{"id":487,"date":"2023-04-09T05:51:08","date_gmt":"2023-04-09T10:51:08","guid":{"rendered":"https:\/\/kentprotect.com\/?p=487"},"modified":"2023-04-09T06:18:49","modified_gmt":"2023-04-09T11:18:49","slug":"breach-report-chippewa-county-of-wisconsin-breach-via-remote-access-tool-affects-800","status":"publish","type":"post","link":"https:\/\/kentprotect.com\/index.php\/2023\/04\/09\/breach-report-chippewa-county-of-wisconsin-breach-via-remote-access-tool-affects-800\/","title":{"rendered":"Breach Report: Chippewa County of Wisconsin breach via remote access tool affects 800+"},"content":{"rendered":"
<\/div>\n

(image source: Chippewa County Sheriff\u2019s Office (WEAU), 2023)<\/p>\n\n\n\n

One-sentence summary: <\/strong><\/p>\n\n\n\n

In February 2023, a Chippewa County HR employee accidentally downloaded a remote access tool, allowing an attacker to potentially breach the sensitive data of over 800+ Wisconsin residents. <\/p>\n\n\n\n

Who was involved?<\/strong><\/p>\n\n\n\n

Chippewa County Human Resources Department employee, Chippewa County Human Resources Department, 842 potential Wisconsin (current or former) residents, and a threat actor. <\/p>\n\n\n\n

What was the timeline?<\/strong><\/p>\n\n\n\n

February 28, 2023: Threat actor gains initial access to Chippewa County Human Resources Department employee’s computer via remote access tool<\/p>\n\n\n\n

March 1, 2023: Breach is detected by the same Chippewa County Human Resources Department employee. The IT department rapidly responds. <\/p>\n\n\n\n

April 4, 2023: Chippewa County reports the breach to HHS<\/p>\n\n\n\n

What occurred?<\/strong><\/p>\n\n\n\n

In February 2023, a Chippewa County HR employee accidentally downloaded a remote access tool through an unknown method, giving a threat actor access to their county endpoint. The same employee noticed potential UI interaction from the threat actor and notified the county IT department that limited their actual access to five minutes (GovernmentTechnology, 2023). Unfortunately, up to 35 MB of data may have been exfiltrated and potentially included “medical history number, client name, drug prescribed, date signed and the doctor’s initials” belonging to over 842 potential Wisconsin residents (GovernmentTechnology, 2023; HHS, 2023). <\/p>\n\n\n\n

Estimated costs:<\/strong><\/p>\n\n\n\n

Associated incident response costs, breach notification costs <\/p>\n\n\n\n

Involved laws: <\/strong><\/p>\n\n\n\n

Federal: HIPAA and HITECH <\/p>\n\n\n\n

State: Wisconsin: Wis. Stat. \u00a7 134.98<\/p>\n\n\n\n

Root cause: <\/strong><\/p>\n\n\n\n

Remote access tool installed by unknown method (potential phishing or drive-by download)<\/p>\n\n\n\n

Lessons learned: <\/strong><\/p>\n\n\n\n

User awareness includes non-IT user post-breach awareness to recognize indicators of compromise. Network segmentation also pays off. <\/p>\n\n\n\n

Further improvements: <\/p>\n\n\n\n

This incident is a great opportunity for EDR (endpoint detection and response) technologies. EDR could potentially detect the malicious download (i.e., remote access tool) and quarantine it before any access attempts took place. <\/p>\n\n\n\n

Example Solutions<\/em><\/p>\n\n\n\n

CrowdStrike: https:\/\/www.crowdstrike.com\/products\/endpoint-security\/falcon-insight-edr\/<\/a><\/p>\n\n\n\n

SentinelOne: https:\/\/www.sentinelone.com\/blog\/active-edr-feature-spotlight\/<\/a><\/p>\n\n\n\n

Additionally, the is also an opportunity to train employees on cybersecurity user awareness to prevent similar attacks from manifesting from common human methods, such as phishing or drive-by downloads. <\/p>\n\n\n\n

Example Solutions<\/em><\/p>\n\n\n\n

Knowbe4 https:\/\/www.knowbe4.com\/products\/kevin-mitnick-security-awareness-training\/<\/a><\/p>\n\n\n\n

Proofpoint https:\/\/www.proofpoint.com\/us\/products\/security-awareness-training<\/a><\/p>\n\n\n\n

Finally, one cannot underestimate the value of 24\/7 MDR (managed detection and response) services, such as a SOC. A SOC could potentially receive and correlate EDR alerts, network logs, as well as email alerts via a SIEM in order to piece together a potential, successful phishing attempt. <\/p>\n\n\n\n

Example Solution<\/em><\/p>\n\n\n\n

CyberConvoy MDR (managed detection and response): https:\/\/cyberconvoy.com\/<\/a><\/p>\n\n\n\n

Sources: <\/strong><\/p>\n\n\n\n

Chippewa County Sheriff\u2019s Office (WEAU). (2023, February 6). 43UKWCKDKVHLPAN7BQVE2ZHGCM.jpg<\/em>. WEAU 13 News. https:\/\/cloudfront-us-east-1.images.arcpublishing.com\/gray\/43UKWCKDKVHLPAN7BQVE2ZHGCM.jpg<\/p>\n\n\n\n

GovernmentTechnology. (2023, April 6). Chippewa County, Wis., Officials Report Data Breach<\/em>. GovTech. Retrieved April 9, 2023, from https:\/\/www.govtech.com\/security\/chippewa-county-wis-officials-report-data-breach<\/p>\n\n\n\n

HHS. (2023, April 4). Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information<\/em>. U.S. Department of Health & Human Services – Office For Civil Rights. Retrieved April 9, 2023, from https:\/\/ocrportal.hhs.gov\/ocr\/breach\/breach_report.jsf<\/p>\n\n\n\n

Commentary: <\/strong><\/p>\n\n\n\n

This attack is a great example of where a victim can turn around a breach by notifying their employer or IT department of a potential incident. Sure, it is embarrassing to fall victim to a phishing attempt. But so much more damage can be prevented by reporting it. This awareness and responsiveness should be included in user awareness training for end-users (not just preventing breaches). Chippewa County also appears to have a good network segmentation in place to confine the breach to just that employee’s endpoint. Additionally, this is a great example of government transparency.<\/p>\n\n\n\n

\n