More than four-fifths (85%) of the UK’s top 20 universities are putting their students, staff and suppliers at risk of email fraud, according to a new study by Proofpoint.

The researchers found that just 15% of the universities have implemented the recommended and strictest level of domain-based message authentication, reporting and conformance (DMARC). DMARC is an email validation protocol that verifies that the domain of the sender has not been impersonated.

The findings have come amid surging phishing attacks targeting the education sector since the start of the COVID-19 pandemic. For example, last year, a Barracuda Networks study showed that schools, colleges and universities are being disproportionately targeted by spear-phishing attacks. Experts believe that cyber-criminals increasingly view the industry as a soft target.

Encouragingly, 70% of the universities included in the analysis have published a DMARC record, representing a 100% increase since 2019. Therefore, more than two-thirds of these institutions have recognized the need to implement DMARC protocols.

However, six universities out of the 20 had no DMARC record.

Adenike Cosgrove, a cybersecurity strategist at Proofpoint, commented: “Our research has shown that many UK universities are still exposing people to cyber-criminals on the hunt for personal and financial data by not implementing simple, yet effective email authentication best practices. Email continues to be the vector of choice for cyber-criminals and the education sector remains a key target.

“Organizations in all sectors should deploy authentication protocols, such as DMARC, to shore up their email fraud defenses. Cyber-criminals pay close attention to major trends and will drive targeted attacks using social engineering techniques such as impersonation, and universities are no exception to this. As the university terms begins, students and staff must be vigilant in checking the validity of all emails, especially when levels of uncertainty and anticipation are higher at the beginning of a new term.”

A court in Illinois has issued an opinion clarifying how the statute of limitations should be applied to the state’s Biometric Information Privacy Act (BIPA).

In what The National Law Review described as “a highly anticipated ruling,” the Illinois Appellate Court published an opinion that while a one-year deadline would be applied to claims based on unlawful profit or disclosure, claims relating to data retention policy disclosure, informed consent, and safeguarding would have a limitation period of five years. 

The ruling was made by a panel of three judges in the case of Tims v. Black Horse Carriers, Inc. The panel said that the different limitation periods are necessary because each BIPA requirement is “separate and distinct.”

The five-year statute of limitations period applies to all BIPA claims that assert (1) unlawful collection of biometric data without written notice, or (2) issues relating to storing or transmitting it, or (3) claims involving the company’s failure to develop a publicly available retention and destruction schedule.

BIPA claims that allege (1) improper disclosure or (2) improper sale, lease, trade, or profit from biometric data will fall under the one-year limitations period.

“This long-awaited decision provides much-needed clarity for businesses and entities involved in the collection or processing of biometric data that impacts Illinois residents,” said Natalie Prescott, practice group associate at law firm Mintz.

“This clarification by the Illinois Appellate Court provides more certainty with respect to when potential claims can be deemed untimely.”

Commenting on the ruling, Tim Wade, technical director, CTO team at California-based AI cybersecurity company Vectra, emphasized the unique importance of biometric data.

“The loss of biometric data is concerning for the same reasons biometric-based authentication systems are weak – an individual can’t go out and get a new set of fingerprints, a new retinal pattern, or a new face. 

“For this reason, companies that collect and store such information must be held to the highest standards of stewardship, and failure to maintain such stewardship is a non-trivial matter. Any erosion in our legal system’s position with respect to that seriousness is a net-loss for individual privacy.”

An alert has been issued by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) over Conti ransomware.

In the warning, which was posted on September 22, the agencies observed the increased use of Conti in more than 400 attacks against organizations in the United States and internationally. 

The alert said that Conti actors often get network access via spearphishing campaigns, stolen or weak Remote Desktop Protocol (RDP) credentials, phone calls, fake software promoted via search engine optimization, common vulnerabilities in external assets, and other malware distribution networks. 

In the execution phase, the actors run a getuid payload, then use a more aggressive payload to lower the risk of triggering antivirus engines. 

Cobalt CIO Andrew Obadiaru ascribed the increase in Conti ransomware attack to “our new remote work ecosystem.”

“To protect yourself from becoming the next victim of a Conti attack, I recommend business leaders deploy the following security safeguards: (1) invest in email filtering and phishing detection capabilities, (2) protect and properly secure your remote desktop platform connectivity, (3) perform regular backup testing, and (4) ensure your backups are offline,” Obadiaru told Infosecurity Magazine.

On the same day on which the alert was issued, security specialist Positive Technologies published a report that found that ransomware attacks have reached “stratospheric” levels, accounting for 69% of all attacks involving malware in the second quarter of 2021. This represents an increase of 30% compared with the same period last year. 

Other key findings in Cybersecurity Threatscape: Q2 2021 are that the percentage of attacks aimed at compromising computers, servers, and network equipment increased from 71% in Q1 this year to 87% in Q2. 

While the volume of attacks on governmental institutions soared from 12% in Q1 to 20% in Q2, there was only a minor rise (0.3%) in overall attacks from Q1 to Q2. 

“This slowdown was to be expected as companies took greater measures to secure the network perimeter and remote access systems during a global pandemic and the growth of a dispersed workforce,” said Positive Technologies. “However, the rise in ransomware attacks in particular – a 45% jump in the month of April alone – should cause grave concern.”

The protected health information of hundreds of thousands of Americans has been exposed in two separate security incidents at eye-care providers in the United States.

Simon Eye Management reported a data breach to the Department of Health and Human Services’ Office for Civil Rights on September 14. An email hacking incident at the Delaware-based eye-care group exposed the data of 144,000 individuals.

According to a notice issued by Simon Eye, suspicious activity “related to certain employee email accounts” was observed on or about June 8. An investigation carried out with the help of third-party computer forensic specialists found that unauthorized access to some employee email accounts had occurred from May 12, 2021, to May 18, 2021.

“Our investigation revealed that the unauthorized third party attempted to engage in wire transfer and invoice manipulation attacks against the company, none of which were successful,” said the eye-care group.

Information impacted by the incident may have included names, medical histories, treatment or diagnosis information, and health insurance information. Simon Eye said that “a smaller number of individuals” may also have had their Social Security numbers, birth dates, and/or financial account information exposed.

The eye-care provider said that it had not discovered any evidence of data misuse linked to the incident. 

On May 12, USV Optical, Inc., a subsidiary of U.S. Vision, Inc., noticed suspicious activity on its network. A forensic investigation confirmed that hackers were able to access certain USV Optical servers and systems for nearly a month.

It was determined that data belonging to 180,000 individuals (employees and patients) may have been accessed and possibly exfiltrated by an unauthorized individual from April 20, 2021, to May 17, 2021. 

Information that could have been compromised included names, eye-care insurance information, and insurance claims information. In a security notice, USV Optical said that for some individuals, addresses, dates of birth, and/or “other individual identifiers” may also have been exposed. 

“We have no evidence of any identity theft or fraud occurring as a result of this incident,” stated USV Optical, adding that they “are reporting this incident to relevant state and federal regulators as required.”