Preview Newsletter
Deloitte Media Monitoring (9/25/17)
-
Deloitte hit by cyber-attack revealing clients’ secret emails
Sep 25, 2017 | The Guardian
By Nick Hopkins
One of the world’s “big four” accountancy firms has been targeted by a sophisticated hack that compromised the confidential emails and plans of some of its blue-chip clients, the Guardian can reveal. -
Deloitte cyberattack: Secret emails and plans from blue-chip companies at risk in widespread hack
Sep 25, 2017 | ALPHR
By Victoria Woollaston
Following on from an attack which exposed millions of Equifax customer details earlier this month, The Guardian is reporting Deloitte has been similarly targeted by an especially sophisticated hack. -
Deloitte hit by sophisticated cyber attack: Guardian newspaper (UPDATE 2)
Sep 25, 2017 | Reuters
Global accountancy firm Deloitte has been hit by a sophisticated hack that resulted in a breach of confidential information and plans from some of its biggest clients, Britain's Guardian newspaper said on Monday. -
HACK ATTACK Cyber-attack hits accounting giant Deloitte with clients’ details, passwords and emails stolen (UPDATE)
Sep 25, 2017 | The Sun
By Holly Christodoulou
A CYBER attack has hit accounting giant Deloitte as hackers steal passwords, emails and personal details of clients. -
Deloitte hit by cyber attack - report
Sep 25, 2017 | City A.M
By Lynsey Barber
Deloitte has been hit by a cyber attack, The Guardian reports. -
Deloitte Is the Latest Target of a Cyber Attack With Confidential Client Data at Risk
Sep 25, 2017 | Fortune
Global accountancy firm Deloitte has been hit by a sophisticated hack that resulted in a breach of confidential information and plans from some of its biggest clients, Britain's Guardian newspaper said on Monday. -
Deloitte Hit By Cyber-Attack Revealing Clients’ Secret Emails
Sep 25, 2017 | OODA Loop
“One of the world’s ‘big four’ accountancy firms has been targeted by a sophisticated hack that compromised the confidential emails and plans of some of its blue-chip clients, the Guardian can reveal. -
Deloitte hit by sophisticated cyber attack
Sep 25, 2017 | RTE
Global accountancy firm Deloitte has been hit by a sophisticated hack that resulted in a breach of confidential information and plans from some of its biggest clients, The Guardian newspaper has reported. -
Deloitte hit by major cybersecurity breach
Sep 25, 2017 | IT ProPortal
By Michael Moore
Secret client emails apparently compromised after hackers were able to access email systems, accountancy giant confirms. -
Deloitte hit by cyber attack, clients’ emails leaked: The Guardian
Sep 25, 2017 | Scroll.in
Some of the world’s biggest banks, media enterprises and government agencies are clients of the company. -
Deloitte cyberattack: Secret emails and plans from blue-chip companies at risk in widespread hack
Sep 25, 2017 | alphr
Another week, another report of a major cyberattack hitting a global firm -
Deloitte says 'very few' clients impacted by cyber attack
Sep 25, 2017 | Reuters
Global accountancy firm Deloitte said on Monday it had reviewed its systems following a cyber attack which it said had affected a small number of its clients. -
Accounting group Deloitte hit with cyber attack
Sep 25, 2017 | Financial Times
By Madison Marriage
Deloitte was hit by a cyber attack earlier this year, forcing the ‘big four’ accounting firm to contact governmental authorities about the breach and tarnishing its reputation as an expert provider of cyber security advice. -
Deloitte hack exposes secret emails and plans from firm's blue-chip clients
Sep 25, 2017 | The Inquirer
By Carly Page
ACCOUNTANCY OUTFIT Deloitte has fallen victim to a cyberattack that has exposed potentially millions of confidential emails. -
Five things you should know about the Deloitte data breach
Sep 25, 2017 | Silicon Republic
By Ellen Tannam
Deloitte, of the biggest global accounting firms, suffered an attack that affected clients across sectors from auditing and tax consultancy to cybersecurity advice. It is believed that the breach is mainly affecting US-based clients. -
Big four accountant Deloitte hit by cyber-attack
| Insider.co.uk
By Scott McCulloch
Big four accountants Deloitte has admitted to being the victim of a cyber attack which is reported to have gone unnoticed for months. -
Clients’ secret emails compromised in cyber-security attack on Deloitte
Sep 25, 2017 | Geo.tv (Pakistan)
A sophisticated hack has targeted one of the world’s “big four” accountancy firms – Deloitte – it surfaced. -
Global accounting firm Deloitte hit by major cyberattack, reveals client emails: report
Sep 25, 2017 | GlobalNews.ca (Canada)
By Katie Dangerfield
One of the world’s top accountancy companies, Deloitte, has been hit by a targeted cyberattack that apparently resulted in the release of clients’ confidential information, the Guardian reported Monday. -
Deloitte Hacked: Banks, Government Agencies & Multinationals Data Breached
Sep 25, 2017 | Digit
Only days after Equifax suffered one of the largest data breaches in recent history, The Guardian reports that Deloitte, one of the world’s largest accountancy firms has suffered a ‘sophisticated hack’ which gave the attackers access to the company’s e-mail servers as an administrator. -
Emails and more could be breached in possible Deloitte cyberattack
| Digital Look
By Josh White
Deloitte has been the subject of the latest major cybersecurity attack, with confidential information from some of its clients reportedly compromised. -
Deloitte hacked, compromising its clients' emails
Sep 25, 2017 | CNET
By Ben Fox Rubin
The consulting firm Deloitte was hit with a cyberattack that may have revealed the emails of its government and corporate clients, The Guardian reported Monday. -
Deloitte hack: Secret client data hijacked in cyberattack that went 'unnoticed for months'
Sep 25, 2017 | International Business Times
By Jason Murdock
A major cyberattack at consultancy giant Deloitte reportedly went undiscovered for months, with investigators now deep into a probe to uncover exactly what was stolen. -
Hackers hit accountancy firm Deloitte, stealing plans, emails and passwords
| Beta News
By Mark Wycislik-Wilson
Global accountancy firm Deloitte -- known as one of the "big four" -- has been hit by a sophisticated hack. With echoes of the Equifax data breach and CCleaner hack, the cyberattack went undetected for months and results in confidential emails being accessed, as well as company plans, and the private information of high-profile, blue-chip clients. -
Deloitte insists ‘very few’ clients hit by major cyber attack
Sep 25, 2017 | Belfast Telegraph
Accountancy giant Deloitte has insisted “very few clients” have been impacted by a major cyber attack that saw hackers target the company through its email system. -
Deloitte cyber-attack reveals blue-chip client details – report
Sep 25, 2017 | Computer Business Review
By James Nunns
Accountancy firm Deloitte has reportedly been hit by a cyber-attack that’s resulted in secret client emails being revealed. -
Deloitte becomes the latest victim of a cyber attack with hackers accessing the secret emails of blue-chip clients and US government bodies
Sep 25, 2017 | This Is Money (UK)
By Jane Denton
Accounting and professional services firm Deloitte has been hit by a cyber attack, with hackers accessing confidential details and plans from some of the group's clients, including multinational blue-chip companies and US government departments. -
Deloitte Email Platform and Client Data Accessed by Cyberattack (UPDATE)
Sep 25, 2017 | Bloomberg
By Giles Turner
Deloitte LLP has been targeted by a cyberattack that let hackers access data from an internal email platform. -
Deloitte confirms hack exposed email system
Sep 25, 2017 | Zero Day Net
By Zack Whittaker
Tax and auditing giant Deloitte has confirmed it was targeted by a cyberattack, resulting in the theft of confidential documents and emails. -
Deloitte hacked, cybersecurity attack compromises client emails and plans
Sep 25, 2017 | Tech Republic
By Conner Forrest
Accountancy firm Deloitte was recently the victim of a cyberattack that left confidential client emails and business plans exposed, according to a Monday report from the Guardian. -
One of the World's Biggest Accounting Firms Hacked After Basic Security Goof
Sep 25, 2017 | Gizmodo
By Rhett Jones
For months, the systems of Deloitte, a consulting and accounting firm that ranks among the world’s “big four,” were compromised and hardly anyone knew it. According to the Guardian, the breach has been kept under wraps since it was noticed by administrators in March. The attackers were able to access information from Deloitte’s major corporate and government clients in the US—all because, it appears, someone didn’t use two-factor authentication. -
A cyberattack at Deloitte may have revealed blue-chip client information
Sep 25, 2017 | CNBC
By Sara Salina
A cyberattack at Deloitte, one of the "big four" accounting firms, went unnoticed for months and may have revealed confidential client emails and plans, according to a report Monday from the British newspaper the Guardian. -
Deloitte impacted by cyberattack: report
Sep 25, 2017 | The Hill
By Morgan Chalfant
Deloitte was hit with a cyberattack that allowed hackers access to company emails and possibly confidential client information, the Guardian is reporting. -
Major accounting firm Deloitte reports extensive cybersecurity breach
Sep 25, 2017 | Engadget
By Mallory Locklear
Deloitte, a major US and global accounting firm, revealed that it was hit with a cybersecurity breach that may have extended from October of last year through this past March, the Guardian reports. -
Deloitte hit by data breach
Sep 25, 2017 | BBC News
Corporate finance giant Deloitte suffered a cyber-attack that compromised confidential data, including the private emails of some of its clients, the company has confirmed. -
Deloitte hit by major cybersecurity breach
Sep 25, 2017 | Click Lancashire (UK)
By Marco Green
Following on from an attack which exposed millions of Equifax customer details earlier this month, The Guardian is reporting Deloitte has been similarly targeted by an especially sophisticated hack. -
Sensitive client emails, usernames, passwords exposed in Deloitte hack
Sep 25, 2017 | The Register (UK)
By John Leyden
Deloitte, one of the world's "big four" accountancy firms, has fallen victim to a cyberattack that compromised sensitive emails. -
Deloitte says it's been hacked
Sep 18, 2017 | CNN Money
By Alanna Petroff
The global accountancy firm Deloitte said Monday it was the victim of a hack that targeted its email system. -
Deloitte says 'very few' clients hit by hack
Sep 25, 2017 | AFP News
Deloitte said Monday that "very few" of the accounting and consultancy firm's clients were affected by a hack after a news report said systems of blue-chip clients had been breached. -
Deloitte hit by cyber attack
Sep 25, 2017 | Telegraph (UK)
Global accountancy firm Deloitte has been hit in a cyber attack that compromised the data of a small number of its clients. -
Deloitte, a source of cyber-security advice - hacked, emails accessed
Sep 25, 2017 | SC Media
Five years ago Gartner ranked the big-four accounting firm Deloitte as number one in cyber-security, but today it has been reported that usernames, passwords and personal details of some of its leading clients have been obtained by hackers. -
Deloitte becomes the latest victim of cyber-attack
Sep 25, 2017 | London Loves Business
By Purvai Dua
Global accountancy firm Deloitte has been hit by a sophisticated cyber attack which has resulted in a possible breach of confidential information and plans from some of its biggest blue-chip clients. -
Deloitte says 'very few' clients hit by hack
Sep 25, 2017 | Phys.org
Deloitte said Monday that "very few" of the accounting and consultancy firm's clients were affected by a hack after a news report said systems of blue-chip clients had been breached. -
Accounting Firm Deloitte Says It Suffered Cyberattack
Sep 25, 2017 | Wall Street Journal
By Michael Rapoport
Accounting firm Deloitte said Monday it had suffered a cyberattack in which a hacker accessed data affecting a “very few” of Deloitte’s clients. -
Global accountancy firm Deloitte admits cyber attack
Sep 25, 2017 | Sky News
By Clare Downey
Global accounting firm Deloitte has admitted it was the victim of a cyber attack which may have revealed sensitive emails belonging to some of its clients. -
Deloitte breach underlines need for better authentication
Sep 25, 2017 | ComputerWeekly.com
By Warwick Ashford
Cyber attackers have reportedly compromised Deloitte’s global email server through an administrator’s account, giving them unrestricted access to emails and attachments. -
Deloitte Hit By Data Breach, Customer Information Reportedly Exposed
Sep 25, 2017 | CRN
By Sarah Kuranda
When it comes to data breaches, solution providers themselves are becoming a target, with a report Monday that consulting giant Deloitte, No. 18 on the 2017 CRN Solution Provider 500 list, had been hacked. -
Global Accounting Firm Deloitte Reports Cyberattack
Sep 25, 2017 | Ubergizmo
By Adnan Farooqui
One of the largest accounting firms in the United States and indeed the world, Deloitte, has reported that it was the victim of a cyberattack that it caught back in March this year. -
Deloitte hit by cyberattack (UPDATE)
Sep 25, 2017 | The Hill
By Morgan Chalfant
Deloitte was hit with a cyberattack that allowed hackers access to company emails and possibly confidential client information, the Guardian reported Monday. -
Global accounting firm Deloitte reports hack of internal emails
Sep 25, 2017 | UPI
By Ed Adamczyk
London-based accountant, tax consultant and cybersecurity firm Deloitte LLP reported a hack of its internal emails on Monday. -
Deloitte Hack Exposes Confidential Email for World's Largest Companies—Report
Sep 25, 2017 | Infosecurity Magazine
By Tara Seals
Accountancy giant Deloitte has been the victim of a cyber-attack that has compromised its global clients’ confidential emails and intellectual property. -
Deloitte Data Hack 2017: Clients’ Secret Emails Exposed
Sep 25, 2017 | InvestorPlace
By William White
A Deloitte data hack has resulted in the private information of some users being stolen. -
Deloitte Tries To Play It Cool After Cyberattack
Sep 25, 2017 | Going Concern
By Caleb Newquist
Deloitte, the biggiest of the Big 4, has joined the ranks of the hacked. -
Deloitte cyberattack reportedly hit corporate, government clients
| CBS
A cyberattack hit the email system of accounting company Deloitte, compromising some clients' data, the company acknowledged Monday. -
Deloitte hacked, says 'very few' clients affected (UPDATE-2)
Sep 25, 2017 | Reuters
By Paul Sandle and Jim Finkle
Global accounting firm Deloitte [DLTE.UL] said on Monday it was the victim of a cyber attack that affected the data of a small number of clients, providing few details on the breach. -
I'm starting to have some major doubts about corporate cyber-security
Sep 25, 2017 | Forex Live
By Adam Button
We all had a good laugh when accountants from PricewaterhouseCoopers screwed up the Academy Awards. It was an embarrassing mix-up but not one was genuinely hurt. -
A Cyberattack on Accounting Firm Deloitte Reveals Clients’ Emails
Sep 25, 2017 | Tech.Co
By Adam Rowe
Earlier this month we released a list rounding up the major internet security breaches of 2017, from WannaCry to HBO’s 1.5 terabyte leak to the Petya ransomware attacks.
National News
-
Deloitte hit by cyber-attack revealing clients’ secret emails
Sep 25, 2017 | The Guardian
By Nick Hopkins
One of the world’s “big four” accountancy firms has been targeted by a sophisticated hack that compromised the confidential emails and plans of some of its blue-chip clients, the Guardian can reveal.
Deloitte, which is registered in London and has its global headquarters in New York, was the victim of a cybersecurity attack that went unnoticed for months.
One of the largest private firms in the US, which reported a record $37bn (£27.3bn) revenue last year, Deloitte provides auditing, tax consultancy and high-end cybersecurity advice to some of the world’s biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies.
The Guardian understands Deloitte clients across all of these sectors had material in the company email system that was breached. The companies include household names as well as US government departments.
So far, six of Deloitte’s clients have been told their information was “impacted” by the hack. Deloitte’s internal review into the incident is ongoing.
The Guardian understands Deloitte discovered the hack in March this year, but it is believed the attackers may have had access to its systems since October or November 2016.
The hacker compromised the firm’s global email server through an “administrator’s account” that, in theory, gave them privileged, unrestricted “access to all areas”.
The account required only a single password and did not have ”two-step“ verification, sources said.
Emails to and from Deloitte’s 244,000 staff were stored in the Azure cloud service, which was provided by Microsoft. This is Microsoft’s equivalent to Amazon Web Service and Google’s Cloud Platform.
In addition to emails, the Guardian understands the hackers had potential access to usernames, passwords, IP addresses, architectural diagrams for businesses and health information. Some emails had attachments with sensitive security and design details.
The breach is believed to have been US-focused and was regarded as so sensitive that only a handful of Deloitte’s most senior partners and lawyers were informed.
The Guardian has been told the internal inquiry into how this happened has been codenamed “Windham”. It has involved specialists trying to map out exactly where the hackers went by analysing the electronic trail of the searches that were made.
The team investigating the hack is understood to have been working out of the firm’s offices in Rosslyn, Virginia, where analysts have been reviewing potentially compromised documents for six months.
It has yet to establish whether a lone wolf, business rivals or state-sponsored hackers were responsible.
Sources said if the hackers had been unable to cover their tracks, it should be possible to see where they went and what they compromised by regenerating their queries. This kind of reverse-engineering is not foolproof, however.
A measure of Deloitte’s concern came on 27 April when it hired the US law firm Hogan Lovells on “special assignment” to review what it called “a possible cybersecurity incident”.
The Washington-based firm has been retained to provide “legal advice and assistance to Deloitte LLP, the Deloitte Central Entities and other Deloitte Entities” about the potential fallout from the hack.
Responding to questions from the Guardian, Deloitte confirmed it had been the victim of a hack but insisted only a small number of its clients had been “impacted”. It would not be drawn on how many of its clients had data made potentially vulnerable by the breach.
The Guardian was told an estimated 5m emails were in the ”cloud” and could have been been accessed by the hackers. Deloitte said the number of emails that were at risk was a fraction of this number but declined to elaborate.
Advertisement
“In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman said.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required.
“Our review enabled us to determine what the hacker did and what information was at risk as a result. That amount is a very small fraction of the amount that has been suggested.”
Deloitte declined to say which government authorities and regulators it had informed, or when, or whether it had contacted law enforcement agencies.
Though all major companies are targeted by hackers, the breach is a deep embarrassment for Deloitte, which offers potential clients advice on how to manage the risks posed by sophisticated cybersecurity attacks.
“Cyber risk is more than a technology or security issue, it is a business risk,” Deloitte tells potential customers on its website.
“While today’s fast-paced innovation enables strategic advantage, it also exposes businesses to potential cyber-attack. Embedding best practice cyber behaviours help our clients to minimise the impact on business.”
Deloitte has a “CyberIntelligence Centre” to provide clients with “round-the-clock business focussed operational security”.
Advertisement
“We monitor and assess the threats specific to your organisation, enabling you to swiftly and effectively mitigate risk and strengthen your cyber resilience,” its website says. “Going beyond the technical feeds, our professionals are able to contextualise the relevant threats, helping determine the risk to your business, your customers and your stakeholders.”
In 2012, Deloitte, which has offices all over the world, was ranked the best cybersecurity consultant in the world.
Earlier this month, Equifax, the US credit monitoring agency, admitted the personal data of 143 million US customers had been accessed or stolen in a massive hack in May. It has also revealed it was also the victim of an earlier breach in March.
About 400,000 people in the UK may have had their information stolen following the cybersecurity breach. The US company said an investigation had revealed that a file containing UK consumer information “may potentially have been accessed”.
The data includes names, dates of birth, email addresses and telephone numbers, but does not contain postal addresses, passwords or financial information. Equifax, which is based in Atlanta, discovered the hack in July but only informed consumers last week.
-
Deloitte cyberattack: Secret emails and plans from blue-chip companies at risk in widespread hack
Sep 25, 2017 | ALPHR
By Victoria Woollaston
Another week, another report of a major cyberattack hitting a global firm.
Following on from an attack which exposed millions of Equifax customer details earlier this month, The Guardian is reporting Deloitte has been similarly targeted by an especially sophisticated hack.
It is believed confidential emails and plans of Deloitte’s blue-chip clients have been exposed in an attack that went unnoticed for months. Reports suggest Deloitte learned of the breach in March, but its systems could have been vulnerable since October 2016.
A hacker, or group of hackers, was able to break into Deloitte’s systems by compromising an email server via an “administrator’s account”. This would have given the attackers full access to the company, and such accounts typically have two-factor authentication enabled.
Deloitte, one of the world’s largest private accountancy firms, manages clients such as a banks, publishers as well as government agencies and it is thought companies spanning the full range of Deloitte’s clients could be at risk.
-
Deloitte hit by sophisticated cyber attack: Guardian newspaper (UPDATE 2)
Sep 25, 2017 | Reuters
Global accountancy firm Deloitte [DLTE.UL] has been hit by a sophisticated hack that resulted in a breach of confidential information and plans from some of its biggest clients, Britain’s Guardian newspaper said on Monday.
Deloitte - one of the big four professional services providers - confirmed to the newspaper it had been hit by a hack, but it said only a small number of its clients had been impacted.
The firm discovered the hack in March, according to the Guardian, but the cyber attackers could have had breached its systems as long ago as October or November 2016.
The attack was believed to have been focused on the U.S operations of the company, which provides auditing, tax advice and consultancy to multinationals and governments worldwide.
”In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilizing a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman told the newspaper.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.”
A Deloitte spokeswoman declined immediate comment, saying that the firm would issue a statement shortly.
-
Sep 25, 2017 | The Sun
By Holly Christodoulou
A CYBER attack has reportedly hit accounting giant Deloitte with hackers alleged to have stolen the passwords, emails and personal details of clients.
The firm - one of the world's 'big four' accountancy firms - was targeted by a sophisticated hack that went unnoticed for months, The Guardian reports.
According to the newspaper, the attack breached the company email system and allowed the hackers "access to all areas".
Deloitte - one of the big four professional services providers - confirmed to the newspaper it had been hit by a hack, but it said only a small number of its clients had been impacted.
The firm discovered the hack in March, according to the Guardian, but the cyber attackers could have had breached its systems as long ago as October or November 2016.
The attack was believed to have been focused on the U.S operations of the company, which provides auditing, tax advice and consultancy to multinationals and governments worldwide.The attack was believed to have been focused on the U.S operations of the company, which provides auditing, tax advice and consultancy to multinationals and governments worldwide.
Deloitte has already launched an investigation and contacted the people who were affected.
“In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman told The Guardian.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity.
"We will continue to evaluate this matter and take additional steps as required."
There have been several high-profile cyber attacks this year.
More than 200,000 victims across 150 countries were infected by malicious software known as WannaCry in May.
The NHS was one of the worst affected victims of the international cyber attack
Around 40 NHS trusts were hit in the WannaCry ransomware attack, forcing them to postpone operations and procedures.
Seven hospitals remained on A&E divert two days later, with ambulances taking emergency patients elsewhere, NHS England said.
The full scale of the attack on the NHS only become apparent four days later as people returned to work.
-
Deloitte hit by cyber attack - report
Sep 25, 2017 | City A.M
By Lynsey Barber
Deloitte has been hit by a cyber attack, The Guardian reports.
The professional services giant - one of the so called top four in the world - has not yet responded to a request for comment, but confirmed to the newspaper that a breach had occurred.
The attack was discovered earlier this year, according to the report, and client information was leaked.
A spokesperson for the firm told the Guardian:
"In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required.
“Our review enabled us to determine what the hacker did and what information was at risk as a result. That amount is a very small fraction of the amount that has been suggested.”
-
Deloitte Is the Latest Target of a Cyber Attack With Confidential Client Data at Risk
Sep 25, 2017 | Fortune
Global accountancy firm Deloitte has been hit by a sophisticated hack that resulted in a breach of confidential information and plans from some of its biggest clients, Britain's Guardian newspaper said on Monday.
Deloitte—one of the big four professional services providers—confirmed to the newspaper it had been hit by a hack, but it said only a small number of its clients had been impacted.
The firm discovered the hack in March, according to the Guardian, but the cyber attackers could have had breached its systems as long ago as October or November 2016.
The attack was believed to have been focused on the U.S. operations of the company, which provides auditing, tax advice, and consultancy to multinationals and governments worldwide.
"In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilizing a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman told the newspaper. "As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators."
A Deloitte spokeswoman declined immediate comment, saying that the firm would issue a statement shortly.
-
Deloitte Hit By Cyber-Attack Revealing Clients’ Secret Emails
Sep 25, 2017 | OODA Loop
“One of the world’s ‘big four’ accountancy firms has been targeted by a sophisticated hack that compromised the confidential emails and plans of some of its blue-chip clients, the Guardian can reveal.
Deloitte, which is registered in London and has its global headquarters in New York, was the victim of a cybersecurity attack that went unnoticed for months.”
-
Deloitte hit by sophisticated cyber attack
Sep 25, 2017 | RTE
Global accountancy firm Deloitte has been hit by a sophisticated hack that resulted in a breach of confidential information and plans from some of its biggest clients, The Guardian newspaper has reported.
Deloitte - one of the big four professional services providers - confirmed to the newspaper it had been hit by a hack, but it said only a small number of its clients had been impacted.
The firm discovered the hack in March, according to the Guardian, but the cyber attackers could have had breached its systems as long ago as October or November 2016.
The attack was believed to have been focused on the US operations of the company, which provides auditing, tax advice and consultancy to multinationals and governments worldwide.
"In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cyber-security and confidentiality experts inside and outside of Deloitte, a spokesman told the newspaper.
"As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators."
A Deloitte spokeswoman declined immediate comment, saying that the firm would issue a statement shortly.
In Ireland, Deloitte is the second largest of Ireland's "Big Four" accounting and professional services firms, behind KPMG.
It is not known at this stage if Deloitte's Irish operation or customers here are affected by the breach.
-
Deloitte hit by major cybersecurity breach
Sep 25, 2017 | IT ProPortal
By Michael Moore
One of the world's top accountancy companies has been hit by a targeted cyber-attack that apparently released details of secret client emails.
Deloitte, one of the so-called 'big four' firms, saw its company email system breached by unknown hackers who were able to gain access to client accounts and all the details within.
Hackers were able to use an unsecured administrator's account to access the emails, meaning details including usernames, passwords, IP addresses and more were accessible.
The account, reportedly for Microsoft's Azure cloud platform, which hosted Deloitte's email, did not use two-step authentication, meaning it only required a single password to access.
The attack reportedly went unnoticed for several months, according to the Guardian, which states that clients in multiple sectors, including banks, media companies, pharmaceutical firms and even government agencies could all be affected.
Deloitte's internal investigation into the incident is still ongoing, but the Guardian says that the breach is thought to have begun around October or November 2016.
The company confirmed to the Guardian that it had been the victim of "a cyber incident", but that only a small amount of clients (thought to number six unidentified US organisations) have so far been told their accounts were affected by the the hack.
“In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman said.
“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required."
-
Deloitte hit by cyber attack, clients’ emails leaked: The Guardian
Sep 25, 2017 | Scroll.in
Accountancy firm Deloitte was the target of a sophisticated hack that compromised confidential emails and plans of some of its biggest clients, The Guardian said in an exclusive report on Monday. Deloitte confirmed to The Guardian it was a victim of a hack but insisted only a few clients were hit.
The report said the cybersecurity attack on Deloitte – which provides auditing, tax consultancy and cybersecurity advice to some of the world’s biggest banks, media enterprises and government agencies – went unnoticed for months. Six of Deloitte’s clients were told their information was “impacted” by the hack, which Deloitte discovered in March 2017, the report said. But the attackers may have had access to the systems since October or November 2016. The breach was US-focused.
The firm’s global email server was hacked through an “administrator’s account” that gave unrestricted “access to all areas”. Only a handful of Deloitte’s most senior partners and lawyers were informed and an internal inquiry was started, but no headway has been made yet.
Earlier this month, US credit monitoring agency Equifax said the personal data of 14.3 crore United States consumers were accessed by hackers between mid-May and July, in one of the largest data breaches in the United States.
-
Deloitte cyberattack: Secret emails and plans from blue-chip companies at risk in widespread hack
Sep 25, 2017 | alphr
Following on from an attack which exposed millions of Equifax customer details earlier this month, The Guardian is exclusively reporting Deloitte has been similarly targeted by an especially sophisticated hack.
It is believed confidential emails and plans of Deloitte’s blue-chip clients have been exposed in an attack that went unnoticed for months. Reports suggest Deloitte learned of the breach in March, but its systems could have been vulnerable since October 2016.
A hacker, or group of hackers, was able to break into Deloitte’s systems by reportedly compromising an email server via an “administrator’s account”. This would have given the attackers full access to the company, and such accounts typically have two-factor authentication enabled. It is only believed to be impacting US clients, but the precise number is not known.
Deloitte, one of the world’s largest private accountancy firms recently named the best cybersecurity consultant in the world, manages clients such as a banks, publishers as well as government agencies and it is thought companies spanning the full range of Deloitte’s clients could be at risk. It said only a small number of its clients had been affected, and all those impacted have been notified by Deloitte's lawyers.
This is the latest in a long line of companies that have suffered embarrassing, and in some cases damaging, attacks in recent months. The most recent, of course, being Equifax. Earlier this month, the credit monitoring firm said details of more than 143 million people (including 400,000 UK citizens) had been exposed following "unauthorised access" to its systems.
In a statement revealing the breach, Equifax said: "Criminals exploited a US website application vulnerability to gain access to certain files."
A week or so later, CCleaner, an app used by millions to optimise computer performance, was hit by a malware attack. It's thought the latest version of the app infects PCs, making them part of a botnet; slave computers that hackers can use at will to direct traffic for malicious purposes.
According to security investigators Cisco Talos, a version of CCleaner 5.33 downloaded in August included hidden malware. But owner Avast Piriform says it prevented the breach harming customers.
This latest Deloitte cyberattack comes off the back of comments made by technical director Ian Levy, from GCHQ's National Cyber Security Centre who warned an unprecedented cyberattack will hit in the next few years.
Speaking at an event hosted by security software company Symantec, Ian Levy said he was “reasonably confident” a major attack will happen, and organisations should be prepared. He added that he expects the initial reaction to a category-one attack to be assertions that nothing could be done to stop it, but that an independent investigation will show that the attack was entirely preventable. Much of the blame, he said, should be levelled at organisations that don’t understand the data they have, and try to outsource their risk to firms that only mystify the process of cybersecurity.
-
Deloitte says 'very few' clients impacted by cyber attack
Sep 25, 2017 | Reuters
Global accountancy firm Deloitte said on Monday it had reviewed its systems following a cyber attack which it said had affected a small number of its clients.
A spokeswoman said “only very few clients” were impacted in the hack, which was first reported by Britain’s Guardian newspaper.
“No disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers,” she said.
-
Accounting group Deloitte hit with cyber attack
Sep 25, 2017 | Financial Times
By Madison Marriage
Deloitte was hit by a cyber attack earlier this year, forcing the ‘big four’ accounting firm to contact governmental authorities about the breach and tarnishing its reputation as an expert provider of cyber security advice.
The attack, described by Deloitte as a “cyber incident” and first reported by the Guardian newspaper, will come as a blow to the firm, which views the cyber security advice it provides to large companies as one of its fastest-growing revenue streams.
The accounting firm, which this month posted record global revenues of $39bn, said in a statement that the cyber breach had affected “only very few clients” and that “no disruption had occurred to client businesses, to Deloitte’s ability to continue to service clients, or to consumers”.
The firm added that its response to the cyber incident included mobilising a team of cyber security and confidentiality experts inside and outside of Deloitte, contacting governmental authorities immediately after the firm became aware of the incident; and contacting all of the clients impacted.
The firm said in a statement: “Deloitte remains deeply committed to ensuring that its cyber-security defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security.”
-
Deloitte hack exposes secret emails and plans from firm's blue-chip clients
Sep 25, 2017 | The Inquirer
By Carly Page
ACCOUNTANCY OUTFIT Deloitte has fallen victim to a cyberattack that has exposed potentially millions of confidential emails.
The Guardian has the scoop on the attack, which comes just a week after Equifax suffered a data breach that exposed the personal information of 143 million US citizens, and reports that a hacker, or group of hackers, was able to break into Deloitte's systems using an unsecured administrator's account, giving them full access to the company's five million cloud-hosted emails.
Hackers are said to have accessed confidential emails and plans of Deloitte's blue-chip clients, along with usernames, passwords, IP addresses, architectural diagrams for businesses and health information.
Deloitte first learned of the breach in March, according to the Guardian, but its systems could have been vulnerable since October 2016.
The company confirmed to the Guardian that it had been the victim of "a cyber incident", but said that only a small amount of clients have so far been told their accounts were affected by the hack.
According to the report, six of Deloitte's clients - which include some of the world's biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies - have been notified.
"In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte," a Deloitte spokesperson said.
"As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
"The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers.
"We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required."
It is not yet known who is responsible for the attack, with the Guardian noting that the firm has yet to establish whether a lone wolf, business rivals or state-sponsored hackers were to blame.
-
Five things you should know about the Deloitte data breach
Sep 25, 2017 | Silicon Republic
By Ellen Tannam
Five things you should know about the Deloitte data breach
Silicon Republic
Ellen Tannam
September 25, 2017
https://www.siliconrepublic.com/enterprise/deloitte-cyberattack-breach
The attack on Deloitte was described as ‘sophisticated’ and may have compromised some blue-chip client information.
Deloitte, of the biggest global accounting firms, suffered an attack that affected clients across sectors from auditing and tax consultancy to cybersecurity advice. It is believed that the breach is mainly affecting US-based clients.
What we know
How long ago was the initial hack?
The Guardian learned of the attack today (25 September), and so far six of Deloitte’s have been informed by the firm that the breach has affected them. The attack was first discovered in March of this year, but it is understood that the hackers may have had access to its systems for months before, in October or November 2016.
How was the email server compromised?
Hackers apparently compromised the server by using an “administrator’s” account that ostensibly gave them full and privileged access to the information contained within. The account was missing much-lauded two-step verification, requiring just a single password to gain entry. Emails had been stored in Microsoft’s Azure cloud storage service.
Did the hackers have access to anything else?
Those responsible may have had the potential to find IP addresses, health information, passwords and usernames, and business documents.
Who is analysing the hack?
The Guardian reported that the internal inquiry into the hack is called “Windham”, and the investigations team is carrying out operations in Rosslyn, Virginia.
What has Deloitte said?
“In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte.”
Another in a string of breaches
This cyberattack is another high-profile breach in what has been a string of serious compromises, from the Equifax incident to the recent disclosure from the SEC, detailing hackers potentially using information to carry out insider trading.
This breach in particular is not ideal for the firm, as it has its own cybersecurity advisory service and offers consultations to clients on the subject of data protection.
-
Big four accountant Deloitte hit by cyber-attack
| Insider.co.uk
By Scott McCulloch
Big four accountants Deloitte has admitted to being the victim of a cyber attack which is reported to have gone unnoticed for months.
The Guardian reports Deloitte's company email system was breached in an attack dating back to October or November 2016, though the breach was only discovered in March of this year.
The attack came via the firm's global email server, the Microsoft-led Azure cloud server, and was apparently accessed through an administrator account.
The Guardian reports the hack, believed to be US-focused, also provided hackers with potential access to usernames, IP addresses and passwords.
Deloitte is reported to have launched an internal enquiry in the hack, codenamed “Windham” which has been up-and-running for six months.
The firm reported in April it had hired US law firm Hogan Lovells to review what is described as a “possible cyber security incident”.
Deloitte has now confirmed it was hacked but insists only a “small number” of clients had been impacted.
The firm told the Guardian of the estimated five million emails on the server, the number at risk of being accessed by hackers was only a fraction of the total though refused to state how many emails held on the cloud were compromised.
A Deloitte spokesperson said: “In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity.
“We will continue to evaluate this matter and take additional steps as required.
“Our review enabled us to determine what the hacker did and what information was at risk as a result.
“That amount is a very small fraction of the amount that has been suggested.”
-
Clients’ secret emails compromised in cyber-security attack on Deloitte
Sep 25, 2017 | Geo.tv (Pakistan)
A sophisticated hack has targeted one of the world’s “big four” accountancy firms – Deloitte – it surfaced.
Confidential emails and plans of some of the company’s blue-chip clients were compromised in the attack.
The cyber-security attack went unnoticed for months, the Guardian reported.
Deloitte – one of the largest private firms in the US – provides auditing, tax consultancy, and high-end cyber-security advice to some of the world’s biggest banks, multinational companies, media enterprises, pharmaceutical firms, and government agencies.
Deloitte clients across all of these sectors had material in the company email system that was breached. The companies include household names as well as US government departments.
So far, six of Deloitte’s clients have been told their information was “impacted” by the hack. An internal review of the incident is underway.
According to The Guardian, Deloitte discovered the hack in March this year, but the attackers may have had access to its systems since October or November 2016.
The hacker’s obtained privileged, unrestricted “access to all areas” after the firm’s global email server was compromised through an “administrator’s account.”
The account required only a single password and did not have “two-step” verification, sources said.
Emails to and from Deloitte’s 244,000 staff were stored in the Azure cloud service, which was provided by Microsoft.
In addition to emails, the hackers had potential access to usernames, passwords, IP addresses, architectural diagrams for businesses and health information, with some emails having attachments with sensitive security and design details.
The breach is believed to have been US-focused and was regarded as so sensitive that only a handful of Deloitte’s most senior partners and lawyers were informed.
It has yet to establish whether a lone wolf, business rivals or state-sponsored hackers were responsible.
-
Global accounting firm Deloitte hit by major cyberattack, reveals client emails: report
Sep 25, 2017 | GlobalNews.ca (Canada)
By Katie Dangerfield
One of the world’s top accountancy companies, Deloitte, has been hit by a targeted cyberattack that apparently resulted in the release of clients’ confidential information, the Guardian reported Monday.
Emails, passwords, usernames and IP addresses were apparently accessed by the hack.
Deloitte — one of the big four accounting firms in the world — confirmed to the Guardian, it had hacked but said only a small number of its clients had been impacted.
The attack was said to have been discovered earlier this year, according to the report, and client information was leaked. The report also said the attackers may have accessed the systems since October or November 2016.
The cyberattack focused on the U.S. operations of the company, which provides auditing, tax advice and consultancy to multinationals and governments worldwide, the report said.
Deloitte said it reviewed its systems following the attack and only a small number of clients are affected.
“In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilizing a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman told the Guardian.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.”
Deloitte also operates in Canada. Global News reached out to the company to see if any Canadian clients were impacted, but we have not heard back yet.
This breach comes weeks after Equifax, the U.S. credit monitoring agency, said the personal data of 143 million U.S. customers and 100,000 Canadian costumers had been accessed or stolen in a massive cyberattack in May.
The breached data may have included names, addresses, social insurance numbers and — in some cases — credit card numbers.
-
Deloitte Hacked: Banks, Government Agencies & Multinationals Data Breached
Sep 25, 2017 | Digit
Only days after Equifax suffered one of the largest data breaches in recent history, The Guardian reports that Deloitte, one of the world’s largest accountancy firms has suffered a ‘sophisticated hack’ which gave the attackers access to the company’s e-mail servers as an administrator.
This gave the hackers access to all of the data sent via e-mail, including attachments, affecting many of the company’s biggest clients, including government departments from numerous countries, banks and multinational corporations in media, healthcare and other industries.
Professor Bill Buchanan OBE, the head of Edinburgh Napier University’s Cyber Academy, told DIGIT: “This attack is another example of companies not taking security seriously. To have a single password for the administrator account for a financial services company is extremely sloppy. Increasingly companies need to be using multi-factor authentication for administrator access. This should include “out-of-band” methods, such as using an additional access step through a mobile phone. With an increasing number of companies using Cloud-based email systems, they need to understand that they need to increase security and apply encryption wherever possible, and especially lock-down access from trusted places.”
Award Winning Cyber Security Consultancy
Deloitte’s investigation into the incident is ongoing, but according to The Guardian, six of the company’s clients have so far been informed that their data was ‘impacted’. The incident is doubly troubling for Deloitte as the company – which was ranked the world’s best cyber security consultancy in 2012 – offers advice to clients on cyber security and avoiding attacks similar to the one it has suffered.
Deloitte’s website states: “Cyber risk is more than a technology or security issue, it is a business risk. While today’s fast-paced innovation enables strategic advantage, it also exposes businesses to potential cyber-attack. Embedding best practice cyber behaviours help our clients to minimise the impact on business.”
“We monitor and assess the threats specific to your organisation, enabling you to swiftly and effectively mitigate risk and strengthen your cyber resilience. Going beyond the technical feeds, our professionals are able to contextualise the relevant threats, helping determine the risk to your business, your customers and your stakeholders.”
The breach, which is currently believed to have primarily focused on the USA, was regarded as so confidential that only Deloitte’s most senior partners (and lawyers) were informed.
The Guardian says the company has now involved specialist investigators, to to map out exactly where the hackers went, by analysing the which searches the hacker(s) carried out.
There is no information on whether the hack was the work of an individual, rival companies or state-sponsored hackers. The Guardian suggests that 5 million e-mails may have been vulnerable in the attack, however Deloitte states that the hack affected ‘a fraction’ of that number.
Security expert Stu Hirst, the Head of SecOps for Capital One, said: “Major businesses will continue to be targets for hackers given the value of information that can potentially be obtained. As our industries become cloud-first, it has never been more important to adopt world-class security practices & procedures to protect against data loss. Email especially continues to be a medium where vitally sensitive information is shared, so encrypting in transit & at rest should be mechanisms to prevent secrets being deciphered.”
Deloitte Responds
A spokesman for Deloitte told The Guardian: “In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte,”
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required.
“Our review enabled us to determine what the hacker did and what information was at risk as a result. That amount is a very small fraction of the amount that has been suggested.”
-
Emails and more could be breached in possible Deloitte cyberattack
| Digital Look
By Josh White
Deloitte has been the subject of the latest major cybersecurity attack, with confidential information from some of its clients reportedly compromised.
The London-registered, New York-based big four accountancy firm has had its email system breached, the Guardian reported, with the content of some emails - possibly including financial planning information of some of its blue-chip clients - said to be impacted.
It’s understood six of Deloitte’s clients have been informed that their information was involved, with the company undertaking an internal review.
The company apparently discovered the hack in March, although attackers could have had access to the email systems as far back as October 2016.
On top of the emails, the Guardian report suggests the hackers may have been able to access usernames, passwords, IP addresses, health information and architectural diagrams for business planning.
An administrative account was used by the attacker to gain unfettered access to the company’s cloud email service, hosted through Microsoft Azure, with the administrator’s account reportedly not having two-factor authentication turned on.
Two-factor authentication requires a second level of authentication above and beyond a password - usually a code sent to a user’s mobile phone, to ensure the person accessing the account is the intended user.
It’s understood the breach was focusses on the US, and Deloitte’s internal investigators were still not certain of who the attacker was, or whether it was a business, a state-sponsored hacker, or an individual.
The revelation comes weeks after details of a major security breach of credit reporting firm Equifax was reported.
That saw the credit and social security details of up to 143 million Americans, and a number of overseas individuals, potentially compromised.
-
Deloitte hacked, compromising its clients' emails
Sep 25, 2017 | CNET
By Ben Fox Rubin
The consulting firm Deloitte was hit with a cyberattack that may have revealed the emails of its government and corporate clients, The Guardian reported Monday.
Deloitte uncovered the hack in March, but hackers may have had access to the company's systems as far back as October.
The hackers appeared to breach the email servers by using an "administrative account," which may have had broad access to the company's emails, the publication said.
In addition to emails, hackers may have accessed usernames, passwords, IP addresses and health information.
Deloitte confirmed to The Guardian it was hacked by told the publication only a small number of clients were affected.
Deloitte representatives didn't immediately respond to a request for comment from CNET.
-
Deloitte hack: Secret client data hijacked in cyberattack that went 'unnoticed for months'
Sep 25, 2017 | International Business Times
By Jason Murdock
A major cyberattack at consultancy giant Deloitte reportedly went undiscovered for months, with investigators now deep into a probe to uncover exactly what was stolen.
The intrusion, which was seemingly gained through an administrator's weakly-protected account, has potentially exposed vast amounts of sensitive data from clients, who include some of the world's largest financial institutions, companies and government agencies.
According to The Guardian, which first reported news of the incident, at least six Deloitte clients have been informed that their data was compromised.
The culprit remains a mystery, but the New York-headquartered firm is now probing the possibilities, be it rogue insider, nation-state group or lone hacker.
The identities of the victims are yet to be disclosed.
The global professional services giant – which made $37bn (£27.3bn) revenue in 2016 – is now conducting a full internal review, dubbed "Windham."
The Guardian reported that Deloitte uncovered a breach of its "global email server" in March this year, but experts believe hackers may have been inside as far back as October 2016.
The staffer's compromised account had only one password and did not use two factor authentication, the newspaper reported, adding that usernames, passwords, email attachments and internal infrastructure data of its clients were all vulnerable to hijacking.
That fact would dampen claims that the hack was "sophisticated", as some reports suggest.
In terms of scope, a Deloitte spokesperson said stolen material was "a fraction" of the total five million emails stored in the targeted Microsoft Azure cloud server.
The spokesperson added: "In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review, including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte.
"As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators."
The firm did not elaborate on what government departments or law enforcement agencies it had contacted, but asserted that "no disruption" was caused to clients' businesses.
In reality, it is likely too early to tell what damage has been done by the months-long attack.
The statement added: "We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter."
According to Reuters, Deloitte is expected to release a statement on the matter "soon".
The news comes after a massive cyberattack was disclosed from US credit-monitoring companyEquifax, which exposed millions of records, including 400,000 from British customers.
-
Hackers hit accountancy firm Deloitte, stealing plans, emails and passwords
| Beta News
By Mark Wycislik-Wilson
Global accountancy firm Deloitte -- known as one of the "big four" -- has been hit by a sophisticated hack. With echoes of the Equifax data breach and CCleaner hack, the cyberattack went undetected for months and results in confidential emails being accessed, as well as company plans, and the private information of high-profile, blue-chip clients.
Deloitte says that only a small number of its clients have been affected, but the size and importance of those that it deals with -- including US government departments -- means that even a limited number could have great impact. The firm is said to have discovered the hack in March, but it is possible that attackers gained access as long ago as October 2016.
The Guardian -- which first broke the story -- says that the attack was focused on the US side of Deloitte's operations, and data belonging to banks, multinationals, media enterprises, pharmaceutical firms and government agencies was included in the breach. At the moment, Deloitte has only notified six of its clients that they have been "impacted" by the attack, and an investigation is underway.
The data accessed is said to be so sensitive in nature that only Deloitte's most senior partners and lawyers were informed of the attack. It is thought that as well as emails (complete with sensitive security and design details in attachments), the hackers may have also accessed usernames, passwords, IP addresses, architectural diagrams for businesses and health information.
It is understood that hackers were able to use an administrator account to gain access to the firm's global email server. Stored on Microsoft's Azure cloud service, this was not protected with two-factor authentication.
Speaking to the Guardian, a Deloitte spokesman said:
In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilizing a team of cybersecurity and confidentiality experts inside and outside of Deloitte. As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
Deloitte's Rosslyn, Virginia offices have been used for the last six months to carry out an investigation using the codename Windham. The firm added:
We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required.
Our review enabled us to determine what the hacker did and what information was at risk as a result. That amount is a very small fraction of the amount that has been suggested.
It is not known which government departments have been affected by the attack, and it's not clear whether this was a state-sponsored hack.
-
Deloitte insists ‘very few’ clients hit by major cyber attack
Sep 25, 2017 | Belfast Telegraph
Accountancy giant Deloitte has insisted “very few clients” have been impacted by a major cyber attack that saw hackers target the company through its email system.
The professional services firm said on Monday that it had launched an “intensive and thorough review” into the attack, which saw data accessed from an “email platform”.
Deloitte said it immediately contacted government authorities after it became aware of the incident, though reports suggest it was months before the breach was detected.
The company said it had also contacted “each of the very few clients impacted”.
A spokesman for the company said: “Importantly, the review enabled us to understand precisely what information was at risk and what the hacker actually did, and to determine that only very few clients were impacted (and) no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.”
Six of its clients have reportedly been notified that their information was hit by the attack. US government departments and companies with big household names were reportedly among the clients that had information in the affected email system, according to The Guardian, which broke the story.
It said hackers probably had access to the firm’s global email server through an administrator’s account since October or November last year, and could have accessed passwords, usernames, IP addresses and health information.
The Guardian said the breach of the email system was only discovered in March, giving hackers months to access the data.
Deloitte said it has reviewed its email platform.
The company’s 250,000 staff reportedly had their emails stored on Microsoft’s Azure cloud service, but it is believed to have been a US-focused attack.
A spokesman for the firm said: “Deloitte remains deeply committed to ensuring that its cyber-security defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security.”
-
Deloitte cyber-attack reveals blue-chip client details – report
Sep 25, 2017 | Computer Business Review
By James Nunns
Accountancy firm Deloitte has reportedly been hit by a cyber-attack that’s resulted in secret client emails being revealed.
According to The Guardian, a “sophisticated hack that compromised the confidential emails and plans of some of its blue-chip clients,” went unnoticed by the firm for months.
The report says that Deloitte’s customers across the banking sector, media, pharmaceuticals, and government firms all had material in the email system that was breached.
According to the report, six of Deloitte’s clients have been told that their information has been impacted by the hack.
The Guardian said that the hacker may have had access to the system as far back as October or November, with Deloitte only discovering it in March.
Sources told the publication that an “administrator’s account” is believed to have been accessed and that gave the hacker “in theory” broad access to all areas.
In addition to the emails, which were stored in Microsoft Azure, allegedly being breached, the Guardian alleges that hackers may have also had access to usernames, passwords, IP addresses, architectural diagrams for businesses and health information.
An internal enquiry, codenamed “Windham” is said to be underway and a US law firm called Hogan Lovells was hired back on April 27th under “special assignment” to review a “possible cybersecurity incident.”
Deloitte confirmed to the Guardian that it had been hacked, but played down how many clients may have been impacted.
“In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman said.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.
“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required.
“Our review enabled us to determine what the hacker did and what information was at risk as a result. That amount is a very small fraction of the amount that has been suggested.”
Javvad Malik, security advocate at AlienVault, said: “The unfortunate incident demonstrates that even the largest of organisations can sometimes overlook fundamental security practices such as not enabling two-factor authentication on administrative accounts.”
“It also highlights the importance of ongoing monitoring and threat detection so that any malicious activity can be detected and responded to in a timely manner.”
-
Sep 25, 2017 | This Is Money (UK)
By Jane Denton
Accounting and professional services firm Deloitte has been hit by a cyber attack, with hackers accessing confidential details and plans from some of the group's clients, including multinational blue-chip companies and US government departments.
The firm, which is one of Britain's 'Big Four' accountancy firms, is understood to have discovered the attack in March, but hackers could have had access to the group's confidential data since October or November last year, the Guardian said.
The secret information accessed by the hackers is believed to come mainly from Deloitte's US clients, including household names in the world of banking, media and pharmaceutical firms, as well as US government agencies.
To date, it is understood that six of Deloitte's clients from across the pond have been contacted by the accountancy firm informing them that their confidential details have been 'impacted.''In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte', a spokesman said.
'As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators', the spokesman added.
The hacker or hackers gained access to Deloitte's email server via an 'administrator's account'.
In addition to emails, the Guardian said the hackers had potential access to usernames, passwords, IP addresses, architectural diagrams for businesses and health information. Some emails had attachments with sensitive security and design details.
While Deloitte is registered in London, the firm has its headquarters in New York. The group is yet to determine the identity or location of the hacker, meaning it remains unclear whether the attack was state-sponsored, by a group of hackers or a lone wolf.
Earlier this year, Deloitte posted record revenues of £27.3billion for last year. The group said it achieved growth in each of its five business areas, namely Audit & Assurance, Consulting, Financial Advisory, Risk Advisory and Tax & Legal.
DELOITTE'S RESPONSE IN FULLA Deloitte spokesperson told This is Money: 'Deloitte’s response to the cyber incident included the following:
· Implementing its comprehensive security protocol and initiating an intensive and thorough review which included mobilizing a team of cyber-security and confidentiality experts inside and outside of Deloitte;
· Contacting governmental authorities immediately after it became aware of the incident; and,
· Contacting each of the very few clients impacted
The attacker accessed data from an email platform. The review of that platform is complete.
Importantly, the review enabled us to understand precisely what information was at risk and what the hacker actually did and to determine that:
· Only very few clients were impacted
· No disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers
Deloitte remains deeply committed to ensuring that its cyber-security defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security.'
-
Deloitte Email Platform and Client Data Accessed by Cyberattack (UPDATE)
Sep 25, 2017 | Bloomberg
By Giles Turner
Deloitte LLP has been targeted by a cyberattack that let hackers access data from an internal email platform.
The auditing and consulting firm said in a statement Monday that it’s currently informing the clients affected and has notified governmental authorities after it became aware of the incident.
Deloitte said "very few" clients were impacted, and has drafted outside help to review its security. The hack was first reported by The Guardian.
The email platform was stored on Microsoft’s Azure cloud platform, according to The Guardian. A spokeswoman from Microsoft declined to comment.
The U.K.-domiciled firm offers a range of consultancy services to blue-chip clients, and earlier this month posted record revenues of $38.8 billion for the fiscal year ended 31 May. Deloitte flagged that its Risk Advisory business has seen increasing demand for cybersecurity advice, and the company had launched a number of Cyber Intelligence Centers that offer clients constant threat analytics and management.
Although nowhere near the same scale, the hack follows the infiltration of Equifax Inc, where attackers accessed personal data for as many as 143 million U.S. consumers.
Regulators are facing their own challenges in their attempts to monitor hacks. The U.S. Securities and Exchange Commission this month disclosed that cybercriminals breached its online database of corporate filings, but they may have stolen corporate secrets that they profited from.
-
Deloitte confirms hack exposed email system
Sep 25, 2017 | Zero Day Net
By Zack Whittaker
Tax and auditing giant Deloitte has confirmed it was targeted by a cyberattack, resulting in the theft of confidential documents and emails.
The New York-headquartered company confirmed the breach in an email to sister-site CNETafter news of the breach was first reported by The Guardian.
In an email, the company said that there had been no disruptions to client businesses or its own operations.
Deloitte stands as one of the largest private companies in the US, which reported $38.8 billion in revenue last fiscal year, offering tax, auditing, consulting, and cybersecurity advisory services to major governments and large Fortune 500 multinationals.
But it was the company's own cybersecurity effort that was undermined, according to The Guardian's report.
The report said that the unknown attacker gained access to the email server's administrator account, giving the attacker unfettered access to the company's Microsoft-hosted email mailboxes.
The report said that the account did not have two-factor authentication, which would have alerted the account owner to unauthorized use of the account, and may have prevented the attacker's access.
The lack of two-step verification led to a similar, albeit smaller breach of the UK parliament's email systems earlier this year.
The company declined to say which clients or companies were affected, but The Guardian said six clients of Deloitte were told that their data was affected by the breach, including US government departments. The attackers also had access to sensitive corporate documents within those inboxes.
Deloitte said that it is "implementing its comprehensive security protocol and initiating an intensive and thorough review which included mobilizing a team of cyber-security and confidentiality experts inside and outside of Deloitte," and that it's contacting governmental and regulatory authorities. The company did not say which authorities, however.
Deloitte, when reached, would not address several of our questions prior to publication.
Deloitte is the latest corporate giant that's been hit as a result of a high-profile cyberattack. Last month, Equifax revealed its systems had been breached, affecting as many as 143 million consumers. And, earlier this month, the Securities and Exchange Commission, which regulates the US securities industry, said that a hack on its systems may have given attackers access to gain advantages in stock trading.
-
Deloitte hacked, cybersecurity attack compromises client emails and plans
Sep 25, 2017 | Tech Republic
By Conner Forrest
Accountancy firm Deloitte was recently the victim of a cyberattack that left confidential client emails and business plans exposed, according to a Monday report from the Guardian.
According to the report, Deloitte discovered the breach in March of this year. However, it is possible that the attackers could have breached the firm's network back in October or November 2016. Because of the sensitive nature of the breach, only senior partners and legal professionals were initially informed.
While the affected clients were not revealed, The Guardian did note that they were blue-chip clients. "The companies include household names as well as US government departments," the report said. The breach seems to have been focused on US-based companies.
Deloitte does business with companies in verticals such as media, banking, pharmaceuticals, and more. The Guardian reported that six Deloitte clients have already confirmed that the hack had impacted their data.
Attackers were initially able to gain access into Deloitte's email server with an admin account that gave them unrestricted access to the network. The account itself was protected with a single password and did not have multi-factor authentication setup, The Guardian reported.
The emails were stored in Microsoft Azure. Some 5 million emails were said to have been stored in the cloud when it was compromised, but Deloitte told The Guardian that only a fraction were actually at risk.
Attackers also got access to other account credentials, IP addresses, sensitive email attachments, and "architectural diagrams for businesses and health information," the report said.
Deloitte hired law firm Hogan Lovells back in April to begin looking into the hack. At the time of this writing, an internal review is still ongoing.
The 3 big takeaways for TechRepublic readers
Accountancy firm Deloitte was the victim of a cybersecurity attack that could have put 5 million emails, and other sensitive business data at risk, The Guardian reported. The attack was discovered back in March 2017, but the attackers could have gained access as early as October 2016, the report said. Other data, such as business diagrams, were also compromised, and Deloitte's internal review is still ongoing.
-
One of the World's Biggest Accounting Firms Hacked After Basic Security Goof
Sep 25, 2017 | Gizmodo
By Rhett Jones
For months, the systems of Deloitte, a consulting and accounting firm that ranks among the world’s “big four,” were compromised and hardly anyone knew it. According to the Guardian, the breach has been kept under wraps since it was noticed by administrators in March. The attackers were able to access information from Deloitte’s major corporate and government clients in the US—all because, it appears, someone didn’t use two-factor authentication.
Lately it seems like a sophisticated hack is deployed against a major target with troves of sensitive data on a weekly basis. But in Deloitte’s case, the hackers reportedly just needed to acquire a single password from an administrator of the firm’s email accounts. The Guardian reports that the intruders had “access to all areas” of the email system. Internal investigators say they’ve been able to follow an electronic trail that shows major clients were the point of interest.
The full details of the breach are sketchy and Deloitte appears to have taken great pains to keep its investigation, codenamed “Windham,” under wraps. Only senior partners and lawyers were informed when the breach was noticed in March after an outside law firm was brought in to investigate “a possible cybersecurity incident.”
Deloitte insists that only a small fraction of its clients have been “impacted” by the breach. So far, six clients have been notified that the hackers were able to access “usernames, passwords, IP addresses, architectural diagrams for businesses and health information,” and in some cases sensitive security information. In total, the system reportedly stored emails from 244,000 staff members on Microsoft’s Azure cloud.
A spokesperson for Deloitte told the Guardian that in the course of implementing “its comprehensive security protocol,” it found “that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.” It also said it has notified government authorities and regulators but declined to specify which ones. Gizmodo has reached out to Deloitte for further information and we’ll update this post when we receive a reply.
For Deloitte, this is particularly embarrassing because—among many other services—the multinational firm runs a “CyberIntelligence Centre” that advises clients on how to “swiftly and effectively mitigate risk and strengthen your cyber resilience.” In 2012, research and advisory firm Gartner named Deloitte the best cybersecurity consultant in the world. As is so often the case, you can have the most fool-proof security operations around, but if some fool doesn’t use two-factor authentication, you’re a sitting duck.
-
A cyberattack at Deloitte may have revealed blue-chip client information
Sep 25, 2017 | CNBC
By Sara Salina
A cyberattack at Deloitte, one of the "big four" accounting firms, went unnoticed for months and may have revealed confidential client emails and plans, according to a report Monday from the British newspaper the Guardian.
The firm believes hackers gained access through Deloitte's email server. The breach could have also revealed usernames, passwords, IP addresses and health information for primarily U.S.-based clients, the newspaper said.
Deloitte is still investigating the incident, but said in a statement to CNBC that the review of the email platform is complete.
The company contacted governmental authorities immediately after discovering the attack and notified each of the "very few" clients impacted, a Deloitte spokesman said in the statement.
"Deloitte remains deeply committed to ensuring that its cybersecurity defenses are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity," the spokesman said.
The firm is registered in London and has its headquarters in New York and boasts clients including Morgan Stanley, Berkshire Hathaway, Starbuck's, Boeing and Microsoft, along with global banks, media organizations and government agencies.
Six clients have been told their information was "impacted" by the breach, according to the Guardian.
The firm offers cybersecurity advice to clients.
Deloitte discovered the breach in March, the newspaper said, but it is thought the hackers may have breached its systems in October or November of 2016.
-
Deloitte impacted by cyberattack: report
Sep 25, 2017 | The Hill
By Morgan Chalfant
Deloitte was hit with a cyberattack that allowed hackers access to company emails and possibly confidential client information, the Guardian is reporting.
A global company with headquarters in New York, Deloitte provides consulting, financial advisory, risk management, tax and other services to clients around the world, including major banks, companies, and U.S. government departments and agencies.
The hack was reportedly discovered in March, but hackers potentially had access to the company’s systems as far back as October or November of last year—meaning the access went undetected for as many as six months.
Hackers are said to have compromised the company’s system through an administrator account, which was secured by a password but did not have two-factor authentication in place.
News of the hack comes two weeks after credit reporting firm Equifax acknowledged a breach that may have impacted up to 143 million Americans, an incident that has put the spotlight on cyber threats to major private sector entities.
According to the Guardian, some company clients, including major companies and U.S. government entities, had information in the company’s email system at the time of the breach.
Hackers potentially had access to 5 million emails stored in the company’s Azure cloud, which is managed by Microsoft. The breach may also have offered hackers access to usernames, passwords, IP addresses, business diagrams, and other sensitive information.
Deloitte confirmed to the Guardian that it was a victim of a hack but said that “few clients” had been impacted. A spokesman for the accounting firm did not immediately return a request for comment from The Hill.
“In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilizing a team of cybersecurity and confidentiality experts inside and outside of Deloitte,” a spokesman told the Guardian.
The company said it has contacted “the very few clients impacted and notified governmental authorities and regulators.”
Six clients have reportedly been notified that their information was impacted by the breach.
-
Major accounting firm Deloitte reports extensive cybersecurity breach
Sep 25, 2017 | Engadget
By Mallory Locklear
Deloitte, a major US and global accounting firm, revealed that it was hit with a cybersecurity breach that may have extended from October of last year through this past March, the Guardian reports. The company -- one of the world's Big Four accounting firms -- which works with large banks, global firms and government agencies, among others, provides tax and auditing services, operations consulting, merger and acquisition assistance and, wait for it, cybersecurity advice.
It's currently unclear who was behind the attack, but for the past six months, Deloitte has been investigating the breach of its email server, which exposed some five million emails. Along with emails and their sometimes sensitive attachments, the hackers may have gotten their hands on usernames, passwords, IP addresses, business information and workers' health records. The breach apparently stemmed from an administrator's account that was protected by a password and not two-step verification.
The Guardian reports that six of Deloitte's clients have been notified that their information was affected. A Deloitte spokesperson told the newspaper, "In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte." The review of the breach is ongoing and the company is working to retrace the hacker's steps to see exactly what information was accessed. "The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers," said the spokesperson.
Deloitte hasn't stated which of its clients, which include US government agencies, have been impacted, but said, "As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators. We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required."
-
Sep 25, 2017 | BBC News
Corporate finance giant Deloitte suffered a cyber-attack that compromised confidential data, including the private emails of some of its clients, the company has confirmed.
Its system had been accessed via an email platform and "very few" clients had been affected, Deloitte said.
The Guardian reported the attack had been discovered in March but could have happened months earlier.
Deloitte said it had contacted those whose data had been accessed.
It did not confirm exactly how many people had been affected or how much information had been compromised.
Deloitte carries out auditing, consultancy, tax and financial advice services for clients worldwide.
For the year ending on 31 May, it reported revenues of of £3.38bn ($4.6bn).
Email addresses
Prof Alan Woodward, cyber-security expert at Surrey University, told the BBC that private email addresses alone were valuable data for hackers.
"Many people expect their email address to be in the public domain," he said.
"But what most people have done when dealing with confidential matters is they have a second address - and it looks like it is that one that may have been let out here.
"Is it immediately going to be mean people's data will be breached? Not really - but the secondary, more confidential email addresses mean phishing can become much more sophisticated."
Phishing is an attempt by criminals to get valuable information, such as banking login details, by pretending to be emailing from an official source.
It is more likely to succeed if it is sent to an address that regularly receives correspondence from the real organisation.
Deloitte said it had reviewed the email platform accessed and had determined there had been "no disruption" to the work of its clients.
However, Tony Pepper, chief executive of data security company Egress, said that compromised email servers could be full of sensitive information.
"This is why multi-factor access control such as two-factor authentication is important, especially for administrators," he said.
"It makes it much harder to gain illicit access in the first place, and provides a warning if someone is trying to log in without your knowledge."
Two-factor authentication involves providing extra information before logging in - for example, an access code sent by text message.
Mr Pepper added that individual emails should also be encrypted.
In a statement, Deloitte said it had informed government authorities and regulators of the breach.
"Deloitte remains deeply committed to ensuring that its cyber-security defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber-security," it said.
-
Deloitte hit by major cybersecurity breach
Sep 25, 2017 | Click Lancashire (UK)
By Marco Green
Following on from an attack which exposed millions of Equifax customer details earlier this month, The Guardian is reporting Deloitte has been similarly targeted by an especially sophisticated hack.
Deloitte - one of the big four accounting firms in the world - confirmed to the Guardian, it had hacked but said only a small number of its clients had been impacted.
The attack was believed to have been focused on the U.S operations of the company, which provides auditing, tax advice and consultancy to multinationals and governments worldwide.
At the moment, Deloitte has only notified six of its clients that they have been "impacted" by the attack, and an investigation is underway.
The Guardian said that the hacker may have had access to the system as far back as October or November, with Deloitte only discovering it in March.
The hacker's obtained privileged, unrestricted "access to all areas" after the firm's global email server was compromised through an "administrator's account".
It's understood the breach was focusses on the USA, and Deloitte's internal investigators were still not certain of who the attacker was, or whether it was a business, a state-sponsored hacker, or an individual.
The global professional services giant - which made $37bn (£27.3bn) revenue in 2016 - is now conducting a full internal review, dubbed "Windham".
In addition to emails, the hackers had potential access to usernames, passwords, IP addresses, architectural diagrams for businesses and health information, with some emails having attachments with sensitive security and design details.
"In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte", a spokesman said.
The culprit remains a mystery, but the New York-headquartered firm is now probing the possibilities, be it rogue insider, nation-state group or lone hacker.
It also contacted authorities immediately after it found out about the incident and contacted each of the clients affected.
The statement added: "We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter".
-
Sensitive client emails, usernames, passwords exposed in Deloitte hack
Sep 25, 2017 | The Register (UK)
By John Leyden
Deloitte, one of the world's "big four" accountancy firms, has fallen victim to a cyberattack that compromised sensitive emails.
The breach dates back to November 2016 but was only discovered in March, according to The Guardian, which broke the news through an exclusive on Monday. Deloitte has reportedly informed six of its clients that their information was "impacted". The firm's internal review into the incident is ongoing.
Hackers gained access to Deloitte's email system through an administrative account that was not secured using two-factor authentication, The Guardian reports. Emails to and from Deloitte staff were hosted on Microsoft's Azure cloud service. As well as email, hackers may have had access "usernames, passwords, IP addresses, architectural diagrams for businesses and health information".
The breach is said to have been US-focused. A Deloitte spokeswoman confirmed over the phone that it had been the victim of a breach. The firm forwarded a lengthy statement (below) that said only a few customers had been affected but didn't get into numbers or how much information was potentially exposed.
Deloitte's response to the cyber incident included the following:
· Implementing its comprehensive security protocol and initiating an intensive and thorough review which included mobilizing a team of cyber-security and confidentiality experts inside and outside of Deloitte;
· Contacting governmental authorities immediately after it became aware of the incident; and,
· Contacting each of the very few clients impacted
The attacker accessed data from an email platform. The review of that platform is complete.
Importantly, the review enabled us to understand precisely what information was at risk and what the hacker actually did and to determine that:
· Only very few clients were impacted
· No disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.
Deloitte remains deeply committed to ensuring that its cyber-security defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security.
Tony Pepper, co-founder and chief exec of encryption tech provider Egress, said: "Whilst it hasn't been confirmed exactly what was stolen, compromised mail servers can be a good source of sensitive information for an attacker, allowing them to siphon off message content and attachments. This is why multi-factor access control such as two-factor authentication is important, especially for admins. It makes it much harder to gain illicit access in the first place, and provides a warning if someone is trying to log in without your knowledge."
Deloitte provides auditing, tax consultancy and a range of cybersecurity services to banks, multinationals and government agencies.
-
Deloitte says it's been hacked
Sep 18, 2017 | CNN Money
By Alanna Petroff
The global accountancy firm Deloitte said Monday it was the victim of a hack that targeted its email system.
The cybersecurity breach, which was first reported by The Guardian newspaper on Monday, impacted "only very few clients," Deloitte said in an emailed statement.
The firm said it contacted "governmental authorities immediately after it became aware of the incident .... No disruption has occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers."
Deloitte is one of the "big four" accounting firms, offering audit, tax and advisory services to large global corporations. It reported global revenue of nearly $39 billion in its latest fiscal year, and risk advisory was one of its fastest growing business segments. It's competitors include PwC, EY and KPMG.
The Guardian reported Monday that the hack compromised "confidential emails and plans of some of its blue-chip clients," but the breach went unnoticed for months. It reported that six clients were told their information was "impacted."
Deloitte did not provide further information about when the breach happened or how many emails were accessed.
This is especially embarrassing for a firm that prides itself on helping other companies thwart online cybersecurity attacks.
The company's website boasts that its "Cyber Intelligence Centre integrates state-of-the-art technology with industry insight to provide round-the-clock business-focused operational security [to clients]."
Deloitte is just the latest firm to fall victim to a high-profile cybersecurity breach.
Equifax (EFX) announced this month that there was an incident in which hackers were able to gain access to personal information for about 143 million Americans, along with a large number of Canadian and British individuals.
This spurred the FBI and the U.S. Federal Trade Commission to launch investigations. At least 50 class action lawsuits have been filed against the company.
Even the U.S. Securities and Exchange Commission was recently hacked.
The financial regulatory agency said its network was hacked last year, possibly allowing intruders to make money by seeing crucial financial information before everyone else.
SEC officials said the problem that made them vulnerable to the hack was quickly discovered and fixed. But it "resulted in access to nonpublic information" that "may have provided the basis for illicit gain through trading." An investigation is under way.
-
Deloitte says 'very few' clients hit by hack
Sep 25, 2017 | AFP News
Deloitte said Monday that "very few" of the accounting and consultancy firm's clients were affected by a hack after a news report said systems of blue-chip clients had been breached.
Deloitte said it immediately contacted government authorities and the affected clients after discovering the hack, which stemmed from a breach in an email platform, the firm said in a statement.
"Only very few clients were impacted," the company said. "No disruption has occurred to client business, to Deloitte's ability to continue to serve, or to consumers."
"Deloitte remains deeply committed to ensuring that its cyber-security defenses are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security," the company said.
The Guardian reported Monday that six Deloitte clients had information breached by a sophisticated attack and hackers potentially had access to usernames, passwords, IP addresses, architectural diagrams for business.
Deloitte discovered the attack in March, but the hackers may have had access to the information since October or November 2016, the newspaper reported.
The Guardian described the breach as a "deep embarrassment" for the company in part because it advises clients on cybersecurity.
The Deloitte hack comes on the heels of numerous attacks on major institutions and companies in recent years. Credit ratings service Equifax is under fire after disclosing this month a breach of its systems that exposed data from about 143 million US customers.
Last week, the US Securities and Exchange Commission disclosed that a software vulnerability allowed hackers to gain "nonpublic" information that could have enabled them to make profits with inside information.
-
Sep 25, 2017 | Telegraph (UK)
Global accountancy firm Deloitte has been hit in a cyber attack that compromised the data of a small number of its clients.
The company said attackers had accessed data from its email platform, but gave few details about how its systems had been breached.
Deloitte, one of the "big four" accountants, said it has mobilised a team of cyber-security experts to review its systems and discover what information has been put at risk.
It said "very few" clients had been affected.
"No disruption has occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers," the company said.
The firm, which provides auditing, tax advice and consultancy to multinationals and governments, did not say when the attack occurred or how its defences had been breached.
Deloitte discovered the hack in March, but the cyber attackers could have had breached its systems as long ago as October or November 2016, according to the Guardian.
The attack is believed to have targeted the company's US operations.
Deloitte's statement did not say when the attack took place or who was targeted.
Deloitte, which also provides cyber security and consulting services, including helping businesses analyse potential acquisition targets, did not say which units were affected.
It said it had implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cyber security and confidentiality experts inside and outside of Deloitte.
The firm said it contacted government authorities immediately after it became aware of the incident, and it had contacted each client that had been affected.
-
Deloitte, a source of cyber-security advice - hacked, emails accessed
Sep 25, 2017 | SC Media
Five years ago Gartner ranked the big-four accounting firm Deloitte as number one in cyber-security, but today it has been reported that usernames, passwords and personal details of some of its leading clients have been obtained by hackers.
The Guardian newspaper reports that the London registered company with global headquarters in New York, had its email system hacked, possibly as long ago as October or November 2016, but it discovered the breach in March this year. With a reported US$ 37 billion (£27.3 billion) revenue last year, it is one of the largest private firms in the US, and as well as accountancy services, provides “high-end cyber-security advice to some of the world's biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies,” according to the report which notes that at least six major clients have been informed that their data is impacted.
All emails to and from Deloitte's 244,000 staff are stored in an Azure cloud service, provided by Microsoft and it appears that an “administrator's account” was used to give the hackers unrestricted “access to all areas.”
According to the report, on 27 April Deloitte hired US law firm Hogan Lovells on “special assignment” to review what it called “a possible cyber-security incident” with the investigation subsequently codenamed “Windham.”
The Guardian quotes a spokesperson saying, “In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cyber-security and confidentiality experts inside and outside of Deloitte. As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators,” adding “.... no disruption has occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers.”
Only a small fraction of the reported five million emails at risk are reported to have actually been accessed.
Industry commentators contacting SC include Dr Jamie Graves, CEO, ZoneFox who noted how, “This attack is another clear example that anyone can be affected by cybercriminals - even those whose speciality is to stop them. It's discomforting to see that even an experienced firm as Deloitte have fallen victim to attackers supposedly using an administrative password and account to access their Azure storage. This has to act as a wake-up call for the industry to pursue a more proactive, threat-hunting approach to their cyber-security. “
In response to the suggestion that the account only needed a password and did not use two factor verification, Graves added, “Passwords still have a hugely important role to play in securing information, but they have to be combined with other layers of security within a two or multi-factor approach. The bottom line is that data visibility has to be in place for an effective, modern security structure; firms need to know not just who is accessing their data, but where it's being accessed from, what has specifically been looked at and where the data (or copies of it) is residing, while stationary and in transit.
“Extra layers - such as IP listing and user behaviour analytics - would have helped Deloitte identify that outside agents were using the administrative account; certainly reducing the time the attackers spent within the network before being noticed. Months of access combined with six months of behind-the-scenes work before the attack has come to general attention would certainly fall foul of GDPR once it goes live and does little to generate sympathy for the firm. It's a worthy tactic to try and trace the cyber-footsteps of the attackers now, but a more proactive approach, utilising machine learning and augmented or artificial intelligence, will ensure firms can identify threats before they can create a major security concern.”
Tony Pepper, co-founder and CEO of Egress agrees noting, "Deloitte is a ripe target because of the company's position right at the top of the corporate food chain. They work with some of the biggest organisations on earth, at the very highest level, which is like a red rag to a bull for hackers.
"Whilst it hasn't been confirmed exactly what was stolen, compromised mail servers can be a good source of sensitive information for an attacker, allowing them to siphon off message content and attachments. This is why multi-factor access control such as two-factor authentication is important, especially for admins. It makes it much harder to gain illicit access in the first place, and provides a warning if someone is trying to log in without your knowledge.
“Additionally, if staff's stored emails were encrypted, which arguably most sensitive content should be, then it would be impossible to decrypt each one, even with administrator access. However, if they are not and the attacker has enough time on target, hacked mail servers can provide a wealth of information."
Javvad Malik, security advocate at AlienVault, adds: "The unfortunate incident demonstrates that even the largest of organisations can sometimes overlook fundamental security practices such as not enabling two-factor authentication on administrative accounts."
"It also highlights the importance of ongoing monitoring and threat detection so that any malicious activity can be detected and responded to in a timely manner."
Nigel Hawthorn, chief European spokesperson at Skyhigh Networks, is more critical in his comments saying, “Every day that I read another major organisation has lost data due to misconfiguration, patches not implemented or user password loss I despair at our lack of appropriate IT security. It's shocking if a system was set up with a simple password allowing access to major business information.
“It should be imperative that users have least privilege access, admins should not be able to access business information, everyone should deploy multi-factor authentication, and users and traffic should be measured for unusual patterns – constant vigilance is key. You have to be paranoid because cyber-criminals ARE out to get you”.
Rob Wilkinson, corporate security specialist at internet security company Smoothwall is equally harsh in his criticism, saying companies should practice what they preach: “When an organisation that openly emphasises cyber-security as paramount to any business, is then itself found to be the victim of a major cyber-breach – as with the case of Deloitte – it asks some very serious questions of a company which may have been leaking highly-sensitive information since October last year. For a company reporting a near US$40 billion revenue ... what's clear is that not enough of that money has been poured into protecting names, emails and plans of some of its biggest clients in the case of a hack. For Deloitte, this could lead to serious financial and reputational damage, more so than any other company – it's clearly not practising what it preaches.
“While you would assume Deloitte has the appropriate monitoring, encryption and threat detection in place, it's clearly not enough to protect them from this type of “access all areas” hack.”
Sam Curry, CSO for Cybereason notes, “...if access was gained through an “administrator's account” that, in theory, gave hackers unrestricted “access to all areas' of the network, then this is a wake-up call for corporations to at a minimum have two-step authentication in place as opposed to a single password. Keep in the mind, thousands of other companies ....have been breached but have thus far managed to stay out of the headlines. Trust me, other breaches have occurred.
“I urge all corporations to immediately build out a hunting practice and to improve their security hygiene and their ability stop attackers by deploying a strategy where they can disrupt the hackers early in the process by likewise getting it right once and being able to respond, preventing attackers from setting up beachheads and back doors. Of course, garden variety threats need to be able to be detected, but the sophisticated threats need to be found and stopped earlier as well. Corporations also need a professional, modern CIRC, a real strategy for segmentation and good hygiene and to elevate the way security is managed and operated.” -
Deloitte becomes the latest victim of cyber-attack
Sep 25, 2017 | London Loves Business
By Purvai Dua
Very few clients impacted
Global accountancy firm Deloitte has been hit by a sophisticated cyber attack which has resulted in a possible breach of confidential information and plans from some of its biggest blue-chip clients.
The accountancy firm told The Guardian that its email system was breached in an attack last year in October or November, though the hack was only discovered in March this year.The cyber attack possibly came through the firm’s global email server, the Microsoft-led Azure cloud server, and was reportedly accessed through an administrator account.
Confirmed the hack, Britain’s “big four” accounting firm said: “only very few clients were impacted” and “no disruption” has been caused to the client businesses.In addition to emails, that hackers reportedly had access to usernames, passwords, IP addresses, architectural diagrams for businesses and health information.
The accounting firm stated they have reviewed the hack after going through a “comprehensive security protocol”, and had also contacted the authorities and the clients affected immediately.
According to media reports, Deloitte is reported to have launched an internal inquiry in the hack — codenamed “Windham” — which has been running since the last six months. “We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity.” the company statement added.
-
Deloitte says 'very few' clients hit by hack
Sep 25, 2017 | Phys.org
Deloitte said Monday that "very few" of the accounting and consultancy firm's clients were affected by a hack after a news report said systems of blue-chip clients had been breached.
Deloitte said it immediately contacted government authorities and the affected clients after discovering the hack, which stemmed from a breach in an email platform, the firm said in a statement.
"Only very few clients were impacted," the company said. "No disruption has occurred to client business, to Deloitte's ability to continue to serve, or to consumers."
"Deloitte remains deeply committed to ensuring that its cyber-security defenses are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security," the company said.
The Guardian reported Monday that six Deloitte clients had information breached by a sophisticated attack and hackers potentially had access to usernames, passwords, IP addresses, architectural diagrams for business.
Deloitte discovered the attack in March, but the hackers may have had access to the information since October or November 2016, the newspaper reported.
The Guardian described the breach as a "deep embarrassment" for the company in part because it advises clients on cybersecurity.
The Deloitte hack comes on the heels of numerous attacks on major institutions and companies in recent years. Credit ratings service Equifax is under fire after disclosing this month a breach of its systems that exposed data from about 143 million US customers.
Last week, the US Securities and Exchange Commission disclosed that a software vulnerability allowed hackers to gain "nonpublic" information that could have enabled them to make profits with inside information.
-
Accounting Firm Deloitte Says It Suffered Cyberattack
Sep 25, 2017 | Wall Street Journal
By Michael Rapoport
Accounting firm Deloitte said Monday it had suffered a cyberattack in which a hacker accessed data affecting a “very few” of Deloitte’s clients.
In a statement, Deloitte said it had contacted all of the affected clients and that “no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers” as a result of the incident. The firm said it notified government authorities immediately after it became aware of the incident,
Deloitte said the hacker accessed data from an email platform. The firm said it has conducted “an intensive and thorough review” of the incident, using cybersecurity and confidentiality specialists both inside of Deloitte and outside the firm.
News of the Deloitte hack follows two other major data breaches reported in recent weeks. Credit-reporting company Equifax Inc. EFX -0.07% said Sept. 7 that hackers had gained access to personal data the company held on potentially 143 million Americans. The Securities and Exchange Commission said last Wednesday that its Edgar corporate-filing system had been hacked last year and that the thieves could have benefited from access to nonpublic information.
The cyberbreach at Deloitte was first reported by the U.K.’s Guardian newspaper. The Guardian said Deloitte discovered the hack in March, and that it compromised the confidential emails and plans of some of the firm’s blue-chip clients.
Much isn’t known about the Deloitte hack, though. The firm didn’t say in which country it occurred, or to which government authorities it reported the breach. While Deloitte is a global organization, it is comprised of individual, country-based partnerships.
Deloitte and other major accounting firms have long been concerned about the possibility of cyberbreaches. Their auditing, consulting and tax-services businesses mean they hold large amounts of confidential financial data on many of the world’s largest companies, which makes them attractive potential targets for hackers.
“We’re in the business of trust and that’s something we don’t take lightly,” Jon Raphael, chief innovation officer at Deloitte & Touche LLP in the U.S., told The Wall Street Journal in a 2015 interview.
-
Global accountancy firm Deloitte admits cyber attack
Sep 25, 2017 | Sky News
By Clare Downey
Global accounting firm Deloitte has admitted it was the victim of a cyber attack which may have revealed sensitive emails belonging to some of its clients.
The company, which is one of the world's 'big four' accountancy firms, released a statement in response to media reports that its data had been compromised.
While asserting that "only very few clients were impacted" by the attack, Deloitte did reveal that the attackers had accessed data held on its email platform.
It said that it had since completed a full review of the attack, including "mobilising a team of cyber-security and confidentiality experts inside and outside of Deloitte" and had informed all affected clients.
The Guardian newspaper reported that the attack took place in October or November last year, but went undetected by the firm until March.
Deloitte provides auditing services, tax consultancy and financial risk advice to some of the world's biggest companies.
The attack is particularly embarrassing for the firm as one of the areas it advises on is how to safeguard businesses against cyber assaults.
"No disruption has occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers," a spokesperson for the company said.
"Deloitte remains deeply committed to ensuring that its cyber-security defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security."
The firm is not the first high-profile company to have been targeted by cyber-criminals in recent weeks.
Equifax, which is one of the world's largest credit checking companies, revealed last month that data belonging to 143 million customers may have been compromised in a security breach earlier this year.
It's thought to be one of the largest data breaches in history, with up to 400,000 Britons thought to have had personal information stolen in the hack.
-
Deloitte breach underlines need for better authentication
Sep 25, 2017 | ComputerWeekly.com
By Warwick Ashford
Cyber attackers have reportedly compromised Deloitte’s global email server through an administrator’s account, giving them unrestricted access to emails and attachments.
The compromised account required only a single password and did not have two-factor authentication (2FA), according to The Guardian.
The attackers may also have been able to access usernames, passwords, IP addresses, architectural diagrams for businesses and health information.
Deloitte’s auditing, tax consultancy and cyber security clients include banks, multinational media enterprises, pharmaceutical firms and government agencies.
Deloitte discovered the breach in March 2017, but it is believed the email system may have been compromised as early as October or November 2016, according to The Guardian.
The breach was regarded as so sensitive that reportedly only a handful of Deloitte’s most senior partners and lawyers were informed.
Deloitte is registered in London and its global headquarters is in New York. The breach is believed to have been US-focused.
The team investigating the breach has been reviewing potentially compromised documents for six months, but the attackers have yet to be identified, according to reports.
Six of Deloitte’s clients have so far been told their information was “impacted” by the breach, according to The Guardian, and a Deloitte spokesperson told Computer Weekly that “very few” clients had been affected.
In response to the breach, the spokesperson said Deloitte had initiated an “intensive and thorough review” that included “mobilising a team of cyber security and confidentiality experts” inside and outside the company, had contacted governmental authorities immediately after it became aware of the incident, and had contacted each of the clients affected.
Deloitte confirmed that the attackers had accessed data from an email platform and that a review of that platform was complete.
“Importantly, the review enabled us to understand precisely what information was at risk and what the hacker actually did, and to determine that only very few clients were impacted and that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers,” the spokesperson said.
“Deloitte remains deeply committed to ensuring that its cyber security defences are best in class, investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security.”
Breach after breach
News of the Deloitte breach comes just two weeks after credit monitoring agency Equifax revealed that the personal data of 143 million US consumersand about 400,000 UK consumers had been accessed in a data breach in May.
The Equifax breach was discovered in July, but those potentially affected were notified only in mid-September 2017.
Last week, several small businesses in the US filed a class-action lawsuitagainst credit rating firm Equifax, representing millions of others affected by the breach of personal data, which included names, dates of birth, email addresses and telephone numbers.
Commenting on the Deloitte breach, Javvad Malik, security advocate at AlienVault, said the incident demonstrated that even the largest of organisations could sometimes overlook fundamental security practices such as not enabling two-factor authentication on administrative accounts.
“It also highlights the importance of ongoing monitoring and threat detection so that any malicious activity can be detected and responded to in a timely manner,” he said.
Prime target for cyber attackers
Tony Pepper, co-founder and CEO of data security and encryption Egress, said Deloitte was a “ripe target” because of the company’s position at the top of the corporate food chain.
“It works with some of the biggest organisations on earth, at the very highest level, which is like a red rag to a bull for hackers,” he said.
According to Pepper, compromised mail servers can be a good source of sensitive information for an attacker, allowing them to siphon off message content and attachments.
“This is why multi-factor access control such as two-factor authentication is important, especially for admins. It makes it much harder to gain illicit access in the first place, and provides a warning if someone is trying to log in without your knowledge,” he said.
If employees’ stored emails were encrypted, which arguably most sensitive content should be, Pepper said it would then be impossible to decrypt each one, even with administrator access.
“However, if they are not [encrypted] and the attacker has enough time on target, hacked mail servers can provide a wealth of information,” he said.
Stop hackers in their tracks
In the light of the Deloitte breach, Sam Curry, chief security officer at Cybereason, urged all corporations to build a hunting practice and to improve their security hygiene.
“Businesses need to improve their ability stop attackers by deploying a strategy where they can disrupt the hackers early in the process by being able to respond, preventing attackers from setting up beachheads and backdoors.
“Of course, garden variety threats need to be detected, but the sophisticated threats need to be found and stopped earlier as well,” he said.
Corporations, said Curry, also need a professional, modern incident response capability, a real strategy for segmentation and good hygiene, and to elevate the way security is managed and operated.
-
Deloitte Hit By Data Breach, Customer Information Reportedly Exposed
Sep 25, 2017 | CRN
By Sarah Kuranda
When it comes to data breaches, solution providers themselves are becoming a target, with a report Monday that consulting giant Deloitte, No. 18 on the 2017 CRN Solution Provider 500 list, had been hacked.
A Guardian report Monday said a Deloitte global email server was hacked, which gave hackers access to emails to and from the company's staff, as well as customer information on some of the company's top federal and private sector clients. The report said the hackers could have also accessed other information, such as usernames, passwords, IP addresses and architectural design diagrams.
The report said Deloitte discovered the attack in March. It said the hackers had been in the company's systems for months, stretching back to October or November 2016.
The report said Deloitte was not using two-factor authentication on the email server, which it said was hosted on the Azure cloud service. It said the server was compromised through an admin account.
Deloitte confirmed the hack to the Guardian, but said only a few clients were impacted by the attack. It said it has engaged in a "comprehensive security protocol," investigation, and notified clients at risk. The Guardian said it appears that Deloitte has also engaged with an outside legal firm around the issue.
Deloitte has not yet replied to CRN requests for comment on the breach, and to what extent it impacted the company's consulting and services customers.
The breach adds to a growing trend around third-party breaches, in which hackers attack a company with the ultimate goal of hacking a company they do business with or are integrated with. The classic example of this type of attack is the hack of an HVAC vendor, which led to the mega data breach at Target in 2013.
A key set of companies in that third-party breach ecosystem is the solution provider channel. Companies like Deloitte, which offers audit, tax consulting, technology consulting and cybersecurity services, are a tantalizing vector of attack for hackers looking to get information on their clients, especially given the deep technical integration and company information required for things like consulting and managed services.
Alton Kizziah, vice president of global managed services at Kudelski Security, said data breaches, like this one, are particularly concerning for managed security services providers.
"It's shocking and scary and we're definitely worried about it," Kizziah said. "We do a lot of things to specifically prevent this type of attack. … It is very stressful and very worrying when you see these things to think we could be a conduit for an attack on one of our clients."
A report earlier this year highlighted that trend, finding that managed service providers are increasingly being targeted by a major APT group, as they serve as a third-party vector of attack into end-target customer accounts. The report, by the National Cyber Security Centre, BAE Systems and PricewaterhouseCoopers UK, found that China-based hacking group APT10 has been targeting managed service providers and others with "common as well as custom malware."
A blog post by BAE Systems said MSPs offer a tantalizing target for attacks because while they offer a way for companies to enable their businesses around technology, the "network connectivity which exists between MSPs and their customers also provides a vector for attackers to jump through."
"Successful global MSPs are even more attractive as they become a hub from which an intruder may access multiple end-victim networks," the blog post said. The post said companies have been tracking attacks at "several major MSPs" since late 2016, attributing them to this APT10 group. It said activity by this group increased in the middle of last year.
FireEye also issued a blog post following the PwC and BAE Systems report, saying its own iSight threat intelligence had seen a "resurgence" in APT10 activity in June 2016, targeting universities, construction, engineering, aerospace and telecom firms. It said it had also seen APT10 activity at "multiple IT service providers worldwide."
Kizziah said Kudelski does see "a lot of stuff" coming after its own business, especially phishing attacks. However, he said the company is "constantly working" to test its own systems to find weaknesses. He said Kudelski also takes measures to protect client privacy and data, saying it limits the amount of client data it keeps and puts multiple steps in between client systems and its own to make it much harder for hackers to use Kudelski as a jumping-off point for an attack. He said the company does not store and cannot even read client passwords, which were one of the pieces of information reportedly exposed in this breach.
Kizziah said that was a particular focus for the managed service provider when it rebuilt its managed service practice last April. He said the company made a "significant investment" and had many people on the team focusing on how to prevent attacks on Kudelski being used as a vector to attack clients.
"I feel pretty good about where we are, but that doesn't mean we aren't worried," Kizziah said. "We spent a lot of time when we started up getting everything set up to serve our clients. One of the things you hear a lot is that we want to be an extension of the team and clients' security partner, instead of just a provider."
Kizziah said he expects existing clients will ask questions of Kudelski following the Deloitte attack to see what security measures are in place. He said the company, which competes with Deloitte, doesn't usually see an uptick in new business inquiries around this type of data breach.
-
Global Accounting Firm Deloitte Reports Cyberattack
Sep 25, 2017 | Ubergizmo
By Adnan Farooqui
One of the largest accounting firms in the United States and indeed the world, Deloitte, has reported that it was the victim of a cyberattack that it caught back in March this year. The company believes that the breach might have begun in October last year which it was eventually able to catch in March of this year.
Deloitte offers its clients a wide range of services such as merger and acquisition assistance, tax and auditing services, and even cybersecurity advice. Therefore, it’s ironic that the company’s own systems have been breached.
It’s not known at this point in time who is responsible for this cyberattack which involved a breach of Deloitte’s email service that exposed five million emails. Aside from emails with sensitive attachments, hackers are also believed to have obtained usernames, passwords, IP addresses, workers’ health records, and business information.
The breach has reportedly been traced back to an administrator’s account that was password protected but didn’t have the additional security layer of two-step verification. According to the Guardian, the company has notified six of its clients that their information has been affected in this breach.
A spokesperson for Deloitte told the scribe that “In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte.”
Deloitte has said that it will continue to evaluate this matter and will take additional steps as required.
-
Deloitte hit by cyberattack (UPDATE)
Sep 25, 2017 | The Hill
By Morgan Chalfant
Deloitte was hit with a cyberattack that allowed hackers access to company emails and possibly confidential client information, the Guardian reported Monday.
A spokesman for the firm confirmed to The Hill in an email that Deloitte suffered a "cyber incident," saying that an attacker accessed data from an email platform. The company, which conducted a review of the breach, said that "very few clients were impacted" and concluded that "no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers."
According to the Guardian, the hack was discovered in March, but hackers potentially had access to the company’s systems as far back as October or November of 2016 — meaning the access went undetected for as many as six months.
Hackers are said to have compromised the company’s system through an administrator account, which was secured by a password but did not have two-factor authentication in place.
According to the Guardian, some Deloitte clients, including major companies and U.S. government entities, had information in the firm’s email system at the time of the breach.
Hackers potentially had access to 5 million emails stored in the company’s Azure cloud, which is managed by Microsoft. The breach may also have offered hackers access to usernames, passwords, IP addresses, business diagrams and other sensitive information.
The global company, which is based in New York, provides consulting, financial advisory, risk management, tax and other services to clients around the world, including major banks, companies and U.S. government departments and agencies.
A Deloitte spokesman said that the company implemented a "comprehensive security protocol" and initiated "an intensive and thorough review which included mobilizing a team of cyber-security and confidentiality experts inside and outside of Deloitte" after detecting the data breach. The company also said that it immediately notified government authorities and contacted each of the "very few clients impacted," but did not give a number or details on those affected.
"Deloitte remains deeply committed to ensuring that its cyber-security defenses are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security," a company spokesman said.
Six clients have reportedly been notified that their information was impacted by the breach.
News of the hack comes two weeks after credit reporting firm Equifax acknowledged a breach that may have impacted up to 143 million Americans, an incident that has put the spotlight on cyber threats to major private sector entities.
-
Global accounting firm Deloitte reports hack of internal emails
Sep 25, 2017 | UPI
By Ed Adamczyk
London-based accountant, tax consultant and cybersecurity firm Deloitte LLP reported a hack of its internal emails on Monday.
The company, one is of the global "Big Four" of the accounting business, said in a statement that it was successfully targeted by a cyberattack, giving hackers access to data from its emails. It said "very few" customers were affected, and added that customers and government agencies were notified.
The emails of 244,000 Deloitte employees, worldwide, were stored on Microsoft's Azure cloud platform.
The hack was first discovered in March, but Deloitte believes the cyberattack may have occurred as early as October 2016, the Guardian reported Monday. It added that sources said access to information came through an "administrator's account" which provided access to all areas of Deloitte's data. The account required only a single password to enter.
The breach was focused on data in the United States and analysts in Deloitte's Rosslyn, Va., office have been investigating potentially compromised documents for the past six months. The firm provides auditing, consulting and cybersecurity advice to government agencies and to the world's largest companies.
The hack, although significantly smaller in scale, follows news last week that personal data of up to 143 million U.S. consumers was potentially compromised in a breach at the U.S. credit reporting company Equifax Inc.
-
Deloitte Hack Exposes Confidential Email for World's Largest Companies—Report
Sep 25, 2017 | Infosecurity Magazine
By Tara Seals
Accountancy giant Deloitte has been the victim of a cyber-attack that has compromised its global clients’ confidential emails and intellectual property.
The attack went unnoticed for months, sources said, and has impacted some of the largest organizations in the world, including multinational banks and media companies, Big Pharma and government entities.
Sources told the Guardian that the compromise was the result of privileged access: The attackers made their way into the company’s global email server by way of a hacked administrator account (that lacked two-factor authentication), sometime last October or November, and stayed there, collecting info on blue-chip clients, until Deloitte discovered the breach in March 2017.
The sources said that the attackers had access to around 5 million emails sent to and from Deloitte’s 244,000 staff during the time period, and that they were able to capture user names, passwords and in some cases intellectual property from email attachments, like architectural diagrams.
Ironically, cybersecurity consulting is one of Deloitte’s lines of business—and the primacy of email should have been understood, at least one expert told Infosecurity.
“Deloitte is one of the largest consulting firms in the world that regularly advises its clients on cybersecurity matters, including strong guidance around information governance,” said Richard Stiennon, chief strategy officer of Blancco Technology Group, via email. “Their own experience with a simplistic breach of their Microsoft 365 infrastructure through an easy to access administrator account highlights how easy it is to overlook critical information stores. Email is the life blood of most modern companies. Practically all information eventually flows through email. Secure policy reviews, audit logs, legal matters and financials are freely shared and discussed on email. In Deloitte's case, this included confidential client information.”
Sources also said that in late April, it hired law firm Hogan Lovells to review “a possible cybersecurity incident”, in tandem with the firm’s own internal review, which it code-named Windham.
For its part, Deloitte has confirmed it had been the victim of a hack but downplayed the impact or reach of the incident.
“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators,” the company told the paper. “The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.”
While information is scant and Deloitte has yet to confirm specific details of what happened, experts said that the compromise of a global email server should be a wake-up call for corporations to, at a minimum, have two-step authentication in place for privileged accounts.
"Deloitte is a ripe target because of the company's position right at the top of the corporate food chain,” said Tony Pepper, co-founder and CEO of Egress. “They work with some of the biggest organizations on Earth, at the very highest level, which is like a red rag to a bull for hackers.”
He added, "Whilst it hasn't been confirmed exactly what was stolen, compromised mail servers can be a good source of sensitive information for an attacker, allowing them to siphon off message content and attachments. This is why multi-factor access control such as two-factor authentication is important, especially for admins. It makes it much harder to gain illicit access in the first place, and provides a warning if someone is trying to log in without your knowledge.”
This is just the latest in a line of high-profile breaches in the global business and finance sector, following the Equifax and SEC breaches. Preventing such occurrences comes down to a multi-layered approach to data protection.
“A complete data governance regime should put email at the top of concerns,” Stiennon said. “While health records, financials and PII usually are considered first, it must be acknowledged that all of that critical information passes through email too. Email should be first protected against unauthorized access. But it’s just as important to manage the content. One critical control is encryption so email exchanges cannot be read without the participants' keys. Another is to regularly scrub emails wherever they reside. This can be based on a simple time horizon (securely erase anything older than a certain amount of years), or it could be fine-tuned to include types of emails or particular content.”
-
Deloitte Data Hack 2017: Clients’ Secret Emails Exposed
Sep 25, 2017 | InvestorPlace
By William White
A Deloitte data hack has resulted in the private information of some users being stolen.
According to a recent report, the Deloitte data hack was discovered in March 2017, but may have originated from October or November of the previous year. Information that may have been stolen in the hack includes usernames, passwords, emails and other private data.
The emails that are stored on Deloitte’s server are likely the biggest security threat. Hackers gained access to them after obtaining a username and password that gave them access to everything on the server. There are at least six clients of the company that have been told the hack affected them.
Deloitte is still investigating the data hack and it doesn’t yet know who is behind it. It is possible that the attack was made by a larger group, or just a lone wolf. Either way, the consulting firm claims that only a very small numbers of its clients have been affected by the data breach, reports The Guardian.
The Deloitte data hack adds another breach to the long list of those in 2017. One of the most recent, and most serious, data hacks hit Equifax Inc. (NYSE:EFX) and was announced earlier this month. This resulted in the private information of 143 million people being stolen.
Another incident this year that was connected to emails came from an attack on DocuSign’s servers. Hackers were able to infiltrate the server that hosted the email addresses of users. However, no other information was stolen.
-
Deloitte Tries To Play It Cool After Cyberattack
Sep 25, 2017 | Going Concern
By Caleb Newquist
Deloitte, the biggiest of the Big 4, has joined the ranks of the hacked. This morning, The Guardian reported that the firm was the latest massive organization to have suffered a cyberattack, and that confidential client information was the target. To make matters worse, Deloitte failed to notice the breach for months. And to add a little insult to injury:
The hacker compromised the firm’s global email server through an “administrator’s account” that, in theory, gave them privileged, unrestricted “access to all areas”.
The account required only a single password and did not have “two-step“ verification, sources said.
Oh, boy. That’s embarrassing. That’s right up there with Equifax’s bumbling of their own security.
The Guardian report has vague details, the kind that are satisfying but still unfulfilling:
The breach is believed to have been US-focused and was regarded as so sensitive that only a handful of Deloitte’s most senior partners and lawyers were informed.
The Guardian has been told the internal inquiry into how this happened has been codenamed “Windham”. It has involved specialists trying to map out exactly where the hackers went by analysing the electronic trail of the searches that were made.
The team investigating the hack is understood to have been working out of the firm’s offices in Rosslyn, Virginia, where analysts have been reviewing potentially compromised documents for six months.
It has yet to establish whether a lone wolf, business rivals or state-sponsored hackers were responsible.
In my imagination, one of the other Big 4 firms created a slush fund to pay for the operation. Remember that cabal of Deloitte spies that was reported on late last year? What if this is revenge? Don’t dismiss the possibility!
Anyway, the backdrop of all this, of course, is that Deloitte markets itself as an expert in cybersecurity. The most sophisticated companies in the world ask Deloitte for help safeguarding their stuff and now Deloitte has been exposed for its dodgy security. A firm spokesman told The Guardian that it has contacted “the very few clients impacted and notified governmental authorities and regulators.”
If I were a client of Deloitte, I’d be…unconvinced? It always seems like when a scandal hits a huge company, they play it down, only to discover a week or two later that the bad event was worse than they thought. If a professional services firm suffers a breach because someone failed to use two-factor authentication, I think a fair number of people would question everything they had to say about the situation.
-
Deloitte cyberattack reportedly hit corporate, government clients
| CBS
A cyberattack hit the email system of accounting company Deloitte, compromising some clients' data, the company acknowledged Monday.
The company said in a statement that "very few clients" were affected by the attack, which was reportedly discovered in March. It has launched an investigation into the attack, and has notified government authorities, the company said.
The Guardian newspaper reported Monday that the breached system had information from a range of clients, including large companies and U.S. government departments.
The newspaper says hackers gained access through an administrator's account last fall and the attack was discovered in March, although it may have occurred as early as October or November 2016.
The breach occurred because the administrator did not have two-factor authentication, requiring only a password to sign in, ZDNet reports. Two-factor authentication would have alerted the account owner of the unauthorized access, and may have prevented the attacker from accessing it outright.
Deloitte is one of the largest private companies in the U.S., with $37 billion in revenue last fiscal year. Interestingly, one of its lines of business is offering cybersecurity advisory services to major governments and large Fortune 500 multinationals. It also advises on tax, auditing and consulting matters.
Deloitte said that no disruption "occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers" as a result of the breach.
The company says it is "deeply committed to ensuring that its cyber-security defenses are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity."
-
Deloitte hacked, says 'very few' clients affected (UPDATE-2)
Sep 25, 2017 | Reuters
By Paul Sandle and Jim Finkle
Global accounting firm Deloitte [DLTE.UL] said on Monday it was the victim of a cyber attack that affected the data of a small number of clients, providing few details on the breach.
Deloitte said in a statement that attackers accessed data from the company's email platform, confirming some details in a report by the Guardian newspaper, which broke news of the hack on Monday.
The attack appeared to target the firm's U.S. operations, was discovered in March and could have begun as early as October 2016, according to the Guardian. Deloitte's statement did not confirm those details.
The breach at Deloitte, which says its customers include 80 percent of the Fortune 500, is the latest in a series of breaches involving organizations that handle sensitive financial data that have rattled lawmakers, regulators and consumers.
The U.S. Securities and Exchange Commission, Wall Street's top regulator, and Equifax Inc , one of the largest credit-monitoring bureaus, this month reported that confidential filings and sensitive personal data were compromised by hackers.
"These are targeted attacks on financial opportunity," said Shane Shook, an independent consultant who helps financial firms investigate cyber attacks. "This trend is going to continue to grow."
The firm said it contacted government authorities immediately after it became aware of the incident, and notified each of the "very few clients" that had been affected.
Deloitte is a "Big Four" firm that provides accounting, auditing and consulting services, including advice on mergers and acquisitions. It also runs a cyber security business that helps customers defend their networks and investigate breaches.
The Guardian said Deloitte had contacted six clients. The company did not name the clients, confirm the number of clients it had contacted or say what type of data was stolen.
"No disruption has occurred to client businesses, to Deloitte's ability to continue to serve clients, or to consumers," the statement said.
Deloitte said it had implemented a "comprehensive security protocol," after the incident was discovered, using internal and external experts to help respond.
Mark Rasch, a former federal cyber crimes prosecutor, said it is too soon to say how serious the attack was because so little is known about what happened.
Still, he said the attack was "a big deal" because Deloitte holds sensitive information about its customers across business units that provide accounting services, review data on potential acquisitions and perform cyber security services.
A U.S. Federal Bureau of Investigation spokeswoman declined to comment, citing agency policy to neither confirm nor deny investigations.
-
I'm starting to have some major doubts about corporate cyber-security
Sep 25, 2017 | Forex Live
By Adam Button
We all had a good laugh when accountants from PricewaterhouseCoopers screwed up the Academy Awards. It was an embarrassing mix-up but not one was genuinely hurt.
Now, rival accounting firm Deloitte is shown then what a real blunder looks like. The Guardian reports today its emails system was compromised for nearly a year. They have some of the most-sensitive information in the world, so it's no surprise they would be targeted.
Deloitte provides auditing, tax consultancy and high-end cybersecurity advice to some of the world's biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies.
The real kicker is how insanely weak their defense was:
"The hacker compromised the firm's global email server through an 'administrator's account' that, in theory, gave them privileged, unrestricted 'access to all areas'. The account required only a single password and did not have 'two-step' verification, sources said."
How insane is that? A single admin password for the entire email system and no one even realized it was compromised for months.
What's even more insane is that Deloitte markets itself as an advisor on how to manage the risks posed by cybersecurity attacks, including many films like this.
So where is all this going? I'm increasingly convinced there is going to be a major, major internet incident. Something like the WannaCry hack but magnified by 100 times in the reach and damage.
Where it goes from there, I'm not sure but it's going to change the internet.
-
A Cyberattack on Accounting Firm Deloitte Reveals Clients’ Emails
Sep 25, 2017 | Tech.Co
By Adam Rowe
Earlier this month we released a list rounding up the major internet security breaches of 2017, from WannaCry to HBO’s 1.5 terabyte leak to the Petya ransomware attacks. And of course we’ve already had another cyberattack since then. Read all about it here, after taking a few seconds to sigh heavily at the state of cybersecurity in 2017.
The Deloitte Breach
The Guardian broke the news this morning: Deloitte — one of the largest private firms in the U.S. — was hacked in an attack that went on unnoticed for months afterwards.
Deloitte is only admitting to a few clients having fallen victim to leaked information.
“So far, six of Deloitte’s clients have been told their information was ‘impacted’ by the hack. Deloitte’s internal review into the incident is ongoing.
The Guardian understands Deloitte discovered the hack in March this year, but it is believed the attackers may have had access to its systems since October or November 2016,” The Guardian writes.
The weak spot? The firm’s global email server, which was accessed through an administrator’s account that did not have two-step verification. In other words, it wasn’t as secure as many people’s smartphones.
Of all the ways a company should secure its information, that’s a basic one.
What It Means
Stephen Cox, Chief Security Architect at SecureAuth, had this to say to TechCo in response to the Deloitte breach.
“The misuse of administrator credentials in the Deloitte incident is strong affirmation that identity is now at the center of information security,” Cox said in a statement. “We’re seeing breach after breach leveraging stolen credentials as an attack vector and even skilled information security practitioners are struggling with this threat. Part of the problem is a general lack of acknowledgement of the importance of identity security in relation to network and endpoint security; these are now the three pillars of security. We have highly distributed organizations across on-premise and cloud infrastructure. Identity is the glue that binds everything together.
Organizations should be rethinking their approach to identity security. The password is dead and even vanilla two-factor authentication is not enough. We must raise the bar with adaptive access control methods that apply risk analysis and introduce a biometric second factor, eliminating the utterly broken technology of password-based authentication.”
And More Equifax Facts
Meanwhile, the Equifax news continues to develop. The credit reporting company’s leak was detected on July 29, 2017 and saw the breach of information from 143 million U.S. consumers, including names, Social Security numbers, addresses, birth dates, and even some drivers license numbers.
Now, news is out that the company had purchased ID Watchdog, an identification protection service, on August 10 — two weeks after they knew about the breach but a month before they disclosed it to the public.
“Denver-based ID Watchdog, founded in 2005, provides services like credit monitoring and identity theft notification for $15 to $20 per month. Equifax last month said it acquired the firm for $63 million without revealing at that time that its systems had been penetrated thus drastically enhancing the market for identity protection services,” Fortune explains.
Law enforcement officials in “about 40 states,” Fortune notes, are “investigating Equifax’s behavior” leading up to and following the data breach. At the risk of making a pun so bad I’ll become the target of a cyberattack, all these hacks are enough to make me wanna cry.
National News
Add recipients
Suggested