Deloitte’s Unlawful Silence of Cyber Rampage Which Imperiled Client Information

After the significant Equifax breach, which affected some 143 million people in 25 countries, they determined that their systems were breached back in July, but they only owned up to the public on September 7th.  Now Deloitte has something much more significant to reveal.

The expansive accounting firm has allegedly been under attack since March and but only chose to reveal to the media the danger that this breach posed to its clients and the public after 6 months of battling with the breach. Deloitte is one of United States’ most influential accounting and consultancy firms.  They provide auditing, tax consultancy and high-end cybersecurity advice to some of the world’s largest banks, business empires, multinational firms, media enterprises, pharmaceutical firms and government.

Deloitte generated $37 Billion revenue back in 2016.

Deloitte’s outstanding 6.5% revenue for the Audit and Enterprise Risk Services and 6.0% for consulting was all demolished by an intrusion within the firm’s email system. Its clients from many sectors have had their information accessed remotely, including household names and US government departments. Deloitte told their six clients that the breach contained their data, and the company’s internal investigation is on ongoing.

Speculations have revealed that the Deloitte siege commenced last March, but more and more hypothesize that the attackers might’ve penetrated the system as early as October last year. They accomplished this intrusion by accessing an administrator account, in itself, was insufficient of anything resembling a two-factor authentication. All of these are hosted on Microsoft’s Azure cloud service and is vulnerable to exposing a multitude of client data from passwords, IP addresses, domain credentials, insurance, and health information.

Deloitte might consider the fact due to their size they have access to the most robust defenses to avoid the attack. They have been derelict in observing what has gone through the firewall, what have been intercepted by the servers including their database server, in which vast surveillance should be imperative.

What’s more questionable is Deloitte’s way of rectifying, or should I say, concealing the issue. Deloitte decided to inform only a few partners and legal staff within the firm, and the six customers who have been affected by the breach. Within 84,940 professionals employed in the US, most of the Deloitte employees had no clue that such a colossal quagmire has taken place.

This decision might’ve crumpled Deloitte to public damnation because most US states and territories possess security breach notification laws mandating that firms promptly alert clients whenever cyber attacks occur. Deloitte could’ve been into a conundrum if these uninformed clients have been impacted by the hack, as these provisions require that firms experiencing cyber siege should report the incident “in the most expedient time possible” and “without unreasonable delay.”

In this case, with Deloitte only informing everyone else after six months- is a seriously stupid act which constitutes severe penalties if in fact, other clients are caught within the hacking manifesto. This will most likely put Deloitte out of the business track and have them doomed into lawsuit persecution. Deloitte, with all these obstinacies, refused to name the government authorities and regulators it had informed or whether they have taken a course of action to approach law enforcement agencies.

The firm is now doing the investigation to the best of their power, in collaboration with the security firms they’ve engaged to, permitting them to pinpoint the manipulated data and which was not. Deloitte’s cyber-sleuthing capabilities are held in question at this very time, considering that they’ve been hiding the breach and haven’t revealed any of their strategies to rectify the problem.

These vulnerabilities arise from two possible roots: one, most companies have no idea a breach occurred or somebody is persistently trying to probe and manipulate their system; and two, very few companies are that diligent to utilize software that meticulously monitors all traffic. This software could scour for any private or confidential information, stops it and logs everything else- which proactively saves them from future malicious intrusions.

Companies pledge to serve the good of their customers and keep their data safe. If their negligence and common security standards have fallen inferior to attackers, their customers have the right to be informed.