerns that when they call the FBI that we’re going to come in with coats and we’re going to take their servers and they’re going to lose control of their business,” the senior FBI official told CNN. “And that’s so far from the truth, but most people are not interacting with the FBI on a daily basis.”

    [ad_2]

    Source link

  • Hackers stole data from multiple electric utilities in recent ransomware attack | CNN Politics

    Hackers stole data from multiple electric utilities in recent ransomware attack | CNN Politics

    [ad_1]



    CNN
     — 

    Hackers stole data belonging to multiple electric utilities in an October ransomware attack on a US government contractor that handles critical infrastructure projects across the country, according to a memo describing the hack obtained by CNN.

    Federal officials have closely monitored the incident for any potential broader impact on the US power sector while private investigators have combed the dark web for the stolen data, according to the memo sent this month to power company executives by the North American grid regulator’s cyberthreat sharing center.

    The previously unreported incident is a window into how ransomware attacks on critical US companies are handled behind the scenes as lawyers and federal investigators quietly spring into action to determine the extent of the damage.

    The ransomware attack hit Chicago-based Sargent & Lundy, an engineering firm that has designed more than 900 power stations and thousands of miles of power systems and that holds sensitive data on those projects.

    The firm also handles nuclear security issues, working with the departments of Defense, Energy and other agencies “to strengthen nuclear deterrence” and keep weapons of mass destruction out of terrorists’ hands, according to its website.

    Two people familiar with the investigation of the Sargent & Lundy hack told CNN that the incident was contained and remediated, and didn’t appear to have a broader impact on other power-sector firms.

    There is no sign that data stolen from Sargent & Lundy, which includes “model files” and “transmission data” the firm uses for utility projects, is on the dark web, according to the memo from the Electricity Information Sharing and Analysis Center.

    But security experts have long been concerned that schematics held by electric and nuclear power contractors could be dumped online and used for follow-on physical or cyberattacks on those facilities.

    “These are literally the configurations for your programmable logic controllers, your relays,” said longtime security consultant Patrick Miller, referring to critical electric equipment that keeps the lights on. “We’re really concerned about the data that’s in those organizations.”

    Those concerns are particularly acute following a spate of physical attacks and vandalism at electric utilities in multiple states. Tens of thousands of people lost power in Moore County, North Carolina, this month after Duke Energy substations were damaged by gunfire. On Christmas, thousands of people lost power in a Washington county after someone vandalized multiple substations there.

    “We’re fully recovered from the incident, which had minimal impact on our normal business operations,” Brenda Romero, a spokesperson for Sargent & Lundy, said in a statement to CNN. Romero said the firm “notified law enforcement” of the hack.

    Romero declined to answer further questions on the ransomware attack, including whether the hackers had tried to extort Sargent & Lundy, citing an ongoing investigation.

    The Biden administration has urged companies to share data on such hacks as US officials have tried to get a grip on the epidemic of ransomware, which has cost critical infrastructure firms many millions of dollars.

    The hackers that hit Sargent & Lundy used a strain of ransomware known as Black Basta that first surfaced early this year, according to two people familiar with the investigation. Scores of Black Basta attacks have been reported since April, according to cybersecurity firm Palo Alto Networks. The hackers steal data from their victims to give them added leverage in ransom negotiations.

    Sargent & Lundy is one of several engineering firms whose work on critical infrastructure projects cuts across different sectors of the economy. For US cybersecurity officials, this engineering work can be harder to evaluate in terms of its risk to supply chain security than a firm that only makes software.

    Federal regulations require electric utilities to maintain certain cybersecurity standards for protecting their systems from hacks. Companies that contract with those utilities, such as Sargent & Lundy, aren’t necessarily held to the same standard and are instead bound by the security requirements in the contract, experts told CNN.

    “Utilities are effectively allowed to accept as much risk as they want,” said Miller, who is CEO of Oregon-based Ampere Industrial Security, a consulting firm. “Is it perfect? No, but [the contractors] are being assessed [for their security] in some ways through the utilities.”

    [ad_2]

    Source link

  • Australia blames cyber criminals in Russia for Medibank data breach | CNN Business

    Australia blames cyber criminals in Russia for Medibank data breach | CNN Business

    [ad_1]


    Brisbane, Australia
    CNN
     — 

    Cyber criminals in Russia are behind a ransomware attack on one of Australia’s largest private health insurers that’s seen sensitive personal data published to the dark web, the Australian Federal Police (AFP) said Friday.

    In a short press conference, AFP Commissioner Reece Kershaw told reporters investigators know the identity of the individuals responsible for the attack on health insurer Medibank, but he declined to name them.

    “The AFP is undertaking covert measures and working around the clock with our domestic agencies and international networks including Interpol. This is important because we believe those responsible for the breach are in Russia,” he said.

    Medibank says the stolen data belongs to 9.7 million past and present customers, including 1.8 million international customers. The files include health claims data for almost half a million people, including 20,000 based overseas.

    This week, the group started releasing curated tranches of customer data onto the dark web, in files with titles including good-list, naughty-list, abortions and boozy, which included those who sought help for alcohol dependency.

    Kershaw said police intelligence points to a “group of loosely affiliated cyber criminals” who are likely responsible for previous significant data breaches around the world, without naming specific examples.

    “These cyber criminals are operating like a business with affiliates and associates who are supporting the business. We also believe some affiliates may be in other countries,” said Kershaw, who declined to take questions due to the sensitivity of the investigation.

    Cyber security experts have said the criminals are likely linked to REvil, a Russian ransomware gang notorious for large attacks on targets in the United States and elsewhere, including major international meat supplier JBS Foods last June.

    That breach shut down the company’s entire US beef processing operation and prompted the company to pay an $11 million ransom. Last November, the US State Department offered a $10 million reward for information leading to the identification or location of key leaders of REvil, also known as the Sodinokibi organized crime group.

    In mid-January, Russian state news agency TASS reported that at least eight REvil ransomware hackers had been detained by Russia’s Federal Security Service (FSB) at the request of the US.

    They were facing charges of committing “illegal circulation of payments,” a crime punishable by up to seven years in prison, TASS reported, citing Moscow’s Tverskoi Court.

    In March, Ukrainian national Yaroslav Vasinskyi, one of the chief suspects linked to an attack on US software vendor, Kaseya, was extradited from Poland to the US to face charges, according to a statement from the Justice Department.

    Jeffrey Foster, associate professor in cyber security studies at Macquarie University, said there’s one major link between the REvil network and the group suspected of hacking the Medibank network.

    “The biggest link is that the REvil dark web website now redirects to this website. So that’s the biggest link we have between them, and the only link we have between them,” said Foster, who is monitoring the blog where the group is posting their demands.

    “As Russia has stated that they’ve arrested and disbanded REvil, it seems likely this is a case of maybe a former REvil member, who had access to the dark web website to be able to do the redirect which requires access to the hardware,” he said. “Whether or not REvil has returned, we don’t know.”

    Medibank first detected unusual activity in its network almost a month ago. On October 20, the company issued a statement saying a “criminal” had stolen information from its ahm health insurance and international student systems, including names, addresses, phone numbers and some claims data for procedures and diagnoses.

    An initial ransom demand was made for $10 million (15 million Australian dollars), but the company said after extensive consultation with cybercrime experts it had decided not to pay. It was later lowered to $9.7 million – one for every customer affected, according to Foster.

    At the time, Medibank said there was only a “limited chance” that paying the ransom would stop the data being published or returned to the company.

    In his statement on Friday, Kershaw, the AFP Commissioner, said Australian government policy did not condone paying ransoms to cyber criminals.

    “Any ransom payment small or large fuels the cybercrime business model, putting other Australians at risk,” he said.

    Kershaw said investigators at the Australian Interpol National Central Bureau would be talking with their Russian counterparts about the individuals, who he addressed directly with a threat to see them charged in Australia.

    “To the criminals, we know who you are. And moreover, the AFP has some significant runs on the scoreboard when it comes to bringing overseas offenders back to Australia to face the justice system,” he said.

    Earlier Friday, Australian Prime Minister Anthony Albanese said he was “disgusted” by the attacks and, without naming Russia, said the government of the country they come from should be held accountable.

    “The nation where these attacks are coming from should also be held accountable for the disgusting attacks, and the release of information including very private and personal information,” Albanese said.

    In a statement Friday, Medibank CEO David Koczkar said it was clear the criminal gang behind the breach was “enjoying the notoriety,” and it was likely they would release more information each day.

    “The relentless nature of this tactic being used by the criminal is designed to cause distress and harm,” he said. “These are real people behind this data and the misuse of their data is deplorable and may discourage them from seeking medical care.”

    [ad_2]

    Source link

  • In drawn-out recovery, NYC inches out from COVID’s shadow

    In drawn-out recovery, NYC inches out from COVID’s shadow

    [ad_1]

    NEW YORK — As kids returned to school last month, people watching New York City pull itself out of COVID-19’s shadow wondered whether workers who fled Manhattan’s office towers during the pandemic would finally return in a rush, too.

    More workers did return to their offices, at least part time, as the summer ended, limited data suggests. But the onset of autumn has also made it clearer than ever that the recovery will be drawn out, and that some aspects of the city’s economic ecosystem could be changed for good.

    “We’re certainly entered a changed relationship between office workers and their offices,” said James Parrott, director of Economic and Fiscal Policies at the Center for New York City Affairs at The New School.

    That’s meant hardship for New Yorkers who are part of the economy built around the commuting class.

    They are the workers whose livelihoods can’t happen over an internet connection, who have depended on that serendipity of a customer being in the right place at the right time — the sudden impulse to buy a snack, pop into a store, throw some dollars into a street performer’s tip bucket.

    They’re people like Emad Ahmed, 58, who for more than two decades has worked in lower Manhattan, running his food cart on a plaza near Wall Street and the World Trade Center.

    The pandemic forced a pause, but as soon as he was able, Ahmed came back — and really wishes he could say the same for all the workers he relied on as customers, many of them still working at home and coming into Manhattan only a few days a week, at most.

    “The pandemic (is) almost done, nobody uses a mask now, and you can go to the subway and the bus without masks, and people still don’t come,” he said. It’s “absolutely not like before.”

    Some had looked to the Labor Day as a possible catalyst, a transition back to the way things were, and indeed, some data has shown momentum since then, including office occupancy in the metro area getting closer to the halfway mark.

    Subway ridership is on an upswing, as well, with one day last week reaching almost 3.9 million riders. While that’s only about 64% of a comparable day pre-pandemic, the weekday totals have been inching up overall since the holiday.

    A survey of Manhattan companies put out by the Partnership for New York City last month found that on an average day, just under half of Manhattan office workers were in their offices as of the beginning of September.

    But when it comes to being back in the office full time, only 9% of workers were, with the largest group, 37%, in for three days a week. Sixteen percent of workers were still completely remote.

    Looking ahead through the rest of the year to the beginning of 2023, the survey didn’t show those numbers changing drastically, despite city government and corporate leaders urging workers to come back.

    “People have gotten used to the flexibility and the benefits of not having to commute to the office every day,” said Kathryn Wilde, president and CEO of the partnership. “They’re going to have to have good reasons to go back.”

    Remote work has brought an upswing in jobs and liveliness to some neighborhoods in the outer boroughs, as people staying close to home have brought their coffee and other daily needs to their local outlets.

    But that hasn’t made up for what’s been lost, said Jonathan Bowles, executive director of the Center for an Urban Future, a public policy think tank.

    “In some ways, it’s almost miraculous how much the city’s economy has recovered since the depths of March 2020,” Bowles said.

    New York City lost more than 970,000 jobs when the pandemic hit; as of August, just about 810,000 had come back, about 84%.

    “But there are still really large pockets, particularly around the central business districts where entrepreneurs and small businesses are struggling left and right … seeing a fraction of their previous customers,” Bowles said.

    Ahmed is among them. On his best days, midweek, he sees maybe 60% of what he would have before the pandemic. On the worst, even getting to 10-15% can be a challenge.

    For some dependent on office life, the partial return has been enough. Denis Johnston, executive vice president of 32BJ Service Employees International Union, said almost all of the commercial office space cleaners represented by the union are back at work.

    Whether companies have some or all of their employees back on a given day, the spaces need to be cleaned and maintained, so his members are needed, he said.

    Some, like taxi driver Sukhdarshan Singh, have learned to adjust. While there are fewer commuters, he’s finding fares at other times.

    “Office people are not back, but evenings and weekends, people are out,” said Singh, a cabbie for about 35 years.

    But other sectors are suffering. Among retail outlets, food and beverage stores have seen only about 66% of jobs come back, while clothing stores have seen about 62%, according to the New York City Independent Budget Office.

    If office workers are “not in the city, they’re not shopping in the city,” said Stuart Appelbaum, president of the Retail, Wholesale and Department Store Union.

    “Stores are operating with fewer people because there are fewer customers,” he said.

    The city’s unemployment rate was 6.6% in August, significantly higher than the national rate of 3.7%.

    Office workers being slow to go back is “absolutely going to impact the bottom line for tons of … vendors, people that operate food trucks and so many more businesses that are really dependent on office workers providing a big chunk of their sales,” Bowles said.

    “There are just going to be fewer of those chance encounters, where people pick up something to eat or drink or to bring home during their lunch hour, on their way to work and on the way home,” Bowles said. “And that’s a surprisingly huge part of the Manhattan economy.”

    Ahmed worries about his own future, especially as winter approaches. Even prior to the pandemic, the cold weather was slow for business, and now he worries it will be a financial deep freeze.

    He just holds out hope that the city streets will come back to the life they had before.

    “Nothing else can help me,” he said. “Without people? That’s it.”

    [ad_2]

    Source link

  • In drawn-out recovery, NYC inches out from COVID’s shadow

    In drawn-out recovery, NYC inches out from COVID’s shadow

    [ad_1]

    NEW YORK — As kids returned to school last month, people watching New York City pull itself out of COVID-19’s shadow wondered whether workers who fled Manhattan’s office towers during the pandemic would finally return in a rush, too.

    More workers did return to their offices, at least part time, as the summer ended, limited data suggests. But the onset of autumn has also made it clearer than ever that the recovery will be drawn out, and that some aspects of the city’s economic ecosystem could be changed for good.

    “We’re certainly entered a changed relationship between office workers and their offices,” said James Parrott, director of Economic and Fiscal Policies at the Center for New York City Affairs at The New School.

    That’s meant hardship for New Yorkers who are part of the economy built around the commuting class.

    They are the workers whose livelihoods can’t happen over an internet connection, who have depended on that serendipity of a customer being in the right place at the right time — the sudden impulse to buy a snack, pop into a store, throw some dollars into a street performer’s tip bucket.

    They’re people like Emad Ahmed, 58, who for more than two decades has worked in lower Manhattan, running his food cart on a plaza near Wall Street and the World Trade Center.

    The pandemic forced a pause, but as soon as he was able, Ahmed came back — and really wishes he could say the same for all the workers he relied on as customers, many of them still working at home and coming into Manhattan only a few days a week, at most.

    “The pandemic (is) almost done, nobody uses a mask now, and you can go to the subway and the bus without masks, and people still don’t come,” he said. It’s “absolutely not like before.”

    Some had looked to the Labor Day as a possible catalyst, a transition back to the way things were, and indeed, some data has shown momentum since then, including office occupancy in the metro area getting closer to the halfway mark.

    Subway ridership is on an upswing, as well, with one day last week reaching almost 3.9 million riders. While that’s only about 64% of a comparable day pre-pandemic, the weekday totals have been inching up overall since the holiday.

    A survey of Manhattan companies put out by the Partnership for New York City last month found that on an average day, just under half of Manhattan office workers were in their offices as of the beginning of September.

    But when it comes to being back in the office full time, only 9% of workers were, with the largest group, 37%, in for three days a week. Sixteen percent of workers were still completely remote.

    Looking ahead through the rest of the year to the beginning of 2023, the survey didn’t show those numbers changing drastically, despite city government and corporate leaders urging workers to come back.

    “People have gotten used to the flexibility and the benefits of not having to commute to the office every day,” said Kathryn Wilde, president and CEO of the partnership. “They’re going to have to have good reasons to go back.”

    Remote work has brought an upswing in jobs and liveliness to some neighborhoods in the outer boroughs, as people staying close to home have brought their coffee and other daily needs to their local outlets.

    But that hasn’t made up for what’s been lost, said Jonathan Bowles, executive director of the Center for an Urban Future, a public policy think tank.

    “In some ways, it’s almost miraculous how much the city’s economy has recovered since the depths of March 2020,” Bowles said.

    New York City lost more than 970,000 jobs when the pandemic hit; as of August, just about 810,000 had come back, about 84%.

    “But there are still really large pockets, particularly around the central business districts where entrepreneurs and small businesses are struggling left and right … seeing a fraction of their previous customers,” Bowles said.

    Ahmed is among them. On his best days, midweek, he sees maybe 60% of what he would have before the pandemic. On the worst, even getting to 10-15% can be a challenge.

    For some dependent on office life, the partial return has been enough. Denis Johnston, executive vice president of 32BJ Service Employees International Union, said almost all of the commercial office space cleaners represented by the union are back at work.

    Whether companies have some or all of their employees back on a given day, the spaces need to be cleaned and maintained, so his members are needed, he said.

    Some, like taxi driver Sukhdarshan Singh, have learned to adjust. While there are fewer commuters, he’s finding fares at other times.

    “Office people are not back, but evenings and weekends, people are out,” said Singh, a cabbie for about 35 years.

    But other sectors are suffering. Among retail outlets, food and beverage stores have seen only about 66% of jobs come back, while clothing stores have seen about 62%, according to the New York City Independent Budget Office.

    If office workers are “not in the city, they’re not shopping in the city,” said Stuart Appelbaum, president of the Retail, Wholesale and Department Store Union.

    “Stores are operating with fewer people because there are fewer customers,” he said.

    The city’s unemployment rate was 6.6% in August, significantly higher than the national rate of 3.7%.

    Office workers being slow to go back is “absolutely going to impact the bottom line for tons of … vendors, people that operate food trucks and so many more businesses that are really dependent on office workers providing a big chunk of their sales,” Bowles said.

    “There are just going to be fewer of those chance encounters, where people pick up something to eat or drink or to bring home during their lunch hour, on their way to work and on the way home,” Bowles said. “And that’s a surprisingly huge part of the Manhattan economy.”

    Ahmed worries about his own future, especially as winter approaches. Even prior to the pandemic, the cold weather was slow for business, and now he worries it will be a financial deep freeze.

    He just holds out hope that the city streets will come back to the life they had before.

    “Nothing else can help me,” he said. “Without people? That’s it.”

    [ad_2]

    Source link

  • Russian-speaking cyber gang claims credit for hack of BBC and British Airways employee data | CNN Business

    Russian-speaking cyber gang claims credit for hack of BBC and British Airways employee data | CNN Business

    [ad_1]



    CNN
     — 

    A group of Russian-speaking cyber criminals has claimed credit for a sweeping hack that has compromised employee data at the BBC and British Airways and left US and UK cybersecurity officials scrambling to respond.

    The hackers, known as the CLOP ransomware gang, say they have “information on hundreds of companies.” They’ve given victims until June 14 to discuss a ransom before they start publishing data from companies they claim to have hacked, according to a dark web posting seen by CNN.

    The extortion threat adds urgency to an already high-stakes security incident that has forced responses from tech firms, corporations and government agencies from the US to Canada and the UK.

    The compromise of employee data at the BBC and British Airways came via a breach of a human resources firm, Zellis, that both organizations use.

    “We are aware of a data breach at our third-party supplier, Zellis, and are working closely with them as they urgently investigate the extent of the breach,” a BBC spokesperson told CNN Wednesday. The spokesperson declined to comment on the hackers’ extortion threat.

    A British Airways spokesperson said the company had “notified those colleagues whose personal information has been compromised to provide support and advice.”

    The hackers — a well-known group whose favored malware emerged in 2019 — last week began exploiting a new flaw in a widely used file-transfer software known as MOVEit, appearing to target as many exposed organizations as they could. The opportunistic nature of the hack left a broad swath of organizations vulnerable to extortion.

    Numerous US state government agencies use the MOVEit software, but it’s unclear how many agencies, if any, have been compromised.

    The US Cybersecurity and Infrastructure Security Agency has ordered all federal civilian agencies to update the MOVEit software in light of the hack. No federal agencies have been confirmed as victims, a CISA spokesperson told CNN.

    Together with the Federal Bureau of Investigation, CISA also released advice on dealing with the CLOP hack. Progress, the US firm that owns the MoveIT software, has also urged victims to update their software packages and has issued security advice.

    CISA Executive Director for Cybersecurity Eric Goldstein said in a statement: “CISA remains in close contact with Progress Software and our partners at the FBI to understand prevalence within federal agencies and critical infrastructure.”

    But the effort to respond to the cyber attack is very much ongoing.

    The CLOP hackers are “overwhelmed with the number of victims,” according to Charles Carmakal, chief technology officer at Mandiant Consulting, a Google-owned firm that has investigated the hack. “Instead of directly reaching out to victims over email or telephone calls like in prior campaigns, they are asking victims to reach out to them via email,” he said on LinkedIn Tuesday night.

    Allan Liska, a ransomware expert at cybersecurity firm Recorded Future, also told CNN: “Unfortunately, the sensitive nature of the data often stored on MOVEit servers means there will likely be real consequences stemming from the [data theft] but it will be months before we understand the full fallout from this attack.”

    [ad_2]

    Source link

  • TSMC confirms supplier data breach following ransom demand by Russian-speaking cybercriminal group | CNN Business

    TSMC confirms supplier data breach following ransom demand by Russian-speaking cybercriminal group | CNN Business

    [ad_1]



    CNN
     — 

    Taiwanese semiconductor giant TSMC confirmed Friday that one of its hardware suppliers was hacked and had data stolen from it, but said the incident had no impact on business operations.

    Confirmation of the breach came after Russian-speaking cybercriminals claimed TSMC as a victim on Thursday and demanded an extraordinary $70 million ransom from the semiconductor firm.

    There were no signs that TSMC or the hardware supplier, Taiwanese firm Kinmax, had any plans to pay the hackers (representatives from both companies didn’t respond to CNN’s questions about any ransom).

    TSMC — one of the world’s largest chipmakers and a key supplier to Apple

    (AAPL)
    — was quick to assure investors and the public that the hack had no impact on its operations and that it did not compromise its customers’ data.

    “After the incident, TSMC has immediately terminated its data exchange with this concerned supplier in accordance with the Company’s security protocols and standard operating procedures,” TSMC said in a statement to CNN.

    The hackers accessed Kinmax’s internal “testing environment” for the technology it prepares to deliver to customers, Kinmax said in a statement distributed by TSMC.

    “The leaked content mainly consisted of system installation preparation that the Company provided to our customers as default configurations,” Kinmax said. The company apologized to customers whose names may show up in the leaked data.

    Ransomware groups are known to exaggerate the value of the data they steal and make outlandish demands that are never met.

    LockBit is the name of the group claiming responsibility for the hack of the TSMC supplier and the type of ransomware they use. LockBit ransomware was the most deployed ransomware around the world in 2022, according to US cybersecurity officials.

    Jon DiMaggio, an executive at security firm Analyst1 who has studied LockBit extensively, said the hackers will likely publish the stolen data or sell it if TSMC refuses to negotiate a ransom.

    For years, American officials and Taiwanese cybersecurity experts have looked to fortify the island’s infrastructure in the face of hacking threats.

    Taiwan’s chip industry is critical to the global hardware supply chain, making any potentially impactful cyberattacks on it a concern for government officials and business executives around the world.

    While the TSMC-related hacking incident doesn’t appear to have been impactful, a separate ransomware attack in 2020 on Taiwan’s state-run energy company temporarily disrupted some customers’ ability to pay for gas with company cards, according to local media reports at the time.

    [ad_2]

    Source link

  • Japan’s largest port hit with ransomware attack | CNN Business

    Japan’s largest port hit with ransomware attack | CNN Business

    [ad_1]


    New York
    CNN
     — 

    Japan’s busiest shipping port said Thursday it would resume operations after a ransomware attack prevented the port from receiving shipping containers for two days.

    The expected restoration of the Port of Nagoya, a hub for car exports and an engine of the Japanese economy, will ease concerns about any wider economic fallout from the ransomware attack.

    The hacking incident began Tuesday when the computer system that handles shipping containers was knocked offline, according to a statement from the Nagoya Harbor Transportation Association. The hack forced the port to stop handling shipping containers that came to the terminal by trailer, the association said.

    Ransomware is a type of malicious software that typically locks the computers of a victim organization so that hackers can demand payment.

    This is the first reported ransomware attack on a Japanese port, and the incident has “created great concerns over the impact on the local economy and supply chain including the auto industry,” Mihoko Matsubara, chief cybersecurity strategist at NTT Corporation, a Japanese telecom firm, told CNN.

    Japanese media reported that LockBit, a type of ransomware linked with Russian-speaking hackers, was used in the hack.

    The LockBit cybercriminal group has been prolific in recent weeks, claiming Taiwanese semiconductor giant TSMC as a victim last week (TSMC said one of its hardware suppliers was hacked but the incident had no impact on TSMC’s business operations.)

    As of midday Thursday in Japan, there was no claim of responsibility for the Port of Nagoya ransomware attack from the LockBit group on their dark-web site.

    It was unclear if the Port of Nagoya received a ransom demand. CNN was unable to reach a spokesperson for the port association.

    Japanese critical infrastructure operators should drill for cyberattacks on their supply chains and have a response plan in place, given threats from both cybercriminals and state-backed hackers, Matsubara told CNN.

    Though this may be a first for Japan, ransomware and related hacks have hit ports in other countries.

    In 2017, malicious software allegedly unleashed by the Russian military on Ukraine spread around the world and disrupted operations at shipping giant Maersk, coasting the company an estimated $300 million.

    — CNN’s Mayumi Maruyama contributed to this report

    [ad_2]

    Source link