Tanya Janca

Loblaw Breach - Ransom Paid? CyberAGroup assesses that a ransom was likely paid in the Loblaw breach, primarily because the threat actors voluntarily removed their post on the morning of the deadline. In typical data ransom scenarios, attackers don’t simply disappear when a deadline passes; they usually escalate by doubling their demands, even when bluffing, or by leaking more data to maintain leverage. Having worked on similar cases, we have found that hackers generally only back down once they’ve been compensated. Given that they probably paid a ransom, the incident is certainly more than a "low-level data breach." It is also being reported that Loblaw has engaged outside cybersecurity firms to conduct a forensic audit and determine the full extent of the intrusion. At the time of this post, Loblaw is sticking to its guns; its original notification from March 10 remains and has not been updated. Just because Loblaw paid a ransom doesn't mean your personal information is safe, especially in this case. Trusting in the "honor" and good faith of cybercriminals to actually delete data is a gamble at best. With respect to "branded" ransom groups like PLAY, SHINYHUNTERS, or COINBASE CARTEL, a victim’s only hope is that these groups won't dump, resell, or re-ransom the data in order to protect their reputations so that future victims will pay up. In this incident, involving a single username created specifically for this ransom (not publicly identified with any of the known groups), there is no reputational damage if the attackers turn around and sells the data to other bad actors or simply dumps it on the dark web in the future. Payment doesn't equal real protection. It may only prevent Loblaw from dealing with immediate consequences, with the company hoping that when your data does eventually surface, they won't be blamed. So, what now? We should expect to know exactly what personal data is out there and could resurface. Unfortunately, we don't know of a case where a company provided its customers with the real full details, even when they know exactly what was leaked. The sad reality is that companies will often tell customers it was a "low-level" leak and hope everyone forgets about it. While those companies go back to business as usual, the data lives on to be exploited by the burgeoning industry of fraudsters, extortionists, and data brokers.

8

External Attack Surface Signals, $Calgary Organizations At NEL Professional, we analyzed the publicly visible cyber posture of several large Calgary organizations. Common exposure signals included: • Missing SPF / DMARC email authentication • Publicly listable cloud storage buckets • Missing Content Security Policy headers • Lack of CAA DNS certificate controls • Large public subdomain attack surfaces These are not breaches but they represent the same signals attackers use during reconnaissance. Cybersecurity begins with understanding what the internet already reveals about your infrastructure. 🌐 https://lnkd.in/gaTS-QQi #CyberSecurity #AttackSurfaceManagement #NIST #ISO27001 #SOC2

2

Cyber Update for SMEs 1,400 MongoDB Servers at Risk Thousands of databases remain exposed online due to weak or missing access controls, making data wipes and ransom demands easy for attackers. Dozens of SMEs across Quebec have already been impacted often without realizing their systems were publicly accessible in the first place. This highlights a simple but critical reality: without basic security hardening, asset visibility, and continuous monitoring, cloud environments remain an easy target. Misconfigurations , not sophisticated exploits , continue to be one of the leading causes of data exposure for growing businesses. Unsure if your systems are properly secured? Techsek works as a long-term partner to help SMEs reduce risk and build resilient IT environments. 📩 info@techsek.ca #CyberSecurity #SMEs #Canada #Quebec #CloudSecurity #DataProtection #MongoDB #ITSecurity #DigitalRisk #BusinessContinuity

2

The Digital Governance Standards Institute is pleased to announce the reaffirmation of the National Standard of Canada CAN/DGSI 100-4, Data Governance – Part 4: Scalable Remote Access Infrastructure. CAN/DGSI 100-4 provides a comprehensive set of requirements and guidance to help organizations: ➡️Mitigate security risks related to remote access ➡️ Support rapid scaling of remote access technologies ➡️ Protect organizational networks from unsecured endpoint devices ➡️ Maintain robust compliance monitoring and auditability ➡️ Implement zero-trust and least-privilege access controls ➡️ Ensure secure onboarding and offboarding of workers It also offers guidance to organizations responding to sudden or unplanned shifts to remote work, ensuring that remote access environments remain secure, manageable, and aligned with best practices in data governance. Access the reaffirmed standard here: https://lnkd.in/d5Nadjq2

11

The CIRA 2025 Cyber Security Survey - https://lnkd.in/gBHtYUmg ⚠️ The Current Threat Reality: Canadian organizations face an aggressive threat landscape where cyber attacks and data breaches are common. 43% of Canadian organizations reported being targeted in a cyber attack in the last 12 months. A similar share, 42%, experienced a breach of customer or employee data. 🤖 The Intensifying Danger: New, sophisticated threats powered by generative AI are raising major concerns among decision-makers. 70% of cybersecurity decision-makers are worried about: Improved phishing emails and texts: 61% AI-powered cyber attacks: 54% 🍁 A Call for Canadian Solutions: Data Sovereignty: Cited as the single most important consideration when selecting third-party cybersecurity vendors: 69% 82% say that a vendor’s country of origin is now more important than it was 12 months ago. Partner with a made-in-Canada consultancy, message us here on LinkedIn, or email us: Arssinc@gmail.com

3

1 Comment

The City of Hamilton has spent over $18 million dollars and will continue to spend $400K per month until November 2026 to rebuild their systems after a ransomware attack. See article in comments section. Reading this article, I’m shaking my head at the vulnerabilities the city’s IT leadership tolerated leading up to this attack. Root cause? Multi-factor authentication was not enabled for many departments. Why? Because many users resisted the inconvenience of having to manage MFA. The only reason the city decided to re-ignite their MFA rollout was because their insurance company was demanding it. Unfortunately, a ransomware gang got to them first. This is serious incompetence that has wasted millions of dollars of taxpayers’ money. There is no doubt rolling out MFA in large enterprises with diverse workstyles can be challenging. In our experience in healthcare, we take the following approach to ensuring everyone is using MFA: 1.      For remote users, enforce MFA, no questions. 2.      For office-only users, use conditional policies to not enforce a double login when working within the office. This makes life easier for internal, high-trust users. 3.      For users that don’t have company-issued mobile phones or those with shared accounts, use a physical token technology such as Yubikeys. These are USB keys that users will plug into the computer to provide a second authentication. MFA is cybersecurity 101. There is NO excuse to ignore it. #cybersecurity

24

4 Comments

If you don’t think you need to be able to tell a story in this business you’ve never dealt with a breach, a customer or a board. They all involve telling a story effectively and each one is different. Learning to present is a key part of any job but it is critical to cyber. Story telling is one of the most effective methods to get your point across and make it stick.

13

1 Comment