The Weekly Five

The top five must-reads

We like to write our own articles, but we think others do it well, too

1. Senator questions Customs and Border Patrol on third-party vendor management after breach

Photos of travelers and vehicles crossing U.S. borders were nicked from a Customs and Border Patrol (CBP) subcontractor through a cyberattack, and Suprema BioStar 2 exposed more than 1 million fingerprint records along with facial recognition information and other sensitive data, Sen. Mark Warner, D-Va., pressed CBP for details on how it ensures third-party contractors are following security best practices (SC Magazine)

 2. The U.S. sanctions North Korean hacking group after continued cyber/ransomware attacks

The U.S. has slapped sanctions on three well-known North Korean state-sponsored hacker groups…Together, the three groups have hit U.S. entities and organizations with dozens of malicious cyberattacks – including widescale, operation-crippling ransomware attacks, information-stealing hacks and at one point stealing $571 million in cryptocurrency in just five attacks (Threatpost)

3. More than 20 million Ecuadorians’ data was leaked online, which may mean the entire population

The detailed information of potentially every person in Ecuador has been leaked online, in a massive and unprecedented national data breach, it was revealed on Monday…The breach exposed a host of personal information for the millions affected — their full names, date, and place of birth, home and email addresses, national identification numbers and taxpayer numbers, employment information, and more (CNN)

4. According to Proofpoint, more than 99% of cyberattacks need victims’ help

Research highlights how most criminals exploit human curiosity and trust to click, download, install, open, and send money or information (Darkreading)

5. 3 questions that board members should want answered as they engage with managers on cybersecurity

As they deal with their oversight duties, board members need to ask a related question: Are they themselves sufficiently in the know? (Symantec)