Incident: Deloitte Email Server Hack Compromising Client Data and Security

Published Date: 2017-10-10

Postmortem Analysis
Timeline 1. The software failure incident at Deloitte happened in autumn last year when Deloitte was migrating and updating its email system to Microsoft’s cloud-based Office 365 service [63947]. 2. Published on 2017-10-10. 3. The incident occurred in autumn of 2016.
System 1. Deloitte's email system 2. Microsoft's cloud-based Office 365 service 3. Lack of multi-factor authentication on the server that was breached [63947]
Responsible Organization 1. The hackers who gained access to Deloitte's system using an administrator's account were responsible for causing the software failure incident [63947].
Impacted Organization 1. The US departments of state, energy, homeland security, and defense 2. The US Postal Service 3. The National Institutes of Health 4. "Fannie Mae" and "Freddie Mac" 5. Fifa 6. Four global banks 7. Three airlines 8. Two multinational car manufacturers 9. Energy giants 10. Big pharmaceutical companies [Cited from Article 63947]
Software Causes 1. Lack of multi-factor authentication on the server that was breached, making it easier for hackers to gain unauthorized access [63947]. 2. Complications arising from the migration to a new email system, which hindered the forensic investigation required to determine the extent of the breach and track the hacker's activities [63947]. 3. Inadequate monitoring of privileged accounts, specifically the administrator's account that was compromised, allowing the hackers to have unrestricted access to the entire email database [63947].
Non-software Causes 1. Lack of multi-factor authentication on the server that was breached [63947] 2. Complexity and complications introduced by the migration to a new email system [63947]
Impacts 1. The hack into Deloitte compromised a server containing emails of an estimated 350 clients, including four US government departments, the United Nations, and major multinationals [63947]. 2. The incident was potentially more widespread than acknowledged by Deloitte, with a cache of emails and attachments compromised from various entities [63947]. 3. Clients affected by the hack included US government departments, global banks, airlines, car manufacturers, energy giants, and pharmaceutical companies [63947]. 4. The hackers potentially had access to usernames, passwords, IP addresses, architectural diagrams, health information, and sensitive security and design details [63947]. 5. Deloitte's internal inquiry found that only six clients had information compromised, but this analysis was contested by sources indicating a larger amount of data was extracted [63947].
Preventions 1. Implementation of multi-factor authentication as a standard security measure on the server that was breached could have prevented unauthorized access [63947]. 2. Regular security audits and monitoring of privileged accounts to detect any unusual activities or unauthorized access [63947]. 3. Timely detection and response to security incidents through robust cybersecurity incident response protocols [63947]. 4. Enhanced encryption software to protect sensitive data and communications from being compromised [63947].
Fixes 1. Implementing multi-factor authentication as a standard security measure on the server to prevent unauthorized access [63947]. 2. Conducting a thorough forensic investigation to determine the extent of the data breach and identify any potential gaps in security measures [63947]. 3. Enhancing monitoring capabilities to detect and respond to any suspicious activities within the network, especially in critical systems like email platforms [63947]. 4. Regularly updating and patching software systems to address vulnerabilities that could be exploited by hackers [63947]. 5. Educating employees on cybersecurity best practices and raising awareness about the importance of maintaining strong security protocols [63947].
References 1. Sources with knowledge of the hack [63947] 2. Deloitte 3. The Guardian's investigation and sources who spoke to the Guardian [63947]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident at Deloitte involved a hack that compromised a server containing emails of various clients, including government departments and multinational companies. Deloitte had been migrating its email system to Microsoft's Office 365 service when the hackers gained access using an administrator's account. The incident raised concerns about the extent of the breach and the potential data compromised, including usernames, passwords, IP addresses, architectural diagrams, and health information [63947]. (b) The software failure incident at Deloitte is not explicitly mentioned to have happened at other organizations in the articles provided. Therefore, there is no information available regarding similar incidents occurring at multiple organizations.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the article where it mentions that the hack into Deloitte's system occurred during a migration and update of its email system from an in-house system to Microsoft's cloud-based Office 365 service [63947]. This migration and update process could have introduced vulnerabilities that the hackers exploited to gain access to the system. (b) The software failure incident related to the operation phase is evident in the article where it states that Deloitte did not have multi-factor authentication as standard on the server that was breached at the time of the hack [63947]. This lack of security measure in the operation of the system made it easier for the hackers to access and remain undetected in the system for an extended period.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at Deloitte was primarily due to contributing factors that originated from within the system. The hackers gained access to the system using an administrator's account, which theoretically provided them access to the entire email database, including sensitive information of Deloitte's clients [63947]. (b) outside_system: The software failure incident at Deloitte was also influenced by contributing factors that originated from outside the system. The hackers were able to breach the system and access sensitive data, compromising the security of the emails and attachments stored on the server. Additionally, the lack of multi-factor authentication on the server that was breached was highlighted as a vulnerability that could have been exploited by external attackers [63947].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the Deloitte hack was primarily due to non-human actions. The incident involved hackers gaining unauthorized access to Deloitte's system using an administrator's account, potentially compromising a significant amount of data including emails, usernames, passwords, IP addresses, architectural diagrams, and health information [63947]. (b) Human actions also played a role in the software failure incident. Deloitte was in the process of migrating and updating its email system when the hack occurred. The lack of multi-factor authentication on the server that was breached was highlighted as a significant oversight, making it easier for the hackers to access the system undetected for an extended period of time [63947].
Dimension (Hardware/Software) software (a) The software failure incident at Deloitte was not directly attributed to hardware issues. The incident was primarily a result of a hack that compromised the server containing sensitive data. The hackers gained access to the system using an administrator's account, allowing them to access the entire email database and potentially sensitive information like usernames, passwords, IP addresses, and architectural diagrams [63947]. (b) The software failure incident at Deloitte was primarily due to contributing factors originating in software. The hack into Deloitte's system allowed unauthorized access to sensitive data, including emails and attachments, from various clients and entities. The incident was a result of vulnerabilities in the email platform being exploited by the hackers, leading to a breach that compromised information from multiple organizations [63947].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. The incident involved a hack into Deloitte's system, compromising a server containing emails of numerous clients, including government departments, the United Nations, multinationals, and other entities. The hackers gained access using an administrator's account, potentially accessing sensitive information like usernames, passwords, IP addresses, architectural diagrams, and health information [63947]. The attack was sophisticated, allowing the hackers free rein in the network for an extended period, with the exact extent of data taken being uncertain. The incident was not accidental but a deliberate breach by external malicious actors aiming to access and potentially exploit sensitive information [63947].
Intent (Poor/Accidental Decisions) poor_decisions The software failure incident at Deloitte was primarily due to poor decisions rather than accidental decisions. The incident was a result of various poor decisions and actions taken by the company: 1. Deloitte did not have multi-factor authentication as standard on the server that was breached, which was described as "astonishing" by a cybersecurity specialist [63947]. 2. The migration to the new email system complicated the forensic investigation required to understand the extent of the breach, indicating a lack of proper planning and risk assessment during the migration process [63947]. 3. The hackers had undetected access to Deloitte's email system for months, suggesting a lack of robust monitoring and detection mechanisms in place [63947]. 4. Despite claims by Deloitte that only six clients were impacted, sources contest this and suggest that a large amount of data was actually extracted by the hackers, indicating a lack of accurate assessment and transparency regarding the breach [63947]. These points highlight that the software failure incident at Deloitte was primarily driven by poor decisions and actions taken by the company, rather than accidental mistakes or unintended decisions.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence is evident in the Deloitte hack incident. The hackers gained access to Deloitte's system using an administrator's account during a migration and update of their email system to Microsoft's cloud-based Office 365 service. This migration process was taking place at Deloitte's Hermitage office in Nashville, Tennessee. The lack of proper security measures, such as multi-factor authentication, on the server that was breached was highlighted as a significant oversight. Additionally, the cybersecurity specialist mentioned that the migration complicated the forensic investigation required to understand the extent of the breach, indicating a lack of thorough planning and execution in the development process [63947]. (b) The software failure incident related to accidental factors is seen in the manner in which the hackers were able to access Deloitte's system undetected for a long period. The article mentions that the hackers had free rein in the network for a significant amount of time, and the exact amount of data taken remains unknown. This lack of detection and the potential underestimation of the impact of the breach point to accidental oversights or failures in monitoring and security protocols within Deloitte's systems [63947].
Duration temporary The software failure incident at Deloitte was temporary in nature. The incident started in autumn the previous year when Deloitte was migrating its email system to Microsoft's Office 365 service [63947]. The hackers gained access to the system using an administrator's account, allowing them access to the entire email database, including sensitive information [63947]. Deloitte realized the problem in spring the following year and took steps to investigate and address the breach [63947]. The company has since introduced multi-factor authentication and encryption software to prevent further hacks [63947].
Behaviour crash, omission, value, other (a) crash: The software failure incident in the Deloitte hack can be associated with a crash behavior as the hackers gained access to the system using an administrator's account, theoretically giving them access to the entire email database, resulting in a loss of control over the system's state and functionality [63947]. (b) omission: The incident can also be linked to an omission behavior as the system failed to prevent unauthorized access and protect sensitive information, omitting to perform its intended function of maintaining data security [63947]. (c) timing: The timing behavior is not explicitly mentioned in the articles. (d) value: The software failure incident can be related to a value behavior as the hackers potentially accessed usernames, passwords, IP addresses, architectural diagrams, health information, and sensitive security details, indicating that the system performed its functions incorrectly by allowing unauthorized access to critical data [63947]. (e) byzantine: The byzantine behavior is not explicitly mentioned in the articles. (f) other: The software failure incident can also be associated with an "other" behavior as the system failed to detect the intrusion for a prolonged period, leading to uncertainty about the extent of data compromised and the effectiveness of the investigation, showcasing a behavior not fitting into the defined categories [63947].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving the hack into Deloitte's system compromised a server containing emails and data of numerous clients, including government departments, multinational companies, and organizations like the United Nations [63947]. The incident potentially exposed sensitive information such as usernames, passwords, IP addresses, architectural diagrams, health information, and security details [63947]. Deloitte stated that the attack impacted six clients, but sources indicated that a significant amount of data was extracted, and the hackers had access to the entire email database [63947]. The breach raised concerns about the extent of the data taken and the potential damage caused by the hackers [63947].
Domain information, finance, government (a) The failed system was intended to support the industry of information, specifically in the realm of accountancy and consulting services. The incident involved a hack into the accountancy giant Deloitte, compromising sensitive information such as emails and attachments of numerous clients, including government departments, multinational corporations, and other entities [63947].

Sources

Back to List