November 2024 - CORSA-broadcast

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

Holiday Loss Control Tips
by Frank Hatfield Nov. 25, 2024

Nov. 25, 2024

The holiday season is here. We wish you a happy and safe season. Please take a moment to plan for a safe holiday season in the following three areas: 1. At your facilities; 2. In the cyber universe; and 3. on the roadway. Below and attached are general tips to assist with your preparation, with links to more information. As always, feel free to contact Jim Hale or myself regarding CORSA loss control resources. We wish you, your peers, friends and family a happy and safe holiday season. PREPAR FOR HOLIDAY CYBER ATTACKS: Attackers strike the most during holidays and weekends when companies are vulnerable and understaffed. ⚠️ Attacks are more common during non-business hours, mostly due to less staff available to protect the company. ⚠️ Large, profitable companies tend to be the main targets but small businesses with less protection are also a target. ⚠️The attacks that occur during non-business hours take longer to investigate and resolve, which may slow response and notification. Action Items Protect your organization with these practices: ✅ Review cyber incident response plans, resiliency plans, and communications plans. ✅ Reiterate cybersecurity user awareness and training program tips that include guidance on how to report incidents. ✅ Tune endpoint protection, regularly update, and enable real-time detection for antivirus software on all hosts. ✅ Make (and test restore) an offline backup of your data. ✅ Confirm multi-factor authentication (MFA) is working as intended for all services possible. ✅ Confirm software and operating systems are up to date to download the latest security patches. ✅ Scan for open and unused ports and remove any application not deemed necessary for day-to-day operations. ✅ Add an email banner to emails received from outside your organization to warn employees. More Information 🔒 FBI - Ransomware Awareness for Holidays and Weekends https://www.cisa.gov/uscert/ncas/alerts/aa21-243a 🔒 Why do cyber-attacks increase during holidays? - Security Boulevard https://securityboulevard.com/2022/12/why-do-cyber-attacks-increase-during-… https://www.linkedin.com/pulse/prepare-now-holiday-weekend-cyberattacks-ris… PREPARE FOR HOLIDAY TRAVEL ON AND OFF THE JOB More Than 502 People May Die in Preventable Traffic Crashes Over Thanksgiving https://www.prnewswire.com/news-releases/more-than-502-people-may-die-in-pr… National Safety Council urges all drivers to share the road responsibly by following these safety tips during this holiday season—and always: * Prepare before you go: Before hitting the road, make sure your car is safe for driving. Vehicle owners should check the oil, put air in the tires, and check for and repair open recalls. Visit ChecktoPrtect.org<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=181857447&u=https%3A%2F%2Fw…> to see if your vehicle has an open recall, and get it repaired for free. * Buckle up: Lack of seat belt use is a top cause of fatalities in crashes. Buckle up, while also making sure you have appropriate car seats installed correctly<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=3783644550&u=https%3A%2F%2F…>. * Designate a sober driver or arrange alternate transportation: Holidays are a cause for celebration, but alcohol is only one cause of impaired driving. Drugs, including opioids, marijuana and some over-the-counter medicines, can cause drowsiness, alter visual functions and affect mental judgment and motor skills. * Slow down: Speeding is a factor in more than a quarter of all traffic fatalities<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=795979627&u=https%3A%2F%2Fi…>. Drive the speed limit or below it if conditions dictate. Be sure to pay close attention to those walking and biking in order to keep all road users safe. * Drive distraction-free: Thousands have died in car crashes involving cell phone use. Put your phones away and #JustDrive. * Look before you lock: Pediatric vehicular heatstroke is still the leading cause of non-crash motor vehicle-related fatality for children. So far in 2023, 19 children in the U.S. are reported to have died<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=1235261407&u=https%3A%2F%2F…> because of this completely preventable tragedy. Always check your back seat for children or animals when you reach your destination. PREPARE FOR YOUR FACILITIES FOR THE HOLIDAYS See attached. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.” CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

U.S. Department of Health and Human Services Issues First Enforcement Action Under HIPAA Security Rule Risk Analysis Initiative
by Frank Hatfield Nov. 13, 2024

Nov. 13, 2024

County governments that are regulated in whole or in part by HIPAA need to be aware of a recent enforcement action against a county ambulance authority which was clearly designed to put counties big and small on notice of the importance of paying close attention to the Security Rule requirements under HIPAA. Attached please find a Cybersecurity, Data Protection & Privacy Update. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> [cid:image001.png@01DB35E3.9CFDD210] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Ohio State Highway Patrol Warns of Increased Deer-Involved Crashes During Fall Months
by Jim Hale Nov. 13, 2024

Nov. 13, 2024

OSHP Crash Dashboard set to Deer-Related crashes for the period of 1/1/2019 to 11/12/2024 [cid:image001.jpg@01DB35AF.9B0F4620] OSHP Crash Dashboard: https://statepatrol.ohio.gov/dashboards-statistics/ostats-dashboards/crash-… The Ohio State Highway Patrol (OSHP) is urging motorists to be especially cautious during the fall months as deer-related crashes rise significantly. Since 2019, there have been 109,507 deer-involved crashes on Ohio roadways. While most of these crashes-95%-resulted in only property damage, there have been 44 fatal crashes, leading to 45 deaths. The majority of deer crashes occur during the fall. From 2019 to 2023, nearly half (47%) of these crashes happened in October, November, and December, with November accounting for 22% of all deer-related incidents. Colonel Charles A. Jones, Patrol Superintendent, advised drivers to stay focused and practice safe driving habits. "Practicing safe driving habits and staying fully focused on the road increases your chances of spotting deer before it's too late," he said. "If you do strike a deer, prioritize your safety by moving to a secure location, turning on your hazard lights, and reporting the incident." The counties with the highest number of deer-related crashes include Stark (3,138 crashes), Richland (2,880), Hancock (2,725), and Defiance (2,560), which together account for 10% of all deer-involved crashes in Ohio. Additionally, more than 100 deer crashes have occurred in nearly every county across the state since 2019. To reduce the risk of a collision with wildlife, OSHP recommends the following tips: * *Scan the road ahead for wildlife, especially in rural areas. * Use high-beam headlights when possible, as they help to illuminate the road further. * Be extra cautious at dawn and dusk, when deer are most active. * If a collision is unavoidable, brake firmly but do not swerve as this can cause you to lose control of your vehicle. Motorists are also reminded that they can dial #677 from their mobile phones to reach the nearest Ohio State Highway Patrol post in the event of an emergency on the road. For more detailed crash statistics, including a statistical map of deer-involved incidents, visit the Ohio State Highway Patrol's OSTATS Dashboard<https://statepatrol.ohio.gov/dashboards-statistics/ostats-dashboards>, which provides data on traffic safety and crash trends across the state. Stay alert, drive safely, and help reduce the number of deer-related accidents this season. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets."

1 0

Driving & Drug policies
by Dawn Fry Nov. 12, 2024

Nov. 12, 2024

Good morning, I was wondering what other counties have for their driving and drug policies? If you'd be willing to share both driving and drug policies? We are interested in knowing when and who they test including post-accident and if any modifications have been made to who would not apply if medical marijuana was used by an employee. For example anyone not safety sensitive, driving on behalf of the county, etc. Thanks, [Dawn's Signature (002)]

2 1

Don't Inadvertently Give Email Access to Bad Actors
by Frank Hatfield Nov. 7, 2024

Nov. 7, 2024

Halloween has passed, but there's plenty of spooky things lurking online where we live a good portion of our lives these days. The data cookies we create online may give bad actors access to our email and, as we all know, theft by way of business email compromise is on the rise. We can expect criminal activity to increase during the holiday season. Below is an FBI press release issued this week on this topic and recommendation on how to reduce the risk of you and your county/agency from falling victim. As always, please be safe and feel free to contact us regarding CORSA loss control services. Frank Cybercriminals Are Stealing Cookies to Bypass Multifactor Authentication The FBI Atlanta Division is warning the public that cybercriminals are gaining access to email accounts by stealing cookies from a victim's computer. A "cookie" is a small piece of data that a website sends to your computer, allowing the website to remember information about your session, such as login details, preferences, or items in your shopping cart. "Remember-Me cookies" are tied specifically to a user's login and often last for 30 days before expiring. This type of cookie helps a user login without having to keep putting in their username, password, or their multifactor authentication (MFA). Typically, this type of cookie is generated when a user clicks the "Remember this device" checkbox when logging in to a website: [Atlanta Remember This Device Screenshot] If a cybercriminal obtains the Remember-Me cookie from a user's recent login to their web email, they can use that cookie to sign-in as the user without needing their username, password, or multifactor authentication (MFA). For these reasons, cybercriminals are increasingly focused on stealing Remember-Me cookies and using them as their preferred way of accessing a victim's email. Victims unknowingly provide their cookies to cybercriminals when they visit suspicious websites or click on phishing links that download malicious software onto their computer Here are tips to protect yourself from putting yourself at risk: * Regularly clear your cookies from your Internet browser. * Recognize the risks of clicking the "Remember Me" checkbox when logging into a website. * Do not click on suspicious links or websites. Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission. * Periodically monitor the recent device login history from your account settings. Anyone who is a victim of an account takeover or Internet scam should report it to the FBI Internet Crime Complaint Center (IC3) at www.ic3.gov<http://www.ic3.gov/>. https://www.fbi.gov/contact-us/field-offices/atlanta/news/cybercriminals-ar… Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> [cid:image002.png@01DB30DB.5D4A40C0] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0