MongoDB Security Breach Exposes Customer Contact Information

MongoDB, a leading provider of NoSQL database services, has alerted its customers about a security breach that led to unauthorized access to some of MongoDB’s internal systems. The breach resulted in the exposure of customer account metadata and contact information. However, MongoDB has stated that there is no evidence of any compromise of the data stored in their MongoDB Atlas service, which is a multi-cloud database-as-a-service offering.

MongoDB has urged customers to remain alert for potential social engineering and phishing attacks. They have also recommended that customers enable phishing-resistant multi-factor authentication (MFA) and routinely change their MongoDB Atlas passwords.

Following the security incident, MongoDB observed a significant increase in login attempts, leading to login difficulties for customers trying to access Atlas and the MongoDB Support Portal. The company clarified that this spike in login attempts was not related to the security incident and advised customers facing login issues to try again after a few minutes.

Critical Vulnerabilities in Industrial Control Systems (ICS)

• Several critical vulnerabilities have been identified in industrial control systems (ICS), with some carrying a Common Vulnerability Scoring System (CVSS) score of 9.8:
• Siemens SIMATIC S7-1500 CPU PLCs: Around 404 vulnerabilities in software versions prior to 3.1.0, leading to information disclosure, tampering, and denial of service (DoS). Immediate patching is advised.
• Unitronics Vision Series PLCs: A critical vulnerability (CVE-2023-6448) due to default administrator passwords in VisiLogic software versions prior to v9.9.00.
• Siemens SCALANCE M-800 and S615 ICS Switches: Multiple vulnerabilities allowing code injection and root shell access.
• Siemens SINEC Software: Vulnerabilities that could lead to DoS attacks, credential interception, and privilege escalation.

Data Breach Impacting Cancer Patients at Fred Hutchinson Cancer Center

Patients at Seattle’s Fred Hutchinson Cancer Center have started receiving ransom letters following a November security breach. Attackers are demanding $50 to prevent the sale of stolen data on the dark web. The breach exposed patient names, social security numbers, addresses, medical histories, lab results, and insurance information. The Hunters International ransomware gang has claimed responsibility for the attack.

Delta Dental Acknowledges Data Breach Affecting Millions

Delta Dental, a US dental insurance group, has reported a data breach impacting nearly 7 million individuals. The breach was linked to the MOVEit file transfer application attack and involved the theft of sensitive data including financial account numbers, credit/debit card details, social security numbers, and health information. Delta Dental is offering free credit monitoring services and has apologized to the affected individuals. This incident is part of a larger series of breaches connected to the MOVEit application, affecting millions of individuals and numerous organizations.

Catch the latest supply chain news at The Supply Chain Report. Learn more about international trade at ADAMftd.com with free tools.

#MongoDBSecurityBreach #NoSQLDatabaseSecurity #MultiFactorAuthentication #ICSvulnerabilities #SiemensVulnerabilities #UnitronicsVisionPLCs #FredHutchinsonBreach #RansomLetters #DeltaDentalDataBreach #MOVEitAttackImpact #CybersecurityAlerts #HealthcareDataBreach #PhishingProtection #IndustrialControlSystemSecurity