Potential User Data Breach

Possible Rogue Employee?

2FA/MFA please.

Are you looking into two-factor authentication?

Everyone can stop thanking GGG for disclosing this data breach as they are required by law to do so.

Change your password on all sites and services that use the same password (understand why this is bad practise in hindsight) and that share the same email address or user name as you are registered with at GGG. Keep an eye on suspicious CC activity and call the issuer when in doubt.

Skynet

Will you let the community know who did the Breach when you find out? Also what they were looking for?!

Late on Thursday, March 23rd (NZT), we became aware that there was an external intruder illegally connected to our office network and that he had compromised several machines. We immediately severed all internet connectivity and began the process of reformatting all computers and rebuilding a new clean network with increased security measures in place.

^ This does not inspire a lot of confidence. If you severed internet connections and started immediately reformatting without performing imaging on the affected systems, it shows that you clearly do not have capable incident responders on staff. With that being known, I sincerely doubt the security measures you put in place are adequate, unless you have identified root cause, which is once again hard to do when you immediately start erasing evidence. Along with this, if there was potential proof that sensitive information was accessed, you are wiping this out as well.

With that said, as long as the payment card data never touches your network and you actually are salting, very little issue aside from your proprietary information potentially being breached. I appreciate the notice, but your response didn't inspire much enthusiasm for your ability to handle the event.

I know the common though is blah blah blah who does this guy think he is, I am a former PCI Forensic Investigator consultant who has led with major credit card breaches and now lead the incident management department at a large financial institution. Before this I served as a lead penetration tester as well.

Can you imagine how much currency I could farm if a Breach lasted 10 days in Dried Lake?

So, the breach was detected on the 23rd, that's fine. Why is the communication about that only reaching us now, though?

Breach meta confirmed.

Peace,

-Boem-