Hi, It's Andy on Bloomberg's cybersecurity team. For the last few years, our team has documented cyberattacks against government agencies, hospital networks, major corporations and energy providers. Those attacks have demonstrated the ruthlessness and sophistication of hacking groups, both criminal and state-sponsored. But a recent court case in California is a reminder that many hacks aren't particularly sophisticated and often aren't executed by cyber cartels such as Russia's Evil Corp. But they can still cause damage and angst—or even disrupt a Major League Soccer match. Last week, a judge sentenced a San Jose man to 20 months in prison for an episode that dates back to the season opener for the San Jose Earthquakes last year. The match featured a dramatic comeback against Toronto FC that ended in a 2-2 draw. But for some fans, the event was marred by how hard it was to get some nachos and beer.
The problems started just before kickoff. While people tried to order food and drinks, a small number of employees for concession operator Spectra Food Services & Hospitality couldn't complete credit card transactions or open cash drawers. Soon, the employees' mobile tablets lost the ability to access menu items or list any prices or inventory for items sold at the game, according to court records.
Within about 15 minutes, all 204 of Spectra's mobile tablets stopped working. Beer and snack orders were thwarted, while some employees handwrote orders and used calculators to carry out cash transactions. Others just gave away food for free, the court records show. Federal prosecutors said the man behind the game-day food crisis was Salvatore La Rosa, a former Spectra employee who was fired from his job as operations and premium services manager about two months earlier.
La Rosa, 41, admitted that he logged into the administrative portal for the Earthquakes stadium from his home and used a password to access Spectra's concessions menu and payment selections, according to prosecutors. He then deleted them. The result, prosecutors wrote, was not only forgone sales but "a devastating impact on staff due to verbal abuse from frustrated, angry fans." La Rosa pleaded guilty to intentional damage to a protected computer. He was sentenced to prison time and ordered to pay $268,733 in restitution for Spectra's lost revenue during its opening game, plus the discounts it offered to placate fans the following month. A spokesman for the Earthquakes declined to comment. A Spectra spokesman said the company was pleased with the outcome "as we take all matters of cybersecurity and data protection very seriously." FBI Special Agent in Charge Craig Fair emphasized that companies need to protect themselves from their own employees. "Insider threats can be incredibly damaging to companies, their data, and intellectual property even after an individual is no longer employed by the company," Fair said in a statement. He added that companies should secure their networks and ensure that "they are only available to those with authorized access." With more infrastructure migrating online, companies are justifiably worried about state-sponsored espionage and Russian ransomware. But it's worth remembering that in the daily onslaught of hacking attempts, many threats are more mundane. And nothing, not even nachos, are immune. –Andrew Martin |
Post a Comment