Zendesk announces data breach impacting years

An investigation is still underway but initial signs indicate accounts registere before November 2016 were hit.

Up to 10,000 Zendesk support and chat accounts may be impacted by a 2016 data breach, the San Francisco-based company announced Wednesday.

Zendesk is a customer service software provider that promises to help clients ranging from Spotify to Vimeo via customer chats and data analysis. A third-party alerted the firm to a security incident impacting roughly 10,000 Zendesk support and chat accounts, including expired trial accounts and accounts that are no longer active. Zendesk determined on Sept. 24 an incident had occurred, the company said, and an initial investigation has confirmed agent names and contact information was compromised, along with user names and hashed and salted passwords.

Zendesk “customers” are not individual users, but some 145,000 companies like Airbnb, Squarespace and Uber, according to the Zendesk website. Agents are employees of those client companies and “end users” refers to the customers of the Zendesk client, according to the company’s definitions. Only the accounts activated prior to November 2016 appear to be affected, Zendesk says.

“The safety and security of our customers and their data of our customers and their data is of paramount importance to us,” Martin Van Horenbeeck, Zendesk’s chief information security officer, said in a blog post Wednesday. “Our goal is to communicate this information as quickly as possible with transparency and guidance on how to address.”

Affected information also includes Transport Layer Security encryption keys that customers gave to Zendesk, and the configuration settings of apps installed from the Zendesk app market.

It’s common for companies to learn from partners or other third parties that they have experienced a data breach. Often, when a company is probing its own defenses, it may come upon data that appears to be from a single source, and may point to a breach at another victim. Zendesk has not provided much detail about this incident, but the announcement follows a notification from the delivery service DoorDash confirmed a breach affected 4.9 million customers, workers and merchants.

“A lot of times [companies] have the data indicating they’ve been breached,” Candace Worley, Vice President and chief technical strategist at McAfee, said of corporate cyber defense at the Aspen Institute’s Cyber Summit in New York. “They just don’t know it yet.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure