Skip to content

Intelligent resilience: A strategic imperative

Rethinking data protection

As reliance on digital infrastructure grows, so must our approach to resilience. Most organizations have a data protection strategy in place. We all understand the importance of safeguarding data and the severe impact that disruptions—whether from cyberattacks, system failures, or natural disasters—can have on business operations. But as reliance on digital infrastructure grows, so too must our approach to resilience.

In this article, we move beyond traditional data protection to explore a new paradigm: Intelligent resilience. This approach goes beyond basic recovery strategies by integrating real-time visibility, anomaly detection, and automation, delivering faster, smarter, and more secure recovery processes.

What is “intelligent resilience?”

Intelligent resilience represents a proactive and adaptive approach to data protection. Rather than simply reacting to incidents, it leverages real-time insights and predictive analysis to anticipate risks and minimize disruption.

Through powerful features such as Keepit’s Data Protection Dashboard and Anomaly Detection Dashboard, IT teams gain enhanced visibility into data activity, empowering them to identify irregularities and mitigate risks before they evolve into critical incidents.

Keepit’s Data Protection Dashboard 

Keepit’s Data Protection Dashboard offers unparalleled transparency into the state of your backups and recovery points. IT teams can monitor backup status, identify gaps, and gain instant insights into data integrity and compliance.

This real-time visibility allows organizations to be proactive rather than reactive, ensuring that data is not only safe but also recoverable at a moment’s notice. This kind of real-time monitoring is a foundational element of intelligent resilience, as it enables immediate action when issues arise, mitigating risks before they become critical.

Anomaly Detection for real-time threat awareness 

One of the standout features of intelligent resilience is Keepit’s Anomaly Detection Dashboard. This system continuously scans for irregularities in data patterns, flagging potential threats like ransomware or data corruption before they escalate.

Anomaly detection empowers IT leaders with predictive insights, allowing them to intervene swiftly and prevent downtime or data loss, helping you stay ahead of the curve.

Shifting from reactive to proactive

Traditional disaster recovery models are inherently reactive: a system fails, and then recovery begins. Intelligent resilience flips this model on its head by incorporating real-time monitoring and predictive capabilities.

With Keepit’s dashboards, IT leaders can:

  • Detect threats before they disrupt operations
  • Optimize backup and recovery times
  • Ensure compliance and data integrity continuously
  • Visualize risks and recovery paths proactively

By embracing this forward-thinking model, organizations are not just responding to incidents—they are actively preventing them.

Building intelligent resilience: A step-by-step guide

1. Evaluate your current strategy Begin by assessing your current data protection policies and recovery plans. Identify gaps in visibility, automation, and real-time monitoring.

2. Leverage advanced dashboards Integrate Keepit’s Data Protection Dashboard for comprehensive backup monitoring and the Anomaly Detection Dashboard for early threat identification.

3. Automate recovery processes Remove human error and accelerate recovery by automating key processes like failover, replication, and disaster recovery orchestration.

4. Ensure governance and compliance Intelligent resilience demands transparent audit trails and constant compliance monitoring—both of which Keepit’s platform enables.

5. Test and adapt regularly Intelligent resilience isn’t static; regular testing and updates are essential for maintaining robustness against emerging threats.

The path forward

Intelligent resilience is more than just a concept—it’s a strategic imperative for businesses aiming to thrive in an unpredictable world. By integrating advanced monitoring, anomaly detection, and real-time visibility through Keepit’s solutions, IT leaders can achieve unprecedented levels of security and reliability.

The time to rethink cyber resilience is now. With intelligent resilience, disruptions are not just managed, they are mitigated before they happen. It’s time to move resilience forward.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

What to Look for in Endpoint Security

You must protect every device connecting to your company’s network from cyber threats. These devices, known as endpoints, include laptops, smartphones, servers, and IoT devices. Each is vulnerable to a variety of threats that could put your organization’s data and finances at risk.

Endpoint security, the practice of securing endpoints to prevent malicious actors from breaching devices and networks, is required for optimal protection. According to IBM, as many as 70% of data breaches occur at endpoints, illustrating the need for comprehensive security measures. 

Without proper endpoint security measures, your business risks significant financial losses, reputational damage, and legal liabilities. In this article, we’ll explore what to look for in an effective endpoint security solution.

Let’s start by defining endpoint security. 

Key Takeaways

  • Endpoint security protects devices like laptops and servers from cyber threats.
  • Centralized management simplifies security policy enforcement and updates.
  • Key components include antivirus, firewalls, and data loss prevention tools.
  • AI-driven analytics enhance threat detection through continuous learning.
  • Endpoint security ensures compliance with industry regulations.
  • Best practices include zero trust, regular updates, and user behavior monitoring.
  • UDR cybersecurity providers such as Guardz provide comprehensive endpoint protection. 

What Is Endpoint Security?

Endpoint security is a cybersecurity approach that protects end-user devices like servers, desktops, laptops, smartphones, tablets, and IoT devices from malicious activities. It involves securing each device or endpoint that connects to your corporate network.

Endpoint security aims to create a secure environment for all devices accessing your company’s data and systems. This is achieved through a combination of technologies, policies, and best practices designed to prevent, detect, and remediate cyber threats at the device level.

So, how exactly does this work?

How Does Endpoint Security Work?

Endpoint security protects individual devices like laptops, smartphones, and servers from cyber threats by deploying software that monitors, detects, and responds to risks.

Centralized Management

A centralized console allows administrators to control security settings across all devices, simplifying policy management, updates, and compliance checks. This ensures consistent protection, regardless of location, and quick remediation of vulnerabilities.

Policy Enforcement

Security policies govern how devices and users interact with networks and data. Policies include access controls, data encryption, and application restrictions, ensuring devices meet organizational security standards and preventing unauthorized access.

Real-Time Monitoring

Endpoint security continuously monitors device activity, analyzing system logs, network traffic, and user actions to detect real-time threats. This visibility helps identify and respond to suspicious activities like malware infections or unauthorized access.

Threat Detection and Response

Endpoint security detects and blocks threats, including zero-day exploits and fileless attacks, using techniques like behavioral analysis and machine learning. 

Automated responses such as quarantining devices and blocking connections prevent further damage when threats are found. Incident response tools provide forensic analysis and detailed reports to help security teams investigate and prevent future incidents.

MSPs should pay attention to several essential components of endpoint security, as discussed below. 

Key Components of Endpoint Security

Endpoint security solutions typically include a combination of tools and technologies to protect devices from various threats, including anti-malware, firewalls, intrusion detection, and DLP, among the others listed below. 

Here are the most important components of endpoint security: 

Antivirus and Anti-Malware

Antivirus and anti-malware software detect and prevent malicious software from infecting your devices. These tools scan files, emails, and applications for known malware signatures and suspicious behaviors. They also provide real-time protection by monitoring system activities and blocking potential threats.

Firewalls

Firewalls monitor and control network traffic, acting as a barrier between your devices and the internet. They enforce security policies by allowing or blocking incoming and outgoing connections based on predefined rules.

Intrusion Detection and Prevention

Intrusion detection and prevention systems (IDPS) monitor network activities for suspicious patterns that may indicate an attempted security breach. They analyze real-time traffic, comparing it against known attack signatures and abnormal behavior profiles.

Data Loss Prevention (DLP)

Data loss prevention (DLP) tools help protect sensitive information from unauthorized access, use, or transmission. They monitor and control data movement across your network, endpoints, and cloud applications.

Encryption

Encryption secures data by converting it into an unreadable format that can only be decrypted with the proper key. It protects sensitive information from unauthorized access, even if a device is lost or stolen.

Mobile Device Management (MDM)

Mobile device management (MDM) enables you to secure and control smartphones, tablets, and other mobile devices that access your corporate data. It allows you to enforce security policies, remotely wipe lost or stolen devices, and manage applications.

Aside from these main components, there are other factors to consider when choosing an endpoint security provider. 

What Features Should You Look for in an Endpoint Security Solution?

When evaluating endpoint security solutions, look for key features that provide comprehensive protection, streamline management, and enable proactive threat detection and response. The following are the most important.

Real-Time Threat Detection

Real-time threat detection continuously monitors your endpoints for signs of malicious activity. It uses signature-based, behavioral-based, and machine-learning techniques to analyze system behavior, network traffic, and file activities to identify potential threats as they occur.

This feature helps you detect and respond to advanced threats, such as zero-day exploits, fileless malware, and ransomware, before they can cause significant damage. 

AI-Driven Analytics

AI-driven analytics harnesses the power of artificial intelligence and machine learning to enhance threat detection and response capabilities. 

It analyzes vast amounts of data from your endpoints, network, and security tools to identify patterns, anomalies, and potential security incidents.

AI-driven analytics helps you uncover hidden threats, detect sophisticated attacks, and prioritize security alerts based on risk severity. It continuously learns and adapts to your environment, improving its accuracy and effectiveness over time.

Integration with Other Security Tools

An endpoint security solution should integrate with your existing security tools and infrastructure. This includes security information and event management (SIEM) systems, network security solutions, and identity and access management (IAM) platforms.

Integration enables centralized visibility, correlation of security events, and automated response workflows across your security ecosystem. It allows you to share threat intelligence, enrich security data, and streamline incident response processes.

Cloud-Based Management

Cloud-based management simplifies the deployment, configuration, and maintenance of your endpoint security solution. It provides a centralized console accessible from anywhere, allowing you to manage and monitor your endpoints across multiple locations and devices.

With cloud-based management, you can easily scale your endpoint security as your organization grows without additional hardware or infrastructure. 

It enables automatic updates, ensuring your endpoints are always protected against the latest threats. Cloud-based management also offers flexible deployment options, such as SaaS or hybrid models, to suit your specific requirements.

Automated Response Capabilities

Automated response capabilities enable your endpoint security solution to act immediately when a threat is detected. 

It can automatically isolate infected devices, terminate malicious processes, and block suspicious network connections to prevent the spread of malware.

Automated response helps you quickly contain and mitigate threats, reducing the impact of security incidents. It also frees your security team from manual tasks, allowing them to focus on more strategic initiatives.

Guardz UDR features all the components needed to keep endpoints safe. Find out how Guardz protects your valuable digital assets. 

Now that you know how to choose an endpoint security solution, let’s discuss the major benefits they can bring to your cybersecurity posture. 

Benefits of Endpoint Security

Implementing endpoint security offers several key benefits, including protection against cyber threats and ensuring regulatory compliance.

Protects Against Cyber Threats

Endpoint security safeguards devices from malware, ransomware, phishing, and other threats 

through real-time monitoring and automated responses. Advanced platforms use AI and machine learning to detect sophisticated attacks by analyzing device behavior and network activity, protecting your organization from evolving cyber risks.

Ensures Compliance

Industries like finance and healthcare require strict security standards. Endpoint security helps meet these by enforcing encryption, access controls, and other regulatory measures. For instance, it ensures PCI DSS compliance for handling credit card data and HIPAA compliance for protecting patient information.

Enhances Visibility and Control

Endpoint security provides centralized management, offering complete visibility into all connected devices. Administrators can track security events, enforce policies, and detect vulnerabilities. Remote controls allow locking, wiping, or quarantining compromised devices to mitigate risks.

Improves Incident Response Times

Endpoint security enables swift responses to threats with real-time alerts and automated actions. Systems can isolate affected devices, terminate malicious processes, and restore systems quickly. Detailed incident reports help teams analyze events, reducing downtime and preventing major breaches.

Endpoint Security Best Practices

Implementing endpoint security is not a one-time task. It requires ongoing effort and adherence to best practices to protect your devices against evolving cyber threats. Here are some key best practices to follow, including implementing zero trust policies, regularly updating and patching, and educating employees.

Implement Zero Trust Principles

Zero trust assumes that no user, device, or network is inherently trustworthy. It requires verifying user and device identities, enforcing least privilege access, and continuously monitoring access to prevent unauthorized activities.

Regularly Update and Patch

Keeping devices and software up to date prevents breaches by addressing known vulnerabilities. Establish a schedule for applying security patches to operating systems, applications, and firmware, and automate updates for timely deployment across all endpoints.

Educate Employees

Employees are critical to endpoint security. Provide regular training on threats like phishing and social engineering, and encourage best practices such as strong passwords, multi-factor authentication, and reporting suspicious activities.

Monitor User Behavior

Use behavior analytics tools to detect abnormal activities, such as unauthorized data access or bypassing security controls. Regularly review and adjust user access privileges to minimize insider threats.

Conduct Regular Audits

Perform security audits to assess endpoint configurations, patch status, and policy compliance. Use vulnerability scans to identify gaps, conduct penetration testing, and document findings. Develop and monitor action plans to address weaknesses and improve security continuously.

Finally, let’s discuss how to choose an endpoint security provider that best suits the needs of your MSP. 

10 Essential Criteria for Choosing an Endpoint Security Provider

When selecting an endpoint security provider, consider these ten essential criteria to ensure you choose a solution that effectively protects your devices and data from cyber threats.

Comprehensive Threat Protection

Look for an endpoint security solution that offers multi-layered protection against a wide range of threats, including malware, ransomware, phishing, and zero-day exploits. The solution should use advanced techniques like behavioral analysis, machine learning, and threat intelligence to detect and block both known and unknown threats.

Ease of Deployment and Management

Choose an endpoint security provider that offers a simple, intuitive platform for deploying and managing the solution across your entire device ecosystem.

The platform should provide centralized visibility and control, allowing you to configure policies, monitor security events, and initiate response actions from a single console.

Scalability

Ensure the endpoint security solution can scale to accommodate your organization’s growth and changing needs. It should support a wide range of devices and operating systems, including desktops, laptops, servers, and mobile devices. The solution should also offer flexible deployment options, such as cloud-based or on-premises, to align with your IT infrastructure.

MSP Friendly Features

If you are a managed service provider (MSP), look for an endpoint security solution that caters to your specific needs. MSP-friendly features may include multi-tenancy support, role-based access control, and integration with remote monitoring and management (RMM) tools.

Select an endpoint security provider that offers reliable and responsive customer support. Look for a vendor with a proven track record of delivering timely and effective support, including 24/7 availability, multiple communication channels, and a knowledgeable support team. 

Transparent Pricing

Choose an endpoint security provider with transparent and predictable pricing. Avoid solutions with hidden fees or complex pricing structures. Look for a vendor that offers straightforward pricing, such as per-device or per-user subscription models, with clear inclusions and limitations. 

Positive User Reviews

Research user reviews and testimonials to gauge the real-world performance and customer satisfaction of endpoint security solutions. Look for providers with consistently positive feedback from users in your industry or with similar security requirements. 

Industry Recognition and Awards

Consider endpoint security providers that have earned recognition and awards from reputable industry organizations and analysts. Look for vendors that have been positively evaluated by independent research firms.

Compliance Certifications

Verify that the endpoint security provider holds relevant compliance certifications for your industry or regulatory requirements. Common certifications include ISO 27001, SOC 2, HIPAA, and PCI DSS.

Free Trial or Proof of Concept

Look for an endpoint security provider that offers a free trial or proof of concept (POC) to evaluate the solution in your own environment. A trial or POC allows you to assess the solution’s effectiveness, usability, and compatibility with your existing systems before making a long-term commitment. 

Is Endpoint Security Worth the Investment?

Endpoint security is essential for protecting your organization’s devices, data, and networks from cyber threats. With features like real-time threat detection, centralized management, and AI-driven analytics, endpoint security solutions provide comprehensive protection and streamlined management.

Considering that the average cost of successful endpoint attacks on organizations has reached nearly $9 million, it’s clear that investing in a premium security solution is called for.

By following best practices such as zero trust implementation, regular updates, and employee training, you can strengthen your defenses. Selecting the right endpoint security provider involves evaluating threat protection, scalability, and MSP-friendly features.

Investing in robust endpoint security helps prevent data breaches, ensure regulatory compliance, and maintain business continuity, making it a worthwhile investment for any MSP or business.

To find out how Guardz can enhance your endpoint security, visit Guardz.com today.

Frequently Asked Questions

How Does AI Improve Endpoint Security?

AI improves endpoint security by analyzing large data sets to detect anomalies, predict threats, and automate responses, improving accuracy and speed.

Can Endpoint Security Prevent Zero-Day Attacks?

Yes, endpoint security uses behavioral analysis and machine learning to detect and block zero-day exploits before they cause damage.

What Industries Benefit Most From Endpoint Security?

Industries handling sensitive data, such as finance, healthcare, and legal sectors, benefit most from endpoint security to meet regulatory requirements and prevent breaches.

How Does Cloud-Based Management Help MSPs?

Cloud-based management allows MSPs to monitor, manage, and update endpoint security for multiple clients remotely, improving efficiency and scalability.

What Is the Role of MDM in Endpoint Security?

Mobile Device Management (MDM) secures and controls mobile devices, ensuring they comply with security policies and enabling remote management like wiping lost devices.

Start Free Trial

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

[Security Issue] The Reality and Countermeasures of Healthcare Hacking Attacks: Patients’ Lives Are at Risk

Cybersecurity in the healthcare sector is becoming more crucial than ever. As medical institutions accelerate digital transformation, Electronic Medical Records (EMR) and Picture Archiving and Communication Systems (PACS) have been widely adopted. Consequently, the proportion of sensitive patient information stored and managed digitally has surged. In particular, at the end of 2023, major hospitals in South Korea suffered ransomware attacks(Healthcare Hacking Attacks) that disrupted medical services, significantly highlighting the importance of healthcare cybersecurity.

 

Healthcare Hacking Attacks

Healthcare Hacking Attacks

 

The Importance of Healthcare Security Through Domestic and International Case Studies

In November 2023, the hacking incident at Korea University Medical Center shocked the Korean healthcare industry. A ransomware attack paralyzed the hospital’s information systems, shutting down emergency rooms and severely disrupting outpatient services. As healthcare digitalization progresses, such cybersecurity incidents are occurring more frequently both in Korea and abroad.

In 2022, CommonSprit Healthㅡa large healthcare chain in the U.S. operating over 140 hospitalsㅡsuffered a ransomware attack that crippled its EMR system. The incident delayed emergency surgeries and caused major service disruptions. Recovery costs reached $150 million, and millions of patients’ data were exposed. Even earlier, in 2017, the UK’s National Health Service(NHS) fell victim to the WannaCry ransomware, which halted medical services.

 

Healthcare Hacking Attacks

 

4 Essential Cybersecurity Tips Medical Institutions must Implement Immediately

Medical Institutions must pay close attention to the following key security measures. These are not just recommendations ㅡ they are essential practices in today’s modern healthcare environment.

  1. Encrypt All Data ㅡ Always
    Data encryption is non-negotiable. Both stored and in-transit medical data must be protected using strong encryption methods. Even if hackers intercept the data, proper encryption ensures it remains indecipherable. Particularly, sensitive records such as Electronic Medical Records(EMR) and medical imaging data should be encrypted using advanced standards like AES-256. End-to-end(E2E) encryption must be implemented for all data transmissions. In addition, secure management of encryption keys is critical.
  2. Secure Medical Devices
    With the growing number of network-connected medical devices, the risk of cyberattacks has significantly increased. Hospitals must ensure that all connected devices—including MRI, CT, ultrasound machines, patient monitoring systems, and syringe pumps—receive regular security patches and updates. Older devices that cannot be easily updated should be isolated on separate secure networks. Periodic security checks for all networked devices are highly recommended.
  3. Establish a Robust Backup System
    To defend against ransomware attacks, it is crucial to regularly back up critical medical data and implement a system that allows for rapid recovery. Following the 3-2-1 backup rule is a best practice: keep at least three copies of the data, store them on two different types of media, and keep one copy offline or offsite. Additionally, conducting quarterly backup recovery drills ensures that institutions can respond quickly and effectively in a real crisis.
  4. Provide Regular Security Training
    Ongoing security education for healthcare professionals and staff is essential. Training should raise awareness of social engineering attacks and ensure strict compliance with internal security policies. Practical education on topics like identifying phishing emails, managing strong passwords, and handling suspicious links should be included. Quarterly phishing simulations and regular updates on emerging threats can help reinforce a culture of cybersecurity.

 

Implementing a security system is not a one-time task—it requires continuous monitoring and improvement. As cyber threats continue to evolve, healthcare organizations must regularly assess and update their security frameworks.

Cybersecurity in healthcare is not just about protecting data—it directly impacts patient safety. With cyberattacks on medical institutions on the rise, cybersecurity has become a core component of healthcare delivery. Institutions must continuously strengthen and enhance their security measures to ensure patient data protection and uninterrupted care.

About Penta Security
Penta Security takes a holistic approach to cover all the bases for information security. The company has worked and is constantly working to ensure the safety of its customers behind the scenes through the wide range of IT-security offerings. As a result, with its headquarters in Korea, the company has expanded globally as a market share leader in the Asia-Pacific region.

As one of the first to make headway into information security in Korea, Penta Security has developed a wide range of fundamental technologies. Linking science, engineering, and management together to expand our technological capacity, we then make our critical decisions from a technological standpoint.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

NordStellar | Full Cyber Threat Visibility For Business

Scale Computing’s Marlena Fernandez Spotlighted on the 2025 Women of the Channel Power 100 List for the Fourth Consecutive Year

INDIANAPOLIS – May 12, 2025 – Scale Computing, a market leader in edge computing, virtualization, and hyperconverged solutions, proudly announced today that CRN®, a brand of The Channel Company, has recognized Marlena Fernandez, Scale Computing’s vice president, marketing, as one of the 2025 Women of the Channel Power 100. This prestigious honor highlights an elite subset of influential leaders chosen from the CRN® 2025 Women of the Channel list.

This annual CRN list celebrates women from vendors, distributors, solution providers, and other channel-focused organizations who make a positive difference in the IT ecosystem. The 2025 Women of the Channel honorees are innovative and strategic leaders committed to supporting the success of their partners and customers. From within this impressive group, the annual Power 100 recognizes some of the most influential women leaders from technology vendors and distributors who consistently contribute their advocacy and expertise to advancing the channel.

Fernandez has been named to the Women of the Channel list for six consecutive years and to the Women of the Channel Power 100 for the past four years for her leadership within the Scale Computing Partner Community. She joined Scale Computing in 2019 and was the first executive to be named to both lists. This past year, Fernandez significantly contributed to growing the Scale Computing partner program and helping Scale Computing achieve record revenue growth in 2024. She led the marketing strategy behind the launches of several partner campaigns, as well as the launches of new tailored pricing tiers, a new Scale Computing Pricing Tool, and more. Fernandez also plays a crucial role in the success of the annual Scale Computing Platform Summit, the company’s flagship event for IT professionals and partners.

“Marlena has achieved a lot this past year, and we’re very proud that she is recognized on the prestigious Women of the Channel Power 100 list for all of her accomplishments. She is instrumental in the success, not only of Scale Computing, but of the overall channel partner ecosystem,” said Dave Hallmen, chief revenue officer, Scale Computing. “As a critical member of our executive team, Marlena brings a wealth of experience from her more than 20 years of results-oriented global marketing and constantly works to improve and grow our business. As more customers and partners continue to seek VMware alternative virtualization platforms, edge computing, and AI inference solutions, we remain committed to being the best solution in our partner’s portfolio. We’re excited for what’s to come within the Scale Computing Partner Community in 2025 and beyond under Marlena’s leadership.”

The women on the Power 100 are an inspiration to industry peers and show deep dedication to improving outcomes and opportunities for their own organizations and their partners in the channel ecosystem.

“It’s an honor to recognize the outstanding accomplishments of these women, who are leaders and change-makers in the IT channel,” said Jennifer Follett, VP, U.S. Content and Executive Editor, CRN at The Channel Company. “Each woman spotlighted on this list has shown exceptional dedication to building creative strategies that propel transformation, growth, and success for their organizations and the entire IT channel. We are pleased to spotlight their important contributions and look forward to their future success.”

The 2025 Women of the Channel will be featured in the June issue of CRN Magazine, with online coverage beginning May 12 at CRN.com/WOTC.

 

About Scale Computing
Scale Computing is a leader in edge computing, virtualization, and hyperconverged solutions. Scale Computing HC3 software eliminates the need for traditional virtualization software, disaster recovery software, servers, and shared storage, replacing these with a fully integrated, highly available system for running applications. Using patented HyperCore™ technology, the HC3 self-healing platform automatically identifies, mitigates, and corrects infrastructure problems in real-time, enabling applications to achieve maximum uptime. When ease-of-use, high availability, and TCO matter, Scale Computing HC3 is the ideal infrastructure platform. Read what our customers have to say on Gartner Peer Insights, Spiceworks, TechValidate and TrustRadius.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

5 cyber threats password managers protect against

When you think of a password manager, you probably think about its ability to generate unique and secure passwords for every account. While that’s true, password managers also protect against a range of technical threats you might not expect—threats that can devastate businesses, from phishing attacks using Punycode domains that trick employees into revealing corporate credentials to keyloggers and brute-force attacks on admin panels that expose sensitive systems. 

In 2025, with 74% of all data breaches involving some kind of human element or error and costing companies millions in downtime and fines, password managers like NordPass are far more powerful than just a password generator—they’re a business’s shield against financial and reputational ruin. In this article, we’ll break down 5 cyber threats and explain exactly how password managers defend against them.

1. Phishing

Phishing is a cyberattack in which attackers trick users into revealing sensitive information, like usernames and passwords, by creating fraudulent websites that mimic legitimate ones. This type of attack is a huge problem, especially for businesses losing data to fake login pages. In 2025 so far, phishing has accounted for over 36% of all data breaches, and about 3.4 billion phishing emails are sent every day. These numbers show how widespread and persistent phishing has become.

These attacks often rely on techniques like Punycode domains, hijacked subdomains, and typosquatting to deceive users. Phishing links are commonly distributed via email, SMS, or malicious ads, directing victims to fake login pages where their credentials are captured. 

For example, an attacker might create a domain like http://www.goоgle.com (using the Cyrillic “о” instead of the Latin “o”), which looks nearly identical to http://www.google.com but directs users to a malicious site. Alternatively, attackers might exploit a misconfigured DNS setting to hijack a subdomain, like secure.login.example.com, making the phishing site appear as if it belongs to the legitimate example.com. In typosquatting, domains like http://www.faceboook.com or http://www.pay-pal.com are registered to exploit common user typing errors.

asset2

Image: An example of an open-source phishing kit

Password managers protect against phishing by using exact domain matching when autofilling credentials. When a user visits a phishing site, even if the domain visually resembles the legitimate one, the password manager recognizes the mismatch and refuses to autofill credentials. 

For instance, if credentials are saved for http://www.paypal.com, they will not be provided on a phishing domain like http://www.paypa1.com. This prevents users from unknowingly submitting their passwords to fraudulent sites.

Another layer of protection comes from eliminating the need for manual password entry. Password managers use secure browser APIs or system-level frameworks like Android’s Autofill API or iOS’s AutoFill to inject credentials directly into login fields. This bypasses keyboard input entirely, preventing phishing websites from capturing credentials through keylogging or fake form fields.

2. Credential stuffing

Credential stuffing is a type of cyberattack in which attackers use large sets of stolen username and password combinations, often obtained from previous data breaches, to gain unauthorized access to user accounts on different platforms. 

For businesses, this is a huge threat—employees reusing personal passwords for work accounts can open the door to attackers who might use a breach of a random website to access corporate emails, CRM systems, or financial tools, costing companies millions in stolen data or ransomware payouts. The attack relies on the assumption that many people will reuse the same credentials across multiple websites and services. 

Automated tools are used to test these credential pairs across numerous sites at scale, often with the help of bots, enabling attackers to exploit any reused credentials efficiently.

asset5


Image: Cybercrime forum discussions focusing on credential-stuffing tools

For example, if an attacker acquires a leaked database from a breached e-commerce platform, they might use the stolen email-password pairs to attempt logins to banking, social media, or other sensitive services. Automated credential stuffing tools, like Sentry MBA or OpenBullet (as seen above), can test thousands of combinations per minute, often evading basic security measures like rate limiting or CAPTCHA using proxies.

Password managers provide a strong defense against credential stuffing by generating and storing unique, complex passwords for every account. Since credential stuffing depends on the reuse of credentials across multiple platforms, having a distinct password for each account renders the attack ineffective. Password managers make this feasible by securely storing and autofilling these unique passwords, so users don’t need to remember them.

NordPass offers a valuable feature called Password Health. This feature scans all passwords stored in your vault and checks how vulnerable they are, giving you a clear view of your password security. It alerts you about weak, reused, or compromised passwords, helping you take necessary actions to strengthen your online security. This is an effective way to ensure your passwords aren’t putting your accounts at risk.

3. Brute-force attacks

Brute-force attacks involve systematically guessing passwords by trying all possible combinations, often with the help of automated tools. While most modern consumer platforms include protection mechanisms like two-factor authentication (2FA), CAPTCHA, or account lockouts to prevent these attacks, there are edge cases where brute-force attacks remain viable. This is particularly true for public-facing admin portals or legacy systems that lack built-in protections by default.

For instance, if your business runs a WordPress site without security plugins, it may be leaving its admin panel (/wp-admin) exposed to brute-force attacks. Attackers might use tools like Hydra or WPScan to test thousands of password combinations, starting with weak or default credentials like admin with password123. Without additional configurations, some versions of these platforms remain vulnerable, as they typically don’t include features like rate limiting or CAPTCHA out of the box. Users must proactively install plugins to secure these areas.

asset4

Image: An example of WPScan brute-force functionality

Password managers provide an important layer of protection against brute-force attacks by encouraging the use of strong, complex passwords that are resistant to guessing. A password manager can generate a password like Tx8&@K1p!Rv2#, which is more difficult to crack, even with the most advanced brute-force tools. Furthermore, password managers ensure that users don’t rely on weak or default credentials and prevent the reuse of passwords across different systems, which attackers could exploit.

NordPass, in particular, not only generates strong, complex passwords but also stores them securely. Users have the flexibility to determine the complexity of their passwords, allowing them to create passwords that are both highly secure and tailored to their needs. Importantly, NordPass encourages the use of unique passwords for each account, ensuring that even if one set of credentials is exposed, it cannot be used to access other systems.

In addition to generating and securely storing strong passwords, NordPass also includes its built-in Authenticator feature, which can be used as an authenticator app. This adds an extra layer of security by enabling 2FA for your accounts, making it a lot harder for attackers to gain access, even if they manage to crack a password. The NordPass Authenticator is a convenient and secure option to further bolster your defenses against brute-force and other types of attacks.

With a password manager, the only password users need to remember is their master password—the key to unlocking their vault of securely stored credentials. Once this master password is entered, the manager handles the rest, automatically filling in passwords for all other accounts. This removes the burden of remembering each password individually, while still keeping your accounts protected with strong, unique passwords.

Although brute-force attacks are not a genuine risk for most consumers due to modern protections, they still pose a threat in specific scenarios, like unsecured admin portals or systems without rate limiting. By using a password manager to create and store strong, unique passwords, users add an extra layer of defense against this type of attack. In these edge cases, password managers provide protection, ensuring that even if other security layers are missing, accounts are protected with passwords that are resilient to brute-force attempts.

4. Keyloggers

Keyloggers are malicious tools designed to record every keystroke a user types, allowing attackers to steal sensitive information like usernames, passwords, and other private data. Companies can leak important information if keyloggers hit employee devices. They are often deployed as malware through phishing emails, malicious websites, or software downloads, but they can also exist as physical hardware devices installed between a keyboard and a computer.

Software-based keyloggers function by intercepting keyboard inputs at different stages within the operating system. They often utilize API hooks to monitor and record keystrokes as they are being processed. 

For example, a keylogger on a Windows system might use the SetWindowsHookEx function to intercept keystrokes in real time. This allows it to capture credentials and other private information as they are typed. Clipboard loggers, another variation, monitor copy-paste actions to steal sensitive data like passwords copied for use.

asset3

Image: Guides being shared on a cybercrime forum on how to write keyloggers

Password managers effectively counter these risks by eliminating the need for manual password entry. Instead of requiring users to type their passwords, password managers use secure autofill mechanisms to directly input credentials into login fields. On web browsers, they inject credentials through direct interaction with the DOM, while on mobile devices, they use system-level frameworks like Android’s Autofill API or iOS’s AutoFill. These methods bypass the keyboard entirely, rendering keyloggers unable to capture any useful data during the login process.

Although a keylogger could potentially capture the master password during the initial login to the password manager, modern password managers mitigate part of this risk by minimizing the need for repeated master password entry. Many password managers support biometric authentication, like fingerprint or facial recognition, allowing users to unlock the manager without typing anything after the initial login. Biometric data is securely stored on the device and cannot be intercepted by keyloggers, making it a highly secure and convenient method of authentication.

5. Database leaks

Database leaks occur when attackers gain unauthorized access to databases storing sensitive user information, such as usernames, passwords, and personal details. Businesses face huge losses when customer data spills out. These leaks often happen due to issues like web-application vulnerabilities, misconfigured servers, or outdated software. 

Once a database is leaked, attackers can use the stolen credentials in further attacks, like credential stuffing (as mentioned above) or direct account takeovers, particularly if the passwords are weak or reused across multiple accounts.

For example, in a typical breach, a compromised database may store passwords in plain text or use weak hashing algorithms like MD5 or SHA-1, which are vulnerable to tools like Hashcat. 

Hashcat, a high-performance password-cracking tool, allows attackers or researchers to brute-force or perform dictionary attacks on leaked password hashes to recover plaintext passwords. Even strong passwords can become vulnerable if the hashing algorithm is outdated or poorly implemented (e.g., missing salting).

asset6

Image: A researcher or cybercriminal trying to use Hashcat to crack passwords

Password managers protect users from the consequences of database leaks in several key ways. First, they encourage the use of unique, strong passwords for every account. This ensures that even if one set of credentials is exposed in a breach, it cannot be used to access other accounts. For example, a leaked password from an e-commerce site would not provide access to a user’s banking or email accounts if unique credentials were used.

In addition to promoting password uniqueness, password managers generate and store randomized passwords that are resistant to brute-force attacks. A password like T&$9jf@3#1Px2! is much harder to crack using tools like Hashcat compared to common or weak passwords. Password managers also make it easy to update compromised passwords quickly by identifying affected accounts and help in generating secure replacements.

Many password managers further enhance protection by integrating breach monitoring tools. For example, NordPass offers an integrated Data Breach Scanner that provides real-time alerts when your email or credit card details appear in a data breach or leak. This feature allows you to respond proactively by updating your credentials before attackers can exploit the compromised data.

NordPass follows a zero-knowledge architecture, meaning it never has access to user passwords. Additionally, NordPass provides businesses with a free tool to check for potential leaks through its dark web monitoring service. This service helps companies detect any exposed employee or customer data across the dark web, adding an essential layer of defense for businesses concerned about database breaches.

Get protection with NordPass

Credential theft can cause serious problems for businesses of all sizes. When someone’s login details are stolen, it can lead to unauthorized access to accounts, financial scams, identity theft, or even corporate spying. Hackers often sell stolen login details on dark web marketplaces, making them available to criminals around the world.

If a hacker gets into someone’s email, they can reset passwords for other accounts, giving them access to even more services. To protect against credential theft and its harmful effects, it’s important to use strong passwords and a password manager.

Start taking control of your security today. As a business owner, you have the power to strengthen your company’s defenses by mandating the use of a password manager. NordPass Business makes it easy to implement best practices across your team, protecting against the very threats we’ve discussed. 

asset1

NordPass also constantly passes security audits, ensuring it meets the highest levels of protection. This helps your business achieve information security standard compliance (like ISO and NIS2), which protects against high penalties for non-compliance and potential data leaks.

Get started with a complimentary 3-month trial by clicking here and using the code “danielk”—no credit card required. Don’t wait until it’s too late; secure your business now.

Disclaimer: Examples are provided for informational and educational purposes only. NordPass does not endorse, promote, or support their use and has no affiliation with them. Readers are strongly advised to comply with all applicable laws and regulations. All trademarks mentioned are the property of their respective owners.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

A closer look at the biggest data breaches from 2020 to 2024

22 biggest data breaches from 2020 to 2024

The biggest data breaches in history have set new records. According to the Identity Theft Resource Center data, in the first half of 2024, over 1 billion US consumers had their personal information exposed — a 490% increase from 2023[1]. The consequences are severe — businesses are losing millions in lawsuits and facing reputational damage, individuals are dealing with identity theft and fraud, and governments are enforcing stricter regulations and demanding stronger data security measures.

While the risks posed by data breaches continue to grow, companies can take action and protect themselves. In this article, we examine the biggest data breach examples from 2020 to 2024, key trends shaping cybersecurity, and steps companies can take to protect their data.

1. National Public Data (NPD) breach

  • Date the data breach occurred: April 2024
  • Cause: Hacking
  • Countries affected: The United States, Canada, and the United Kingdom
  • Number of records exposed: 2.9 billion
  • People affected: Up to 170 million
  • Types of data compromised: Social Security numbers (SSNs), names, dates of birth (DOBs), email addresses, phone numbers, and mailing addresses

Discovery and announcement

In August 2024, security researchers found around 2.9 billion stolen National Public Data records for sale on dark web forums. The discovery raised alarms and led to an internal investigation. Shortly after, the company confirmed the breach.

Response

In response to the huge data breach, National Public Data collaborated with law enforcement and conducted a thorough review of affected records to assess the impact. The company strengthened its data security measures to prevent future incidents.

National Public Data also provided instructions on obtaining free credit reports from Equifax, Experian, and TransUnion. Additionally, it recommended users place fraud alerts or consider a credit freeze to mitigate the risks of identity theft.

Impact

The NPD data breach not only exposed billions of records but also led to the collapse of the company. After intense scrutiny, regulatory investigations, and mounting legal challenges, NPD declared bankruptcy in October 2024 and ceased operations[2], [3].

2. Mother of all breaches (MOAB)

  • Date the breach was discovered: January 2024
  • Cause: Compilation of multiple data breaches
  • Countries affected: Multiple
  • Number of records exposed: 26 billion
  • People affected: Hundreds of millions
  • Types of data compromised: Usernames, passwords, email addresses, and other sensitive information​

Discovery and announcement

In January 2024, security researcher Bob Diachenko and Cybernews investigators uncovered a huge data breach known as the “Mother of all breaches” (MOAB). The dataset contained approximately 26 billion records compiled from 3,876 websites, combining data from numerous past cybersecurity breaches.

Major platforms like LinkedIn, Twitter, Adobe, and Dropbox were among the affected sources. The breach also included records from government organizations in the US, Brazil, Germany, the Philippines, Turkey, and several other countries. Leak-Lookup, a data breach search engine, admitted it was the holder of the leaked dataset.

Response

Leak-Lookup attributed the breach to a “firewall misconfiguration” that has since been fixed. In response, Cybernews updated its data leak checker to include MOAB-related information, which would allow users to check if their data was exposed in one of the biggest data breaches to date.

Impact

The MOAB breach exposed the dangers of large-scale data collection and the lasting damage caused by repeated data security failures. By combining stolen records from thousands of past incidents, this breach significantly increased the risk of identity theft, fraud, and cyberattacks. With so much sensitive personal data in one place, hackers can easily locate and exploit exposed credentials, launch targeted phishing scams, and take over accounts.

The breach also raised concerns about how long companies store sensitive user data. It underscored the need for stricter policies to limit data retention and improve security. Even old breaches, once considered isolated incidents, can resurface in massive leaks like this, putting millions at risk. As of January 2024, MOAB is almost certainly the largest data breach ever discovered[4].

3. Financial Business and Consumer Solutions (FBCS) data breach

  • Date discovered: February 26, 2024
  • Cause: Unauthorized access to FBCS’s internal network
  • Countries affected: Primarily the United States
  • Number of records exposed: Undisclosed
  • Number of people affected: Undisclosed
  • Types of data compromised: Names, addresses, DOBs, SSNs, driver’s license and state identification numbers, medical claims, provider and clinical information, and health insurance details

Discovery and announcement

On February 26, 2024, FBCS detected unauthorized access to certain systems within its network. Investigators found that hackers had access to FBCS systems from February 14 to February 26, 2024.

During this time, they could view or acquire sensitive information stored on the network. To assess the impact, FBCS conducted a full review to determine what data was at risk and who was affected.

Response

After discovering the breach, FBCS took immediate action to investigate and contain the incident. The company reported the matter to federal law enforcement and worked with forensic specialists to understand how the breach occurred and prevent future attacks.

To strengthen security, FBCS built a new, more secure environment with additional safeguards to protect sensitive data. The company also urged affected individuals to remain vigilant against potential identity theft and fraud.

Impact

One of the biggest data breaches in 2024 exposed highly sensitive personal and healthcare information, which put individuals at risk of identity theft and medical fraud. Stolen SSNs and medical records could be misused for fraudulent insurance claims, unauthorized medical treatments, or financial scams[5].

4. Ticketmaster data breach

  • Date discovered: May 2024
  • Cause: Unauthorized access to a cloud database hosted by a third-party data services provider
  • Countries affected: The United States, Canada, and Mexico
  • Number of records exposed: Undisclosed
  • People affected: Customers who purchased tickets to events in North America
  • Types of data compromised: Email addresses, phone numbers, encrypted credit card information, and other personal details provided during ticket purchases

Discovery and announcement

In May 2024, Ticketmaster detected unauthorized activity in an isolated cloud database managed by a third-party provider. The company launched a full investigation with cybersecurity experts and notified the relevant authorities. The investigation confirmed that no further unauthorized access occurred beyond the initial incident.

Response

Ticketmaster worked with law enforcement, banks, and credit card companies to investigate the breach and mitigate its impact. Affected customers were offered a free 12-month identity monitoring service from a leading provider. Customers were also advised to monitor their bank and credit card statements for suspicious transactions and report any unauthorized activity immediately.

Impact

The Ticketmaster breach raised concerns about the security of third-party data storage and the risks customers face when trusting companies with personal and payment information. Although the company encrypted payment card data, hackers could still use exposed contact details for phishing scams, fraud attempts, and identity theft[6].

5. Change Healthcare data breach

  • Date discovered: February 21, 2024
  • Cause: A cybercriminal gained unauthorized access to Change Healthcare’s computer system and deployed ransomware
  • Countries affected: Primarily the United States
  • Number of records exposed: Undisclosed
  • People affected: Patients, healthcare providers, and insurers relying on Change Healthcare’s services
  • Types of data compromised: Names, contact details, DOBs, health insurance information, SSNs, government-issued IDs, medical records, diagnoses, medications, test results, financial data, and payment details

Discovery and announcement

On February 21, 2024, Change Healthcare detected ransomware activity in its systems. The company immediately shut down affected systems, disconnected its network to contain the attack, and launched an investigation with law enforcement and leading cybersecurity experts.

Response

On July 29, 2024, Change Healthcare began notifying affected individuals by mail. To contain the breach, the company shut down systems and severed network connections to stop further access. It also strengthened security policies and implemented additional safeguards to prevent future incidents.

Change Healthcare worked with cybersecurity experts to monitor both the clear and dark web for any misuse of stolen data. The company offered affected individuals free credit monitoring and identity protection services through IDX for two years, covering all costs.

Impact

One of the biggest data breaches in the healthcare industry had serious consequences for patients, healthcare providers, and insurers. Stolen medical records and insurance details could be used for identity theft, fraudulent claims, or financial fraud[7], [8].

6. AT&T data breach

  • Date discovered: April 19, 2024
  • Cause: Unauthorized access to AT&T’s workspace on a third-party cloud platform
  • Countries affected: Primarily the United States
  • Number of records exposed: Undisclosed
  • People affected: Both current and former AT&T customers, as well as customers of mobile virtual network operators (MVNOs) using AT&T’s wireless network
  • Types of data compromised: Records of customer call and text interactions, including telephone numbers and, for some records, associated cell site identification numbers

Discovery and announcement

On April 19, 2024, AT&T learned that a threat actor had unlawfully accessed and copied its call logs. The company immediately launched its incident response plan and brought in external cybersecurity experts to investigate.

The breach took place between April 14 and April 25, 2024. During this period, hackers stole files containing customer call and text records from May 1 to October 31, 2022, and January 2, 2023.

Response

AT&T quickly closed the unauthorized access point and worked with law enforcement to arrest those involved in the incident. The company notified both current and former customers whose information was compromised and provided resources to help protect their data.

Impact

The breach exposed call and text records from nearly all of AT&T’s wireless customers, including those using AT&T’s network through MVNOs and landline customers who interacted with these numbers during the specified periods.

Although the compromised data didn’t include content from communications or other sensitive personal information, the exposure of phone numbers and associated cell site identification numbers raised significant privacy concerns[9], [10].

7. Dell customer information data breach

  • Date the breached data was posted on the dark web: April 28, 2024
  • Cause: Unauthorized access to a Dell portal
  • Countries affected: The United States, China, India, Australia, and Canada​
  • Number of records exposed: 49 million customer records
  • People affected: Dell customers who made purchases between 2017 and 2024
  • Types of data compromised: Customer names, physical addresses, Dell hardware details, order and warranty information

Discovery and announcement

On May 9, 2024, Dell confirmed unauthorized access to a database containing customer information related to sales. Dell clarified that no financial or other personal data, such as email addresses, phone numbers, or passwords, were exposed.

Response

Dell took immediate action to contain the breach, activated its incident response procedures, and involved external cybersecurity experts to investigate the scope of the attack. The company notified law enforcement and worked to secure its systems further. It also informed the customers of the breach and gave advice on how to safeguard their information.

Impact

The breach exposed the personal information of approximately 49 million customers, particularly affecting those who made purchases from Dell between 2017 and 2024[11], [12].

8. Synnovis data breach

  • Date of attack: June 3, 2024
  • Cause: Ransomware cyberattack
  • Country affected: The United Kingdom
  • Data exposed: Approximately 400 GB of data
  • People affected: Patients and healthcare providers in South East London
  • Types of data compromised: Names, NHS numbers, and test codes

Discovery and announcement

On June 3, 2024, Synnovis, a partnership providing pathology services to several NHS organizations in South East London, experienced a ransomware attack that disrupted all IT systems and affected sample processing and result transmission.

On June 20, a cybercriminal group claiming responsibility for the attack published data online and claimed it was stolen from Synnovis. Synnovis confirmed that the data was from its administrative systems.

Response

In response to the breach, Synnovis worked closely with law enforcement, the Information Commissioner, the National Cyber Security Centre, and NHS England. It began a comprehensive investigation and took immediate steps to contain the breach and restore operations.

Synnovis publicly apologized for the disruptions caused to patients and healthcare services and reaffirmed its commitment to preventing future incidents. The company urged affected patients to attend scheduled appointments unless instructed otherwise and continued to provide updates to the public regarding the impact on services.

Impact

The ransomware attack caused major disruptions, including delays in test result processing and appointment cancellations. While emergency care remained operational, the breach affected many non-urgent services in South East London. It took the company until late autumn to restore access to all services that were available before the cyber attack.
Although the breach didn’t expose any sensitive clinical data, it severely impacted essential healthcare services, resulting in significant financial losses. According to company accounts, the estimated cost of the breach was £32.7 million — well above Synnovis’ 2023 profits of £4.3 million[13], [14], [15], [16], [17].

9. The 2023 Twitter (now X) data breach

  • Date discovered: January 4, 2023
  • Cause: A vulnerability in Twitter’s application programming interface (API) that allowed unauthorized access to user data
  • Countries affected: Multiple
  • People affected: Over 200 million Twitter users
  • Types of data compromised: Email addresses and phone numbers

Discovery and announcement

In January 2023, a hacker forum published a database containing the email addresses and usernames of over 200 million Twitter (now X) users. The data was sold for eight credits of the forum’s currency, worth approximately $2.

It was released as a RAR archive, which consisted of six text files totaling 59 GB of data. It was reportedly collected by exploiting a vulnerability in Twitter’s API between June 2021 and January 2022. BleepingComputer confirmed the validity of many of the email addresses listed in the leak.

Response

Twitter stated that it found no evidence the data was obtained through a vulnerability in its systems. The company suggested that the data might have been collected from publicly available sources.

Impact

The breach made it easier to link Twitter handles to real identities, potentially exposing these individuals to harm, retaliation, or surveillance. Verified users, including celebrities and politicians, were particularly vulnerable to extortion or manipulation because hackers could potentially exploit their data for malicious purposes[18], [19].

10. Progress Software data breach (MOVEit vulnerability)

  • Date discovered: May 2023
  • Cause: Zero-day vulnerability in Progress Software’s MOVEit Transfer application
  • Countries affected: Primarily the United States
  • People affected: Over 94 million users
  • Types of data compromised: Names, SSNs, banking details, and other confidential records

Discovery and announcement

On May 31, 2023, Progress Software identified a critical zero-day vulnerability (CVE-2023-34362) in its MOVEit Transfer application, a managed file transfer solution widely used across various sectors. This vulnerability, which stemmed from an SQL injection flaw, allowed unauthorized access to sensitive data within MOVEit Transfer’s databases.

Response

​Progress Software acted swiftly upon discovering the vulnerability. Within 48 hours, the company initiated an investigation, alerted MOVEit customers, and provided immediate mitigation steps.

On June 15, 2023, Progress released a security patch to address the flaw. The company temporarily took MOVEit Cloud offline to prevent further exploitation while applying patches.

Impact

The MOVEit breach significantly affected thousands of organizations globally. Progress Software reported $951,000 in cyber incident and vulnerability response expenses during its fiscal third quarter, which ended August 31, 2023.

Additionally, Progress Software faced 58 class-action lawsuits and received a subpoena from the US Securities and Exchange Commission (SEC). However, in August 2024, the SEC concluded its investigation and decided not to recommend any enforcement action against the company.

Despite this, as of this article’s publication, Progress Software continues to face hundreds of class-action lawsuits centralized in Massachusetts federal courts[20], [21], [22], [23], [24].

11. T-Mobile data breach

  • Date discovered: January 5, 2023
  • Cause: Unauthorized access via an exposed application programming interface (API)
  • Country affected: The United States
  • Number of records exposed: 37 million customer accounts
  • People affected: Current postpaid and prepaid customers of T-Mobile in the US
  • Types of data compromised: Customer names, billing addresses, email addresses, phone numbers, DOBs, T-Mobile account numbers, number of lines on the account, and service plan features

Discovery and announcement

On January 5, 2023, T-Mobile confirmed a data breach after a thorough investigation. The investigation found that a bad actor exploited an exposed application programming interface (API) to access limited customer information.

Response

Within 24 hours of detection, T-Mobile shut down the compromised API to prevent further access. The company immediately implemented its incident response protocols, notified affected customers, and reassured them that their financial data remained secure. It emphasized that no customer accounts were at direct risk.

Impact

While T-Mobile didn’t expect a significant impact on its business operations, it acknowledged the potential effect on customer trust. To address this, the company pledged to invest in cybersecurity improvements to better protect its customers and prevent future breaches.

In addition, on September 30, 2023, T-Mobile reached a $31.5 million settlement to resolve a probe by the Federal Communications Commission (FCC) into major data breaches that occurred over a three-year period. As part of the settlement, T-Mobile was required to pay a $15.75 million civil penalty and spend another $15.75 million over the next two years to strengthen its cybersecurity program[25], [26].

 

12. HCA Healthcare data breach

  • Date discovered: July 5, 2023
  • Cause: Theft from an external storage location
  • Country affected: The United States
  • Number of records exposed: 27 million rows of data
  • People affected: 11 million HCA Healthcare patients
  • Types of data compromised: Patient names, cities, states, ZIP codes, email addresses, phone numbers, DOBs, genders, service dates, facility locations, and upcoming appointment details

Discovery and announcement

On July 5, 2023, HCA Healthcare discovered that an unauthorized party had posted a list containing patient information on an online forum. The stolen data came from an external storage location used for formatting email communications, like appointment reminders and healthcare education messages.

On July 10, 2023, the company announced the breach in a press release, outlined its response plan, and began assessing the full impact.

Response

Upon discovering the breach, HCA Healthcare promptly disabled access to the compromised storage location and enrolled third-party experts for a comprehensive investigation. The company also reported the incident to law enforcement.

On July 14, 2023, HCA Healthcare began notifying impacted patients via email and mailed official notification letters. Shortly after, the company launched a dedicated webpage for real-time updates. To support affected individuals, it offered credit monitoring and identity protection services.

Impact

The breach didn’t disrupt patient care or operations but raised concerns about potential phishing attacks that may target affected individuals. HCA Healthcare advised patients to remain cautious of unsolicited communications asking for sensitive personal information. The company reported no financial costs[27], [28].

13. Cash App data breach

  • Date discovered: April 2022
  • Cause: Unauthorized access by a former employee
  • Country affected: The United States
  • People affected: 8.2 million users
  • Types of data compromised: Names, brokerage account numbers, portfolio values, holdings, and stock trading activity for one day

Discovery and announcement

In December 2021, a former employee of Block, Inc., the parent company of Cash App, accessed and downloaded sensitive customer data without authorization. Four months later, the company discovered the breach.

The discovery prompted Block to file a report with the US Securities and Exchange Commission (SEC). The compromised data was related to users of Cash App Investing, which is separate from Cash App’s primary peer-to-peer payment service.

Response

Once the breach was identified, Block acted quickly to launch an internal investigation and notify law enforcement. The company also brought in a leading forensics firm to help assess the scope of the breach.

Block notified approximately 8.2 million affected current and former customers. The company also provided them with clear information about the breach and offered guidance on how to protect their accounts.

Impact

Although hackers did not access critical personal details, the breach raised concerns about internal security practices and data protection measures. In response, Block agreed to a $15 million settlement to address allegations of negligence and compensate affected customers[29], [30].

14. The 2022 Twitter (now X) data breach

  • Date discovered: July 21, 2022
  • Cause: API vulnerability
  • Countries affected: Multiple
  • Number of records exposed: Details of 5.4 million Twitter accounts
  • People affected: 5.4M users
  • Types of data compromised: Usernames, phone numbers, and email addresses
    Discovery and announcement

In January 2022, Twitter (now known as X) was alerted to a vulnerability through its bug bounty program. This flaw allowed anyone to submit an email address or phone number to Twitter’s systems and identify the associated account.

The issue stemmed from a code update in June 2021. Twitter immediately fixed the flaw, and no exploitation was detected at that time. However, in July 2022, a report revealed that someone had exploited the vulnerability and was selling the collected data. Twitter confirmed the breach after reviewing the available data.

Response

Twitter acted quickly by notifying affected account owners. To protect users operating pseudonymous accounts, the company advised all users not to link publicly known phone numbers or email addresses to their accounts. Twitter also recommended enabling two-factor authentication for added security.

Impact

The breach exposed contact details — phone numbers and email addresses — for 5.4 million Twitter accounts. While much of the data was publicly available, hackers could still potentially use it in targeted phishing attacks and compromise users who wanted to remain anonymous[31], [32].

15. Syniverse data breach

  • Date discovered: May 2021
  • Cause: Unauthorized access to Syniverse’s electronic data transfer (EDT) environment
  • Countries affected: Multiple
  • Number of records exposed: Unknown
  • People affected: Customers of 235 telecom carriers, potentially billions of individuals whose messages and call records were processed by Syniverse
  • Types of data compromised: Login credentials for carrier customers, call records, data usage details, and text message routing information

Discovery and announcement

In May 2021, Syniverse discovered that an unknown individual or group had gained unauthorized access to its electronic data transfer (EDT) environment. The breach had been ongoing since May 2016, which means that attackers had access to sensitive information for nearly five years before the company discovered the breach.

On September 27, 2021, Syniverse disclosed the breach in a filing with the US Securities and Exchange Commission (SEC). The company confirmed that the breach impacted 235 telecom customers, but the potential number of affected individuals could be in the millions or even billions.

Response

Upon discovery, Syniverse activated security protocols and hired a top-tier forensics firm to investigate. The company reset or deactivated all affected customer credentials to prevent further access.

Syniverse notified law enforcement agencies, cooperated with investigators, and implemented stronger security measures to prevent future breaches. However, the company didn’t notify individual users directly. Instead, it relied on telecom customers to inform impacted subscribers.

Impact

The breach raised concerns because Syniverse handles inter-carrier messaging and data routing for major telecom operators. While the full extent is still unclear, cybersecurity experts speculated that the breach could have been a state-sponsored attack because no ransom demands or attempts to sell the data were observed[33], [34].

16. Facebook (Meta) data breach

  • Date discovered: April 2021
  • Cause: Scraping due to a vulnerability in Facebook’s feature
  • Number of countries affected: 106 countries
  • Number of records exposed: Unknown
  • People affected: 533 million Facebook users
  • Types of data compromised: Phone numbers, Facebook IDs, names, locations, DOBs, bios, and email addresses

Discovery and announcement

In April 2021, personal data from over 533 million Facebook users across 106 countries was leaked online. Hackers obtained the data through a vulnerability in Facebook’s “Contact importer” feature, which Facebook claimed to have patched in 2019.

Response

A Facebook spokesperson stated that the data was scraped due to the vulnerability in the “Contact importer” feature. However, Facebook didn’t notify affected users and argued that the data was publicly available.

Further investigation showed that Facebook planned to downplay the leak as an industry-wide issue rather than an isolated security failure. An internal email from April 2021 revealed the company’s strategy to minimize press coverage of the breach.

Impact

The exposed data posed risks, including potential impersonation, scams, and social engineering attacks. In November 2022, the Irish Data Protection Commission fined Meta Platforms, Facebook’s parent company, $276 million for violating GDPR regulations. This fine contributed to Meta’s reputation for receiving some of the largest data breach fines under GDPR[35], [36], [37], [38].

17. Microsoft data breach

  • Date discovered: January 2021
  • Cause: Exploitation of four zero-day vulnerabilities
  • Countries affected: Primarily the United States and several countries in Europe
  • Number of records exposed: Not explicitly quantified
  • Servers affected: Approximately 250,000 servers worldwide
  • People affected: Undisclosed
  • Types of data compromised: Emails, email attachments, user credentials, and administrative privileges on affected servers

Discovery and announcement

In early January 2021, cybersecurity firm Volexity discovered unusual activity on Microsoft Exchange Servers, which led to the identification of a major breach. Attackers exploited four zero-day vulnerabilities in the Exchange Server, collectively known as “ProxyLogon,” which allowed them to access email accounts, passwords, and administrative privileges.

The attackers used this access to move laterally within networks and installed web shells — malicious scripts that provided ongoing access, even after the vulnerabilities were patched. On March 2, 2021, Microsoft publicly disclosed the vulnerabilities.

Response

Upon discovering the breach, Microsoft acted swiftly and released security patches for Exchange Server versions 2010, 2013, 2016, and 2019. The company urged organizations to implement these patches immediately to close the vulnerabilities.

However, simply applying the patches didn’t remove the web shells already installed by the attackers. Organizations were advised to conduct thorough investigations to identify and remove any remaining threats and ensure their systems were secure.

Impact

The breach affected about 250,000 servers worldwide. In the United States alone, it compromised approximately 30,000 organizations. The breach impacted various sectors, including healthcare, legal, higher education, defense, policy think tanks, and small businesses.

The exposed stolen data could potentially lead to intellectual property theft, espionage, and further malicious activities, such as ransomware deployment on some compromised servers. The scale and severity of the attack make it one of the largest and most damaging cyber incidents in recent US history[50], [51], [52].

18. SolarWinds data breach

  • Date discovered: December 2020
  • Cause: Supply chain attack
  • Countries affected: Primarily the United States, but also the United Kingdom, Canada, Mexico, Spain, Israel, the United Arab Emirates, and other countries
  • Number of records exposed: Undisclosed, but numerous US federal agencies and private sector companies were affected
  • People affected: More than 18,000 SolarWinds customers
  • Types of data compromised: Emails, confidential documents, internal communications, and potentially sensitive government and corporate data

Discovery and announcement

In December 2020, cybersecurity firm FireEye discovered a cyberattack targeting SolarWinds’ Orion software, a widely used IT management platform. Investigations revealed that the attackers had infiltrated SolarWinds as early as September 2019 and were testing their ability to inject malicious code.

By February 2020, they successfully inserted trojanized code into Orion’s software updates, which SolarWinds unknowingly distributed. This backdoor, named SUNBURST, granted remote access to infected systems.

Response

On December 13, 2020, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive for federal agencies to disconnect SolarWinds Orion products. The White House’s National Security Council formed a Cyber Unified Coordination Group to lead the response.

SolarWinds worked with law enforcement and cybersecurity experts to investigate the breach and released patches to fix the vulnerability. Microsoft and other security firms helped reroute malicious traffic to limit further exploitation. Congress held hearings to assess the risks to the IT supply chain and urged stricter regulations for government contractors handling extremely sensitive data.

Impact

The SolarWinds breach is one of the most significant cybersecurity incidents in history, which affected multiple US federal agencies, including the Departments of Treasury, Commerce, State, Homeland Security, and the National Nuclear Security Administration.

The breach exposed vulnerabilities in supply chain security and raised concerns about espionage and cyber warfare. While not all 18,000 customers were exploited, high-value targets, such as US government agencies and Fortune 500 companies, were specifically targeted.

In response to the breach, the US government formally blamed Russia’s Foreign Intelligence Service (SVR) for orchestrating the attack. The US administration identified the breach as part of a broader campaign of cyber espionage linked to the Russian government.

In April 2021, the Biden administration imposed sanctions on Russia. Additionally, the US Securities and Exchange Commission (SEC) fined several tech firms for failing to disclose cybersecurity risks related to the breach[39], [40], [41], [42].

19. MGM Hotels data breach

  • Date discovered: July 2019
  • Cause: Unauthorized access to an exposed cloud database
  • Countries affected: Primarily the United States
  • Number of records exposed: Tens of millions of private customer data records
  • People affected: More than 10.6 million hotel guests
  • Types of data compromised: Names, home addresses, phone numbers, emails, DOBs

Discovery and announcement

In July 2019, MGM Resorts suffered a large data breach when an unauthorized party accessed a cloud database containing information of millions of guests, including regular travelers, celebrities, tech executives, journalists, and government officials. Although MGM stated that the compromised data was “old,” many contact details were still valid.

Response

After discovering the breach, MGM hired two cybersecurity firms to investigate. While the company notified affected customers of the breach, it didn’t make a public disclosure until cybercriminals exposed the breached data in 2020. Experts criticized the delayed public disclosure and MGM’s lack of transparency.

Impact

The exposed data presented significant security risks, especially for high-profile guests. While MGM stated the breach didn’t affect operations, the leak damaged the company’s reputation and highlighted vulnerabilities in its data protection practices. The breach led to class-action lawsuits and a $45 million settlement, which also covered damages from later cybersecurity incidents.

In September 2023, MGM experienced another major data breach, which further heightened concerns about its data security practices[43], [44].

20. Marriott International data breach

  • Date discovered: End of February 2020
  • Cause: Unauthorized access using compromised employee login credentials
  • Countries affected: Multiple
  • People affected: 5.2 million guests
  • Types of data compromised: Contact details (name, address, email, phone), loyalty account info (account number, points balance), personal details (company, gender, birthday), preferences (room type, language), linked partnerships (airline loyalty programs)

Discovery and announcement

In late February 2020, Marriott discovered that an unexpected amount of guest information had been accessed using the login credentials of two employees at a franchise property. The unauthorized activity likely began in mid-January 2020.

Response

Upon discovery, Marriott disabled the compromised credentials and initiated an investigation. The company increased monitoring and provided resources to inform and assist guests. It also notified relevant authorities and cooperated with their investigations.

On March 31, 2020, Marriott emailed affected guests, set up a dedicated website, and provided call center resources. Marriott also offered free enrollment in the IdentityWorks personal information monitoring service for one year, provided by Experian.

Impact

The breach exposed the sensitive information of 5.2 million guests. While the breach didn’t compromise financial data or encrypted passwords, it raised concerns about Marriott’s data security practices, especially in light of the 2018 breach that affected 500 million guests.

In October 2024, Marriott agreed to pay a $52 million settlement to 49 states and the District of Columbia over multiple data security failures from 2014 to 2020 that affected over 334 million customers.

As part of the settlement, Marriott and Starwood committed to improving data security. They also allowed US customers to request the deletion of their personal information and reviewed loyalty accounts for potentially stolen points[45], [46], [47].

21. CAM4 data breach

  • Date discovered: March 2020
  • Cause: A firewall failure
  • Countries and people affected: Primarily users from the US, Brazil, and Italy
  • Number of records exposed: 10 billion records
  • Types of data compromised: Names, email addresses, hashed passwords, country of origin, device information, gender preference, sexual orientation, payment logs (credit card type, amount paid), chat transcripts, fraud detection logs, and IP addresses

Discovery and announcement

In March 2020, cybersecurity researchers from Safety Detectives discovered that CAM4, an adult live-streaming platform, had left its Elasticsearch production database exposed online without a password. This misconfiguration allowed anyone with the correct IP address to access sensitive user information.

Response

Granity Entertainment, CAM4’s parent company, quickly secured the exposed database by removing it from public access and moving it to a secure internal network. It also deleted any personally identifiable information from the database. However, because the logs dated back to March 16, 2020, it’s possible that cybercriminals had accessed the data before the company secured it.

On May 4, 2020, Granity publicly stated that researchers and internal security teams had accessed only 93 individuals’ data. It denied that external hackers had exploited the database. Still, experts criticized CAM4 for not having sufficient security measures in place.

Impact

Although investigators found no confirmed evidence of widespread data misuse, the breach exposed users to potential blackmail, phishing, and identity theft. Users who did not use anonymous credentials risked having their real identities linked to their online activity.

While the breach didn’t receive widespread media attention, privacy experts warned that if cybercriminals had exploited the data, Granity Entertainment could have faced significant lawsuits and regulatory penalties, especially under Europe’s GDPR and other global data protection laws[48], [49].

22. Sina Weibo data breach

  • Date discovered: March 2020
  • Cause: Exploitation of a feature allowing users to find friends by uploading their phone contacts
  • Countries affected: Primarily China
  • Number of people affected: 538 million users
  • Types of data compromised: Names, usernames, gender, location, and phone numbers

Discovery and announcement

In March 2020, Sina Weibo, China’s leading microblogging platform, confirmed a massive data breach that affected approximately 538 million users. The breach was revealed when a hacker offered the stolen user data for sale on the dark web for $250. Weibo clarified that passwords were not exposed in the breach.

Response

After the breach, China’s Ministry of Industry and Information Technology (MIIT) summoned Weibo representatives to address the incident. The MIIT instructed Weibo to improve data security and internal management and notify users and authorities of future incidents.

Although the data breach didn’t expose any passwords, Weibo advised users who reused passwords across different platforms to take extra precautions. The company committed to strengthening its security measures and reported the breach to law enforcement.

Impact

The breach compromised the personal information of 538 million users, making it one of the world’s biggest data breaches. The stolen data increased the risk of phishing attacks, identity theft, and other malicious activities[53].

Trends and patterns in recent large data breaches

Recent major data breaches reveal several key trends and patterns:

  1. Attackers continue to rely on common but highly effective methods, including phishing, ransomware, and supply chain attacks. Top ransomware groups use these tactics to target organizations and maximize their impact.
  2. Corporate data breaches expose large volumes of sensitive customer information, while government hacks raise serious national security concerns.
  3. Industries dealing with valuable personal or financial data, including healthcare, finance, and technology, remain prime targets.
  4. The full scale of data breaches often takes months or years to emerge.
    What’s more, stolen data frequently appears on the dark web long after the initial attack, making it challenging for authorities to trace the source or hold attackers accountable. This delay puts organizations and individuals at risk without their knowledge, giving cybercriminals a significant advantage.

In response, regulatory bodies are tightening compliance requirements. Laws like GDPR and CCPA are driving companies to improve security and breach disclosure practices. However, as cybercrimes continue to evolve, businesses must go beyond just compliance and implement proactive cybersecurity strategies to stay ahead of emerging threats.

How companies can protect against data breaches

Cyberattacks are becoming more sophisticated, but businesses can take strategic steps to reduce the risk and minimize damage. Below are four essential measures every company should implement to strengthen cybersecurity and respond effectively to various data breach types.

  • Enforce strong access controls. Limiting access to sensitive data and systems with multi-factor authentication (MFA) and role-based permissions reduces the risk of insider threats and unauthorized intrusions. Regular vulnerability management can help identify and address any weaknesses in these systems.
  • Keep systems updated and patched. Cybercriminals often exploit outdated software with known vulnerabilities. Regularly updating and patching applications, operating systems, and security tools can close these gaps and prevent attackers from using them as entry points.
  • Train employees to recognize cyber threats. Recent findings show that human error is the leading cause of data breaches[54]. Educating employees on phishing, social engineering, and secure data handling can reduce the likelihood of accidental leaks and security lapses. A well-trained staff acts as the first line of defense against cyber threats.
  • Monitor and contain breaches with threat detection tools. No system is completely immune to cyberattacks, which is why early detection is critical. Data breach monitoring and threat detection and response solutions, like those provided by NordStellar, can help businesses identify breaches in real time, contain the damage, and prevent attackers from spreading further within the network.
    Additionally, the rise of malware-as-a-service (MaaS) means companies must be prepared for increasingly accessible and powerful malware tools that may bypass traditional security measures. Rapid response and continuous monitoring can significantly reduce an incident’s impact.

Cyberattacks aren’t going anywhere. Contact the NordStellar team to get complete visibility over your cyber threats.

References

[1] “ITRC sees third-most data breach victims in a quarter in Q2 2024,” Identity Theft Resource Center, Jul. 17, 2024. [Online]. Available: https://www.idtheftcenter.org/post/itrc-sees-third-most-data-breach-victims-in-quarter/

[2] “Breach information,” National Public Data, 2024. [Online]. Available: https://web.archive.org/web/20240813211719/https://nationalpublicdata.com/Breach.html

[3] Hofmann v. Jerico Pictures Inc., No. 024-CV-61383-SD (Fla. Aug. 1, 2024). Bloomberg Law. [Online]. Available: https://www.bloomberglaw.com/public/desktop/document/HofmannvJericoPicturesIncDocketNo024cv61383SDFlaAug012024CourtDoc?doc_id=X6S27DVM6H69DSQO6MTRAQRIVBS

[4] V. Petkauskas, “Billions of passwords and credentials leaked in the ‘Mother of All Breaches,'” Cybernews, Mar. 13, 2024. [Online]. Available: https://cybernews.com/security/billions-passwords-credentials-leaked-mother-of-all-breaches/

[5] “Cyber incident,” FBCS, Inc., n.d. [Online]. Available: https://www.fbcs-inc.com/cyber-incident/

[6] “Ticketmaster data security incident,” Ticketmaster, n.d. [Online]. Available: https://help.ticketmaster.com/hc/en-us/articles/26110487861137-Ticketmaster-Data-Security-Incident

[7] “Health data breach,” UnitedHealth Group. [Online]. Available: https://www.unitedhealthgroup.com/ns/health-data-breach.html

[8] “HIPAA substitute notice,” Change Healthcare. [Online]. Available: https://www.changehealthcare.com/hipaa-substitute-notice.html

[9] “Form 10-Q: Quarterly report,” US Securities and Exchange Commission. [Online]. Available: https://www.sec.gov/ix?doc=/Archives/edgar/data/0000732717/000073271724000046/t-20240506.htm

[10] “Addressing illegal download activity,” AT&T. [Online]. Available: https://about.att.com/story/2024/addressing-illegal-download.html

[11] D. Winder, “Dell confirms database hacked, hacker says 49 million customers hit,” Forbes, May 10, 2024. [Online]. Available: https://www.forbes.com/sites/daveywinder/2024/05/10/dell-confirms-database-hacked-hacker-says-49-million-customers-hit/

[12] “Threat actor claims sale of Dell database containing 49 million customer records,” Daily Dark Web, [Online]. Available: https://dailydarkweb.net/threat-actor-claims-sale-of-dell-database-containing-49-million-customer-records/

[13] “Update on cyber incident, 25 July 2024,” Synnovis. [Online]. Available: https://www.synnovis.co.uk/news-and-press/update-on-cyber-incident-25-july-2024

[14] “Cyberattack update, 01 July 2024,” Synnovis. [Online]. Available: https://www.synnovis.co.uk/news-and-press/cyberattack-update-01-july-2024

[15] “NHS London statement on Synnovis ransomware cyber attack,” NHS England, Jun. 4, 2024. [Online]. Available: https://www.england.nhs.uk/london/2024/06/04/nhs-london-statement-on-synnovis-ransomware-cyber-attack/

[16] “Synnovis ransomware cyber attack,” NHS England. [Online]. Available: https://www.england.nhs.uk/london/synnovis-ransomware-cyber-attack/

[17] “Cyber attack cost Synnovis an estimated £32.7m in 2024,” Digital Health, Jan. 2025. [Online]. Available: https://www.digitalhealth.net/2025/01/cyber-attack-cost-synnovis-estimated-32-7m-in-2024/

[18] “Update about an alleged incident regarding Twitter user data being sold online,” Twitter (X), 2023. [Online]. Available: https://privacy.x.com/en/blog/2023/update-about-an-alleged-incident-regarding-twitter-user-data-being-sold-online

[19] L. Abrams, “200 million Twitter users’ email addresses allegedly leaked online,” BleepingComputer, [Online]. Available: https://www.bleepingcomputer.com/news/security/200-million-twitter-users-email-addresses-allegedly-leaked-online/

[20] “MOVEit Transfer critical vulnerability,” Progress, May 31, 2023. [Online]. Available: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

[21] “MOVEit Transfer and MOVEit Cloud vulnerability,” Progress, [Online]. Available: https://www.progress.com/trust-center/moveit-transfer-and-moveit-cloud-vulnerability

[22] “MOVEit vulnerability,” National Cyber Security Centre, [Online]. Available: https://www.ncsc.gov.uk/information/moveit-vulnerability

[23] “Form 8-K: Current report,” US Securities and Exchange Commission, Aug. 6, 2024. [Online]. Available: [https://www.sec.gov/Archives/edgar/data/876167/000087616724000138/prgs-20240806.htm (https://www.sec.gov/Archives/edgar/data/876167/000087616724000138/prgs-20240806.htm)

[24] “MDL 3083: In Re: MOVEit Customer Data Security Breach Litigation,” US District Court for the District of Massachusetts, [Online]. Available: https://www.mad.uscourts.gov/caseinfo/multi-district-litigation.htm#:~:text=MDL%203083%3A%20In%20Re%3A%20MOVEit%20Customer%20Data%20Security%20Breach%20Litigation

[25] “Customer information,” T-Mobile, [Online]. Available: https://www.t-mobile.com/news/business/customer-information

[26] “Form 8-K: Current report,” US Securities and Exchange Commission, Jan. 9, 2023. [Online]. Available: https://www.sec.gov/ix?doc=/Archives/edgar/data/0001283699/000119312523010949/d641142d8k.htm

[27] “HCA Healthcare reports data security incident,” HCA Healthcare, [Online]. Available: https://investor.hcahealthcare.com/news/news-details/2023/HCA-Healthcare-Reports-Data-Security-Incident/default.aspx

[28] “Privacy update,” HCA Healthcare, [Online]. Available: https://hcahealthcare.com/about/privacy-update.dot

[29] “Form 8-K: Current report,” US Securities and Exchange Commission, Aug. 9, 2022. [Online]. Available: https://www.sec.gov/ix?doc=/Archives/edgar/data/0001512673/000119312522095215/d343042d8k.htm

[30] “Salinas, et al. v. Block, Inc. and Cash App Investing, LLC,” Cash App Security Settlement, [Online]. Available: https://cashappsecuritysettlement.com/home

[31] “An issue affecting some anonymous accounts,” X (Twitter), 2022. [Online]. Available: https://privacy.x.com/en/blog/2022/an-issue-affecting-some-anonymous-accounts

[32] L. Abrams, “Hacker selling Twitter account data of 54 million users for $30K,” BleepingComputer, [Online]. Available: https://www.bleepingcomputer.com/news/security/hacker-selling-twitter-account-data-of-54-million-users-for-30k/

[33] “Preliminary proxy statement,” US Securities and Exchange Commission, [Online]. Available: https://www.sec.gov/Archives/edgar/data/1839175/000119312521284329/d234831dprem14a.htm

[34] “Telecoms giant Syniverse discloses years-long data breach,” SecurityWeek, [Online]. Available: https://www.securityweek.com/telecoms-giant-syniverse-discloses-years-long-data-breach/

[35] A. Holmes, “Stolen data of 533 million Facebook users leaked online,” Business Insider, Apr. 3, 2021. [Online]. Available: https://www.businessinsider.com/stolen-data-of-533-million-facebook-users-leaked-online-2021-4?r=US&IR=T

[36] “Data Protection Commission announces decision in Facebook data scraping inquiry,” Data Protection Commission, [Online]. Available: https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-in-facebook-data-scraping-inquiry

[37] Reuters, “Facebook users affected by data breach eligible for compensation, German court says,” Reuters, Nov. 18, 2024. [Online]. Available: https://www.reuters.com/technology/facebook-users-affected-by-data-breach-eligible-compensation-german-court-says-2024-11-18/

[38] P. Van Leemputten “Interne mail toont hoe Facebook veiligheidsproblemen wil ‘normaliseren,’” Data News, [Online]. Available: https://datanews.knack.be/nieuws/interne-mail-toont-hoe-facebook-veiligheidsproblemen-wil-normaliseren/

[39] D. Temple-Raston, “A worst nightmare cyberattack: The untold story of the SolarWinds hack,” NPR, Apr. 16, 2021. [Online]. Available: https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack

[40] “SolarWinds cyberattack demands significant federal and private sector response [infographic],” US Government Accountability Office, [Online]. Available: https://www.gao.gov/blog/solarwinds-cyberattack-demands-significant-federal-and-private-sector-response-infographic

[41] “Fact sheet: Imposing costs for harmful foreign activities by the Russian government,” The White House, Apr. 15, 2021. [Online]. Available: https://web.archive.org/web/20210422234636/https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/

[42] “Press release 2024-174,” US Securities and Exchange Commission, [Online]. Available: https://www.sec.gov/newsroom/press-releases/2024-174

[43] C. Cimpanu, “Exclusive: Details of 10.6 million MGM hotel guests posted on a hacking forum,” ZDNet, [Online]. Available: https://www.zdnet.com/article/exclusive-details-of-10-6-million-of-mgm-hotel-guests-posted-on-a-hacking-forum/

[44] “Tonya Owens, et al. v. MGM Resorts International et al.,” US District Court for the District of Nevada, [Online]. Available: https://storage.courtlistener.com/recap/gov.uscourts.nvd.164564/gov.uscourts.nvd.164564.63.0.pdf

[45] “Marriott International notifies guests of property system incident,” Marriott International, Mar. 31, 2020. [Online]. Available: https://news.marriott.com/news/2020/03/31/marriott-international-notifies-guests-of-property-system-incident

[46] “Marriott International: Incident Notification,” Marriott International, [Online]. Available: https://web.archive.org/web/20200401163431/https://mysupport.marriott.com/

[47] “FTC takes action against Marriott, Starwood over multiple data breaches,” Federal Trade Commission, Oct. 2024. [Online]. Available: https://www.ftc.gov/news-events/news/press-releases/2024/10/ftc-takes-action-against-marriott-starwood-over-multiple-data-breaches

[48] “CAM4 responds to allegations of security breach,” CAM4, [Online]. Available: https://www.cam4.com/blog-uk/cam4-responds-to-allegations-of-security-breach/

[49] A. Bizga, “CAM4 data leak exposes personal data of millions of users,” Security Boulevard, May 2020. [Online]. Available: https://securityboulevard.com/2020/05/cam4-data-leak-exposes-personal-data-of-millions-of-users/

[50] A. M. Pitney, S. Penrod, M. Foraker, and S. Bhunia, “A systematic review of 2021 Microsoft Exchange data breach exploiting multiple vulnerabilities,” 2022 7th International Conference on Smart and Sustainable Technologies (SpliTech), Split / Bol, Croatia, 2022, pp. 1-6, https://doi.org/10.23919/SpliTech55088.2022.9854268

[51] “Active exploitation of Microsoft Exchange zero-day vulnerabilities,” Volexity, Mar. 2, 2021. [Online]. Available: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

[52] MSRC Team, “Multiple security updates released for Exchange Server,” Microsoft Security Response Center, Mar. 2021. [Online]. Available: https://msrc.microsoft.com/blog/2021/03/multiple-security-updates-released-for-exchange-server/

[53] 微博安全中心 (Weibo Security Center), “有关“微博用户信息被出售事件”的说明,” Weibo, [Online]. Available: https://weibo.com/2735327001/IzCMJioqC?from=page_1006062735327001_profile&wvr=6&mod=weibotime&type=comment

[54] “2024 Data Breach Investigations Report,” Verizon, 2024. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/?CMP=OOH_SMB_OTH_22222_MC_20200501_NA_NM20200079_00001

 

About NordStellar
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Data Protection Federation in Document Collaboration and Management Platforms

1. What is Federated Security?

Federated security is an IT security methodology that allows centralized authentication and authorization to be applied across multiple, interconnected systems or organizations. It provides a way to ensure seamless integration and interoperability between various platforms while maintaining robust access control. Instead of managing separate credentials for each system, federated security enables users to authenticate once and gain access to multiple resources, reducing complexity and enhancing security.

A key concept within federated security is federated identity, which is the foundation of this approach. Federated identity is a trusted connection between identity providers (IdPs) and service providers (SPs). Here, user credentials are managed by a central identity provider, and other interconnected systems trust this provider to authenticate users. This trust framework ensures that a user’s identity is consistently recognized across different platforms. If you would like to learn more, here is an article from Microsoft.


A typical federated security architecture consists of:

  • 1. Identity Providers (IdPs): These manage user authentication and identity verification.
  • 2. Service Providers (SPs): These are the systems or applications that rely on the IdP to validate user access.
  • 3. Federation Protocols: Technologies like SAML (Security Assertion Markup Language) or OAuth that enable secure communication and information exchange between IdPs and SPs.
  • 4. Policies and Agreements: Predefined security policies and trust agreements that outline roles, permissions, and access rules between entities.

This architecture simplifies access management, enhances user experience, and ensures security policies are uniformly enforced across diverse platforms. Federated security not only reduces administrative workloads but also mitigates risks associated with fragmented systems and multiple access credentials.

2. And Federated Access?

Federated access extends the principle of federated identity into the realm of IT security by focusing specifically on how access to resources and applications is managed across multiple systems. It is a method where access rights and privileges are centralized yet seamlessly extended to various interconnected environments or systems. This approach not only simplifies the user experience but also streamlines the management of access permissions.

In a federated access environment, the link between identity providers and service providers ensures that access policies are consistent and uniformly applied. This simplifies administrative processes and reduces the risk of unauthorized access, as users’ permissions are centrally managed rather than being scattered and duplicated across disparate systems.

Federated access plays a crucial role in enhancing security and operational efficiency by ensuring that access controls are aligned with the organization’s overall security policies and business needs. This approach not only boosts security but also supports compliance with regulatory requirements, making it a vital component of modern IT security strategies.

3. Why is Federated Security Important in Cybersecurity?

Federated security is essential in cybersecurity because it simplifies access management while strengthening protection against data breaches and unauthorized access. By centralizing authentication and extending secure access controls across systems, organizations can ensure consistent enforcement of security policies. This approach reduces human errors, eliminates redundant tools, and addresses key risks associated with fragmented security practices.

Key benefits include:

  • 1. Enhanced Data Protection: Federated security ensures sensitive information remains secured through unified access management.
  • 2. Operational Efficiency: IT teams spend less time managing individual credentials and permissions across systems.
  • 3. Improved User Experience: Single sign-on (SSO) eliminates the need for multiple passwords, making workflows smoother and reducing credential fatigue.
  • 4. Regulatory Compliance: Simplified auditing of access controls ensures alignment with industry regulations like DORA or NIS2.

Consider the cloud-based collaboration tools used in large organizations, such as Google Workspace or Microsoft 365. Without federated security, employees would require separate credentials for each service, increasing the risk of weak passwords and inconsistent access control. With federated security, organizations integrate these platforms under a trusted identity provider, ensuring employees can securely access multiple tools or data through SSO.

Overall, federated security delivers a cohesive strategy to safeguard organizational resources while improving efficiency.

4. Real-World Examples of Federated Practices

Federated security is increasingly adopted across various sectors, from industry to finance and public administration, reflecting its versatility and effectiveness. Let’s explore two real-world examples and understand how different types of federated security systems are applied.

1. Industry: Manufacturing

In the manufacturing sector, federated identity management systems streamline access to shared resources across multiple plants and partners. By adopting Single Sign-On (SSO), employees can access a range of tools from CAD software to supply chain management platforms without logging in separately for each one. This integration not only enhances productivity but also ensures stringent security protocols are consistently applied, preventing unauthorized access across the vast industrial network. Learn more about data protection in the supply chain here.

2. Financial Company: Banking Sector

Financial institutions are particularly sensitive to security breaches. A large bank might employ Federated Identity as a Service (IDaaS) to manage customer access across digital banking services, investment platforms, and partner financial services. This federated system enhances user convenience by allowing seamless transitions between services, while also safeguarding sensitive financial data through a centralized, secure authentication process. The bank can thus offer robust customer experiences without compromising security standards.

5. How does federated access help with data permission management?

Federated access plays a pivotal role in permission management by offering a centralized approach to controlling and monitoring data access across multiple systems. In today’s interconnected digital ecosystems, ensuring secure and efficient permission management is critical for preventing unauthorized data access and minimizing the risks of breaches.

Here’s how federated access enhances permission management:

1. Centralized Authorization Control
Federated access enables organizations to unify permission management under a single framework, rather than managing individual systems independently. This centralization improves consistency in enforcing access policies and reduces the complexity associated with fragmented security protocols.

  • Administrators can define roles, attributes, and permissions in one place, with those policies automatically reflected across all connected systems.
  • This strengthens governance, as organizations gain a clear overview of “who has access to what” across all platforms.

2. Granular Access Management
Federated systems often leverage attribute-based access control (ABAC) or role-based access control (RBAC) principles, know more here. These models allow permission levels to adapt dynamically based on a user’s role, location, or specific attributes.

For example: A healthcare worker may access specific patient data during working hours but have restricted permissions outside of those hours. Federated access ensures permissions align with organizational policies while preventing excessive or unnecessary data access.

3. Scalability Across Complex Environments

As organizations grow, managing permissions across multiple databases, cloud services, and applications can become overwhelming. Federated access scales with expansion, ensuring robust permission management across diverse infrastructures, whether they include remote teams, external partners, or multi-cloud environments.

4. Reduced Risk of Human Error
Manual permission management often leads to mistakes, such as granting incorrect access levels or forgetting to remove permissions after an employee leaves. Federated access automates these processes, reducing vulnerabilities caused by human error and improving overall security hygiene.

Federated access provides a unified framework for managing permissions to data stored across diverse platforms such as storage repositories (e.g., SharePoint) and data security solutions like Enterprise Digital Rights Management (EDRM). By aligning access controls across these systems, federated access ensures that sensitive information is consistently protected, regardless of where it resides. Remember that it is also important to protect data in all three states, not just rely on access measures.

This approach eliminates silos by linking permission policies to a centralized identity, enabling organizations to apply uniform security protocols across file storage, document management, and collaboration tools. The result is a more cohesive, scalable, and secure method for controlling data access in increasingly complex environments.

6. Introducing SealPath´s Federated Policies for SharePoint and Nextcloud

SealPath’s Federated Policies offer a seamless and dynamic approach to protecting sensitive data stored in platforms like SharePoint and Nextcloud. By automatically applying protection to a root folder and its contents, these policies ensure that access permissions are continuously synchronized with the folder’s permission settings. This integration removes the need for manual updates, providing robust security that adapts in real-time to changes in user permissions.

Automatic Protection: SealPath federated rules automatically apply protection to designated root folders and their files, ensuring consistent security.

Dynamic Synchronization: Permissions within SealPath federated policies mirror the user permissions assigned to the folder. For example, an employee with edit permissions for a SharePoint folder (e.g., Financial Reportings) is granted equivalent edit permissions for the protected documents within that folder.

Granular Control: User permissions are determined exclusively based on the folder’s access rules and are managed via the SealPath web administration console. These permissions are non-editable by users, ensuring centralized control.

Folder-Specific Protection: Federated policies apply only to the defined folder and its contents, cannot be associated with other folders, and cannot be used to protect individual files outside the defined scope.

Real-Time Detection of Changes: SealPath reads folder permissions continuously and adapts protection settings immediately upon detecting changes. This ensures evolving permissions (e.g., promotions or role changes) are reflected in real-time.

Flexible Permission Equivalence: Organizations can customize how folder permissions translate to SealPath policy access levels.

For example:

Read in SharePoint → View permission in SealPath policy.
Write in SharePoint → Edit, copy, paste, and print permissions in SealPath policy.
Owner in SharePoint → Full control in SealPath policy.

Security Beyond the Folder: Even if documents leave the protected folder, they remain under SealPath control ensuring continued protection and mitigating the risks of unauthorized access or data leakage.

SealPath’s Federated Policies create a powerful synchronization mechanism between folder permissions and document security, providing organizations with automated, scalable, and airtight protection for sensitive files stored in SharePoint and Nextcloud.

7. Advantages and Benefits of Using SealPath Federated Policies

SealPath’s Federated Policies introduce a highly efficient and automated approach to securing sensitive data across platforms like SharePoint and Nextcloud. By aligning security measures with folder permissions, organizations can achieve dynamic protection without the complexity of manual intervention.

1. Aligned Data Security Measures
SealPath federated policies ensure that data protection is always in sync with folder access permissions, promoting a uniform approach to security across the organization.

2. Consistent Data Access Policies
Federated policies eliminate inconsistencies in access control, ensuring all users have permissions that align with their roles, improving transparency and trust.

3. Improved Data Governance
By applying uniform controls across folders, SealPath federated policies enhance data governance, reducing the risk of misconfigured rules or permissions that could lead to security vulnerabilities or operational friction.

4. Centralized Access Control
Permissions and rules are managed directly from the SealPath web administration console, simplifying access control management and eliminating the need for individual file-level adjustments.

5. Real-Time Application of Policies
Protection is applied instantaneously based on predefined rules, adapting dynamically to changes in folder permissions without disrupting workflows.

Key Benefits

1. Reduced Risk of Human Error
Automating the synchronization of permissions with data protection significantly reduces the likelihood of mistakes or oversights that could result in a data breach.

2. Eliminates Repetitive Manual Adjustments
The automation provided by SealPath federated policies removes the need for repeated manual input, enhancing operational hygiene and freeing up time.

3. Greater Operational Efficiency
By minimizing the effort required to manage permissions and protection, teams can shift their focus to higher-priority strategic initiatives instead of tackling administrative tasks.

4. Prevention of Conflicting Rules
Federated policies avoid overlapping or contradictory permissions, ensuring a streamlined and frictionless experience for employees while maintaining airtight security.

In conclusion, federated rules for protecting files in folders follow the principles of federated security applied to data access rights, thereby providing greater protection against data leaks and risks. Therefore, based on our experience of more than 10 years helping various entities protect their most sensitive data and information, we strongly recommend that organizations implement this practice.

About SealPath
SealPath is the European leader in Data-Centric Security and Enterprise Digital Rights Management, working with significant companies in more than 25 countries. SealPath has been helping organizations from different business verticals such as Manufacturing, Oil and Gas, Retail, Finance, Health, and Public Administration, to protect their data for over a decade. SealPath’s client portfolio includes organizations within the Fortune 500 and Eurostoxx 50 indices. SealPath facilitates the prevention of costly mistakes, reducing the risk of data leakage, ensuring the security of confidential information, and protecting data assets.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.