SBA Reports Data Breach in Disaster Loan Application Website

guest · Apr 22, 2020

SBA Reports Data Breach in Disaster Loan Application Website
April 22, 2020
https://www.securityweek.com/sba-reports-data-breach-disaster-loan-application-website

The Small Business Administration said Tuesday that the personal information of more than 7,000 business owners applying for economic injury disaster loans was potentially seen by other applicants on the SBA website on March 25.

The SBA said only the disaster loan program was affected, not the Paycheck Protection Program, which did not begin until April 3 and which is handled by a separate system.
SBA spokeswoman Carol Wilkerson said the agency has notified the 7,913 owners whose information may have been exposed and offered them a year of free credit monitoring. The agency immediately disabled the affected part of its system, Wilkerson said.
Click to expand...

Ars Technica: Almost 8,000 could be affected by federal emergency loan data breach

A Trump administration official described the problem to CNBC:

"The official said that in order to access other business owners' information, small business applicants must have been in the loan application portal. If the user attempted to hit the page back button, he or she may have seen information that belonged to another business owner, not their own."
The SBA says it discovered the flaw on March 25 and notified affected users. One victim posted a copy last Friday of a paper letter she received about the breach. The letter stated that personally identifiable information—including Social Security numbers, addresses, dates of birth, and financial data—may have been exposed. The letter said that, as of last week, there was no sign yet of the data being misused.

The SBA says that it immediately disabled the portion of its website that was exposing applicant data, fixed the problem, and re-launched the website.
Click to expand...

Minimalist · Apr 27, 2020

Hackers spoof SBA to try to compromise companies' computers

With the U.S. Small Business Administration continuing to play a high-profile role in getting cash to companies that are struggling because of the coronavirus pandemic, cybercriminals are stepping up their efforts to steal money from those very firms.

Research published Monday by IBM’s incident response team shows that attackers are spoofing the SBA in emails to try to install a remote hacking tool capable of stealing passwords and accessing webcams. They are exploiting attention on a nascent SBA program that offers up to $10 million in lending per business.
Click to expand...

https://www.cyberscoop.com/small-business-administration-spoof-ibm-coronavirus/

guest · Jun 6, 2020

SBA systems fended off foreign adversaries applying for coronavirus loans
June 4, 2020
https://www.fedscoop.com/sba-loan-systems-foreign-adversaries/

Amid the Small Business Administration’s early struggles with its system for coronavirus relief loans, the agency was able to quickly identify and block North Korean, Chinese and Russian accounts making bogus applications, officials said Thursday.

The agency moved to the cloud three years ago but didn’t realize just how powerful its cloud cybersecurity tools were until it deployed them against foreign adversaries, said Guy Cavallo, deputy chief information officer, during an AFFIRM webinar Thursday.

“We’ll make an exception if there’s an American businessperson traveling abroad,” Cavallo said. “But our overseas warning, when we turned it on, went off like a Christmas tree.”
SBA will always have problems adjusting loan systems quickly to new requirements in coronavirus stimulus legislation, Cavallo said, but its investment in the cloud paid off.
Click to expand...

Log in or Sign up

SBA Reports Data Breach in Disaster Loan Application Website

guest Guest

Minimalist Registered Member

guest Guest

Log in or Sign up

SBA Reports Data Breach in Disaster Loan Application Website

guest Guest

Minimalist Registered Member

guest Guest

Useful Searches