Cybersecurity Crisis Unleashed: Lessons Learned from Paramount and Forever 21 Data Breaches

Paramount Global and Forever 21 Data Breaches Expose Thousands to Cyberattacks

Media giant Paramount Global and fashion retailer Forever 21 have recently suffered data breaches that have compromised the personally identifiable information (PII) of thousands of individuals. These breaches not only pose a significant threat to the affected individuals but also create opportunities for follow-on attacks. Both companies have disclosed the nature of the data that was accessed, which includes sensitive information such as names, birthdates, Social Security numbers, and driver’s license numbers.

Paramount Global Breach

The data breach at Paramount Global took place between May and June of this year. While the specific details of the compromised data and the number of affected individuals are not clear, the breach notification letter obtained by the media indicates that the stolen data also included passport numbers and “information related to [the individual’s] relationship with Paramount.” This raises concerns about the potential use of the stolen information for targeted phishing attacks.

Forever 21 Breach

In the case of Forever 21, the breach was discovered on August 4th, but the unauthorized access occurred between January 5th and March 21st. The compromised data includes PII of 539,000 consumers, employee information, and details about Forever 21 health plans. This additional information about victims’ health plans and their relationship with the company can significantly increase the chances of successful phishing attempts and further data breaches.

Precursors for More Cyberattacks

These data breaches highlight the potential for a wide range of cyberattacks. Stolen PII, particularly Social Security numbers, can be exploited for identity theft and various fraudulent activities. Moreover, the information acquired can also enable hackers to mount convincing follow-on phishing attacks. The personalization offered by the compromised data, such as health plan details and relationship descriptions, significantly increases the likelihood of successful social engineering attacks. Victims should remain vigilant and be prepared for different attack methods.

Erich Kron, a security awareness advocate at cybersecurity company KnowBe4, emphasizes the significance of these breaches, stating that the stolen information “could easily be bundled and sold on the Dark Web and not used for months or even years.” He further highlights that information like Social Security numbers does not expire and can remain useful to malicious actors for decades.

The Need for Improved Security Measures

The details surrounding the security vulnerabilities that led to these cyber intrusions are still unclear. However, these breaches serve as a reminder to companies that hold PII to strengthen their security defenses. Companies must prioritize patching vulnerabilities, securing cloud instances against open access, and implementing robust authentication methods for databases and servers that store PII.

Stuart Wells, CTO at Jumio, emphasizes the necessity for robust identity verification measures across all organizations. Wells argues that organizations should establish the true identity of each user to prevent fraudsters from gaining unauthorized access to user accounts.

Conclusion

The recent data breaches at Paramount Global and Forever 21 underscore the need for stronger security measures to protect personally identifiable information. These breaches not only expose individuals to potential identity theft and fraud but also lay the foundation for more sophisticated cyberattacks. Proactive security practices, including patching vulnerabilities and implementing robust authentication methods, are essential for preventing future breaches. Additionally, organizations should prioritize identity verification measures to ensure that user accounts are not compromised by fraudsters. As individuals, it is crucial to remain vigilant and take steps to protect personal information from falling into the wrong hands by regularly monitoring accounts, using strong and unique passwords, and being cautious of suspicious communications.