Incident Of The Week: Dominion National Finds Evidence of Data Breach Nearly a Decade Later
Add bookmark
Data breaches are often in the headlines these days, and one of the things you most want to know about those incidents is how long the vulnerabilities existed before company representatives found out and took action. After all, the longer that hackers have access, the easier it could be for them to grab sensitive customer data and wreak havoc for those affected.
It is bad enough when data breaches persist for weeks or months before companies discover them, but what about years? That is what happened in the case of a breach affecting Dominion National, a vision and dental insurance company and benefits administrator.
What Do Dominion National Customers Need to Know?
In late April 2019, Dominion National investigated an internal alert with the assistance of an outside cybersecurity firm. The results showed that unauthorized parties could have had access to some of the companies servers since August 25, 2010. The company did not disclose what triggered the initial alert. It also did not say how many of the company's 900,000 customers possibly had data on the servers.
However, Dominion National representatives assessed what kind of information got compromised during the breach. They say the potentially at-risk parties are the current and former customers of Dominion National, as well as the health providers that offer Dominion National plans to their clients. In one instance of a related party affected by the breach, the Delaware Department of Insurance said the incident could affect 10% of the state's population.
With more than 140,000 members, Cyber Security Hub is the vibrant community connecting cyber security professionals around the world.
See Related: “6 Cyber Security Trends To Watch Going Into 2020”
The kinds of information possibly accessed include names, addresses, emails, subscriber identification numbers, Social Security numbers dates of birth and other details specific to the person's relationship to the insurance company, such as their group identification numbers.
And, the news is even worse for people who utilized Dominion National's online enrollment feature. The company says that those customers may have had their bank account and routing number information compromised, in addition to the details in the previous paragraph.
But, Dominion National asserts that it has no evidence of any unauthorized access or information getting acquired or misused. As with most data breaches, including this one, the affected brands alert their customers before they know the precise extent of the damage.
How Is Dominion National Responding?
The Dominion National homepage has a small gold banner at the top that alerts people to the data breach and has a link that takes them to a dedicated site about the data breach and what it means for customers. The company says that after they became aware of the issue with the vulnerable servers, they acted quickly to clean them and started using heightened monitoring and alerting tools.
The FBI also got notified about the breach, and the company is cooperating with that organization until the completion of an investigation into the matter.
See Related: “Cyber Security Mid-Year Snapshot 2019”
Notification letters to potentially affected parties went out starting on June 21, 2019, and the company will provide two years of complimentary credit monitoring and fraud protection service to those individuals. There is also a dedicated phone line that people can call to get more details about the issue or enroll in the monitoring service.
A Standout Incident Due to the Time Involved
Data breaches are commonplace, but this one is arguably worse than most considering the length of time that the servers in question remained open to cybercriminals. People in the security industry should consider this issue a strong reminder of the need to diligently monitor their networks and all associated equipment for signs of trouble.
