"The giant ransomware attack against Kaseya might have been entirely avoidable," writes Engadget: Former staff talking to Bloomberg claim they warned executives of "critical" security flaws in Kaseya's products several times between 2017 and 2020, but that the company didn't truly address them... Employees reportedly complained that Kaseya was using old code, implemented poor encryption and even failed to routinely patch software. The company's Virtual System Administrator, the remote maintenance tool that fell prey to ransomware, was supposedly rife with enough problems that workers wanted the software replaced.

One employee claimed he was fired two weeks after sending executives a 40-page briefing on security problems. Others simply left in frustration with a seeming focus on new features and releases instead of fixing basic issues. Kaseya also laid off some employees in 2018 in favor of outsourcing work to Belarus, which some staff considered a security risk given local leaders' partnerships with the Russian government.

Kaseya has declined to comment...

The company's software was reportedly used to launch ransomware at least twice between 2018 and 2019, and it didn't significantly rethink its security strategy.
Engadget adds the Kaseya's software "was reportedly used to launch ransomware at least twice between 2018 and 2019, and it didn't significantly rethink its security strategy."

Slashdot reader tinkers writes: A new study has found that older job seekers on LinkedIn receive fewer job offers than younger ones. But using a profile photo with a younger appearance reduces this effect...

The study's authors say these results reconfirm why photographs are usually absent from traditional resumes or CVs. As such, they suggest that removing photos from LinkedIn might make job-seeking fairer. The lack of photos might cause recruiters to focus more on information that is more relevant to the job.

Remote-worker incentive programs are gradually expanding beyond Hawaii, Vermont, Indiana, and Tulsa, Oklahoma. Now Charleston, West Virginia is offering a $5,000 "relocation credit" to remote workers. And Ascend WV is offering $12,000 (with a year of free whitewater rafting, rock climbing and skiing...)

Politico discussed the strategies behind luring remote workers with former Intuit CEO Brad Smith (who helped launch the Ascend WV program) and Jim Justice, the state's billionaire governor: At a news conference in April, Justice announced the launch of the program alongside a bill signing of legislation that overhauls the state's corporate income tax law that he said would make West Virginia "the most attractive state in the nation for remote workers and for all businesses." A joyful Justice called West Virginians "frogs proud of their own pond" and labeled Ascend the No. 1 remote worker relocation program in the nation...

The idea is that West Virginia can become "the start-up state," Smith explains to me on a call from his home in Menlo Park, Calif. If you can incentivize ambitious, business minded folks to give overlooked West Virginia a chance, they'll fall in love with the place and stay for good, setting off a domino effect to jumpstart the state economy by creating new businesses and hiring locally, all while giving back to the state in tax dollars along the way and reversing the population decline. And the pool of remote workers is tenfold what it was before the pandemic now that employers everywhere are changing the way they view office work, which could mean high earners will consider a place with a low cost of living where their money can go further — like West Virginia.

A key selling point for Smith is that Ascend participants won't be competing for local jobs; they already have jobs elsewhere. Instead, they'll be spending their money locally, engaging with the community and seeing a place they never would have given a chance before, Smith says... "And their income is taxed in our state, which then creates tax funds to invest in infrastructure."

Prithwiraj Choudhury, a professor at Harvard Business School who studies remote work, believes programs like Ascend can have a positive long-term impact for host cities and will be a "game changer" for places like West Virginia. The Tulsa Remote program, operated by the George Kaiser Family Foundation, has shown payoff in both income tax revenue, projecting a boost of $1.4 million in 2020, and in community engagement; many of the 300-some participants continue to volunteer locally, according to Choudhury's research. Twenty-seven homes have been purchased by Tulsa Remote workers, according to the latest count. "Work from anywhere is here to stay, and people are going to relocate both permanently and for short durations," Choudhury said. "I think policy makers and politicians should view this as an opportunity for attracting tech workers and future entrepreneurs."

That focus on making outsiders happy, though, is at the root of the criticism of programs like Ascend.

Long-time Slashdot reader AmiMoJo shared this report from the Verge: Microsoft is gifting its employees a $1,500 pandemic bonus. In an internal memo seen by The Verge, the software giant says this one-time bonus "is in recognition of the unique and challenging fiscal year that Microsoft just completed."

Microsoft's chief people officer, Kathleen Hogan, announced the gift to employees Thursday, and it will apply to all eligible employees in both the U.S. and internationally. Microsoft is gifting this bonus to all staff below corporate vice president level that started on or before March 31st, 2021, including part-time workers and those on hourly rates. Microsoft has 175,508 employees worldwide, but LinkedIn, GitHub, and ZeniMax employees are not eligible for the bonus, despite Microsoft owning these three separate companies. As a result, we understand it's a gift of around $200 million, or less than two days' worth of profit for Microsoft.
The article also notes similar gifts given to employees at Facebook, BT, and Vox Media, as well as Amazon's $300 holiday bonus to frontline workers.

And GitHub did do something special for its employees, according to the company's holiday FAQ: The pandemic brought unprecedented challenges, revolutionizing the way our customers and open source community build software. We have watched our employees step up...while also balancing the unique complexities of remote work, children, health, and more. We recognize that our employees are our greatest asset, so to give back to our employees who give so much, we will be taking company wide wellbeing days July 5-9, as well as six Fridays in July and August.

GitHub is committed to providing our customers with high-quality customer support and will have staff available to assist should an issue arise, however you may experience a delayed response during these dates.

To ensure a seamless developer experience, we recommend that you refrain from upgrading between June 28 and July 9.

Slashdot reader nray shared this report from CNET: In May, CEO Sundar Pichai unveiled plans for a "hybrid" work environment that would require most employees to work from their offices at least three days a week beginning in September. Under the new structure, 20% of the company would work remotely. Another 20% could work from new locations. People who relocated would get salary adjustments based on the local market. The bulk of Google would pick up where it left off, working from the office. Google makes up almost all of Alphabet, a holding company that has more than 135,000 full-time employees...

The rancor intensified last week, when Urs Hölzle, one of the company's longest-tenured and most senior executives, announced plans to work remotely from New Zealand, according to an email he sent to employees that was viewed by CNET. Hölzle's plans angered rank-and-file workers, who consider it special treatment for company leadership, while lower-level employees have had to wade through a drawn-out and uncertain application process... Hölzle, Google's senior vice president of technical infrastructure, is a revered figure at the company. He was one of Google's first 10 employees and is credited with building the tech giant's IT foundation of servers and networks. But for some Googlers, his relocation email, which was sent on June 29 and hasn't been previously reported, illustrated the inequities of the company's system for deciding remote work... Two Google employees said Hölzle's situation encapsulated the company's "hypocritical" policies. Both complained that the relocation represented a double standard in which different rules apply to executives in senior ranks. While his approval came last year, Google employees now undergoing the remote work application process have been told decisions won't come until August, at the earliest. Approval for Hölzle's move came before the procedure was instituted.

News of Hölzle's relocation especially stung because he has been particularly vocal against remote work, employees said. De Vesine, the resigning Googler, said Hölzle had a policy of not letting people work remotely unless they were assigned to an office and that he wouldn't consider remote work for people who hadn't reached a certain level of seniority...

It's unclear if Hölzle's salary will be adjusted to the local market, as required for other employees relocating to a new place. The Google spokesman declined to comment on his compensation.
"While some tech companies, like Reddit, have said they'll pay employees San Francisco or New York City salaries wherever they work, Google has taken a hard line on making pay adjustments..." CNET reports.

They also point out that for 20 yerars Google "has set the tone for office culture in Silicon Valley... The impact of Google's remote work policies could ripple far and wide..."

"First SolarWinds, now Kaseya. SaaS software heavily used by managed service providers (MSPs) has now been the target of two successful cyberattacks," writes Slashdot reader storagedude.

He shares a ChannelInsider article reporting the Kaseya ransomware attack compromised roughly 1,500 "downstream" businesses — and that now managed service providers "are reassessing their approaches to managing IT" after their own upstream vendors were breached: In many cases, rather than assuming the platforms that MSPs employ are secure, end customers will now require them to prove it via an audit of their software supply chains, says James Shank, Chief Architect of Community Services for Team Cymru, a provider of threat intelligence tools employed to conduct such audits. Shank, who also served on the Ransomware Task Force Committee set up by The Institute for Security and Technology, notes that MSPs should also assume attacks will only get worse before they get any better. "This is not the end or the middle," he says. "It's only the beginning."

Others, however, don't think there will be any widespread mandate to audit IT supply chains in the absence of any government requirement. Most organizations are simply not going to conduct or require extensive audits because of the time, effort, money and expertise required, says Mike Hamilton, chief information security officer (CISO) for Critical Insight, a provider of a managed detection and response platform.

"American companies are not going to do that unless someone holds their feet to the fire," he says.

The challenge that creates for MSPs and their customers is it may force them to continue to place too much trust in IT platforms provided to them by a vendor, says Chris Grove, technology evangelist for Nozomi Networks, a provider of security tools for monitoring networks. "These platforms are over-trusted," he says.

The decision many MSPs are specifically wrestling with is the degree to which they should continue to rely on IT service management (ITSM) platforms from an IT vendor that might be compromised by malware versus building and securing their own custom platform. The latter approach is not immune to malware but might be less of a target as cybercriminals increasingly focus their efforts on platforms that enable them to wreck greater downstream havoc. Alternatively, MSPs could switch to IT service management platforms provided by vendors that don't have enough market share to attract the attention of cybercriminals... Building an IT service management platform from scratch naturally requires a level of investment many MSPs lack the funding or expertise to make, notes Eldon Sprickerhoff, chief innovation officer for eSentire, a provider of a managed detection and response platform. "It's a difficult situation," he says.BR> The article points out that few small- to medium-sized businesses can afford their own internal IT security team.

Slashdot reader storagedude then suggests "on-premises installed and managed software could get another look as a result of the attacks," while vendors who can prove high levels of security "could gain a market advantage."

A few months ago PC Magazine explained eSIMs: You almost certainly have a SIM card: a thumbnail-sized chip that sits in your mobile phone, telling it which carrier and what phone number you use. Now those SIMs are going digital (or "e") and moving your information to a reprogrammable, embedded chip.

A SIM card is a "subscriber identity module." Required in all GSM, LTE, and 5G devices, it's a chip that holds your customer ID and details of how your phone can connect to its mobile network... An eSIM takes the circuitry of a SIM, solders it directly to a device's board, and makes it remotely reprogrammable through software... There are some minor consumer downsides, though. With eSIMs, it's harder to switch one plan between devices — you can't just swap the physical card around — and they can make it harder for you to temporarily remove your SIM if you don't want to be tracked by a carrier.

Google's Pixels have had eSIMs since 2017, and Apple's iPhones have had them since 2018...
Now let's see how long-time Slashdot reader shanen feels about them: Shopping for a new smartphone due to premature battery swelling of a cheapie, but surprised to find out I can't just plug the SIM into a new phone. There ain't no SIM here, but rather the dying phone has an eSIM.... Quick research indicated it's only software, so my obvious question is "How secure can an eSIM be?" (The obvious search results also fail to produce "fresh" results.)

But the black hats have already had a couple of years to work on the problem, and it seems intrinsically difficult to do anything securely if you're only using software. My probably obsolete understanding is that part of the basis of SIM security is that you'd have to destroy the SIM to save its data, but is there an actual security expert in the house?

Related question based on my surprise. How would you even know if you're using an eSIM? Especially since it appears to be possible to use an eSIM on a phone with a SIM.
Share your own thoughts and opinions in the comments.

How secure is an eSIM?

An anonymous reader shares a post: Google Chrome for Android has a feature that gives Google Search an unfair advantage over its competition. Sure, it's the default search engine and that's a huge hurdle to overcome for any competitor. However, Chrome also reserves a performance-boosting feature for Google Search exclusively. I recently poked around in the Chromium project source code; the open-source foundation for Google's Chrome web browser. The Chromium project is co-developed by Google, and other corporate and individual contributors. The project is managed and controlled by Google, however. I was looking for something else when I stumbled upon a feature called PreconnectToSearch. When enabled, the feature preemptively opens and maintains a connection to the default search engine.

The preconnection feature resolves the domain name, and negotiates and sets up a secure connection to the server. All these things take time and they must happen before the search engine can receive the users' search queries. Preempting these steps can save a dozen seconds on a slow network connection or half a second on a fast connection. This optimization can yield a nice performance boost for Google's customers. Assuming the connection only requires a trivial amount of processing power and network bandwidth, of course. Setting up the connection early can be wasteful or slow down the loading of other pages if the user isn't going to search the web. There's just one small catch: Chromium checks the default search engine setting, and only enables the feature when it's set to Google Search. This preferential treatment means no other search engine can compete with Google Search on the time it takes to load search results. Every competitor must wait until the user has started to type a search query before Chrome will establish a connection.

Microsoft is to give its non-executive staff a $1,500 bonus for their work during the pandemic. From a report: The company told the BBC it was a symbol of appreciation "during a uniquely challenging year." It added: "We are proud to recognise our employees with a one-time monetary gift." In the first quarter of 2021 Microsoft's profits rose 38% on the same period last year. The Verge reported that employees below vice-president level who joined no later than 31 March 2021 would receive the payment, including part-time workers. The big tech firms have done well during the pandemic and Microsoft is not the only firm to have made bonus payments to staff. In March 2020, Facebook gave employees a $1,000 bonus to help them with increased expenses caused by the pandemic, such as those associated with setting up a home office. Google made a similar $1,000 payment in May 2020. In December, Amazon gave front-line employees a $300 dollar bonus with part-time workers receiving $150.

Ministers back down after hundreds of government offices insist banishing fax would be impossible. From a report: Most bureaucrats might be expected to welcome the chance to be freed from the tyranny of the fax machine. But in Japan, government plans to send the must-have item of 1980s office equipment the way of telex have in effect been scrapped after they encountered resistance from "faxophile" officials. A cabinet body that promotes administrative reform said in June it had decided to abolish the use of fax machines "as a rule" by the end of the month and switch to emails at ministries and agencies in the Tokyo district of Kasumigaseki, Japan's bureaucratic nerve centre. The move would enable more people to work from home, it said, citing concerns that too many people were still going to the office during the coronavirus pandemic to send and receive faxes. Exceptions would be made for disaster response and interactions with the public and businesses that had traditionally depended on faxes. Instead of embracing the digital age, however, hundreds of government offices mounted a defence of the much-maligned machine, insisting that banishing them would be "impossible," according to the Hokkaido Shimbun newspaper.

The backlash has forced the government to abandon its mission to turn officialdom into a digital-only operation, the newspaper said on Wednesday. Members of the resistance said there were concerns over the security of sensitive information and "anxiety over the communication environment" if, as the government had requested, they switched exclusively to email. Japanese ministries and agencies use faxes when handling highly confidential information, including court procedures and police work, and the Hokkaido Shimbun said there were fears that exclusively online communication would result in security lapses. "Although many ministries and agencies may have stopped using fax machines, I can't say with pride that we managed to get rid of most of them," an official at the cabinet body told the newspaper.

A potential cyber attack on Iran's state railway company created "unprecedented chaos" at stations across the country and led to cancellations and delays on hundreds of lines, state TV reported. From a report: Departure notice boards showed blanket cancellations and carried the message "long delay following cyber attack," the national broadcaster said, adding that the disruption to Islamic Republic of Iran Railways' computer systems also affected station entrances and exits as well as ticket booths. The national rail company's website, www.rai.ir, wasn't loading as of 7.50 p.m. in Tehran. Iranian state TV didn't say where it got the information.

Microsoft awarded $13.6 million to security researchers in the past 12 months, From a report: Microsoft said it awarded more than $13.6 million as monetary rewards to security researchers through its public bug bounty programs over the past 12 months. According to Microsoft:
The funds were awarded for 1,261 bugs reported by 341 security researchers across 17 bug bounty platforms between July 1, 2020 and June 30, 2021.

The highest awarded bounty was $200,000 for a vulnerability reported in Hyper-V, Microsoft's OS virtualization technology.
The average bounty was more than $10,000 per valid bug report across all programs.
Most bug reports came from researchers residing in China, the US, and Israel.
The company said it plans to announce the 2021 Most Valuable Security Researcher next month.
The sum awarded this year is identical to what Microsoft reported one year ago when the company said it awarded $13.7 million to 327 security researchers for 1,226 vulnerability reports across 15 bug bounty programs in the previous 12 months (July 1, 2019 to June 30, 2020).

An anonymous reader quotes a report from ZDNet: Suppose you are in the business of generating passwords, it would probably be a good idea to use an additional source of entropy other than the current time, but for a long time, that's all Kaspersky Password Manager (KPM) used. In a blog post to cap off an almost two year saga, Ledger Donjon head of security research Jean-Baptiste Bedrune showed KPM was doing just that. "Kaspersky Password Manager used a complex method to generate its passwords. This method aimed to create passwords hard to break for standard password crackers. However, such method lowers the strength of the generated passwords against dedicated tools," Bedrune wrote.

One of the techniques used by KPM was to make letters that are not often used appear more frequently, which Bedrune said was probably an attempt to trick password cracking tools. "Their password cracking method relies on the fact that there are probably 'e' and 'a' in a password created by a human than 'x' or 'j', or that the bigrams 'th' and 'he' will appear much more often than 'qx' or 'zr'," he said. "Passwords generated by KPM will be, on average, far in the list of candidate passwords tested by these tools. If an attacker tries to crack a list of passwords generated by KPM, he will probably wait quite a long time until the first one is found. This is quite clever." The flip side was that if an attacker could deduce that KPM was used, then the bias in the password generator started to work against it.

"If an attacker knows a person uses KPM, he will be able to break his password much more easily than a fully random password. Our recommendation is, however, to generate random passwords long enough to be too strong to be broken by a tool." The big mistake made by KPM though was using the current system time in seconds as the seed into a Mersenne Twister pseudorandom number generator. "It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second," Bedrune said. Because the program has an animation that takes longer than a second when a password is created, Bedrune said it could be why this issue was not discovered. "The consequences are obviously bad: every password could be bruteforced," he said. Bedrune added due to sites often showing account creation time, that would leave KPM users vulnerable to a bruteforce attack of around 100 possible passwords. "Kaspersky was informed of the vulnerability in June 2019, and released the fix version in October that same year," adds ZDNet. "In October 2020, users were notified that some passwords would need to be generated, with Kaspersky publishing its security advisory on 27 April 2021."

"All public versions of Kaspersky Password Manager liable to this issue now have a new logic of password generation and a passwords update alert for cases when a generated password is probably not strong enough," the security company said.

In a few weeks, Firefox will start the by-default rollout of DNS over HTTPS (or DoH for short) to its Canadian users in partnership with local DoH provider CIRA, the Canadian Internet Registration Authority. From a report: DoH will first become a default for 1% of Canadian Firefox users on July 20 and will gradually reach 100% of Canadian Firefox users in late September 2021 -- thereby further increasing their security and privacy online. This follows the by-default rollout of DoH to US users in February 2020. As part of the rollout, CIRA joins Mozilla's Trusted Recursive Resolver (TRR) Program and becomes the first internet registration authority and the first Canadian organization to provide Canadian Firefox users with private and secure encrypted Domain Name System (DNS) services.

The computer code behind the massive ransomware attack by the Russian-speaking hacking ring REvil was written so that the malware avoids systems that primarily use Russian or related languages, according to a new report by a cybersecurity firm. NBC News reports: It's long been known that some malicious software includes this feature, but the report by Trustwave SpiderLabs, obtained exclusively by NBC News, appears to be the first to publicly identify it as an element of the latest attack, which is believed to be the largest ransomware campaign ever. "They don't want to annoy the local authorities, and they know they will be able to run their business much longer if they do it this way," said Ziv Mador, Trustwave SpiderLabs' vice president of security research.

Trustwave said the ransomware "avoids systems that have default languages from what was the USSR region. This includes Russian, Ukrainian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, Tatar, Romanian, Russian Moldova, Syriac, and Syriac Arabic." In May, cybersecurity expert Brian Krebs noted that ransomware by DarkSide, the Russia-based group that attacked Colonial Pipeline in May, "has a hard-coded do-not-install list of countries," including Russia and former Soviet satellites that mostly have favorable relations with the Kremlin. In general, criminal ransomware groups are allowed to operate with impunity inside Russia and other former Soviet states as long as they focus their attacks on the United States and the West, experts say. Krebs noted that in some cases, the mere installation of a Russian language virtual keyboard on a computer running Microsoft Windows will cause malware to bypass that machine.

A cyber-espionage group has been observed targeting Indian targets with government and military-related lures in a broad campaign to infect victims with malware. From a report: Tracked under the name of SideCopy, this cyber-espionage group has been active since 2019, according to Seqrite, Quick Heal's threat intelligence team, which first documented its spear-phishing campaigns last September. But in a report published today, Cisco Talos, one of the networking giant's cybersecurity divisions, said the group did not retreat or stop its operations after having its attacks and tooling exposed last year.

Just days after its launch, hackers have already found a way to take advantage of GETTR's buggy API to get the username, email address, and location of thousands of users. Motherboard reports: Hackers were able to scrape the email addresses and other data of more than 90,000 GETTR users. On Tuesday, a user of a notorious hacking forum posted a database that they claimed was a scrape of all users of GETTR, the new social media platform launched last week by Trump's former spokesman Jason Miller, who pitched it as an alternative to "cancel culture." The data seen by Motherboard includes email addresses, usernames, status, and location. One of the people whose email is in the database confirmed to Motherboard that they are indeed registered to GETTR. Motherboard also verified the database by attempting to create an account with three email addresses that appear in the database. When doing that, the site displayed the message: "The email is taken," suggesting it's already registered. It's unclear if the database contains the usernames and email addresses of all users on the site. Alon Gal, the co-founder and CTO of cybersecurity firm Hudson Rock, found the forum post with the database. "When threat actors are able to extract sensitive information due to neglectful API implementations, the consequence is equivalent to a data breach and should be handled accordingly by the firm and to be examined by regulators," he told Motherboard in an online chat.

Russian government hackers breached the computer systems of the Republican National Committee last week, around the time a Russia-linked criminal group unleashed a massive ransomware attack, Bloomberg News reported Tuesday, citing two people familiar with the matter. From the report: The government hackers were part of a group known as APT 29 or Cozy Bear, according to the people. That group has been tied to Russia's foreign intelligence service and has previously been accused of breaching the Democratic National Committee in 2016, and of carrying out a supply-chain cyberattack involving SolarWinds Corp., which infiltrated nine U.S. government agencies and was disclosed in December. It's not known what data the hackers viewed or stole, if anything. An RNC spokesman on Tuesday denied its systems were breached and referred to an earlier statement.

"Microsoft informed us that one of our vendors, Synnex, systems may have been exposed," Mike Reed, a spokesman for the RNC, said on Saturday. "There is no indication the RNC was hacked or any RNC information was stolen. We are investigating the matter and have informed DHS and the FBI." The attack on the RNC, coupled with the recent ransomware attack, is a major provocation to President Joe Biden, who warned Russian President Vladimir Putin about cyberattacks at a June 16 summit. It's not clear if the attack on the RNC is connected in any way to the ransomware attacks, which exploited multiple previously unknown vulnerabilities in software from Miami-based Kaseya Ltd.

Weeks before Didi went public in the U.S., China's cybersecurity watchdog suggested the Chinese ride-hailing giant delay its initial public offering and urged it to conduct a thorough self-examination of its network security, WSJ reported Monday, citing people with knowledge of the matter. From a report: But for Didi, waiting would be problematic. In the absence of an outright order to halt the IPO, it went ahead. The company, facing investor pressure to list after raising billions of dollars from prominent venture capitalists, wrapped up its pre-offering "roadshow" in a matter of days in June -- much shorter than typical investor pitches made by Chinese firms. The listing on the New York Stock Exchange raised about $4.4 billion, making it the biggest stock sale for a Chinese company since Alibaba's IPO in 2014.

Back in Beijing, officials, especially those at the Cyberspace Administration of China, remained wary of the ride-hailing company's troves of data potentially falling into foreign hands as a result of greater public disclosure associated with a U.S. listing, the people said. Didi's American depositary shares began trading in New York on Wednesday, just a day before the ruling Communist Party celebrated its centenary.

It's now being called "the single biggest global ransomware attack on record," with thousands of victims in at least 17 different countries breached with ransomware Friday, reports the Associated Press, citing new details provided by cybersecurity researchers.

An affiliate of the Russia-linked gang REvil deployed the ransomware "largely through firms that remotely manage IT infrastructure for multiple customers." A broad array of businesses and public agencies were hit by the latest attack, apparently on all continents, including in financial services, travel and leisure and the public sector — though few large companies, the cybersecurity firm Sophos reported... The Swedish grocery chain Coop said most of its 800 stores would be closed for a second day Sunday because their cash register software supplier was crippled. A Swedish pharmacy chain, gas station chain, the state railway and public broadcaster SVT were also hit. In Germany, an unnamed IT services company told authorities several thousand of its customers were compromised, the news agency dpa reported...

CEO Fred Voccola of the breached software company, Kaseya, estimated the victim number in the low thousands, mostly small businesses like "dental practices, architecture firms, plastic surgery centers, libraries, things like that." Voccola said in an interview that only between 50-60 of the company's 37,000 customers were compromised. But 70% were managed service providers who use the company's hacked VSA software to manage multiple customers. It automates the installation of software and security updates and manages backups and other vital tasks...

Dutch researchers said they alerted Miami-based Kaseya to the breach and said the criminals used a "zero day," the industry term for a previously unknown security hole in software. Voccola would not confirm that or offer details of the breach — except to say that it was not phishing. "The level of sophistication here was extraordinary," he said. When the cybersecurity firm Mandiant finishes its investigation, Voccola said he is confident it will show that the criminals didn't just violate Kaseya code in breaking into his network but also exploited vulnerabilities in third-party software...

Kaseya, which called on customers Friday to shut down their VSA servers immediately, said Sunday it hoped to have a patch in the next few days.
The attacks may have been timed to exploit America's three-day weekend celebrating the nation's founding, according to experts interviewed by the Associated Press. America's National Security advisor is now urging all who believed they were compromised to alert the FBI.

"The attack comes less than a month after Biden pressed Russian President Vladimir Putin to stop providing safe haven to REvil and other ransomware gangs whose unrelenting extortionary attacks the U.S. deems a national security threat."

UPDATE: Bleeping Computer notes the exploited vulnerability "had been previously disclosed to Kaseya by security researchers from the Dutch Institute for Vulnerability Disclosure (DIVD), and Kaseya was validating the patch before they rolled it out to customers."

In a statement today, DIVD posted that "During the last 48 hours, the number of Kaseya VSA instances that are reachable from the internet has dropped from over 2,200 to less than 140 in our last scan today... A good demonstration of how a cooperative network of security-minded organizations can be very effective during a nasty crisis."