Incident Score: Analysis & Impact (CCS1781130576)

In this Rankiteo incident briefing, we review the CCS (Cannabis Club Systems) breach identified under incident ID CCS1781130576.

The analysis begins with a detailed overview of CCS (Cannabis Club Systems)'s information like the linkedin page: https://www.linkedin.com/company/ccs-cannabis-club-systems-, the number of followers: 0, the industry type: IT Services and IT Consulting and the number of employees: 2 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 786 and after the incident was 718 with a difference of -68 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on CCS (Cannabis Club Systems) and their customers.

Cannabis Club Systems (CCS) / Nefos Solutions recently reported "Massive Data Exposure: Over 985,000 Photo IDs Left Unprotected in Cannabis Club Software Breach", a noteworthy cybersecurity incident.

Security researcher Sammy Azdoufal uncovered a severe data exposure involving over 985,000 photo IDs, including passports, driver’s licenses, and personal details, left publicly accessible on the internet due to critical security flaws in software used by cannabis clubs in Spain.

The disruption is felt across the environment, affecting PuffPal app, CCS verification and management software, and exposing 985,000 photo IDs (passports, driver’s licenses), names, phone numbers, home addresses, cannabis consumption habits, selfies, with nearly 985,000 records at risk.

In response, moved swiftly to contain the threat with measures like Shut down PuffPal app and vulnerable APIs, and began remediation that includes Replaced PuffPal with an independently audited app, severed ties with 9Series, and stakeholders are being briefed through Reported breach to Ireland’s Data Protection Authority (DPC), media inquiries addressed.

The case underscores how Resolved (PuffPal and APIs shut down), teams are taking away lessons such as Third-party software security risks, importance of independent audits, prioritizing security over functionality, timely GDPR compliance, and recommending next steps like Replace vulnerable software with independently audited solutions, enforce strong authentication, avoid hardcoded credentials, comply with GDPR disclosure timelines.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.