Breach Disclosure: Vienna Libraries

Earlier this month, the Technology News page Futurezone disclosed a data breach that affected libraries in Vienna. This breach consists of 224,000 registries containing names, home addresses, dates of birth, phone numbers and email addresses. This breach also includes a field called "Last Activity." Because this field is related to the date of last interaction with the library, it could potentially be used by attackers to determine the validity of the information contained in the breach, as more recent activity is likely suggestive of accurate personal information.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

This breach contains archives of personally identifiable information, with the most recent information dated June 11, 2019. It also contains older backups from September and October 2018, with over 321,000 entries containing activity dating back to 2003. The Vienna-CERT (Computer Emergency Response Team) is investigating the case. The case was also submitted to the Cybercrime Competence Center at the Federal Criminal Police Office.