.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
Know Your Breach: GM
May 27, 2022 11:42:42 AM
The Target: General Motors, a U.S based automobile company.
The Take: Exposure of Personally Identifiable Information including: first and last names, email address, physical address, username, phone numbers, profile picture, and usable reward point balance.
The Vector: Through a credential stuffing attack, the threat actors leveraged customer’s unsecure passwords already exposed through other means and were able to access user’s GM customer accounts. While banking information was not exposed, customer reward-card balances were freely able to be accessed and were used by the attackers to fraudulently redeem rewards.
This breach is a stark reminder that credential hygiene is an important piece in an overall robust cybersecurity posture. Enforcing multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
