Garrett Langley

#CDK Files Notice of #Breach in Maine An interesting filing from CDK's outside counsel appeared over the weekend on the Maine AG's website. Maine, like many other states, requires notification of the state attorney general if a #breach occurs that affects Maine residents. This filing with the Maine AG states that an "external system breach (hacking)" event occurred at CDK on June 14, 2024, that was discovered on June 19, 2024, and that CDK has offered credit monitoring to affected individuals. The details are scarce, and this filing describes a very limited impact (affecting only one Maine resident, and 36 individuals in total), but it appears to be the first public acknowledgement of which we are aware from CDK that personally identifiable #data was #breached in June 2024. According to the CDK notice letter - https://lnkd.in/e2ffyWzf - the data involved included "Name, business or personal address, and business tax identification number or social security number." Exactly what this means is unclear.  The dates listed align with the CDK data breach incident in June 2024, but it is not clear how this apparently very limited breach event is linked to that broader event (if at all), why this was issued now*, what data was involved, whether there is any impact on any dealer data, or whether this is the first or last of such notices to be filed. *The notice letter is dated September 20, 2024, the date it appears to have been reported to the Maine AG was September 23, 2024, but was just posted on the Maine AG site over the weekend.

5

New blog! Nation's Strongest Regulations for #LawEnforcement Use of #FacialRecognition Technology Take Effect SIA's Jake Parker provides detailed information on key provisions of Maryland's new law. Read it at the link in the comments! #securityindustry

1

1 Comment

What’s happening at Metadata Forensics this week? ✈️ On-site client support in GA, IL, TN, TX, and VA. 💻 New and current research work in progress. 👥 More expansion coming soon. If you or someone you know has Digital Forensic experience within DoD and are looking to transition, please message me to see if we can assist. #Onthemove #Litigationsupport #Digitalresearch #ourteamrocks #Moregrowthcoming #slingshotengaged

23

🎆 We're excited to be starting off 2025 with the release of our first #cybersecurity guidebook. This edition will be focused on Owner Operators and Independent Small Fleets. 💻 Join us at 1:00 pm ET this Thursday for more details! https://lnkd.in/eyKe4djU #cyberawareness #NMFTACyber #truckingcybersecurity #supplychaincybersecurity

4

Hey #fleetcommunity 🗣️ Don't just dabble in digital solutions. Maximize your safety and efficiency when you look at the data the tools capture as a whole. Join IntelliShift's Erin Gilchrist as she is a guest on Anyline's webinar with Chris Garcia and host Marc Babin. Listen at: https://lnkd.in/dumRVCNy 1. Learn how comprehensive #fleet oversight makes you a pro at preventing premature or delayed #maintenance. Your legal compliance will be on point, and you’ll see your fleet operating with optimal performance. 2. Hear how using data insights for strategic decisions elevates your fleet management and feeds informed choices that enhance overall fleet efficiency and #safety. 3. Understand how you can address the unique challenges commercial fleet operators face and discover how today’s #technology can optimize efficiency.

8

1 Comment

BreachRx is heading to a city near you, and we'd love the chance to meet! If you're in the Raleigh, Atlanta, or DC area, join us for an exclusive session, featuring Joe Sullivan, former CSO at Facebook, Uber, and Cloudflare. Connect and network with your peers while gaining valuable insights from seasoned security executives on how to protect your company and team and minimize your personal risk. Space is limited, so be sure to save your seat today: https://hubs.li/Q030pPm50 #CISO #Cybersecurity #IncidentResponse #SecurityCommunity

15

Check out our latest blog post “Are Police Officers Training for Chaos”. In it we discuss: 🔹The recent incidents in Las Vegas and New Orleans. 🔹How chaos can affect a critical incident response. 🔹Ways to prepare your agency to respond to chaos. Read it here https://lnkd.in/gxTSSEAr #police #lawrnforcement #criticalincidenttraining

1

In today's Malware blog written by Noah Steigman, we discuss a recent cyber-attack at CDK, greatly affecting the U.S auto industry: At the beginning of this week, the U.S. auto industry was thrown into turmoil due to a sweeping software outage caused by a cyber-attack on CDK, the primary technology provider for more than 15,000 retail locations. This disruption significantly impacted dealer management systems crucial for transaction completion, profitability tracking, and employee compensation management across the country. Dealerships were left scrambling to maintain daily operations as essential tools suddenly became inaccessible, leading many to adopt manual methods to keep sales and service operations running smoothly. Market analysts, including those from JPMorgan, described the event as a major upheaval for the automotive retail sector. While AutoNation, a key industry player, acknowledged operational disruptions, it managed to keep its outlets operational to support ongoing sales and service activities. Nevertheless, other major retailers like Lithia Motors also reported widespread disruptions in their CDK-hosted systems throughout North America, anticipating ongoing operational difficulties until CDK fully restores its services. Looking ahead, industry analysts are closely monitoring developments, particularly the potential impact on late-June auto sales amidst ongoing disruptions. Sonic Automotive and others have expressed concerns about sustained business effects until CDK's systems return to full operation. This incident prompts reflection across the industry on cybersecurity readiness and resilience, underscoring the need for robust defenses in an increasingly digital automotive landscape fraught with evolving threats. Stakeholders are eagerly awaiting updates on CDK's progress, with the aftermath serving as a stark reminder of vulnerabilities in critical infrastructure and the importance of proactive cybersecurity measures.

1

While at #RSA, George Prince and Kinnaird McQuade met with Byron Acohido of LastWatchdog.com to discuss the failures of the #appsec market and the launch of NightVision’s new software testing and security solution. “Our tools make it possible to perform security scans in seconds, not hours, and offer actionable insights that help developers fix issues before they reach production. This not only saves time but also significantly reduces the risk of security breaches.” Listen to the full conversation here: https://bit.ly/3yIr6pB

13

My napkin math says this incident likely cost CDK $132M in total losses BEFORE the $25M ransom payment. I know nothing about CDK’s prior cybersecurity approach, but if the larger corporate zeitgeist attitude to cybersecurity is any indicator, they looked at it like “What is the least amount we can spend to check the box?” Let’s pretend CDK ran the numbers PRIOR to a breach and said “Hey, we could eat $150M in a worse-case scenario ransomware incident, why not spend 1% of that to hire a cybersecurity skunk works team to run simulations 24/7 to continuously innovate their security profile? An ounce of prevention is worth a pound of cure, yet companies seem more willing to skip the prevention citing costs. Cybersecurity is not a cost center; it’s an area where innovation and investment yield operational continuity and minimized risk of catastrophe. We know these attackers are financially motivated, so as long as we continue to invest the bare minimum in time and money, they’ll will keep hunting these multi-million dollar pay days.

3

When analyzing public comments, quickly and effortlessly uncover the relevant matter as required by law. Streamline public comments analysis at your rulemaking agency with DocketScope. 📅 Schedule a demo today. https://lnkd.in/eyE6G9UP #govtech #regtech #regsrule #docketscope

7

Optiv + ClearShark's John Allison recently joined a webinar on “CMMC Compliance Mid-Sized Contractors Can Afford” with experts from Carahsoft, Hypori, Google, and ATX Defense. Missed it? We've got the key takeaways here: https://lnkd.in/evTBXyr7 💰 CMMC compliance will be more expensive than non-compliance, with costs likely passed to the DoD. 👍 Good news: You can keep your current MSP/MSSP as long as they don’t handle FCI or CUI. ☁ Before switching cloud providers, check if your current solution can be reconfigured for compliance. CMMC is here to stay, but there are ways to manage the costs. #CMMC #Compliance #Cybersecurity #DoD #SmallBusiness #MSSP #CloudSecurity #Webinar

18

1 Comment

🚨 New episode alert: This edition of the Weekly C.S. Cyber Update with Chad Robinson and Shawn Waldman explores the latest cybersecurity headlines, starting with DICK'S Sporting Goods shutting down emails and locking employee accounts after a major cyberattack. The episode also dives into Toyota’s data breach and discusses why endpoint security is crucial to preventing data theft. Chad and Shawn also highlight Microsoft's controversial Windows Downdate tool, which allows users to ‘unpatch’ systems, and examine how Iranian hackers are targeting U.S. political campaigns. Finally, they provide updates on the ongoing cyber incident at Seattle Tacoma airport, Columbus' recent attack, and the alarming efforts by Chinese hackers to infiltrate U.S. internet providers. Tune in now to stay informed and secure your digital landscape! https://hubs.ly/Q02NTlpB0 #cybersecurity #cybernews #cyberattack #datasecurity #Election2024

10

Tyler Duke's has a very nice data article on license plate readers in North Carolina. https://lnkd.in/eujAvB4T I think ALPR's (and other surveillance tech) is a net good, there does need to be reasonable checks in place though to prevent abuse. In New York State for example, when you ran a check of someone's criminal history, it should be tied to a specific case and there was potential for an audit (so I should not look up a friend to snoop). It should be similar restrictions with license plate searches. #surveillance #crimeanalysis #tech #ethics

9