Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

VA Data Loss Worse Than Expected

A bad situation just got worse, according to wire reports

Hirings and firings continued at the U.S. Department of Veterans Affairs yesterday. New information revealed that the agency lost even more data than originally reported. (See VA Reports Massive Data Theft.)

The VA said it has "begun implementing the procedures necessary" to dismiss the data analyst who violated policy by taking home the records, which contained the names, Social Security numbers, and birthdates of some 26.5 million veterans and some of their spouses. The VA is also making some changes at the top, and has hired a new IT security adviser.

While the VA reshuffled its staff, the Associated Press reported Wednesday that it has obtained three internal VA memos indicating the data loss went beyond names, Social Security numbers, and birthdates. The exposed files also included phone numbers, addresses, and some disability rating information.

The memos show that a file containing 6,744 records pertaining to "mustard gas veterans" -- those who participated in chemical testing programs during World War II -- was breached, the AP said. Likewise, a "short file" with as many as 10 diagnostic codes indicating a veteran's disability was stolen.

Michael McLendon, VA deputy assistant secretary, resigned Tuesday as a result of the theft. The unnamed data analyst, who reported to McLendon, will be dismissed. Dennis Duffy, the acting head of the division where the analyst worked, has been placed on administrative leave. (See Analyst: VA Data Loss No Surprise.)

Patrick Dunne has been nominated for the position of assistant secretary to the VA. In the meantime, the VA said, Assistant General Counsel for Management and Operations Paul Hutter will temporarily lead the division. (See VA Secretary Comes Under Fire at Hearings.)

In addition, the VA reported yesterday that it has hired Richard Romley for the new position of Special Advisor for Information Security at the VA. Romley, formerly an attorney for Maricopa County, Ariz., will be responsible for evaluating the current state of the VA's IT security procedures and processes, and developing recommendations for improving them. Romley, a decorated Marine veteran, prosecuted "AzScam," the largest public corruption case in Arizona's history.

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18986
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
CVE-2019-18981
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CVE-2019-18982
PUBLISHED: 2019-11-15
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
CVE-2019-18985
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
CVE-2019-18928
PUBLISHED: 2019-11-15
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.