--- title: Business Information Security News of the Week, November 27, 2020 description: Check out the latest news on Cybersecurity and Risk Management --- [Omnistruct Newsletters](https://blog.omnistruct.com) # [Business Information Security News of the Week, November 27, 2020](https://blog.omnistruct.com/business-information-security-news-of-the-week-november-27-2020) Written by [Omnistruct Marketing](https://blog.omnistruct.com/author/omnistruct-marketing) | Nov 27, 2020 6:39:43 PM   # **Top Stories for this Week**   ## [Register for our CMMC Webinar on December 10,2020](https://www.brighttalk.com/webcast/18576/456526?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Join this conversation featuring Josh Bobbit, Founder, and CEO of Fortified Logic, and Matt Monroe, Operations Manager at Omnistruct, on how the CMMC may impact your industry and organization, your internal cybersecurity processes, and third-party due diligence processes. Understand key steps your organization can take in the immediate term to become CMMC ready and demonstrate your compliance posture.. ## [Businesses Should Prepare for a New Phase of Privacy Regulation and Enforcement in the United States](https://www.law.com/therecorder/2020/11/18/businesses-should-prepare-for-a-new-phase-of-privacy-regulation-and-enforcement-in-the-u-s/?slreturn=20201025121850&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) The continuing shift in privacy law embodied by the California Privacy Rights Act is set to make a significant impact on businesses’ compliance efforts and operational risk, as well as individuals’ expectations   # **New Known Breaches in the Past Week**   ## [Travel Booking Sites Hit by Massive Data Breach: How Can You Protect Yourself?](https://www.makeuseof.com/travel-booking-sites-hit-by-massive-data-breach-how-can-you-protect-yourself/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) A hotel reservation platform has exposed users' data along with the details of at least 10 million customers worldwide. This could affect anyone who has booked a room via an online booking site in the last seven years. By Loraine Centeno I November 22, 2020   ## [Mercy Iowa City Discloses Highly Sensitive Data Breach Impacting Over 60,000 Iowans](https://hotforsecurity.bitdefender.com/blog/mercy-iowa-city-discloses-highly-sensitive-data-breach-impacting-over-60000-iowans-24569.html?web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Mercy Iowa City hospital has revealed a data breach that may have compromised the personal and health information of 60,473 patients. By Alina Bizga I November 21, 2020   ## [Real Estate Firm The Corcoran Group Exposed Homeowner and Agent Data Online](https://securethoughts.com/real-estate-firm-exposed-vast-database-to-meow-bot-attack/?web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Secure Thoughts collaborated with Security Expert Jeremiah Fowler to expose a massive leak of property-owner and agent records by a luxury real estate firm. By Jeremiah Fowler I November 23, 2020   ## [Louisiana Hospitals Report Data Breach](https://www.infosecurity-magazine.com/news/louisiana-hospitals-report-data/?&web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) The data of thousands of patients has been exposed following a cyber-attack on Louisiana State University medical centers. By Sarah Coble I November 23, 2020   ## [States Score $17.5M Settlement From Home Depot Over 2014 Data Breach](https://www.law.com/texaslawyer/2020/11/24/states-score-17-5m-settlement-from-home-depot-over-2014-data-breach/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) The Home Depot has agreed to pay $17.5 million to settle litigation that came from a multistate investigation over a data breach that stole 40 million consumers’ credit card numbers. By Angela Morris | November 24, 2020   ## [Bad Medicine: Hospital Hit With Multiple Data Breach Class Actions for Unauthorized Access of Patient Records](https://www.natlawreview.com/article/bad-medicine-hospital-hit-multiple-data-breach-class-actions-unauthorized-access?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Healthcare data breaches are on the rise-recent estimates peg the number of patient records breached in 2019 as exceeding 41 million individuals. Additionally, approximately 60% of all healthcare data breaches are caused by internal actors—a statistic underscored by consecutive data breach class actions filed against the Mayo Clinic concerning the unauthorized access of patient records. By Kristin L. Bryan I November 24, 2020   ## [Attack on Vendor Affects Website of Arizona Court System](https://www.securityweek.com/attack-vendor-affects-website-arizona-court-system?&web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) A internet interruption resulting from a ransomware attack on a hosting provider has limited functionality of the Arizona state court system’s webpage for most of this week, according to the vendor and court officials. By Associated Press I November 23, 2020   ## [Hacker leaks the user data of event management app Peatix](https://www.zdnet.com/article/hacker-leaks-the-user-data-of-event-management-app-peatix/?&web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) A hacker has leaked this month the data of more than 4.2 million users registered on Peatix, an event organizing platform, currently ranked among the Alexa Top 3,500 most popular sites on the internet. By Catalin Cimpanu | November 24, 2020   # **General Cybersecurity News** ## [Montana will again join innovative program promoting cybersecurity](https://www.kpvi.com/news/national_news/montana-will-again-join-innovative-program-promoting-cybersecurity/article_25049d02-df96-5ca8-92b1-ba4f52f185b0.html?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Montana will again partner with the SANS Institute to provide high school students with a free and fun opportunity to learn cybersecurity skills and qualify for the National Cyber Scholarship Competition. By KPVI I November 22, 2020   ## [TTU a partner in U.S. Department of Energy-funded Cybersecurity Manufacturing Innovation Institute](https://www.everythinglubbock.com/news/local-news/ttu-a-partner-in-u-s-department-of-energy-funded-cybersecurity-manufacturing-innovation-institute/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) The University of Texas at San Antonio formally launched the Cybersecurity Manufacturing Innovation Institute (CyManII), a $111 million public-private partnership. Led by UTSA, the university will enter into a five-year cooperative agreement with the U.S. Department of Energy (DOE) to lead a consortium of 59 proposed member institutions in introducing a cybersecure energy-ROI that drives American manufacturers and supply chains to further adopt secure, energy-efficient approaches, ultimately securing and sustaining the nation’s leadership in global manufacturing competitiveness. by: News Release & Posted | November 21,2020   ## [State Department Facing 'Significant' Information Security Issues, OIG Says](https://www.nextgov.com/cybersecurity/2020/11/state-department-facing-significant-information-security-issues-oig-says/170232/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) The State Department faces persistent challenges related to information security and management, according to a recently published inspector general report. By Mila Jasper I November 23, 2020   ## [Robotic vacuum cleaners could be hacked to spy on you](https://www.hackread.com/robotic-vacuum-cleaners-hacked-spy-on-you/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) According to researchers, robotic vacuum cleaners can be hacked to spy on users by recording both conversations and music. By Sudais Asif I November 24th, 2020   ## [TSTC introduces fast-paced cybersecurity boot camp](https://www.panolawatchman.com/news/tstc-introduces-fast-paced-cybersecurity-boot-camp/article_5eb726f4-2b5c-11eb-b31c-93fe143e49bf.html?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Texas State Technical College will offer a fast-paced Workforce Training boot camp in Cybersecurity. The first cohort will begin in February, and the curriculum will feature eight industry-grade foundational courses that will equip students with the knowledge they need to get their foot into the world of cybersecurity. By Watchman I November 24, 2020   | | | --- |   # **Small Business Cybersecurity Concerns**   ## [No such thing as a false positive when it comes to cybersecurity](http://www.digitaljournal.com/tech-and-science/technology/no-such-thing-as-a-false-positive-when-it-comes-to-cybersecurity/article/581552?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) What was supposed to be the exciting start of a new decade quickly became one of the most unpredictable years of this century, as the coronavirus pandemic sent ripples through the cybersecurity sector. What can we expect next year? By Tim Sandle I November 23, 2020   ## [The Widening Security Holes in Our ‘Datasphere’](https://thecrimereport.org/2020/11/24/1141333//?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) If it were measured as a country, cybercrime — which is predicted to inflict damages totaling $6 trillion globally in 2021 — would be the world’s third-largest economy after the U.S. and China. By Steve Morgan | November 24, 2020   # **Cyber Insurance News**   ## [Cyber insurance: Most frequent and costly claims revealed](https://www.canadianunderwriter.ca/insurance/cyber-insurance-most-frequent-and-costly-claims-revealed-1004200430/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) External attacks on companies result in the most expensive cyber insurance losses, but internal failures like employee mistakes and technical problems are the most frequent generator of claims by number (albeit with a lower financial impact), a new report says. By Jason Contant I November 24, 2020   ## [As threats grow, cyber insurance seen as more of a necessity](https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-headlines/as-threats-grow-cyber-insurance-seen-as-more-of-a-necessity-61377276?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Businesses are treating cyber liability insurance as less of a luxury and more of a necessity as larger numbers of customers are drawn into the market and existing clients seek higher coverage limits, according to Advisen Ltd. surveys. By Calvin Trice I November 23, 2020   ## [As cyberattacks rise, know how cyber insurance can protect your hard-earned money](https://www.timesnownews.com/business-economy/personal-finance/insurance/article/as-cyberattacks-rise-know-how-cyber-insurance-can-protect-your-hard-earned-money/685749?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) As the number of applications, devices, etc. increase, you become more vulnerable to attacks. Just like you insure against illness, natural disasters etc, you need insurance coverage for cyber risks as well. By Harshita Tyagi I November 24, 2020     ## # **CVE Announcements This Week** ## [ImageMagick PDF-parsing flaw allowed attacker to execute shell commands via maliciously crafted image](https://portswigger.net/daily-swig/imagemagick-pdf-parsing-flaw-allowed-attacker-to-execute-shell-commands-via-maliciously-crafted-image?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) A security researcher discovered fresh flaws in open source image converter ImageMagick during the process of exploring an earlier vulnerability dating back four years. By John Leyden I November 23, 2020   ## [Hacker posts exploits for over 49,000 vulnerable Fortinet VPNs](https://www.bleepingcomputer.com/news/security/hacker-posts-exploits-for-over-49-000-vulnerable-fortinet-vpns/?&web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) A hacker has posted a list of one-line exploits to steal VPN credentials from almost 50,000 Fortinet VPN devices. By Ax Sharma I November 22, 2020   ## [Mount Locker Ransomware Targets U.S. Taxpayers](https://cyware.com/news/mount-locker-ransomware-targets-us-taxpayers-eaf7861f?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Mount Locker, a ransomware operation that was first discovered in July, is now preparing to take advantage of the tax season in the U.S. Recently, the ransomware operators have been observed specifically targeting TurboTax returns for encryption. The software is used for the preparation of American income tax returns. By Cyware News I November 24, 2020   ## [Malware creates scam online stores on top of hacked WordPress sites](https://www.zdnet.com/article/malware-creates-online-stores-on-top-of-hacked-wordpress-sites/?&web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) A new cybercrime gang has been seen taking over vulnerable WordPress sites to install hidden e-commerce stores with the purpose of hijacking the original site's search engine ranking and reputation and promote online scams. By Catalin Cimpanu I November 23, 2020   ## [Critical Unpatched VMware Flaw Affects Multiple Corporates Products](https://thehackernews.com/2020/11/critical-unpatched-vmware-flaw-affects.html?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system. By Ravie Lakshmanan I November 23, 2020   ## [Ransomware gangs hunt for tax software to ratchet up pressure on victims](https://www.scmagazine.com/home/security-news/ransomware/ransomware-gangs-hunt-for-tax-software-to-ratchet-up-pressure-on-victims/?web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) Ransomware actors are targeting tax software files in a bid to dig up highly sensitive data and increase leverage over their victims, including small businesses whose efforts to be tax-compliant could be seriously disrupted. By Bradley Barth I November 23, 2020   ## [VMware Working on Patches for Critical Workspace ONE Access Vulnerability](https://www.securityweek.com/vmware-working-patches-critical-workspace-one-access-vulnerability?&web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) VMware on Monday published an advisory to inform users that it’s working on patching a critical command injection vulnerability affecting Workspace ONE Access and some related components. By Eduard Kovacs I November 24, 2020   ## [Latest Version of TrickBot Employs Clever New Obfuscation Trick](https://www.darkreading.com/vulnerabilities---threats/latest-version-of-trickbot-employs-clever-new-obfuscation-trick/d/d-id/1339537?&web_view=true&utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) The malware takes advantage of how the Windows command line interpreter works to try and slip past anti-detection tools, Huntress Labs says. By Jai Vijayan I November 24, 2020 ## **Regulations, Frameworks, and Controls**   ## [Why IT General Controls Are Important for Compliance and Cybersecurity](https://securityboulevard.com/2020/11/why-it-general-controls-are-important-for-compliance-and-cybersecurity/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) IT general controls are among the most important elements of effective compliance and IT security. So it’s a bit strange that many businesses — and compliance professionals, for that matter — struggle to understand exactly how “ITGCs” support compliance and the many ways they can fail. By Matt Kelly I November 23, 2020   ## [NIST Updates Control Baselines, Integrates Privacy](https://www.govtech.com/blogs/lohrmann-on-cybersecurity/nist-updates-control-baselines-integrates-privacy.htmll?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_qD5GPWDbLQ7gORQKZCCOPRBHGwpiWftOw4EODeA_zP0BVzL60pG2MIdNh5hU-e2TOomzt) The National Institute of Standards and Technology has finalized 800-53B and 800-53 Revision 5, providing updated guidance on selecting security and privacy control baselines for public- and private-sector organizations. By Dan Lohrmann I November 21, 2020       | Sincerely, **Omnistruct Marketing** 866-683-8827 [www.omnistruct.com](https://omnistruct.com/?utm_campaign=Cybersecurity%20News&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz--bZS74_WZe1IDlpd0Z6DuKMLZcZmRMDuUWzB2uaX6wFusI-z5BS8N513GN3u_X92ecTCaX) Omnistruct, 2740 Fulton Avenue #101-02, Sacramento, CA 95821, USA, (866) 683-8827 [Unsubscribe                  ](https://email.omnistruct.com/business-information-security-news-october-9-2020#)[Manage preferences](https://email.omnistruct.com/business-information-security-news-october-9-2020#) | | --- | [View full post](https://blog.omnistruct.com/business-information-security-news-of-the-week-november-27-2020) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Omnistruct Marketing" }, "dateModified" : "2020-11-27T18:39:43.947Z", "datePublished" : "2020-11-27T18:39:43Z", "headline" : "Business Information Security News of the Week, November 27, 2020", "image" : { "@type" : "ImageObject", "height" : 792, "url" : "https://email.omnistruct.com/hs-fs/hubfs/Newsletter/Newsletter-11_20_2020.png?upscale=true&width=1116&upscale=true&name=Newsletter-11_20_2020.png", "width" : 1116 }, "mainEntityOfPage" : "https://blog.omnistruct.com/business-information-security-news-of-the-week-november-27-2020", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60.0, "url" : "https://cdn2.hubspot.net/hubfs/5223782/Omnistruct1-1.png", "width" : 282.48926 }, "name" : "Newsletters" } } ```