Incident Score: Analysis & Impact (CASEEO1767902926)

In this Rankiteo incident briefing, we review the EEOC breach identified under incident ID CASEEO1767902926.

The analysis begins with a detailed overview of EEOC's information like the linkedin page: https://www.linkedin.com/company/eeoc, the number of followers: 113521, the industry type: Government Administration and the number of employees: 1826 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 770 and after the incident was 700 with a difference of -70 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on EEOC and their customers.

On 18 December 2024, Equal Employment Opportunity Commission (EEOC) disclosed Insider Threat issues under the banner "EEOC Public Portal Data Security Incident".

The Equal Employment Opportunity Commission (EEOC) experienced an internal data security incident involving a contractor’s employees mishandling sensitive information in one of the agency’s systems.

The disruption is felt across the environment, affecting EEOC Public Portal system, and exposing Personally identifiable information (PII).

In response, teams activated the incident response plan, moved swiftly to contain the threat with measures like Secured systems, initiated assessment, and began remediation that includes Password resets, enhanced screening and oversight processes, and stakeholders are being briefed through Notification email sent to affected individuals.

The case underscores how Ongoing (under law enforcement investigation), teams are taking away lessons such as Insider threats through government contractors are a persistent risk. Personnel screening alone is insufficient; enhanced oversight and compliance training are necessary, and recommending next steps like Extend background checks to ten years, enhance compliance training, reinforce controls in hiring and termination workflows, and improve oversight of contractor personnel, with advisories going out to stakeholders covering Monitor financial accounts for suspicious activity; password reset required for agency staff.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.