Connect with us

Business

Column: Why hugely profitable corporations won't spend enough to keep hackers from stealing your private info

Published

on

Column: Why hugely profitable corporations won't spend enough to keep hackers from stealing your private info

AT&T is one of America’s largest telecommunications companies. Last year it recorded a pretax profit of nearly $20 billion on $122.4 billion in revenue.

So why, you might ask, has AT&T been so pathetically sloppy about protecting its customers’ private information that the data of nearly all those customers — 110 million users — ended up in the hands of a “financially motivated” hacker group?

The breach was revealed on July 12, although it mostly occurred in 2022; AT&T attributed the reporting delay to requests from federal authorities to keep it under wraps while they investigated its national security significance.

Protecting your data is one of our top priorities.

— AT&T, after disclosing that personal data of as many as 110 million customers was stolen by hackers

Advertisement

This breach, cybersecurity experts say, is especially alarming because of the nature of the stolen data. It’s not merely financial data such as bank account or Social Security numbers that might enable hackers to raid a victim’s bank account or engage in identity theft to open new accounts.

In this case, it included information about what numbers were called by hacked users and the numbers that called them; the length of calls, and location data — where you might have been when making or receiving a call. The data the hackers snarfed up came from May through October 2022 and Jan. 2, 2023.

“Telecom providers hold some of the most sensitive information on consumers — a map of their daily lives — where they are, who they’re talking with, their social graph, everything,” says cybersecurity professional Brian Krebs.

The latest disclosure of a hack at AT&T might be considered a signpost for “the year of the megabreach.”

Advertisement

It follows AT&T’s announcement in April of an earlier, unrelated breach that may have compromised the Social Security numbers, PINs, email and mailing addresses, phone numbers, dates of birth and AT&T account numbers of 73 million current and former AT&T customers.

Both AT&T incidents pale in comparison with a massive data breach earlier this year at UnitedHealth Group, the nation’s biggest health insurance and health provider conglomerate. According to congressional testimony by UnitedHealth Chief Executive Andrew Witty and company news releases, a ransomware attack on the company’s Change Healthcare subsidiary has affected as many as 1 in 3 Americans.

Change Healthcare manages patient payments and reimbursements to medical providers. The ransomware hack crippled medical services nationwide and resulted in the exposure of patients’ treatment details and billing information, including credit card numbers. Patients reported that pharmacies were refusing to fill prescriptions because they couldn’t access insurance approvals, risking the patients’ health.

UnitedHealth said it paid a $22-million ransom in bitcoin, but couldn’t be sure that all the hacked information was returned. It also said that it advanced about $9 billion to providers to cover their expenses before their billing could be restored.

The company told Congress that it already had in place “a robust information security program with over 1,300 people and approximately $300 million in annual investment,” but of course those figures are meaningless — the question is how much it would cost to actually have a “robust” program in place, since $300 million obviously isn’t enough.

Advertisement

The breach occurred, according to testimony and statements by the company, because UnitedHealth tried to integrate Change Healthcare’s technology system with its own without first ensuring that Change’s system would require multifactor authentication, a basic security feature that requires users to enter an algorithmically generated code along with their password to gain access to a system or account.

The hackers breached “a legacy Change Healthcare server” that didn’t meet the parent company’s standards, the company said — but it used the noncompliant equipment anyway.

Data breaches affecting hundreds of thousands or millions of consumers have become such familiar features of the consumer landscape that the guilty companies respond with a standard playbook replete with promises to customers.

They point out all the data that wasn’t compromised — AT&T told customers that the latest debacle didn’t involve “the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information.” That’s a bit like airlines following up reports of deadly crashes by pointing out how many planes land and take off safely every day.

The companies typically offer aggrieved customers free credit monitoring and identity theft protection for a period of time; at UnitedHealth, that period is two years.

Advertisement

Whether those services are useful is open to question — after a 2017 data breach at the credit reporting firm Equifax exposed the personal data of 143 million Americans, the identity theft service LifeLock trumpeted its protective services (at $29.99 a month). What LifeLock didn’t make very clear was that the services it was selling were actually provided byEquifax.

The breached companies also attest to their determination to get to the bottom of the hacks, and to their commitment to customer security. AT&T’s recent breach disclosure included this pledge: “Protecting your data is one of our top priorities.”

If there were a trophy for flagrant lying in marketing materials, this would be a strong contender. Under the circumstances, it’s either blatantly untrue or reflects a critical flaw in the company’s fulfillment of its priorities. I asked AT&T what steps it has taken to discipline or remove any executives charged with fulfilling such a crucial priority, up to and including the CEO. AT&T didn’t respond directly to this or other questions I submitted, but referred me to its news release and a customer Q&A on the topic.

AT&T says the breach occurred in a company connection to a third-party cloud data service called Snowflake, to which it had entrusted its customer data. As it happens, some 165 of Snowflake’s corporate clients may also have been targeted by the hackers who struck AT&T. An ongoing investigation by cybersecurity experts suggests, however, that the fault isn’t Snowflake’s — it’s the fault of those clients, who didn’t observe best security practices.

That points to several issues that contributed to AT&T’s breach — and similar breaches around the corporate world. One is why AT&T is hoarding so much information about its users in the first place.

Advertisement

“To have years of call histories, text message histories and location data makes you a massive target for hackers,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, a New York nonprofit.

“Why does AT&T keep so much information on so many users?” Cahn asks. “They have a perverse incentive to hold on to as much of our data as possible, to think about new ways to mine it for value. When they do that, we’re the ones put at risk.”

In any event, if AT&T is going to store data this sensitive, he says, it needs to employ more rigorous safeguards to protect it.

Yet in corporate America, cybersecurity has been an afterthought, if it receives any thought at all. “These companies at some point decide that it’s really expensive to care a lot more about security when there really aren’t a lot of consequences for screwing it up,” Krebs told me. “You might get sued or have to pay a few hundred million dollars in fines, but these are rounding errors on their profits.”

The European Union’s General Data Protection Regulation allows for a fine of up to 4% of a company’s annual revenue for an especially severe breach, but it’s unlikely that such a penalty could be legislated in the U.S. (If it were, AT&T might be liable for a bill of $4.9 billion.)

Advertisement

Krebs blames indifferent boards of directors for their inattention. Even a data-oriented company such as AT&T has no directors with specific expertise in cybersecurity. Of the nine directors in place as of the 2024 proxy statement, five are credited with experience in technology and innovation, according to what Villanova University business professor Noah Barsky correctly calls “perfunctory” language in their bios in the company’s 2024 proxy statement.

Only one, Stephen J. Luczo, is said to have any particular expertise in cybersecurity, but that’s only as a private equity investor — his background is in investment banking. The board’s newest member, Marissa Mayer, may have cybersecurity experience, but it’s not encouraging: During her tenure as CEO of Yahoo (2012 to 2017), that company experienced an epic data breach that compromised all 3 billion of its user accounts.

“It’s clear that industry is never going to do enough on its own” to protect customer data, Cahn says. The task may have to be placed in regulatory hands. Krebs suggests something akin to a cybersafety review board to introduce something close to accountability. Cahn suggests rules requiring the proactive deletion of sensitive information such as location data and medical records — “You can’t steal what doesn’t exist,” he told me.

The market may yet exercise its own discipline. UnitedHealth is learning the hard way that carelessness about cybersecurity can have a material effect on earnings. In its second-quarter earnings report released Tuesday, the company said that the full-year cost of the Change Healthcare hack may come to as much as $2.05 per share, an increase of as much as 45 cents from its original estimate. Its second-quarter earnings came to $4.54 per share.

But it’s customers who will really bear the costs. “Most Americans,” Krebs says, “have no choice but to do business with these companies if they want to participate in the modern society.”

Advertisement
Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Business

How Neon's 'Longlegs' became the surprise indie horror hit of the summer

Published

on

How Neon's 'Longlegs' became the surprise indie horror hit of the summer

The greatest plot twists lie at the end of a long trail of clues, dramatically revealing an answer hidden in plain sight all along.

The marketing campaign for independent distributor Neon’s surprise horror smash, “Longlegs,” took that concept a step further.

Breadcrumbs — in the form of enigmatic trailers, chilling phone messages, encrypted newspaper ads, fake blog posts and other stunts — littered the promotional path to “Longlegs.” And audiences took the bait, handing New York-based Neon its biggest opening ever as well as the best launch for an independent horror flick in a decade.

The R-rated title — which cost less than $10 million to make and promote, according to the studio — premiered at No. 2 last weekend with $22.6 million in domestic ticket sales.

Its performance “seemingly came out of nowhere,” said Comscore senior media analyst Paul Dergarabedian, especially when sandwiched between safer, flashier pushes for major studio films such as “Despicable Me 4” and “Twisters.”

Advertisement

“If you had talked to people a month ago and said, ‘Is this movie “Longlegs” on your list of films to be one of those sleeper, surprise hits?’ they’d say, ‘What’s “Longlegs”?’” Dergarabedian said.

“Getting audiences on board like this is not easy,” he added. “The way you entice that audience is to do something that goes above and beyond the ordinary … and they certainly did that.”

Helmed by Osgood Perkins (son of the late horror great Anthony Perkins), “Longlegs” stars veteran scream queen Maika Monroe as an FBI agent investigating a series of gruesome homicides. Nicolas Cage plays the film’s titular bogeyman — but you wouldn’t necessarily know that from the marketing materials, which deliberately obscure the actor’s face.

He’s barely shown in the main trailer, which reveals little about the plot. (The studio scrapped its original plan for a more conventional preview after audiences responded enthusiastically to an early, cryptic teaser.)

“It increases the intrigue,” said Monica Koyama, an entertainment marketing expert and communication management professor at USC.

Advertisement

“I mean, he’s definitely frightening in the film. But … sometimes what’s in your head is scarier than what shows up onscreen.”

Maika Monroe and Nicolas Cage in a poster for Neon’s “Longlegs.” The studio has strategically obscured Cage’s face in marketing materials.

(Neon)

In an added effort to sell audiences on the fear factor, Neon released a recording of Monroe’s heartbeat spiking from 76 beats per minute
to 170 while filming her first scene with Cage as Longlegs. The studio pulled the audio from a microphone taped to Monroe’s chest after a conversation with Perkins — who deliberately separated the actors before shooting that sequence and said Monroe’s heart was racing during the encounter.

Advertisement

“It’s so simple,” Koyama said. “They gave us data. … ‘We’re saying this is scary. Here’s the actual raw data from the actress.’”

It’s all part of Neon’s ploy to place moviegoers in the shoes of the protagonist.

The success of “Longlegs” is “a testament to the wildly creative, exciting film [that director] Osgood Perkins and his fantastic group of collaborators created,” Elissa Federoff, president of distribution at Neon, said in a statement to The Times.

“We couldn’t be happier with the results, and we look forward to continuing our relationship with Osgood and his team of producers, all of whom have allowed us the freedom to build a campaign we believe in.”

Koyama suspected that Neon intentionally blurred the lines between the horror and crime genres to appeal to a wider audience. She also credited plenty of tried-and-true advertising moves — such as quoting rave reviews calling it one of the scariest movies in years — with getting “Longlegs” over the line.

Advertisement

“This is going to reignite the creativity within marketing,” Koyama said. “I’m hoping studios will feel more excited about taking chances.”

Continue Reading

Business

Elon Musk says he's moving SpaceX and X headquarters from California to Texas

Published

on

Elon Musk says he's moving SpaceX and X headquarters from California to Texas

Elon Musk said Tuesday on X that he is moving the headquarters of both SpaceX and the social media platform formerly known as Twitter to Texas — citing several criticisms he has of California and doing business in San Francisco.

Pointing to a new state law that bans teachers from telling families about student gender identity changes, Musk tweeted that he is moving the headquarters of SpaceX from Hawthorne to the company’s launch test site in Texas.

The move would be a blow to Southern California, where SpaceX has helped to anchor a burgeoning space economy.

“This is the final straw,” Musk posted shortly after noon. “Because of this law and the many others that preceded it, attacking both families and companies, SpaceX will now move its HQ from Hawthorne, California, to Starbase, Texas.”

Advertisement

The law the SpaceX founder cited was signed by Gov. Gavin Newsom on Monday after a contentious battle between conservative school boards concerned about parental rights and LGBTQ+ activists worried about vulnerable youths.

Later Tuesday, Newsom retweeted an older Donald Trump post on X about Musk with the comment: “You bent the knee.”

Trump’s tweet talked about how Musk came to the White House seeking help for all his “subsidized projects, whether it’s electric cars that don’t drive long enough, driverless cars that crash, or rocketships to nowhere… I could have said, ‘drop to your knees and beg,’ and he would have done it.”

Shortly after his post about moving SpaceX, Musk posted that he would also move X, formerly known as Twitter, from San Francisco to Austin, saying that he has “had enough of dodging gangs of violent drug addicts just to get in and out of the building.”

Since acquiring Twitter in 2022 in a $44-billion deal, Musk has made sweeping and controversial changes to the social media site, firing top executives and laying off thousands of employees.

Advertisement

The announcement is the latest salvo in Musk’s long-running feud with California and comes nearly three years after he announced the move of Tesla’s headquarters to Austin from Palo Alto, citing the high cost of housing and long commutes for employees. The electric vehicle company maintains a manufacturing operation in Fremont.

It comes amid the highly charged presidential campaign during which the libertarian Musk has increasingly moved to the right. The Wall Street Journal reported Tuesday that the billionaire plans to give $45 million a month to a new pro-Trump super PAC called America PAC.

Musk has an estimated net worth of $254 billion, making him the world’s wealthiest person, according to Forbes. His announcements drew immediate applause from Republicans. GOP Texas Sen. Ted Cruz posted: “Let freedom ring!”

California Assembly Republican Leader James Gallagher, who voted against the parental notification law, issued a statement that “Gavin Newsom’s anti-parent agenda isn’t just bad for families — now it’s doing serious damage to California’s economy.”

Musk also drew a comment from the other side of the political spectrum, with Democratic state Sen. Scott Wiener, who represents San Francisco, posting that Musk hugely benefited from California subsidies. “Will this be a fake temper tantrum move just like Tesla’s fake ‘move’ to Texas?”

Advertisement

In an interview, Wiener said, “I’m not confident that whatever he’s going to do has anything to do with a law that we passed to protect the safety of trans kids.” He added, “He has a history of saying one thing and it not being true.”

Newsom declined to comment on Musk’s announcements.

Musk, who announced in 2020 that he had moved from Los Angeles to Texas, has previously complained about crime in San Francisco. Last year, he said in a post that a friend had experienced two shootings outside his apartment in the city, with a bullet going through his wall.

In posting he would move SpaceX’s headquarters, it was unclear whether Musk was referring just to the company’s executive offices or also production and other employees.

Founded in 2002, SpaceX has deep ties to Los Angeles. In 2007, it moved into a former Northrop Corp. facility off Crenshaw Boulevard that it rapidly expanded last decade.

Advertisement

The sprawling Hawthorne campus is the location of the company’s mission control center and employs thousands of workers who design and build the company’s spacecraft, including the workhorse Falcon 9. SpaceX’s Dragon capsule, made to service the International Space Station, also was built there under a $2.6-billion contract with NASA.

Other facilities in Southern California include one at Vandenberg Space Force Base near Lompoc, where it wants to expand operations. SpaceX is seeking approval to launch 90 rockets from the Santa Barbara County launch site by 2026.

The company also conducts rocket launches in Florida and from Starbase, a site in Boca Chica, Texas, off the Gulf of Mexico. That is where it is building and has launched its massive Starship rocket, which SpaceX intends to send to the moon.

SpaceX has recently suffered some setbacks.

Last week, the Federal Aviation Administration grounded the company’s Falcon 9 rocket after its second stage failed to boost a payload of the company’s Starlink internet satellites into orbit during an uncrewed mission.

Advertisement

And last month, SpaceX and Musk were sued by eight former employees who allege that they were fired after asking the company to address a toxic work culture they say is rife with sexual harassment and discrimination. The company has declined to respond to the claims.

Last year, the Justice Department sued the company, alleging that it discriminated against employees and refugees by discouraging them from applying for jobs and by refusing to consider or hire them because of their citizenship status.

Times staff writer Caroline Petrow-Cohen contributed to this report.

Advertisement
Continue Reading

Business

Hacker group says it leaked Disney data over the company's 'approach to AI'

Published

on

Hacker group says it leaked Disney data over the company's 'approach to AI'

A group of hackers says it recently leaked internal communications at Walt Disney Co. over the company’s handling of “artist contracts, its approach to AI, and its pretty blatant disregard for the consumer.”

The self-proclaimed hacktivist group known as NullBulge told multiple media outlets, including CNN, that it had breached thousands of Disney’s internal messaging channels and leaked roughly 1.2 terabytes of information.

NullBulge did not immediately respond Tuesday to The Times’ request for comment.

A Disney spokesperson said in a statement to The Times that the Burbank-based entertainment behemoth was “investigating this matter.”

The compromised data included computer code and information about unreleased projects, as well as conversations about marketing, studio technology and job applicants, according to the Wall Street Journal.

Advertisement

NullBulge told CNN that it was based out of Russia and that it penetrated Disney’s system thanks to “a man with Slack access who had cookies” and initially tried to kick the hackers out. Slack is a popular workplace messaging platform used by companies for internal discussions.

NullBulge bills itself as a group “protecting artists’ rights and ensuring fair compensation for their work.”

Companies such as Disney, Warner Bros. Discovery and Netflix have come under scrutiny lately amid widespread concerns about the rise of artificial intelligence and its effect on entertainment workers.

Labor unions representing Hollywood actors, writers and crew members have all fought in recent months for limitations on the use of AI. The rapidly evolving technology emerged as a key issue in negotiations between the unions and the studios during last year’s strikes by writers and actors.

California lawmakers are also trying to regulate AI through legislation, and tech companies have responded by urging caution against overregulation.

Advertisement
Continue Reading

Trending