Was the recent Ubiquiti data breach catastrophic?

An unidentified whistleblower who was recently interviewed by KrebsOnSecurity said that Ubiquiti severely downplayed the data breach that hit the network equipment manufacturer at the end of 2020. The interview comes approximately three months after the data breach was first reported and suggests the company intentionally forgot to disclose the data breach’s severity. The news about the possible securities law violations cut off almost 30% of the Ubiquiti stock value. Multiple law firms are actively investigating whether Ubiquiti and its executives may be liable for securities fraud.

According to the whistleblower, the data breach was significantly worse than reported. The anonymous source that KrebsOnSecurity decided to call ‘Adam’ said that Ubiquiti’s legal team actively silenced and overruled efforts to protect customers. Adam reported to both European Data protection authorities and the company’s anonymous whistleblower hotline that the data leak was massive and left customer data at risk. He did not receive a satisfactory action plan from the bodies he approached and decided to raise concerns in an interview for KrebsOnSecurity. According to Adam, the breach made vulnerable millions of devices deployed in corporations and homes worldwide as hackers managed to obtain full read/write access to the network equipment company databases at Amazon Web Services (AWS). Ubiquiti blamed the third-party cloud vendor during the initial breach of information but failed to disclose that this was AWS.

After the interview went live, the troubled network equipment manufacturer came out with a statement acknowledging that hackers tried to extort them but failed to address Adam’s cover-up allegations. Ubiquiti also stated that they have not been able to identify any evidence that customer information was accessed, which is generally accurate and is a way to downplay the breach because the company, in general, doesn’t keep logs of who did or didn’t access the breached servers. In the new statement, Ubiquiti also failed to even mention the third-party cloud provider. The statement ignored to comment on the allegations and just invited customers to change passwords and activate two-step verification services.

Ubiquiti is one of the world’s major players in networking equipment industry, and the troubling news come at a very inconvenient time as the WiFi 6 market is hot. Many businesses are actively upgrading their WiFi networks to the new standard in wireless network protocols. While you are likely not part of the WiFi 6 corporate bloodbath, Ubiquiti products are often deployed in many public places, with millions of people using their networks every day in hospitals, banks, schools, office buildings, malls, etc. Having anti-virus protection on all your connected devices would ensure that you have the best chances to fight off hackers even if the router you are connected to is somehow compromised.