Forum - View topic

NEWS: Hackers Claim Breach of Senior Employee Account at Viz Media

The hackers claimed to have stolen e-mails, non-disclosure agreements (NDAs), licensing agreements, employee credentials, future business plans, employee social security numbers, invoices, and royalty statements.

The news outlet added the hackers likely gained access to a single person's account.

How do you have both this:

Quote:

The hackers claimed to have stolen e-mails, non-disclosure agreements (NDAs), licensing agreements, employee credentials, future business plans, employee social security numbers, invoices, and royalty statements.

And this:

Quote:

The news outlet added the hackers likely gained access to a single person's account.

Seems like either that second part is BS, or why the hell does one person have access to all of those different types of things? Or did they mean the point of entry only a single account which allowed for the compromise of other accounts?

Seems like either that second part is BS, or why the hell does one person have access to all of those different types of things? Or did they mean the point of entry only a single account which allowed for the compromise of other accounts?

How do you have both this:

Quote:

The hackers claimed to have stolen e-mails, non-disclosure agreements (NDAs), licensing agreements, employee credentials, future business plans, employee social security numbers, invoices, and royalty statements.

And this:

Quote:

The news outlet added the hackers likely gained access to a single person's account.

Seems like either that second part is BS, or why the hell does one person have access to all of those different types of things? Or did they mean the point of entry only a single account which allowed for the compromise of other accounts?

SilverTalon01 wrote:

Seems like either that second part is BS, or why the hell does one person have access to all of those different types of things? Or did they mean the point of entry only a single account which allowed for the compromise of other accounts?

The article states that it was a senior executive that fell victim to social engineering, meaning that just one account had access to all of those things.

Sounds like Viz didn't segregate duties, so one senior executive had access to all that info, whether they directly had access to it like through reports, or they had administrative access and the hacker was able to laterally move through the system to somewhere they could access that info.

Mikan-box Glasses-kun wrote:

SilverTalon01 wrote: Seems like either that second part is BS, or why the hell does one person have access to all of those different types of things? Or did they mean the point of entry only a single account which allowed for the compromise of other accounts? The article states that it was a senior executive that fell victim to social engineering, meaning that just one account had access to all of those things.

Um, I think you're misunderstanding how responsible organizations operate. There is no reason for a senior executive to have access to all of that. The cited items include legal agreements, security credentials, and HR data. Those things are very different, and the second one in itself is a wtf. An executive account has access to grab employee credentials? Why? Typically senior executives do have access to sensitive information, but they typically have less system access to things like HR databases and credential vaults. So yeah, none of what you said is a reasonable explanation whatsoever.

Jeff Bauersfeld wrote:

Sounds like Viz didn't segregate duties, so one senior executive had access to all that info, whether they directly had access to it like through reports, or they had administrative access and the hacker was able to laterally move through the system to somewhere they could access that info.

Right. So either they run Viz like a mom and pop shop, or in your second option, it wasn't a single account. The idea of some Viz exec reading through a report of employee credentials and reacting that 1234 was the same password they used for their luggage amuses me. I think I've found my head canon.