February 2025 Cybersecurity Roundup

SSL Support Team

2 days ago

GrubHub Data Breach

Food delivery company GrubHub disclosed that attackers infiltrated its systems via a third-party vendor’s account. The breach exposed personal information of customers, drivers, and restaurant partners. Data accessed included names, email addresses, phone numbers, and partial payment card details (the last four digits). GrubHub stated no full card numbers or passwords were compromised. The company cut off the vendor’s access and hired forensic experts to contain the damage.

SSL.com Actionable Insights:

Protecting sensitive customer and partner data requires proactive security measures and strict access controls.

Implement strict identity verification controls for third-party service providers to prevent unauthorized access to internal systems.

Deploy real-time monitoring tools that detect anomalies in access patterns and immediately flag potential security breaches.

Ensure hashed and encrypted storage of all credentials, with regular forced password rotations for legacy systems to mitigate exposure risks.

SSL.com’s Client Authentication certificates add an extra layer of protection by ensuring only verified individuals or organizations gain access to critical systems, reducing the risk of third-party account compromises.

Strengthen Access Control with SSL.com

Secure Now

Orange Telecom Hack

French telecom giant Orange Group confirmed a breach after a hacker leaked thousands of internal documents. The attacker, alias “Rey” (allegedly linked to the HellCat ransomware group), claimed to have exfiltrated ~12,000 files, including 380,000 unique email addresses, customer and employee data, invoices, and source code. The intrusion affected a non-critical system in Orange’s Romanian division; however, leaked data raises serious privacy and security concerns.

SSL.com Actionable Insights:

Preventing data breaches requires strong access control and proactive vulnerability management.

Restrict access to critical applications by enforcing authentication measures that verify users beyond just passwords.

Continuously monitor internal networks for unusual data transfers to detect and stop unauthorized exfiltration attempts in real-time.

Regularly test and patch vulnerabilities in issue-tracking and internal portals to prevent attackers from exploiting outdated security flaws.

SSL.com’s Client Authentication certificates help secure access to internal systems by ensuring only verified individuals or organizations can log in, eliminating reliance on compromised credentials.

Enhance Security with Verified Access

Secure Now

Lee Enterprises Ransomware Attack

Lee Enterprises, one of the largest U.S. newspaper chains, experienced a ransomware attack on February 9. This incident disrupted news production, billing, and distribution, causing print delays and partial outages in online operations. Although Lee Enterprises described the incident only as a “cybersecurity incident,” the behavior (system lockdown, operational disruption) strongly suggests ransomware.

SSL.com Actionable Insights:

Cyberattacks can disrupt business operations and prevent secure access to critical systems.

Protect remote connections with encrypted channels to prevent attackers from hijacking VPNs and accessing internal networks.
Implement identity verification measures to ensure only authorized personnel can access sensitive files and systems.
Regularly audit and update security protocols to defend against evolving cyber threats targeting media and publishing organizations.

Unimicron Data Theft (Sarcoma Ransomware)

Taiwanese electronics manufacturer Unimicron—a major producer of printed circuit boards—was targeted by a newer ransomware group called Sarcoma around February 12. The attackers claim to have stolen 377 GB of internal data, threatening a leak if demands go unmet. This incident underscores the supply-chain risks posed by emerging ransomware operators, who can disrupt global manufacturing if critical PCB producers are compromised.

SSL.com Actionable Insights:

Preventing ransomware attacks starts with securing communication channels and verifying identities.

Encrypt internal and external email communications to prevent phishing emails from delivering malicious payloads.

Authenticate all email senders to prevent attackers from impersonating executives or vendors in social engineering schemes.

Implement strict email security policies and employee training to recognize and avoid phishing scams, reducing the risk of ransomware infections.

Protect your personal and organizational email communications with SSL.com’s S/MIME certificates. Our certificates encrypt and digitally sign emails, preventing phishing, impersonation, and unauthorized access to sensitive data.

Secure Your Email Communications Today

Protect Now

Defense Contractors’ Credentials Leak

Security researchers found hundreds of compromised credentials for U.S. Department of Defense agencies and major defense contractors on cybercrime markets. The credentials, stolen by infostealer malware throughout 2024, include account details from Lockheed Martin, Boeing, Honeywell, and others. In some cases, session tokens bypassing MFA were discovered, posing a high risk of espionage or sabotage.

SSL.com Actionable Insights:

Preventing Infostealer malware starts with strong cyber hygiene and user awareness.

Train employees to recognize suspicious files, links, and emails to reduce the risk of downloading malware-infected attachments.

Enforce strict browsing policies by restricting access to unverified websites, reducing exposure to malicious downloads and phishing scams.

Require unique, strong passwords for each login to prevent credential reuse from compromising multiple systems.

SSL.com Announcements

MPIC is Coming to SSL.com!

Starting March 15, 2025, SSL.com will begin deploying Multi-Perspective Issuance Corroboration (MPIC) to enhance certificate security. MPIC ensures domain validation and CA Authorization (CAA) checks from multiple Internet network perspectives, preventing DNS and BGP attacks. This rollout follows CA/B Forum’s SC-067 timeline, with no action required from customers. Stay tuned for updates!