A Silicon Valley startup and its CEO have been charged by the US regulator with defrauding investors.

E-commerce player Benja and co-founder Andrew Chapin told investors that the firm made millions by selling popular clothing brands and retailers. However, the truth is that it never did business with the companies, according to the Securities and Exchange Commission (SEC).

The SEC further alleged that Chapin persuaded associates to impersonate representatives from these brands, as well as those from a major venture capital company that had supposedly made a large investment in the firm.

The complaint also alleged that Chapin showed an investor forged contracts and bank statements.

“We allege that Chapin violated the federal securities laws by deceiving investors about the most fundamental aspects of Benja’s business by falsely portraying it as a successful e-commerce technology company that in a short period of time had generated significant revenue from several high-profile clients,” said Erin Schneider, director of the SEC’s San Francisco regional office.

“We will continue to pursue companies and executives who mislead investors.”

The online marketplace for branded goods was apparently founded back in 2014 and headquartered in San Francisco.

However, its future looks uncertain after the SEC charged Benja and Chapin with violating anti-fraud provisions in federal securities laws. It is seeking permanent injunctions, civil penalties, disgorgement with prejudgment interest and an officer-and-director bar against Chapin.

On the same day of the SEC complaint, criminal charges were also filed against Chapin, in the US Attorney’s Office for the Northern District of California.

The SEC investigation is said to be ongoing.

This isn’t the biggest SEC investigation in recent memory: three men were charged last December in connection with a cryptocurrency conspiracy which defrauded investors out of at least $722m.

America’s Cybersecurity and Infrastructure Security Agency (CISA) could soon be on the receiving end of a sizable cash injection to help clear a backlog in state and local vulnerability assessments.

A Senate panel is moving to give the Department of Homeland Security’s agency $58m to support the continued reduction of its sizable assessment caseload.

According to an explanatory statement that accompanied the Senate Appropriations Committee’s draft annual spending bill for the DHS, the proposed new funding would be used to reduce a “12-month backlog in vulnerability assessments reported to the National Cybersecurity and Communications Integration Center.”

NCCIC, which is part of CISA, carries out the task of testing critical infrastructure for state and local agencies. 

The Senate Committee on Appropriations is responsible for legislation allocating federal funds prior to expenditure from the treasury. The committee published its draft spending bills last week.

Federal Computer Week reported that the backlog is outstanding from last year when lawmakers opted to give CISA more money to perform the same task.

The committee’s recommendation is that CISA receive approximately $2bn in fiscal year 2021 funding.  This figure exceeds that sought by President Donald Trump’s budget request by $270m.

The recent US presidential election placed pressure on CISA to conduct risk vulnerability assessments for state and local election officials. 

Geoff Hale, director of CISA’s Election Security Initiative, speaking at a November 17 virtual event hosted by the Cyber Threat Alliance, said: “We started with risk and vulnerability assessments, which are resource intensive teams of six [CISA employees] flying out on location to do an in-depth assessment, but the demand for a more scalable service really drove us to develop remote penetration testing, which the community has embraced in full.”

In 2019, the House Appropriations Committee approved a $63.8bn DHS spending package that allocated about $2bn for CISA, $335m more than the amount allocated in 2018 and roughly $400m over the amount that was requested. 

Three healthcare providers in Florida, Georgia, and New York are notifying patients that their protected health information may have been exposed in recent cyber-attacks involving ransoms.

Warnings went out to patients of Advanced Urgent Care of the Florida Keys on November 6 regarding a ransomware attack that took place on March 1, 2020. 

According to a breach notice issued by the medical center, patient data was compromised when attackers encrypted files on a backup drive. 

Information exposed in the incident included names, dates of birth, health insurance information, medical treatment information, medical diagnostic information, lab results, medical record numbers, Medicare or Medicaid beneficiary numbers, medical billing information, bank account information, credit or debit card information, CHAMPUS ID numbers, Military and/or Veterans Administration numbers, driver’s license numbers, signatures, and Social Security numbers. 

In Katonah, New York, a September 1 ransomware attack on Four Winds Hospital locked staff out of computer systems for a fortnight.

Cybersecurity experts hired to determine the scope and impact of the attack discovered that password-protected files had been accessed and patient lists dating from 1983 to the present day could potentially have been compromised. 

Information on the lists included names, medical record numbers, and Social Security numbers. Four Winds has not yet disclosed how many patients may have been impacted. 

A breach notice issued by Four Winds Hospital stated that the investigators “obtained evidence that the cybercriminals deleted any files in their possession, although that evidence cannot be independently verified.”

The hospital said it has “taken steps to prevent a reoccurrence.” 

Unusually, a ransom was demanded of Galstan & Ward Family and Cosmetic Dentistry in Suwanee, Georgia, over the phone by a caller who said that the practice’s server had been infected with a computer virus.

Galstan & Ward had previously arranged for a third-party vendor to wipe the server in question and restore its data from a backup after detecting suspicious activity. 

On September 11, 2020, the practice discovered that some files had been stolen and published on the dark web. No patient information was contained within these files, though patients were notified out of an abundance of caution.

New legislation introduced into the British Parliament today proposes the imposition of strict new security rules on telecommunication companies in the United Kingdom. 

The Telecommunications (Security) Bill aims to block high-risk equipment suppliers and tighten security requirements for new high-speed fiber optic and 5G wireless networks. 

If approved by Parliament, the bill will demand tougher security standards regarding the software and electronic equipment used at telephone exchanges where calls and internet traffic is handled, and at cell phone mast sites. 

Telecom companies that fail to live up to the rigorous regulations laid out in the draft law will be slapped with steep financial penalties. Dangled over their head like the sword of Damocles will be the threat of fines of £100,000 a day or 10% of sales. 

The bill is in two parts; clauses 1 to 14 introduce a stronger telecoms security framework while clauses 15 to 23 introduce new national security powers for the government to manage risks posed by high-risk vendors.

Under the new bill, public telecoms providers are obliged to report security compromises and share information with UK telecoms regulator Ofcom in order for the security of their networks to be assessed. 

“This groundbreaking bill will give the UK. one of the toughest telecoms security regimes in the world and allow us to take the action necessary to protect our networks,” said Digital Secretary Oliver Dowden.

The proposed law follows Prime Minister Boris Johnson’s July decision to ban Chinese company Huawei from constructing the United Kingdom’s cell phone networks. Wireless carriers in the UK have been given until 2027 to remove any existing Huawei 5G equipment from their networks. 

Security concerns and US sanctions were cited by Johnson as the reasons behind the prohibition.

Huawei said it was disappointed to be excluded from the 5G rollout process in the UK by the government.

“This decision is politically-motivated and not based on a fair evaluation of the risks,” said Huawei vice president Victor Zhang. 

“It does not serve anyone’s best interests as it would move Britain into the digital slow lane and put at risk the government’s levelling up agenda.”