Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

VA Data Loss Worse Than Expected

A bad situation just got worse, according to wire reports

Hirings and firings continued at the U.S. Department of Veterans Affairs yesterday. New information revealed that the agency lost even more data than originally reported. (See VA Reports Massive Data Theft.)

The VA said it has "begun implementing the procedures necessary" to dismiss the data analyst who violated policy by taking home the records, which contained the names, Social Security numbers, and birthdates of some 26.5 million veterans and some of their spouses. The VA is also making some changes at the top, and has hired a new IT security adviser.

While the VA reshuffled its staff, the Associated Press reported Wednesday that it has obtained three internal VA memos indicating the data loss went beyond names, Social Security numbers, and birthdates. The exposed files also included phone numbers, addresses, and some disability rating information.

The memos show that a file containing 6,744 records pertaining to "mustard gas veterans" -- those who participated in chemical testing programs during World War II -- was breached, the AP said. Likewise, a "short file" with as many as 10 diagnostic codes indicating a veteran's disability was stolen.

Michael McLendon, VA deputy assistant secretary, resigned Tuesday as a result of the theft. The unnamed data analyst, who reported to McLendon, will be dismissed. Dennis Duffy, the acting head of the division where the analyst worked, has been placed on administrative leave. (See Analyst: VA Data Loss No Surprise.)

Patrick Dunne has been nominated for the position of assistant secretary to the VA. In the meantime, the VA said, Assistant General Counsel for Management and Operations Paul Hutter will temporarily lead the division. (See VA Secretary Comes Under Fire at Hearings.)

In addition, the VA reported yesterday that it has hired Richard Romley for the new position of Special Advisor for Information Security at the VA. Romley, formerly an attorney for Maricopa County, Ariz., will be responsible for evaluating the current state of the VA's IT security procedures and processes, and developing recommendations for improving them. Romley, a decorated Marine veteran, prosecuted "AzScam," the largest public corruption case in Arizona's history.

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24259
PUBLISHED: 2021-05-05
The “Elementor Addon Elements� WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24260
PUBLISHED: 2021-05-05
The “Livemesh Addons for Elementor� WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24261
PUBLISHED: 2021-05-05
The “HT Mega – Absolute Addons for Elementor Page Builder� WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by ...
CVE-2021-24262
PUBLISHED: 2021-05-05
The “WooLentor – WooCommerce Elementor Addons + Builder� WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-priv...
CVE-2021-24263
PUBLISHED: 2021-05-05
The “Elementor Addons – PowerPack Addons for Elementor� WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scriptin...