Incident: Cybersecurity Breach at Deloitte Compromising Client Data.

Published Date: 2017-09-25

Postmortem Analysis
Timeline 1. The software failure incident at Deloitte happened in October or November 2016 [62930].
System The system that failed in the software failure incident at Deloitte was the email system stored in the Azure cloud service provided by Microsoft [62930].
Responsible Organization 1. The software failure incident at Deloitte was caused by hackers who compromised the firm's global email server through an administrator's account [62930].
Impacted Organization 1. Deloitte's blue-chip clients, including some of the world's biggest banks, multinational companies, media enterprises, pharmaceutical firms, and US government departments were impacted by the software failure incident [62930].
Software Causes 1. Lack of two-step verification for the administrator's account, making it vulnerable to unauthorized access [62930]. 2. Vulnerabilities in the Azure cloud service provided by Microsoft, where emails were stored, allowing hackers to potentially access sensitive information [62930]. 3. Failure to detect the cybersecurity attack for months, indicating a lack of robust intrusion detection and monitoring systems [62930].
Non-software Causes 1. Lack of two-step verification for the administrator's account, making it vulnerable to hacking [62930]. 2. Failure to detect the cybersecurity attack for months, indicating a lack of robust monitoring and detection systems [62930]. 3. Insufficient cybersecurity measures in place, such as inadequate password protection and access controls [62930]. 4. Delay in informing clients and authorities about the breach, potentially impacting the response and mitigation efforts [62930].
Impacts 1. Confidential emails and plans of some of Deloitte's blue-chip clients were compromised by the hack [62930]. 2. Deloitte's internal review into the incident is ongoing, indicating a disruption in their operations [62930]. 3. The hackers potentially had access to usernames, passwords, IP addresses, architectural diagrams for businesses, and health information [62930]. 4. An estimated 5 million emails were in the "cloud" and could have been accessed by the hackers, posing a significant data breach risk [62930]. 5. Deloitte confirmed that a small number of its clients were impacted by the hack, suggesting a direct impact on client relationships and trust [62930].
Preventions 1. Implementing two-step verification for administrator accounts could have prevented unauthorized access to Deloitte's global email server [62930]. 2. Regularly reviewing and updating cybersecurity protocols and defenses to detect and prevent breaches in a timely manner [62930]. 3. Conducting thorough cybersecurity training for all staff members to enhance awareness and vigilance against potential cyber threats [62930].
Fixes 1. Implementing a comprehensive security protocol and conducting an intensive and thorough review, including mobilizing a team of cybersecurity and confidentiality experts inside and outside of the organization [62930].
References 1. Deloitte spokesperson 2. The Guardian 3. Microsoft 4. Hogan Lovells 5. Equifax

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Deloitte, the victim of the cybersecurity attack reported in the article, experienced a significant breach compromising confidential emails and plans of its clients [62930]. - Deloitte confirmed it had been the victim of a hack but insisted only a small number of its clients had been impacted [62930]. - Deloitte mentioned that the breach did not cause any disruption to client businesses or its ability to serve clients [62930]. (b) The software failure incident having happened again at multiple_organization: - Equifax, a US credit monitoring agency, also suffered a massive hack that exposed the personal data of 143 million US customers [62930]. - Equifax admitted to being the victim of an earlier breach in March before the major hack in May [62930]. - About 400,000 people in the UK may have had their information stolen following the cybersecurity breach at Equifax [62930].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase in the Deloitte hack incident can be attributed to the lack of robust security measures in place. The breach occurred due to a sophisticated hack that compromised Deloitte's global email server through an "administrator's account" that had privileged, unrestricted access to all areas. This account required only a single password and did not have two-step verification, making it easier for the hackers to gain unauthorized access [62930]. (b) The software failure incident related to the operation phase in the Deloitte hack incident can be linked to the fact that the cybersecurity attack went unnoticed for months. Despite the breach being discovered in March, it is believed that the attackers may have had access to Deloitte's systems since October or November 2016. This delayed detection and response allowed the hackers to potentially access sensitive information for an extended period before being detected [62930].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at Deloitte was primarily due to contributing factors that originated from within the system. The hack compromised Deloitte's global email server through an "administrator's account" that had privileged, unrestricted access to all areas. Additionally, the account only required a single password and did not have two-step verification, making it easier for the hackers to gain access [62930]. (b) outside_system: The software failure incident at Deloitte was also influenced by contributing factors that originated from outside the system. The hackers were able to breach Deloitte's systems and compromise confidential emails and plans of clients, indicating an external threat to the system's security [62930].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident at Deloitte was primarily due to non-human actions, specifically a sophisticated hack that compromised the confidential emails and plans of its clients. The cybersecurity attack went unnoticed for months, indicating that the contributing factors were introduced without human participation [62930]. (b) However, human actions also played a role in the failure as the breach was facilitated by the lack of robust security measures such as the absence of two-step verification for the administrator's account, which gave the hackers privileged access to all areas. Additionally, the incident highlighted the importance of human actions in maintaining cybersecurity defenses and managing risks posed by sophisticated attacks [62930].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The article does not mention any specific hardware-related issues contributing to the software failure incident at Deloitte [62930]. (b) The software failure incident related to software: - The software failure incident at Deloitte was due to a sophisticated hack that compromised the confidential emails and plans of its clients. The hackers gained access to Deloitte's global email server through an "administrator's account" with privileged, unrestricted access to all areas. The account lacked two-step verification, making it easier for the hackers to breach the system [62930].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at Deloitte was malicious in nature. The incident was a result of a sophisticated hack that compromised confidential emails and plans of some of its blue-chip clients. The hackers gained access to Deloitte's global email server through an administrator's account, allowing them privileged and unrestricted access to sensitive information. The breach was regarded as sensitive, and only a few senior partners and lawyers were informed about it. Deloitte hired a law firm to review the cybersecurity incident, indicating the seriousness of the breach [62930]. (b) There is no information in the articles to suggest that the software failure incident at Deloitte was non-malicious.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident at Deloitte was primarily due to poor decisions. The incident involved a sophisticated hack that compromised confidential emails and plans of blue-chip clients. The breach occurred through an "administrator's account" that had privileged, unrestricted access to all areas, and it required only a single password without two-step verification [62930]. Additionally, the account stored emails in the Azure cloud service without adequate security measures, allowing hackers potential access to sensitive information like usernames, passwords, IP addresses, and health information [62930]. Deloitte's response to the incident, including the lack of proper security protocols and notification processes, reflects poor decisions that contributed to the failure.
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the article as it mentions that Deloitte's email system was compromised due to a lack of proper security measures. The hackers gained access through an "administrator's account" that had unrestricted access to all areas, required only a single password, and did not have two-step verification [62930]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article.
Duration temporary (a) The software failure incident at Deloitte was not permanent as it was discovered and addressed. The incident involved a cybersecurity attack that compromised the company's confidential emails and plans of some clients. Deloitte discovered the hack in March, but it is believed the attackers may have had access to its systems since October or November 2016. The firm took immediate action by implementing a comprehensive security protocol, mobilizing a team of cybersecurity experts, and conducting an intensive review to understand the impact of the breach. Deloitte confirmed that no disruption occurred to client businesses or its ability to serve clients [62930]. (b) The software failure incident at Deloitte can be considered temporary as it was not a permanent failure. The breach was discovered and addressed, with the firm taking steps to enhance its cybersecurity defenses and protect confidential information. Deloitte implemented a thorough review, contacted affected clients, notified governmental authorities and regulators, and engaged a law firm to provide legal advice regarding the incident. The company remained committed to evaluating the matter and taking additional steps as required to strengthen its cybersecurity measures [62930].
Behaviour crash, omission, value, other (a) crash: The software failure incident in the article can be categorized as a crash as it resulted in the compromise of Deloitte's global email server, leading to a loss of state and the system not performing its intended functions [62930]. (b) omission: The incident can also be related to omission as the system omitted to protect the confidential emails and plans of Deloitte's blue-chip clients, resulting in a breach that went unnoticed for months [62930]. (c) timing: There is no specific mention of timing-related failures in the article. (d) value: The incident can be associated with a value failure as the system failed to perform its intended functions correctly by allowing unauthorized access to sensitive information, compromising the security and confidentiality of the data [62930]. (e) byzantine: The article does not provide information indicating a byzantine behavior in the software failure incident. (f) other: The other behavior observed in this software failure incident could be a security vulnerability, where the system failed to adequately protect its email server and sensitive client information, leading to a successful cyberattack [62930].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure - Deloitte, a major accountancy firm, was targeted by a sophisticated hack that compromised confidential emails and plans of some of its blue-chip clients [62930]. - The hacker compromised the firm’s global email server through an “administrator’s account” and potentially had access to usernames, passwords, IP addresses, architectural diagrams for businesses, health information, and sensitive security and design details [62930]. - An estimated 5 million emails were in the "cloud" and could have been accessed by the hackers, although Deloitte stated that the number of emails at risk was a fraction of this number [62930]. - Deloitte confirmed it had been the victim of a hack, and a small number of its clients had been impacted, with potentially vulnerable data due to the breach [62930].
Domain finance (a) The failed system was intended to support the finance industry. Deloitte, a major accountancy firm, was targeted by a sophisticated hack that compromised confidential emails and plans of its blue-chip clients, including banks, multinational companies, and government agencies [62930]. Deloitte provides auditing, tax consultancy, and high-end cybersecurity advice to some of the world's biggest banks and multinational companies [62930]. (h) The failed system was also intended to support the finance industry. Deloitte, the victim of the cybersecurity attack, is one of the largest private firms in the US, with a record revenue of $37 billion last year [62930]. Deloitte offers potential clients advice on managing risks posed by sophisticated cybersecurity attacks [62930]. (m) The failed system was related to the finance industry, which falls under the "other" category in the provided options. Deloitte, the target of the hack, is a major player in the finance and professional services industry, providing a range of financial and consulting services to clients worldwide [62930].

Sources

Back to List