Royal Yachting Association Resets Passwords After Breach

guest · Jan 27, 2020

Royal Yachting Association Resets Passwords After Breach
January 27, 2020
https://www.infosecurity-magazine.com/news/royal-yachting-association/

The Royal Yachting Association (RYA) is forcing a password reset for all online users after warning some that their data may have been compromised by a third party.

The UK’s national body for all things nautical appears to have moved quickly in response to the discovery.

“We have recently become aware that an unauthorized party accessed and may have acquired a database created in 2015 containing personal data associated with a number of RYA user accounts. The affected information included email addresses and RYA website passwords which were encrypted and therefore not visible,” it explained.
Despite passwords being salted and hashed, the RYA is taking no chances and will require all web users to choose a new credential. It is also urging members to be on the lookout for potential phishing scams attempting to capitalize on the breach notification.

Several yachters took to an industry forum [...] Some expressed surprise at receiving the email as they aren’t RYA members, although their email address may have found its way onto the “test” database another way.
Click to expand...

RYA: Data Security FAQs - Important Potential Data Breach

guest · Feb 4, 2020

Exclusive: Data breach exposes 17,000 yachting industry professionals
February 4, 2020
https://www.verdict.co.uk/data-breach-crew-and-concierge-limited-yachting-industry/

Crew and Concierge is an international recruitment agency specialising in securing staff for ultra-high-net-worth clients’ yachts operating around the world.

The server, which was discovered during a Verdict investigation, consisted of over 90,000 files, all of which appeared to relate to individuals on Crew and Concierge’s books. It was left exposed on a misconfigured unsecured Amazon Web Services (AWS) S3 bucket and appears to have been online and available for anyone to access without a password since February 2019.

For all individuals, the data exposed included a CV or resume. In most cases, this contained the individual’s full name, phone number, email, nationality, visas held, date of birth, work history and professional qualifications.
Click to expand...

Sara Duncan, director of Crew and Concierge, said that the company had taken a number steps to resolve the breach, including hiring a cybersecurity expert.

“We have since established that the breached AWS S3 bucket that we outsourced contained personal data stolen by a malicious actor/s based on a misconfiguration by a third party and published into the public domain.
[...] In the very short period, we have come to understand the true impact of a cyberattack, and we have learnt many valuable but hard lessons."
Click to expand...

Log in or Sign up

Royal Yachting Association Resets Passwords After Breach

guest Guest

guest Guest

Log in or Sign up

Royal Yachting Association Resets Passwords After Breach

guest Guest

guest Guest

Useful Searches