New Known Breaches in the Past Week - March 26, 2021

Phish Leads to Breach at Calif. State Controller

A phishing attack last week gave attackers access to email and files at the California State Controller’s Office (SCO), an agency responsible for handling more than $100 billion in public funds each year. The phishers had access for more than 24 hours, and sources tell KrebsOnSecurity the intruders used that time to steal Social Security numbers and sensitive files on thousands of state workers, and to send targeted phishing messages to at least 9,000 other workers and their contacts. By Brian Krebs I March 23, 2021

Energy giant Shell discloses data breach after Accellion hack

Energy giant Shell has disclosed a data breach after attackers compromised the company's secure file-sharing system powered by Accellion's File Transfer Appliance (FTA). By Sergiu Gatlan I March 22, 2021

CNA insurance firm hit by a cyberattack, operations impacted

CNA Financial, a leading US-based insurance company, has suffered a cyberattack impacting its business operations and shutting down its website. By Lawrence Abrams I March 23, 2021

Hobby Lobby Exposes Customer Data in Cloud Misconfiguration

The arts-and-crafts retailer left 138GB of sensitive information open to the public internet. Arts-and-crafts retailer Hobby Lobby has suffered a cloud-bucket misconfiguration, exposing a raft of customer information, according to a report. By Tara Seals I March 23, 2021

Ransomware gang leaks data stolen from Colorado, Miami universities

Grades and social security numbers for students at the University of Colorado and University of Miami patient data have been posted online by the Clop ransomware group. By Lawrence Abrams I March 23, 2021