MongoDB reports breach, critical ICS vulnerabilities revealed

MongoDB issued an alert regarding an unauthorized access incident impacting its internal systems, leading to the exposure of customer account metadata and contact details. The NoSQL pioneer assured no known exposure of data stored in MongoDB Atlas, its multi-cloud database service.

 

While advising customers to stay vigilant against potential social engineering and phishing attacks, MongoDB recommended enabling multi-factor authentication and regularly changing Atlas passwords.

 

Notably, a surge in login attempts unrelated to the security incident caused Atlas and Support Portal access issues. Affected customers were urged to retry logging in after a few minutes.

 

In parallel, critical vulnerabilities surfaced in various industrial control systems (ICS). Siemens SIMATIC S7-1500 CPU PLCs, Unitronics Vision Series PLCs, Siemens SCALANCE M-800, S615 family ICS switches, and Siemens’s SINEC industrial network management software were found susceptible to multiple vulnerabilities, emphasizing the urgency of patching to prevent information disclosure, tampering, DoS attacks, and code injection.

 

Meanwhile, Seattle’s Fred Hutchinson Cancer Center patients received ransom letters demanding $50 to prevent the sale of their exposed data from a November breach. The breach involved unauthorized access to the clinical network, with the Hunters International ransomware gang claiming responsibility for stealing 533GB of files.

 

The ransom notes received by patients detailed compromised information, including names, social security numbers, addresses, phone numbers, medical history, lab results, and insurance details.

 

Additionally, US dental insurance group Delta Dental disclosed being a victim of attacks on MOVEit, affecting nearly seven million patients. Breached data included financial account details, credit/debit card numbers, PINs, driver’s license numbers, social security numbers, addresses, and health information.

 

Acknowledging the breach in July, Delta has offered affected individuals free credit monitoring services and apologies. The total tally of organizational victims from recent breaches, including MOVEit, reaches 2,686, affecting approximately 91 million individuals, according to antimalware vendor Emsisoft’s latest updates.