by PYMNTS | Apr 18, 2023 | Cybersecurity
The European Commission has proposed devoting 1.1 billion euros (about $1.2 billion) to new cybersecurity initiatives.
The proposal of the European Union Cyber Solidarity Act comes at a time when cybersecurity incidents pose a growing threat, driven in part by cyberattacks related to Russia’s invasion of Ukraine, the commission said in a Tuesday (April 18) press release.
“The Cyber Solidarity Act establishes EU capabilities to make Europe more resilient and reactive in front of cyber threats, while strengthening existing cooperation mechanism,” the commission said in the release. “It will contribute to ensuring a safe and secure digital landscape for citizens and businesses and to protecting critical entities and essential services, such as hospitals and public utilities.”
The proposed regulation will now be examined by the European Parliament along with the commission, according to the release.
One element of the act is the proposed establishment of a European Cyber Shield composed of national and cross-border entities tasked with detecting cyber threats, sharing warnings about threats and incidents, and enabling authorities to respond more quickly and effectively, the release said.
Security Operations Centres (SOCs) contributing to the European Cyber Shield are to be established across the EU and are expected to be operational by early 2024, per the release.
Another part of the EU Cyber Solidarity Act is the creation of a Cyber Emergency Mechanism that will test the preparedness of entities in highly critical sectors, create a reserve of pre-contracted providers who can respond to large-scale cybersecurity incidents, and enable EU member states to provide financial support to other member states, according to the release.
The proposed regulation also establishes a Cybersecurity Incident Review Mechanism that will help the EU improve its resilience to cyberattacks by reviewing and drawing lessons from past incidents, the release said.
“With the proposed EU Cyber Solidarity Act, the commission responds to the member states’ call to strengthen EU cyber resilience, and delivers on its commitment expressed in the recent Joint Cyber Defence Communication to prepare an EU Cyber Solidarity Initiative,” the commission said in the release.
As PYMNTS reported in September, the EU has developed a string of regulatory instruments to enhance the bloc’s cyber resilience, and these acts may set new global standards.
For all PYMNTS EMEA coverage, subscribe to the daily EMEA Newsletter.
by PYMNTS | Apr 17, 2023 | Cybersecurity
NCR has been hit by a ransomware attack that is affecting the capabilities of some restaurants.
The incident was discovered Thursday (April 13), caused a single data center outage and has impacted the company’s Aloha point-of-sale (POS) system for restaurants and its Counterpoint retail management system, the provider of technology platforms said in a Monday (April 17) press release.
“We believe this incident is limited to specific functionality in Aloha cloud-based services and Counterpoint,” NCR said in the release. “At this time, our ongoing investigation also indicates that no customer systems or networks are involved. None of our ATM, digital banking, payments or other retail products are processed at this data center.”
The NCR customers affected by the incident are seeing reduced functionality on their restaurant administrative functions. Their in-restaurant purchases and transactions continue to operate, according to the press release. The release didn’t say what restaurants were impacted.
When NCR discovered the ransomware attack, the company started contacting customers and engaged outside experts, including both external forensic cybersecurity experts and federal law enforcement, the release said.
“NCR is conducting concurrent efforts to establish alternative functionality for customers, fully restore impacted data and applications, and to enhance its cyber security protections,” the company said in the release.
The frequency and value of ransomware attacks leaped in 2021, according to figures released in November 2022 by the Financial Crimes Enforcement Network (FinCEN).
The number of ransomware attacks reported by financial institutions and occurring in 2021 leaped 108% from 602 in 2020 to 1,251 in 2021, FinCEN said
The dollar amounts involved in those ransomware-related incidents rose 68% from $527 million in 2020 to $886 million in 2021, the organization added.
The announcement from NCR comes about two months after the Financial Times (FT) reported that a group of hackers had launched one of the largest-ever ransomware attacks, aiming to paralyze the computer networks of nearly 5,000 victims in Europe and the United States.
A month before that, in January, the U.S. Justice Department said that American, German and Dutch authorities had shut down a global ransomware group that had targeted 1,500 victims in 80 countries and received $100 million in ransom payments.
See More In: Aloha Cloud services, cloud services, Counterpoint, cyber attack, Digital Payments, NCR, News, ransomware, restaurant data, restaurant software, What’s Hot
by PYMNTS | Feb 15, 2022 | Cybersecurity
Ransomware professionals are starting to operate more like legitimate businesses, selling ransomware-as-a-service (RaaS) to non-technical would-be cyber thieves — a subscription-based or pay-for-use malware. There are also consultants for hire to gather intel on potential victims, determine realistic demands and act as negotiators between victims and thieves.
Arbitration services to collect payments and help the cyberthieves resolve disputes among themselves is the latest side service, according to the 2021 ransomware trends report issued this month by the FBI, the NSA, and the Cybersecurity and Infrastructure Security Agency in the U.S., as well as the U.K. National Cyber Security Centre and the Australian Cyber Security Centre.
Like any business, even nefarious operations hustling deals on the dark web need arbitrators and consultants. Ransomware gangs are known at being quite proficient at hacking major systems, encrypting data and halting business operations, pipelines and all kinds of everyday infrastructure. But the other details — the ransom negotiations, the collection of funds and even the distribution among gang members — require different levels of expertise.
See also: Ransomware Reaches Beyond Money With More Sinister Goals
Cybercrime-consultancy-as-a-service? Cybercrime-arbitration-as-a service? The possibilities are numerous, from accountants and lawyers to enforcement and penalties. Experts in the field as well as government agencies around the globe are recognizing that the professionalization of ransomware will likely lead to many more adjacent services.
High-profile attacks last year on the world’s largest meat-packing company (JBS lost one-fifth of the nation’s meat supply) and the biggest U.S. fuel pipeline (Colonial Pipeline lost access to its 5,500-mile natural gas pipeline for five days) are just two of the major hacks with big implications.
Last November, the FBI and the Secret Service warned in separate reports that the BlackByte ransomware group hit at three critical infrastructure sectors — government facilities, financial services and food and agriculture.
Read more: Digital Fraud Tracker: Explaining Third- and First-Party Fraud
The U.K. National Cyber Security Centre said in the trends report that it’s seen some ransomware gangs offering a 24/7 help center to assist victims with processing payments and get data restored.
The multi-agency trends report also points to the expanding tech skills of ransomware gangs, with the ability to target cloud infrastructure, which is touted as being the safer way to store data. U.S. authorities reported there have been ransomware attacks involving 14 out of 16 designated critical infrastructure sectors, including the defense industrial base, agriculture and information technology sectors.
by PYMNTS | Feb 1, 2022 | Cybersecurity
China is betting that a requirement for companies that provide deepfake services to verify the identities of their users could shut down the potentially disruptive technology, according to a draft regulation released by the country’s cybersecurity watchdog Friday (Jan. 28).
The “Internet Information Service Deep Synthesis Management Regulations” proposed by the Cyberspace Administration of China promised to regulate technologies that generate or manipulate images, audio, video or text with face swap and image enhancement, the draft stated. The comment period will end at the close of February, and a final version could include changes.
Under the regulation, deepfake service providers must verify the identities of their customers prior to giving them to products. In addition, companies are also expected to “respect social morality and ethics, adhere to the correct political direction, public opinion orientation, and value orientation, and promote deep synthesis services to be upward and good,” according to the draft.
It’s the latest effort by Beijing regulators to fix the vulnerabilities of these emerging consumer technologies. One year ago, China regulators summoned Alibaba Group Holding, ByteDance, and Tencent Holdings for a meeting to demand they conduct security reviews on the use of deepfake technologies on their platforms and submit the results of their reviews, the South China Morning Post reported.
Hollywood-style image manipulation that used to require a huge investment and a team of talented people with above-average expertise can now be attained by anyone with a smartphone. Such developments, which have gained attention following a flurry of high-profile deepfake videos being posted on social media, are emerging as a favorite new way for bad actors to commit fraud and identify theft.
Read more: Deepfakes Challenge Existing Identity Verification Tech
In an interview with PYMNTS last fall, Mariona Campmany, digital identity and innovation director at Mitek, said the situation is catapulting tech into a completely new paradigm.
“We have been preparing for 10 years or more, but this now comes with greater and unexpected speed,” she said.
