Mentioned in passing as part of a Securities and Exchange Commission (SEC) filing, Syniverse admits to hackers having access for five years, potentially impacting millions of mobile phone users worldwide.
In the middle of a recent 837-page SEC filing, telecom company Syniverse mentioned to shareholders of a 2016 data breach that was only discovered earlier this year. Under the topic of how breaches, lapses in data privacy, and other damages to IT operations could impact Syniverse’s business operations, Syniverse acknowledged the 2016 breach flippantly, presenting it merely as “an example.” From the filing (emphasis is mine):
For example, in May 2021, Syniverse became aware of unauthorized access to its operational and information technology systems by an unknown individual or organization (the “May 2021 Incident”). Promptly upon Syniverse’s detection of the unauthorized access, Syniverse launched an internal investigation, notified law enforcement, commenced remedial actions and engaged the services of specialized legal counsel and other incident response professionals. Syniverse has conducted a thorough investigation of the incident.
The results of the investigation revealed that the unauthorized access began in May 2016. Syniverse’s investigation revealed that the individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (“EDT”) environment was compromised for approximately 235 of its customers. All EDT customers have been notified and have had their credentials reset or inactivated, even if their credentials were not impacted by the incident. All customers whose credentials were impacted have been notified of that circumstance.
It’s not clear exactly how hackers were able to compromise the Syniverse network, but, for perspective, I’ve covered how the average dwell time for recent ransomware attacks is 13 days – whereas the Syniverse breach lasted 5 years (1825 days)!!! The filing does mention “All customers whose credentials were impacted have been notified of that circumstance,” which denotes that credentials were compromise and lateral movement is likely.
The potential access gained, data exfiltrated, systems misused, and damage done is incalculable – despite Syniverse’s claims that “there was no attempt to monetize the unauthorized activity.” Cyber forensics is only as good as the logging that exists and whether the threat actor worked to delete their trail.
This attack is a reminder that the best position in a data breach is to be so well-protected the breach never happens. And, given it took Syniverse’s IT team 5 years to even identify the attack, it’s also a reminder that your security strategy needs to include detection and remediation, in addition to prevention and protection.
New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn't a one and done deal, continuous training and simulated phishing are both needed to mobilize users as your last line of defense. Request your one-on-one demo of KnowBe4's security awareness training and simulated phishing platform and see how easy it can be!
