Header Ads

The great nacho hack

Hi, It's Andy on Bloomberg's cybersecurity team. For the last few years, our team has documented cyberattacks against government agencies, hospital networks, major corporations and energy providers.

Those attacks have demonstrated the ruthlessness and sophistication of hacking groups, both criminal and state-sponsored.

But a recent court case in California is a reminder that many hacks aren't particularly sophisticated and often aren't executed by cyber cartels such as Russia's Evil Corp. But they can still cause damage and angst—or even disrupt a Major League Soccer match.

Last week, a judge sentenced a San Jose man to 20 months in prison for an episode that dates back to the season opener for the San Jose Earthquakes last year. The match featured a dramatic comeback against Toronto FC that ended in a 2-2 draw. But for some fans, the event was marred by how hard it was to get some nachos and beer.

The problems started just before kickoff. While people tried to order food and drinks, a small number of employees for concession operator Spectra Food Services & Hospitality couldn't complete credit card transactions or open cash drawers. Soon, the employees' mobile tablets lost the ability to access menu items or list any prices or inventory for items sold at the game, according to court records.

Within about 15 minutes, all 204 of Spectra's mobile tablets stopped working. Beer and snack orders were thwarted, while some employees handwrote orders and used calculators to carry out cash transactions. Others just gave away food for free, the court records show.

Federal prosecutors said the man behind the game-day food crisis was Salvatore La Rosa, a former Spectra employee who was fired from his job as operations and premium services manager about two months earlier.

La Rosa, 41, admitted that he logged into the administrative portal for the Earthquakes stadium from his home and used a password to access Spectra's concessions menu and payment selections, according to prosecutors. He then deleted them. The result, prosecutors wrote, was not only forgone sales but "a devastating impact on staff due to verbal abuse from frustrated, angry fans."

La Rosa pleaded guilty to intentional damage to a protected computer. He was sentenced to prison time and ordered to pay $268,733 in restitution for Spectra's lost revenue during its opening game, plus the discounts it offered to placate fans the following month.

A spokesman for the Earthquakes declined to comment. A Spectra spokesman said the company was pleased with the outcome "as we take all matters of cybersecurity and data protection very seriously."

FBI Special Agent in Charge Craig Fair emphasized that companies need to protect themselves from their own employees. "Insider threats can be incredibly damaging to companies, their data, and intellectual property even after an individual is no longer employed by the company," Fair said in a statement. He added that companies should secure their networks and ensure that "they are only available to those with authorized access."

With more infrastructure migrating online, companies are justifiably worried about state-sponsored espionage and Russian ransomware. But it's worth remembering that in the daily onslaught of hacking attempts, many threats are more mundane. And nothing, not even nachos, are immune. Andrew Martin

If you read one thing

The attorney general for Washington has sued Amazon for alleged anticompetitive practices that raised prices for consumers. The suit is the first to target Amazon in the U.S., and represents a new front in the government's campaign to curb tech giant power. Amazon's stock didn't take a hit Tuesday from the news. 

And here's what you need to know in global technology news

The judge signals that neither Apple nor Epic will get what they want out of the trial. 

Reddit's WallStreetBets is giving GameStop another boost

Elon Musk's quest to reach Mars will be one of the riskiest human endeavors ever attempted. "Honestly, a bunch of people probably will die at the beginning," Musk has said. 

Indoor agriculture company Bowery Farming raised $300 million at a $2.3 billion valuation

The Verge tells the story of how the Chicago Police used an algorithm to determine a man was likely to be involved in a shooting, placing him under heightened surveillance, and inadvertently making him the victim of two shootings. 

 

Like Fully Charged? | Get unlimited access to Bloomberg.com, where you'll find trusted, data-based journalism in 120 countries around the world and expert analysis from exclusive daily newsletters.

 

No comments