No Gaming or Social Media during Work Hours Kerala HC to ban employees from using their phones for non-official purposes during working hours

Introduction

Taj Hotels Group is well known for its luxurious ambience and old-world grace and charm, blended with contemporary comforts and amenities for its guests or customers. But what can make all the netizens perplexed is the recent data breach incident which took place in Tata-owned Taj hotels. The hotel suffer from a data breach that compromises nearly 1.5 million customers' data which includes addresses, membership IDs, mobile numbers and other personally identifiable information, according to sources. This news was brought to light which raised concerns about the privacy and data protection of personal data of individuals. We are living in a space influenced by advanced technology and digital communication which throws a concern or challenge to secure the personal information of individuals. 

Unveiling the incident 

Tata-owned Taj Hotels group has suffered a data breach that compromise information of over 1.5 million customers, according to a news report. A bad actor or entity going by the name “Dnacookies” claimed data set contains data from the 2014-2020 period and has not been disclosed anywhere till now. Such personal data includes name, address, customer ID, mobile number and other personally identifiable information. This shows the risks or challenges of data protection and security. The incidents raise an alarm about the risks and vulnerabilities that might be faced even by the big corporate giants. The bad actor with the handle “Dnacookies” also demanded a ransom of a sum of about Rs 4.16 lakh from the Taj hotel group. In response to the incident, a spokesperson from the concerned hotel group said that we have been made aware of someone claiming possession of a limited data customer data set, which is non-sensitive in nature. Investigation is underway and relevant authorities have been notified about the incident.

‍A demand for ransom

The report from CNBC-TV18 clears that the bad actor not only purloined the data but also demanded around 4.16 lakh as a ransom for the database.  Along with this, the bad actor kept three conditions ahead. Firstly there has to be a middleman for a negotiable deal secondly the data cannot be split either the entire data has to be taken with the ransom demand or no data at all. Thirdly additional samples of data will not be provided. Further, the spokesperson of Indian Hotel Company Limited mentioned that they have been escalated with the fact that someone is claiming authority in a limited data set. The bad actor claimed that the database contains information from 2014- 2020 which has been kept confidential till now. The audacity of the bad actor went to such an extent that the sample containing one thousand rows of unique entries from the bad actor dataset was also provided by the bad actor as proof of the deed. This incident underlines the growing threat in cyberspace and the urgency for individuals, organizations or entities to priorities data security measures and maintain cyber resilience.

Personal Data on Stake

Such data is the personal information of the individuals and also constitutes the personal tastes and preferences of individuals which can be exploited. The biggest gush of winds the hotel and individuals face by such a data breach is not only the volume of data compromised but also the potential ways it can get misused and exploited against the hotel or its customers by cyber crooks. This paves the way for cybercriminals to put forward any demand knowing the sensitivity of the data. Followed by creating a dilemmatic situation for the affected entities to either accept the ransom demands or to stand against ransom. Since the risks are high, going ahead with any of these situations can have an adverse impact on the security of personal data. The organisation or entities holding the personal data need to make sure that data under their realm is well protected and secured.

While the organisation has to sail through the aftermath of this breach, such incidents also pose a challenge for the organisation to maintain the trust and reputation of the organization since these incidents question the cyber security posture of the organisation. It is suggested to be transparent with its stakeholders, and open about the vulnerabilities and steps taken against this. They should also discuss the amplified step added for safeguarding their customer's personal data. Since Taj is well known for its out-of-the-box luxury and for providing comfort to its customers it should take a step ahead to reinforce its digital infrastructure to ensure the security of data.

Digital Personal Data Protection Act, 2023

The newly enacted Digital Personal Data Act, 2023 put certain obligations on data fiduciaries to take reasonable measures to maintain the security of personal data. The Act also requires to inform about the data breach to the data protection board constituted under the Act. The Act aims to protect the individual's digital personal data. The Act casts certain obligations on data principals and data fiduciaries. The Act provides penalty upto 250 crores in case of a data breach. The Act aims to provide consent-based data collection techniques. The Act also establishes the Data Protection Board to ensure compliance with the provisions of the Act and address grievances. 

Conclusion

Data breach in such a big giant in the market serves as an alarming concern to be more cautious and proactively take precautionary measures to protect the security of data and compliance with data protection laws and regulations. We are living in an era where digital security is as important as the basic fundamental rights of an individual. Taj Hotels Group has actively taken steps to handle the aftermath of the data breach by informing the incident to law enforcement agencies and taking necessary steps.  It is also on our part to be more aware, and vigilant about our personal data. Entities need to ensure compliance and measures to protect personal data and overall ensure a true cyber-safe & digital environment.

References

https://www.moneycontrol.com/news/technology/taj-hotels-suffers-data-breach-exposes-information-of-1-5-million-customers-11801161.html

‍

Introduction

The Telecom Regulatory Authority of India (TRAI), on March 13 2023, published a new rule to regulate telemarketing firms. Trai has demonstrated strictness when it comes to bombarding users with intrusive marketing pitches. In a report, TRAI stated that 10-digit mobile numbers could not be utilised for advertising. In reality, different phone numbers are given out for regular calls and telemarketing calls. Hence, it is an appropriate and much-required move in order to suppress and eradicate phishing scammers and secure the Indian Cyber-ecosystem at large.

What are the new rules?

The rules state that now 10-digit unregistered mobile numbers for promotional purposes would be shut down over the following five days. The rule claim that calling from unregistered mobile numbers had been banned was published on February 16. In this case, using 10-digit promotional messages for promotional calling will end within the following five days. This step by TRAI has been seen after nearly 6-8 months of releasing the Telecommunication Bill, 2022, which has focused towards creating a stable Indian Telecom market and reducing the phoney calls/messages by bad actors to reduce cyber crimes like phishing. This is done to distinguish between legitimate and promotional calls. According to certain reports, some telecom firms allegedly break the law by using 10-digit mobile numbers to make unwanted calls and send promotional messages. All telecom service providers must execute the requirements under the recent TRAI directive within five days.

How will the new rules help?

The promotional use of a cellphone number with 10 digits was allowed since the start, however, with the latest NCRB report on cyber crimes and the rising instances and reporting of cyber crimes primarily focused towards frauds related to monetary gains by the bad actors points to the issue of unregulated promotional messages. This move will act as a critical step towards eradicating scammers from the cyber-ecosystem, TRAI has been very critical in understanding the dynamics and shortcomings in the regulation of the telecom spectrum and network in India and has shown keen interest towards suppressing the modes of technology used by the scammers. It is a fact that the invention of the technology does not define its use, the policy of the technology does, hence it is important to draft ad enact policies which better regulate the existing and emerging technologies.

What to avoid?

In pursuance of the rules enacted by TRAI, the business owners involved in promotional services through 10-digit numbers will have to follow these steps-

• It is against the law to utilise a 10-digit cellphone number for promotional calls.
• You should stop doing so right now.
• Your mobile number will be blocked in the following five days if not.
• Users employed by telemarketing firms are encouraged to refrain from using the system in such circumstances.
• Those working for telemarketing firms are encouraged not to call from their mobile numbers.
• Users should phone the company’s registered mobile number for promotional purposes.

Conclusion

The Indian netizen has been exposed to the technology a little later than the western world. However, this changed drastically during the Covid-19 pandemic as the internet and technology penetration rates increased exponentially in just a couple of months. Although this has been used as an advantage by the bad actors, it was pertinent for the government and its institutions to take an effective and efficient step to safeguard the people from financial fraud. Although these frauds occur in high numbers due to a lack of knowledge and awareness, we need to work on preventive solutions rather than precautionary steps and the new rules by TRAI point towards a safe, secured and sustainable future of cyberspace in India.

Introduction

Attacks by cybercriminals targeting national critical infrastructure are increasing at an unsettling rate. Such attacks have the potential to do severe damage by upsetting transportation networks, utilities, financial services, and other vital infrastructure. The physical and digital systems that underpin a nation's economy are known as critical infrastructure thus if they were to be disrupted, there would be serious risks to the economy and public health and safety. Establishing proper cybersecurity measures and protecting those digital systems from possible threats or cyberattacks is necessary. Both public and private sector assets are included in these essential infrastructure categories.

Nationwide alert:

Recently one of the biggest hacker organizations has warned of an upcoming cyberattack on the critical infrastructure and websites in India, causing a countrywide alert. A gang of hackers from Indonesia and Pakistan, celebrating 4,000 members, announced a planned “Cyber Party” on 11 December 2023. The event’s claimed goal is to compromise and disrupt India's digital infrastructure. They disclosed this information on their Telegram channel.

This hacker organization holds a record of launching extensive cyberattacks; in the past, it sent out a "red notice" that was intended to target 12,000 websites run by the Indian government. They have previously attacked other nations, such as Israel, Sweden, and the United States. Their reasons are varied and might include anything from assaults on certain groups to religious disagreements.

The gang has also been acclaimed for hacking into a New York City police agency, obtaining health and social media data from Israel, and exposing information from Swedish social media users. These alarming events show how urgently strong and all-encompassing cybersecurity measures are needed, not only in India but throughout the world.

Effect(s) on India

1.  Central Agencies Are Alert, Expect Health Sector Attacks: The cyberinfrastructure of the health sector has been a common target of assaults, particularly in the aftermath of the COVID-19 epidemic, which has authorities particularly concerned. Relevant ministries have received notifications from central authorities advising them to take precautions against unwanted access. The security of digital infrastructure is seriously challenged by the constantly changing panorama of cyber-attacks, according to those who are aware of the warning and threat.

2. National security concerns: Because of the interconnectedness of critical national infrastructure, a cyberattack may have an impact on national security. Attacks against defense networks, intelligence organizations health infrastructure, or military systems, for instance, might make it more difficult for the nation to respond to threats from outside.

3.    Concerns for Public Safety and Health: Cyberattacks on healthcare systems run the risk of compromising patient data, stopping medical procedures, and even endangering the general public's health. This might have potentially fatal results in urgent circumstances.

4.  Data Breach and Privacy Issues: Stealing confidential data is a common component of cybersecurity assaults. A breach of critical infrastructure systems might result in sensitive data, including personal information, being misused and accessed without authorization, raising privacy issues.

Preventive and protective measures

1.    The plan for responding to incidents: Make sure a clear incident response strategy is in place, with a focus on healthcare systems, and that it is especially designed to handle cyber-attacks on critical infrastructure.

2.  Better Tracking: Observing vital networks, systems, and data flows more closely, especially in the healthcare industry. Using cutting-edge threat detection technologies to spot odd or questionable activity.

3.   Critical System Isolation: Cutting off vital healthcare systems from the wider network to reduce the chance of attackers moving laterally.

4.   Continual Backups: Make sure that backup copies of important data and systems are kept in a safe, isolated location by regularly backing them up. In the event of a ransomware attack or data breach, this makes recovery easier.

5.    Update and patch systems: Make sure that all operating systems and apps utilized in the infrastructure of the healthcare industry are updated with the most recent security updates.

6. Protocols for Communication: In the case of a cyber-incident, establishing explicit communication mechanisms to guarantee that pertinent parties are notified as soon as possible. This covers correspondence with law enforcement, the public, and other members of the healthcare industry as needed.

Conclusion

Urgent preventative actions are essential in response to an impending cyber threat revealed by a large hacker organization that is targeting India's key infrastructure, specifically the healthcare sector. The interconnectedness of this infrastructure puts public safety, privacy, and national security in danger. A crucial defensive approach is formed by the proactive measures mentioned, which include communication protocols, system isolation, improved monitoring, incident response preparation, and frequent backups. The dangers underline the necessity of international collaboration in tackling cybersecurity issues and the requirement for shared responsibility of everyone to safeguard digital networks. To reduce risks and guarantee the resilience of vital national infrastructure in the face of changing cyber threats, authorities must continue to develop and adapt their cybersecurity tactics.

References:

• https://www.cnbctv18.com/technology/exclusive--nationwide-alert-sounded-as-hacker-group-plans-cyber-party-to-attack-indias-critical-digital-infra-18520021.htm
• https://www.the420.in/ndian-authorities-high-alert-hacker-groups-threaten-cyber-assault/
• https://www.cnbctv18.com/technology/exclusive--nationwide-alert-sounded-as-hacker-group-plans-cyber-party-to-attack-indias-critical-digital-infra-18520021.htm#:~:text=By%20News18.com%20Dec%208,%3A58%20AM%20IST%20(Published)&text=A%20nationwide%20alert%20has%20been,Indian%20websites%20and%20critical%20infrastructure
• https://verveindustrial.com/resources/blog/critical-infrastructure-cyber-security/