Up until recently Panama was associated with a canal , hats and cigars…..it is now known for one of the biggest data breaches ever known – the Panama Papers.
What are the Panama Papers?
These are a leaked set of 11.50 million confidential documents that provide details of approximately 214,000 offshore companies listed by Panamanian law firm Mossack Fonseca. This information contained identities of shareholders and directors of these companies and showed the wealth of high profile individuals , including the assets that were hidden from the public. Individuals included past and current heads of states, government officials and celebrities from over 40 countries. Investigations have now determined some of the companies may have been utilized for various illegal purposes.
The Panama Papers far exceeds the previous highest data breach record previously held by Wikileaks by 1500 times.
How did this happen?
An anonymous source know as “John Doe” passed the documents to German newspaper Suddeutsche Zeitung which it is understood commenced at the beginning of 2015. The quantum of data involved was 2.6 terabytes which is a vast amount of data In view of the amount of data involved the newspaper recruited the assistance of the International Consortium of Investigative Journalists (ICIJ) which distributed all the documents so that they could be investigated by various journalists and media organizations around the world. The first documents were published on 3rd April. The ICIJ will issue a full list in May of all the companies involved.
What was the cause of this huge data leak ?
There are a number of different schools of thought as to whether this was due to an insider or outsider hacker attack , but one thing that is certain is that Mossack Fonseca did appear to have very poor cyber security procedures in place.
This has been evidenced by some of the following cyber security flaws that have since been discovered:-
- The Outlook Web Access login had been utilized since 2009 with the client login not being updated since 2013
- The computer systems included a high risk SQL injection vulnerability that allows anyone to remotely execute arbitrary instructions.
- The main computer system included a version of WordPress that was three months out of date.
- Configuration of the website was not recognized as best practice.
- Mossack Fonseca’s e-mails were not encrypted
- The systems were vulnerable to external scanning and possible exploitation
With the amount of data involved it is believed that it took about one year for the data to arrive at its destination. It is a wonder that no one noticed this amount of data leaving the company ? Interestingly enough very few US citizens were listed in the papers , which may be due to the fact that the US does have different corporate tax structures which negates the need for offshore tax arrangements.
www.wired.co.uk The security flaws at the heart of the Panama papers
Why was Mossack Fonseca targeted ?
Legal firms hold a great deal of data on their clients including copies of personal data , confidential documents and legal transactions which does make them a prominent target for hackers. A high profile legal practice such as Mossack Fonseca involved in the areas that they practiced in therefore represents an ideal victim to a hacker.
With the poor cyber security procedures in place it does perhaps suggest that this data compromise may have come from an insider hacker who knew the computer systems and perhaps an employee with a point to make or an overarching grudge.
Reputational damage is also a consequence of a breach of this nature , another possible reason for the this attack. which sometimes causes irreversible damage to a firm.
What could have prevented this data breach?
In the current climate no one business or individual is 100% secure from a cyber security breach but certain procedures seemed to be absent from what would be expected to be standard cyber security risk management procedures:-
- Prioritising of cyber security
- Regular patching of software
- Updating of software
- Regular login updating
- Encryption of all sensitive documents
- Website security
How Cyber Insurance could have helped ?
A cyber insurance policy can provide the following coverage.
- Data breach costs incurred including notification costs to the appropriate regulatory bodies
- Regulatory costs and investigations that may arise as a result of the breach
- Post breach costs including investigation and forensics costs incurred to monitor and analyse the data breach which would help identify the cause of the incident.
The proposal for cyber insurance also requires certain minimum security measures to be in place at the onset prior to the policy incepting , the purchase of a cyber insurance policy therefore may have help Mossack Fonseca focus on certain areas of cyber security that may have prevented the hacker to penetrate their computer systems.
From the wider perspective the insurance market is assessing its exposure by gathering data from insurers and reinsurers in order to ascertain the consequences of this loss to the industry. One thing for sure is that insurance coverage would not respond to any illegal activities.
General Data Protection Regulations
Despite being passed the GDPR are not yet in force , but what would have been the ramifications of this on Mossack Fonseca.. ? These rules will apply to entities that carry out business with companies based in the EEC , whether the complicated legal structures put in place by Mossack Fonseca would have implicated by this is difficult to tell , but fines of 4% of annual global turnover or E20,000,000 , which ever is the less would apply if this was the case.
Lessons to be learned
- Robust cyber security measures and procedures are paramount to a business armoury in protecting their mere existence.
- Law firms will be alerted to this data breach and with recent attacks in the US , this sector is clearly currently a target for hackers
- Cyber Insurance can help improve cyber security and mitigate the effects of a data breach
The biggest data breach ever experienced is still being uncovered, further revelations will no doubt come to light in the coming months… the cigar is still smoudering.