Recent Cyber Security Breaches: Montcler, RR Donnelly, and More

As a managed IT service provider it is important to us to make sure to stay in know about the latest cyber security breaches. Every few weeks we like to share our findings with you here on our blog. Please take a peek below to learn more about some of the most recent cyber security attacks here and around the world.

City of Tenino, Washington (United States)

Municipality

The Hack: Phishing/BEC

Quick Summary: “The City of Tenino, Washington is down $280,309 in public funds according to the Washington State Auditor’s Office after a city employee fell for a phishing message that launched a business email compromise scam. Reports say that former Clerk Treasurer John Millard fell victim to a phishing message and paid cybercriminals a boatload of money, some without city council approval. The official reportedly initiated 20 automated clearing house payments from the city’s bank account to multiple out-of-state bank accounts. News outlets are also reporting that a warning was sent out to clerks about the phishing scam immediately but that didn’t stop this disaster from happening.” -ID Agent

The International Red Cross (Switzerland)

Humanitarian Aid Organization

The Hack: Third Party/Supply Chain

Quick Summary: “The International Committee of the Red Cross has revealed that hackers have stolen data from a Swiss contractor that stores it for them. The stolen data includes information about over 515,000 highly vulnerable people that it has served, recipients of aid and services from at least 60 affiliates of the organization worldwide. The Red Cross says it typically reunites 12 missing people with their families every day through that program. As a result of this cyberattack, The International Red Cross has been forced to temporarily halt a program that reunites families torn apart by violence, migration or other tragedies. A spokesperson for the ICRC told news outlets that there have been no demands from the hackers in exchange for stolen data and that they were working with specialized firms to recover.” -ID Agent

RR Donnelly (United States)

Marketing & Communications Firm

The Hack: Ransomware

Quick Summary: “Major marketing company RR Donnelly has disclosed that they had data stolen in a December cyberattack attributed to ransomware. The Conti ransomware group is suspected to be to blame. In the attack on December 27, 2021, the company experienced a systems intrusion that led it to shut down its network to prevent the attack’s spread. That led to disruptions for customers, with some unable to receive printed documents required for vendor payments, disbursement checks and motor vehicle documentation. The Conti ransomware gang claimed responsibility on January 15 and began leaking 2.5GB of the stolen data that has since been removed.” -ID Agent

Montcler (Italy)

Luxury Fashion & Outerwear

The Hack: Ransomware

Quick Summary: “Luxury retailer Montcler has disclosed that it suffered a data breach in December 2021 after data began appearing on a cybercriminal leak site. The company confirmed that some data related to its employees, former employees, suppliers, consultants, business partners, and customers was stolen and subsequently leaked after they refused to pay the demanded $3 million ransom. The AlphaV (BlackCat) ransomware operation has claimed responsibility. The stolen data is said to include earning statements, spreadsheets with what appears to be customer information, invoices and other documents, but no specifics were provided.” -ID Agent

Strategic Benefits Advisors, Inc (United States)

Human Resources Consulting Firm

The Hack: Hacking

Quick Summary: “In a recent legal filing, Strategic Benefits Advisors disclosed that an unauthorized third party had gained access to its data and may have removed several files containing consumer information. The Georgia-based company provides full-service employee benefits consulting for companies in many industries.” -ID Agent

Bank Indonesia (Indonesia)

Financial Institution

The Hack: Ransomware

Quick Summary: “Bank Indonesia (BI), the central bank of the Republic of Indonesia, confirmed that a ransomware attack hit its networks last month. In a statement, BI said that their operational activities were not disrupted. CNN reported that the hackers made off with non-critical data belonging to Bank Indonesia employees before deploying ransomware payloads on over a dozen systems on the bank’s network. Conti has claimed responsibility. It claims to have 13.88 GB worth of documents and leaked a sample of files allegedly stolen from Bank Indonesia’s network as proof.” -ID Agent

To learn more about how to keep your company safe and secure from cyber security attacks, click here to explore our San Diego IT Services & IT Security plans that are offered by SDTEK.

June 17, 2025
Meeting IT security compliance standards is crucial for businesses that handle sensitive data, particularly in industries such as healthcare, finance, defense, and e-commerce. Regulatory frameworks such as HIPAA, CMMC, PCI-DSS, and GDPR exist to help ensure businesses protect customer information and maintain robust cybersecurity practices. Unfortunately, many organizations fall short of these requirements, often due to common, avoidable mistakes. These gaps can result in costly fines, data breaches, and reputational damage, which can significantly impact the business's bottom line and customer trust. 1. Failing to Conduct Regular Risk Assessments The Pitfall: Many businesses overlook the importance of conducting routine risk assessments. Without these, it’s challenging to identify vulnerabilities or evaluate whether your current cybersecurity controls meet compliance standards. How to Avoid It: Implement a regular risk assessment schedule. Work with a qualified IT provider to evaluate your systems, identify weaknesses, and document remediation plans. These assessments should be performed at least annually, or whenever significant changes to the system occur. 2. Inadequate Employee Training The Pitfall: Your employees are your first line of defense—and often your most significant vulnerability. A common compliance issue arises when businesses fail to train staff on cybersecurity best practices or on handling sensitive data appropriately. How to Avoid It: Invest in ongoing cybersecurity awareness training. Ensure employees understand how to recognize phishing emails, create strong passwords, and report any suspicious activity. Training should be updated regularly to reflect current threats and compliance requirements. 3. Improper Data Handling and Storage The Pitfall: Storing sensitive data in unsecured locations, failing to encrypt information, or retaining data longer than necessary are significant compliance risks. These practices are often flagged during audits. How to Avoid It: Adopt data classification policies that define how different types of data should be handled; encrypt sensitive data both at rest and in transit. Establish clear data retention policies and ensure that obsolete data is disposed of securely. 4. Lack of Incident Response Planning The Pitfall: When a security incident occurs, time is of the essence. Many businesses lack a documented incident response plan, or their existing plan hasn’t been thoroughly tested. This can lead to delayed responses, increased damage, and regulatory penalties. How to Avoid It: Develop a formal incident response plan that includes roles, responsibilities, communication protocols, and steps for containment and recovery. Run simulated breach scenarios with your IT team to ensure everyone knows how to respond effectively. 5. Using Outdated Software or Systems The Pitfall: Running outdated operating systems, software, or firmware is a common issue that can lead to compliance failures. Unsupported technologies are more vulnerable to exploitation. How to Avoid It: Keep all systems and applications up to date with the latest patches. Use automated tools to track software versions and receive alerts about end-of-life technologies. Schedule regular maintenance windows to apply updates and upgrades. 6. Insufficient Access Controls The Pitfall: Allowing too many employees access to sensitive data—or failing to revoke access when it’s no longer needed—can lead to data breaches and non-compliance. How to Avoid It: Implement role-based access controls and follow the principle of least privilege. This principle means that each user should have the minimum level of access necessary to perform their job. Regularly audit user accounts and permissions to ensure access is current and appropriate. Use multi-factor authentication (MFA) to add an additional layer of protection. 7. Neglecting Third-Party Vendor Risks The Pitfall: Businesses often overlook the fact that their compliance responsibilities extend to third-party vendors. If a vendor mishandles your data, you could still be held accountable. How to Avoid It: Vet third-party vendors carefully. Ensure they meet the same compliance standards as your business and include security requirements in your contracts. Conduct periodic audits or request compliance certifications from your vendors. 8. Failing to Document Policies and Procedures The Pitfall: Even if your security practices are strong, failing to document your compliance policies can result in audit failures. Regulators want to see evidence that you have formal processes in place. How to Avoid It: Create and maintain clear documentation for all compliance-related policies, including data protection, access control, incident response, and employee training. Make these documents easily accessible for audits and regularly review them to ensure updates are current. Conclusion Compliance with IT security standards is not a one-time project—it requires ongoing attention, regular updates, and a proactive approach to maintain effectiveness. By understanding and addressing these common pitfalls, your business can stay ahead of regulatory requirements, strengthen its security posture, and reduce the risk of costly incidents. This ongoing attention is crucial to maintaining your business's security and audit readiness. If you’re unsure whether your business is meeting current IT compliance standards, professional support can help. Contact SDTEK today to schedule a compliance assessment and learn how our IT services can keep your business secure and audit-ready. With our support, you can navigate the complex landscape of IT security compliance with confidence.
April 9, 2025
In today’s digital-first world, cybersecurity isn’t just a luxury—it’s a necessity. Whether you run a small startup or a growing enterprise in Fort Wayne , protecting your business’s data, systems, and clients is essential for long-term success. From ransomware attacks to phishing scams, cyber threats are evolving every day, and the best way to stay ahead of them is by partnering with a reliable IT services provider that understands the unique needs of local businesses. Here’s why investing in professional business IT support is one of the smartest decisions Fort Wayne businesses can make—and how working with SDTEK helps protect your operations, your data, and your reputation.