Your Security Cameras Are the Break-In 🛜 + 65,000 People's Data Stolen

Two stories from today's security headlines that hit close to home: the gear watching your office may be the easiest way into it, and a company you've probably never heard of just lost the most sensitive data you have.

The Cameras Watching Your Office Just Became the Front Door 🛜

Ubiquiti — the company behind the UniFi networking gear and security cameras found in an enormous number of small businesses, offices, and homes — just patched three vulnerabilities rated CVSS 10.0. That's the maximum score on the severity scale, and it isn't handed out casually.

Two of the flaws let an attacker send malformed input to the UniFi Protect camera platform or UniFi Talk phone system and run their own commands on the device. The third lets someone skip the login screen on UniFi OS entirely. Translation: a device you bought to make your building safer can be turned into an attacker's foothold on your network — with a view of your cameras and a path to everything else plugged in.

If your office runs UniFi anything, update it today. These systems are often installed once and then forgotten for years, which is exactly what attackers are counting on.

Read more →

65,000 People Just Lost Their SSNs to a Company They Never Chose 👤

Paylogix, a platform that administers employee benefits, disclosed a breach affecting at least 65,000 people. The stolen data is about as bad as it gets: Social Security numbers, financial account details, medical records, passport numbers, taxpayer IDs, and electronic signatures. The Akira ransomware group listed the company on its leak site back in January.

Here's the part worth sitting with — the breach happened last November, and the disclosure is landing now. And nobody in that group of 65,000 signed up for Paylogix. Their employer did. That's the uncomfortable reality of modern data risk: your most sensitive information sits with vendors you've never evaluated, chosen, or even heard of.

For businesses, the lesson is direct. Your security posture includes every vendor holding your employees' data, and "we trusted them" isn't a control. For individuals, if you get a breach notice from a benefits administrator, freeze your credit and take it seriously.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.