Description: In August 2023, a hacker reportedly was successful in breaching Retool, an IT company specializing in business software solutions, impacting 27 cloud customers. The attacker appears to have initiated the breach by sending phishing SMS messages to employees and later used an AI-generated deepfake voice in a phone call to obtain multi-factor authentication codes. The breach seems to have exposed vulnerabilities in Google's Authenticator app, specifically its cloud-syncing function, further enabling unauthorized access to internal systems.
Entités
Voir toutes les entitésAlleged: unknown developed an AI system deployed by Unknown hacker, which harmed Retool employee who was the victim of the unknown hacker , Retool , Google et 27 of Retool's clients.
Statistiques d'incidents
ID
567
Nombre de rapports
1
Date de l'incident
2023-08-27
Editeurs
Sean McGregor, Daniel Atherton
Applied Taxonomies
Risk Subdomain
A further 23 subdomains create an accessible and understandable classification of hazards and harms associated with AI
2.2. AI system security vulnerabilities and attacks
Risk Domain
The Domain Taxonomy of AI Risks classifies risks into seven AI risk domains: (1) Discrimination & toxicity, (2) Privacy & security, (3) Misinformation, (4) Malicious actors & misuse, (5) Human-computer interaction, (6) Socioeconomic & environmental harms, and (7) AI system safety, failures & limitations.
- Privacy & Security
Entity
Which, if any, entity is presented as the main cause of the risk
Human
Timing
The stage in the AI lifecycle at which the risk is presented as occurring
Post-deployment
Intent
Whether the risk is presented as occurring as an expected or unexpected outcome from pursuing a goal
Intentional
Rapports d'incidents
Chronologie du rapport
Un pirate informatique a utilisé l’IA pour deepfake la voix d’un employé et s’introduire dans une entreprise informatique.
La violation, qui a pris au piège 27 clients du cloud, s'est produite le mois dernier chez Retool, une entreprise qui…
Variantes
Une "Variante" est un incident qui partage les mêmes facteurs de causalité, produit des dommages similaires et implique les mêmes systèmes intelligents qu'un incident d'IA connu. Plutôt que d'indexer les variantes comme des incidents entièrement distincts, nous listons les variations d'incidents sous le premier incident similaire soumis à la base de données. Contrairement aux autres types de soumission à la base de données des incidents, les variantes ne sont pas tenues d'avoir des rapports en preuve externes à la base de données des incidents. En savoir plus sur le document de recherche.
Incidents similaires
Did our AI mess up? Flag the unrelated incidents
The man who was fired by a machine
· 20 rapports
False positives still cause threat alert fatigue
· 1 rapport
A Lesson Worth $11 Million
· 1 rapport
Incidents similaires
Did our AI mess up? Flag the unrelated incidents
The man who was fired by a machine
· 20 rapports
False positives still cause threat alert fatigue
· 1 rapport
A Lesson Worth $11 Million
· 1 rapport