Wind River Systems, which develops embedded system software, on Friday warned of a “security incident” that had exposed personnel records.
One or more files were downloaded from the company’s network on or around September 29, it said. Affected data included information maintained within the company’s personnel records – including critical data like Social-Security numbers, driver’s license numbers and passport numbers.
“We have been working with law enforcement and outside experts to investigate a security incident that occurred toward the end of September,” according to the security-incident notice, filed with California’s Attorney General as part of the state’s data-breach notification requirements. “We have no indication that any information in these files has been misused.”
Alameda, Calif.-based Wind River develops software for embedded systems, such as Wind River Linux, its embedded Linux development platform. Embedded systems are microprocessor units on a chip that serve a dedicated function within a larger system.
The company is also known for industry-specific software offerings for the aerospace and defense, industrial and automotive fields, for instance.
Wind River said that the full scope of information affected includes dates of birth, SSNs, social insurance, driver’s license or national identification numbers, passport or visa numbers, health information or financial account information. It’s not stated which specific health information is affected. If accessed this type of data can provide cybercriminals the tools that they need for identity-theft attacks, phishing scams and more.
It’s unclear how many are affected, and if those affected include any clients. As of 2018, the company had 1,200 employees. What’s also not stated is the context around how the files were downloaded from Wind River’s network.
Threatpost has reached out to Wind River for further details.
The company said in its notification that it is not aware of any “actual or attempted misuse” of personal information as a result of the event. “Recent searches by our experts did not uncover any of these files online,” according to Wind River.
The company said that it has installed additional security monitoring tools and implemented new processes as a result of the incident. In the meantime, it is telling those affected to remain vigilant by monitoring their credit reports.
Wind River said it “will continue to focus on improving the cyber-resiliency and security posture of our company.”
Wind River has previously dealt with various security incidents. In 2019, researchers said that Wind River VxWorks versions that include the IPnet stack are affected by a group of bugs collectively called “URGENT/11.” In 2015, a TCP prediction vulnerability was found in Wind River’s widely deployed VxWorks embedded software that could enable an attacker to disrupt or spoof the TCP connections to and from target devices.
Download our exclusive FREE Threatpost Insider eBook, Healthcare Security Woes Balloon in a Covid-Era World, sponsored by ZeroNorth, to learn more about what these security risks mean for hospitals at the day-to-day level and how healthcare security teams can implement best practices to protect providers and patients. Get the whole story and DOWNLOAD the eBook now – on us!