TikTok fined EUR 5 million over cookies misuse | Cyber Intelligence Briefing: 20 January

Top news stories this week

1. Watch your diet. TikTok fined EUR 5 million over cookies misuse.
2. Vice Society attacks. Ransomware group continues to compromise educational institutions.
3. Ship ahoy! Ransomware attack on Norwegian risk management firm impacts of 1,000 ships.
4. Toughening up. US National Cybersecurity Strategy goes on the offensive against hackers.
5. TV malware. Android TV box available on Amazon found to contain malware.
6. Faulty lock. Thousands of NortonLifeLock password manager accounts compromised in data breach.

1. TikTok fined EUR 5 million under GDPR for cookies policy

France’s data protection authority CNIL fined TikTok UK and TikTok Ireland EUR 5 million after making it difficult for users to refuse cookies. They also failed to appropriately inform users of changes to the platform. CNIL deemed these practices to be a violation of France’s data protection laws.

Separately, the law firm DLA Piper reported that EUR 3.1 billion in GDPR fines were imposed in 2022. This is a 168 percent increase on 2021.

So what?

All organisations must familiarise themselves and stay up-to-date with their legal and regulatory data protection obligations. Failing to do so could lead to significant regulatory fines and reputational damage.

2. Vice Society compromises educational institutions

The Vice Society ransomware group has listed the University of Duisburg-Essen, one of Germany’s largest universities, on their leak site. The university confirmed that it was the victim of an attack in November 2022 which compromised the university's entire IT infrastructure.

Vice Society has compromised and leaked sensitive data belonging to numerous educational institutions. Meanwhile, research by the UK’s National Cyber Security Centre claims that cyber defences at educational institutions have been improving, as 53 percent of schools feel prepared for a cyber-attack.

So what?

Educational institutions have long been attractive targets for ransomware groups. This primarily stems from their large digital footprints and insufficient security budgets to secure their environment.

3. Attack on fleet management software

Norwegian assurance and risk management firm DNV has confirmed a ransomware attack on its fleet management software. The attack affected 70 customers and around 1,000 ships. DNV has assured that the attackers were unable to access all parts of their network nor did the attack affect the ships’ ability to operate.

So what?

Organisations should treat defence-in-depth as a core part of their cyber security strategy. Network segmentation is a key tenet of this and can help limit the impact of a breach.

4. US toughens up on cyber security

President Biden is expected to approve a new National Cybersecurity Strategy for the United States. The policy sets out mandatory regulations to enhance cyber security standards for both public and private sector organisations. The policy will also allow authorities to use pre-emptive offensive measures to disrupt hostile attacks on American networks.

So what?

As the Biden Administration continues its proactive approach of tackling cyber threats, organisations within the public and private sector must stay up to date with all legislative and regulatory requirements.

5. Hardware for sale on Amazon discovered to contain malware

A T95 Android TV box purchased on Amazon was found to contain sophisticated pre-installed malware. The malware could install apps and display ads to generate revenue for cyber criminals.

So what?

This incident shows that even reputable e-commerce sites should be treated with caution when buying electronic devices. Purchasing devices directly from reputable manufacturers will help reduce this threat.