Hightower Holdings data breach impacted over 130,000 individuals

Multinational communications and digital marketing company Hightower Holdings suffered a major data breach in January that compromised the personal information of more than 130,000 individuals.

The company, which offers communications, advertising, public relations, e-commerce and digital marketing services to organisations worldwide, announced in data security notifications shared with regulators that it suffered unauthorised access to its network in early January that allowed threat actors to steal customers’ personal information.

Hightower Holdings said it became aware on January 9 that malicious actors used a compromised user account to gain access to its IT environment. A comprehensive investigation into the unauthorised access with the assistance of third party cyber security and digital forensic specialists found that malicious actors downloaded certain files from its network between January 8 and January 9.
 
"The Company identified the affected files and engaged third-party data review specialists to conduct a time-intensive and thorough review of the files to identify sensitive information contained therein and to whom the information relates," Hightower said. "The information that could have been subject to unauthorized access includes name and Social Security Number."

The company said the data security incident was not due to a deficiency in its IT environment  but due to compromised user credentials, and it has taken steps to prevent such an incident from occurring in the future.

"In connection with the Company’s review of the incident, it undertook additional measures to further strengthen its cybersecurity posture even with respect to credentialed users. Further, the Company notified federal law enforcement regarding the event," it added.

Hightower Holdings informed the office of the Attorney General of Maine that the data security incident compromised the personal information of 131,483 individuals, including 1557 Maine residents. The company is providing one year of complimentary credit monitoring and identity theft services through TransUnion to all the affected victims. 

The company said it is also providing victims with guidance on how to protect against identity theft and fraud, how to place a fraud alert or security freeze on their accounts, how to obtain free credit reports and the contact details for national consumer reporting agencies.