(KTTC) – The Veterans Health Administration (VHA) announced Friday that more than 2,000 veterans are being notified of the potential disclosure of protected health information.

According to the U.S. Department of Veteran Affairs, this information may have been obtained through a cyber security attack of a server, managed by DBP, Inc., a contracted medical transcription vendor. The affected documents contained information such as full names, medical record information, and social security numbers.

Following an investigation by the VHA, it was determined that the cyber security attack did not affect medical record information in the VA electronic health record. However, the files on the DBP, Inc. server were “locked down,” and may have been copied by the offending party.

In order to prevent any more cyber-attacks, the server was shut down and disconnected from the internet. New hardware was purchased, and new security controls were implemented on the equipment. The Department of Veteran Affairs continues to work with the vendor, ensuring appropriate security measures are in place.

Veterans will be receiving a Privacy Notification Letter, which will contain what information was at risk. Any veterans that may still have questions or concerns about what information may have been involved can call 1-844-838-5433 between 8 a.m. to 4:30 p.m., Monday through Friday.

Find stories like this and more, in our apps.

Copyright 2024 KTTC. All rights reserved.

The Veterans Health Administration (VHA) has reported that over 2,000 veterans are being informed about a potential breach of protected health information. This breach occurred through a cyber security attack on a server managed by DBP, Inc., a contracted medical transcription vendor. The compromised documents contained personal details such as full names, medical record information, and social security numbers.

After investigating the incident, the VHA confirmed that the cyber security attack did not impact medical records in the VA electronic health record system. However, the files on the DBP, Inc. server were secured to prevent further unauthorized access. The server was taken offline and new security measures were implemented to prevent future attacks. The Department of Veteran Affairs is working closely with the vendor to ensure enhanced security protocols are in place.

Affected veterans will receive a Privacy Notification Letter detailing the information that was potentially exposed. For any inquiries or concerns regarding the breach, veterans can contact 1-844-838-5433 between 8 a.m. to 4:30 p.m., Monday through Friday.

For more news updates, download our apps.

Copyright 2024 KTTC. All rights reserved.

This story was updated to add new information.

More than 1,000 veterans were possibly affected by a data breach involving VA Amarillo Healthcare System and several other sites, the Veterans Health Administration (VHA) said Friday.

The VHA said it is sending letters to 2,302 veterans — nearly half of those with VA Amarillo — notifying them of the "potential disclosure of protected health information that may have been obtained through the cyber security attack of a server managed by a contracted medical transcription vendor, DBP, Inc.," a news release states. "The affected transcribed documents contained some or all the following information: full name, medical record information, or social security number."

The Amarillo VA Healthcare System consists of the Thomas E. Creek Medical Center in Amarillo and four outpatient clinics located in Lubbock, Childress and Dalhart, as well as Clovis, New Mexico.

VHA said its employees conducted a thorough investigation regarding the incident and determined the cyber security attack did not affect any medical record information in the VA electronic health record. Rather, it involved the files on the DBP, Inc. server "being 'locked down' (encrypted) and potentially copied by the offending malicious party," the release said.

According to VHA, the vendor was able to shut down the server and disconnect it from the internet to prevent further attacks, and they have purchased new hardware and implemented new security controls on the equipment. The Department of Veterans Affairs continues to work with the vendor to ensure appropriate security measures are in place.

Veterans were impacted in the following locations:

In VISN 1: 386 Veterans from VA Boston Healthcare System, 37 Veterans from VA Connecticut Healthcare System, and 144 Veterans from VA Togus Healthcare System were affected.

In VISN 5: 25 Veterans were affected from Baltimore VA Medical Center.

In VISN 17: 1,069 Veterans were affected from VA Amarillo Healthcare System.

In VISN 23: 616 Veterans were affected from VA Minneapolis Healthcare System.

VHA said veterans who were possibly affected will receive a Privacy Notification Letter containing details on what information was at risk.

Veterans who have questions or concerns about whether their personal information may have been involved can call and leave a message at 1-844-838-5433 between the hours of 8 a.m. and 4:30 p.m., Monday through Friday. Calls will be returned by the Privacy Officers at the local Medical Centers within two business days.

This article originally appeared on Amarillo Globe-News: VA Amarillo veterans affected by cyber security attack

The Veterans Health Administration (VHA) recently announced that more than 1,000 veterans may have been impacted by a data breach involving VA Amarillo Healthcare System and other sites. The breach involved the potential disclosure of protected health information due to a cyber security attack on a server managed by a contracted medical transcription vendor, DBP, Inc.

The VHA is sending letters to 2,302 veterans, notifying them of the breach and the information that may have been compromised, such as full names, medical record information, or social security numbers. The affected veterans are from locations including the Thomas E. Creek Medical Center in Amarillo and outpatient clinics in Lubbock, Childress, Dalhart, and Clovis, New Mexico.

Fortunately, the VHA confirmed that the cyber security attack did not affect any medical record information in the VA electronic health record. The vendor was able to shut down the server and implement new security measures to prevent further attacks. Veterans who may have been affected will receive a Privacy Notification Letter with details on the breach.

If veterans have questions or concerns about their personal information, they can call 1-844-838-5433 between 8 a.m. and 4:30 p.m., Monday through Friday. Privacy Officers at local Medical Centers will return calls within two business days.

Dan Potter at Immersive Labs describes how leaders can be ready for a nightmare cyber-crisis

The constant threat of cyber-attacks has just become just another cost of doing business today. More than half of all UK organisations reported experiencing at least one cyber-incident in the last 12 months, with many being attacked on a weekly basis.

While most of these incidents are manageable, organisations never know when a more serious attack may strike, potentially bringing down months of disruption and huge financial costs. 

Like any emergency situation, weathering a cyber-crisis calls for strong leadership. A cool head and practised hand at the top of the business can make the difference between a minor incident and a full-blown catastrophe.

Effective crisis management requires leaders to make high-stakes decisions with limited information and maintain composure under public scrutiny. By learning from past incidents and establishing a reliable checklist, business leaders can give themselves the best chance of making the right calls when a disaster looms. 

Lessons from MOVEit and Log4J

“Those that fail to learn from history are doomed to repeat it.” The adage is especially accurate when it comes to cyber-security. While tactics are constantly evolving and the details of any one attack will differ, studying previous high-profile incidents can go a long way in shaping crisis play books. 

The Log4J vulnerability, discovered in December 2021, is a prime example. With roughly one in three applications using the vulnerable version of Log4Shell and thus vulnerable to remote code execution, the incident represents one of the most widespread global cyber-risks yet seen. 

But despite its scope, the vulnerability was easily addressed on an individual level by updating from the vulnerable version. The main takeaway from Log4J is the importance of proactive vulnerability management and effective incident response. Regular patching, combined with community collaboration, helped many organisations respond swiftly and contain the impact. 

Those businesses out of sync with security trends or with poor patching processes were left exposed for far longer, with many still using vulnerable versions years later.

A contrasting lesson comes from the MOVEit breach. Beginning in May 2023, the breach exposed critical weaknesses in the widely used file transfer solution, compromising sensitive data across more than 2,600 organisations and nearly 90 million individuals.

Since the Cl0p group exploited a zero-day vulnerability within MOVEit to gain unauthorised access, there was little that could be done to proactively deal with the risk. Instead, this case highlights the value of a strong early detection system, transparent internal and external communication, and coordinated response. Clear communication with stakeholders was essential for managing expectations and preserving trust.

Decision-making framework for cyber-crises

When a cyber-crisis strikes, leaders need more than technical knowledge – they need a structured decision-making framework to act effectively under pressure. An effective playbook guides leaders in addressing immediate threats, while also ensuring decisions support long-term organisational goals.

The first element of a practical framework is accurate information gathering. In the chaos of a crisis, conflicting information and unverified rumours can spread quickly. Senior management must find credible sources and cross-check facts to make informed decisions. Mapping the crisis’s scope and impact helps determine priorities and allocate resources efficiently, while proactive misinformation management maintains clarity.

Setting priorities is the next critical step. An effective playbook must be tailored to the organisation’s specific structure and business needs. 

As such, leaders should identify essential functions in a high-stakes scenario, such as protecting data and maintaining key operations, while temporarily deprioritising less critical areas. This focus provides the greatest chance of stabilising operations and minimising the impact while an incident is contained. 

Alongside this, ethical considerations are equally vital. Decisions during a crisis can affect employees, customers, and communities, so leaders should weigh up the broader implications of their actions. Upholding fairness and transparency and considering long-term reputational impacts ensures responsible decision-making that respects organisational values and stakeholder interests.

The cyber-crisis management checklist

It’s common for policies and processes to eventually get overlooked and gather dust, especially if they don’t see regular use. But this is a very risky scenario for a security crisis framework – when an emergency strikes, no company can afford to waste time flicking through an old file last opened several years ago.

Conducting regular risk assessments will enable organisations to identify emerging threats and discover how their own growth and changing business structure has impacted priorities. These assessments need to be fed back into the response framework to keep it current.

Further, a comprehensive incident response plan, with clearly defined roles, responsibilities, and communication protocols, should be regularly tested through drills and simulations to ensure readiness. 

Ongoing training reinforces the crisis response plan, helping teams gain confidence and familiarity with their roles in an emergency. Ideally, this should include full crisis simulations, including cyber-drills and exercises, that capture the feeling of a real incident.

It’s also important to update a framework in the aftermath of a cyber-incident. Once the immediate crisis is under control, a thorough review should be conducted to drive long-term improvement. 

A debrief helps leaders analyse their response’s effectiveness, identifying successes and improvement areas. Documenting lessons learned and updating response protocols based on this analysis equips the organisation to handle future incidents more effectively. There should be a mindset of continuous improvement to maintain a strong state of crisis readiness. 

A proactive approach to crisis management

As cyber-attacks become more inevitable, business leaders must take a proactive, structured approach to crisis management if they hope to weather an incident successfully. Preparation, effective decision-making, and a commitment to continuous improvement allow organisations to withstand crises and emerge stronger.

A proactive crisis management, backed by regular training and practice, instills confidence, reassures stakeholders, and provides the best chance of emerging through a crisis intact. 

Dan Potter is Senior Director Operational Resilience at Immersive Labs 

Main image courtesy of iStockPhoto.com and Olemedia

Cyber-crisis management is a crucial aspect of business operations in today's digital landscape. With the constant threat of cyber-attacks looming, organisations must be prepared to handle potential incidents effectively. Dan Potter, Senior Director of Operational Resilience at Immersive Labs, provides insights on how leaders can navigate through a nightmare cyber-crisis.

Recent statistics show that more than half of UK organisations have experienced at least one cyber-incident in the past year, with many facing attacks on a weekly basis. While most incidents are manageable, the possibility of a serious cyber-attack causing significant disruption and financial losses is always present.

In times of crisis, strong leadership is essential. Leaders must be able to make high-stakes decisions with limited information and maintain composure under public scrutiny. By learning from past incidents and establishing a reliable checklist, business leaders can increase their chances of making the right calls during a crisis.

Lessons from high-profile incidents like the Log4J vulnerability and the MOVEit breach highlight the importance of proactive vulnerability management, effective incident response, early detection systems, and transparent communication with stakeholders.

When a cyber-crisis strikes, leaders need a structured decision-making framework to act effectively under pressure. Accurate information gathering, setting priorities, ethical considerations, and a comprehensive incident response plan are key elements of an effective crisis management strategy.

Regular risk assessments, testing of response plans through drills and simulations, ongoing training, and post-incident debriefs are essential for maintaining a strong state of crisis readiness. A proactive approach to crisis management, supported by continuous improvement efforts, is crucial for organisations to withstand cyber-attacks and emerge stronger from a crisis.

Dan Potter at Immersive Labs describes how leaders can be ready for a nightmare cyber-crisis

The constant threat of cyber-attacks has just become just another cost of doing business today. More than half of all UK organisations reported experiencing at least one cyber-incident in the last 12 months, with many being attacked on a weekly basis.

While most of these incidents are manageable, organisations never know when a more serious attack may strike, potentially bringing down months of disruption and huge financial costs. 

Like any emergency situation, weathering a cyber-crisis calls for strong leadership. A cool head and practised hand at the top of the business can make the difference between a minor incident and a full-blown catastrophe.

Effective crisis management requires leaders to make high-stakes decisions with limited information and maintain composure under public scrutiny. By learning from past incidents and establishing a reliable checklist, business leaders can give themselves the best chance of making the right calls when a disaster looms. 

Lessons from MOVEit and Log4J

“Those that fail to learn from history are doomed to repeat it.” The adage is especially accurate when it comes to cyber-security. While tactics are constantly evolving and the details of any one attack will differ, studying previous high-profile incidents can go a long way in shaping crisis play books. 

The Log4J vulnerability, discovered in December 2021, is a prime example. With roughly one in three applications using the vulnerable version of Log4Shell and thus vulnerable to remote code execution, the incident represents one of the most widespread global cyber-risks yet seen. 

But despite its scope, the vulnerability was easily addressed on an individual level by updating from the vulnerable version. The main takeaway from Log4J is the importance of proactive vulnerability management and effective incident response. Regular patching, combined with community collaboration, helped many organisations respond swiftly and contain the impact. 

Those businesses out of sync with security trends or with poor patching processes were left exposed for far longer, with many still using vulnerable versions years later.

A contrasting lesson comes from the MOVEit breach. Beginning in May 2023, the breach exposed critical weaknesses in the widely used file transfer solution, compromising sensitive data across more than 2,600 organisations and nearly 90 million individuals.

Since the Cl0p group exploited a zero-day vulnerability within MOVEit to gain unauthorised access, there was little that could be done to proactively deal with the risk. Instead, this case highlights the value of a strong early detection system, transparent internal and external communication, and coordinated response. Clear communication with stakeholders was essential for managing expectations and preserving trust.

Decision-making framework for cyber-crises

When a cyber-crisis strikes, leaders need more than technical knowledge – they need a structured decision-making framework to act effectively under pressure. An effective playbook guides leaders in addressing immediate threats, while also ensuring decisions support long-term organisational goals.

The first element of a practical framework is accurate information gathering. In the chaos of a crisis, conflicting information and unverified rumours can spread quickly. Senior management must find credible sources and cross-check facts to make informed decisions. Mapping the crisis’s scope and impact helps determine priorities and allocate resources efficiently, while proactive misinformation management maintains clarity.

Setting priorities is the next critical step. An effective playbook must be tailored to the organisation’s specific structure and business needs. 

As such, leaders should identify essential functions in a high-stakes scenario, such as protecting data and maintaining key operations, while temporarily deprioritising less critical areas. This focus provides the greatest chance of stabilising operations and minimising the impact while an incident is contained. 

Alongside this, ethical considerations are equally vital. Decisions during a crisis can affect employees, customers, and communities, so leaders should weigh up the broader implications of their actions. Upholding fairness and transparency and considering long-term reputational impacts ensures responsible decision-making that respects organisational values and stakeholder interests.

The cyber-crisis management checklist

It’s common for policies and processes to eventually get overlooked and gather dust, especially if they don’t see regular use. But this is a very risky scenario for a security crisis framework – when an emergency strikes, no company can afford to waste time flicking through an old file last opened several years ago.

Conducting regular risk assessments will enable organisations to identify emerging threats and discover how their own growth and changing business structure has impacted priorities. These assessments need to be fed back into the response framework to keep it current.

Further, a comprehensive incident response plan, with clearly defined roles, responsibilities, and communication protocols, should be regularly tested through drills and simulations to ensure readiness. 

Ongoing training reinforces the crisis response plan, helping teams gain confidence and familiarity with their roles in an emergency. Ideally, this should include full crisis simulations, including cyber-drills and exercises, that capture the feeling of a real incident.

It’s also important to update a framework in the aftermath of a cyber-incident. Once the immediate crisis is under control, a thorough review should be conducted to drive long-term improvement. 

A debrief helps leaders analyse their response’s effectiveness, identifying successes and improvement areas. Documenting lessons learned and updating response protocols based on this analysis equips the organisation to handle future incidents more effectively. There should be a mindset of continuous improvement to maintain a strong state of crisis readiness. 

A proactive approach to crisis management

As cyber-attacks become more inevitable, business leaders must take a proactive, structured approach to crisis management if they hope to weather an incident successfully. Preparation, effective decision-making, and a commitment to continuous improvement allow organisations to withstand crises and emerge stronger.

A proactive crisis management, backed by regular training and practice, instills confidence, reassures stakeholders, and provides the best chance of emerging through a crisis intact. 

Dan Potter is Senior Director Operational Resilience at Immersive Labs 

Main image courtesy of iStockPhoto.com and Olemedia

The threat of cyber-attacks is a constant concern for businesses today, with more than half of UK organisations experiencing at least one incident in the last year. In the event of a serious cyber-crisis, strong leadership is crucial to navigate the situation effectively.

Learning from past incidents, such as the Log4J vulnerability and the MOVEit breach, can help shape crisis playbooks and improve incident response strategies. Proactive vulnerability management, regular patching, and clear communication with stakeholders are key components of effective crisis management.

When a cyber-crisis strikes, leaders need a structured decision-making framework to make informed decisions under pressure. Accurate information gathering, setting priorities, and considering ethical implications are essential steps in managing a crisis effectively.

Regular risk assessments, testing incident response plans, ongoing training, and post-incident reviews are all important aspects of maintaining a strong state of crisis readiness. A proactive approach to crisis management, supported by continuous improvement and regular practice, can help organisations withstand cyber-attacks and emerge stronger.

Dan Potter, Senior Director Operational Resilience at Immersive Labs, emphasizes the importance of proactive crisis management in today's cyber-threat landscape.

The future of a Liberal government bill meant to protect vital infrastructure from cyberattacks and enable Ottawa to ban telecommunications providers from partnering with what it considers risky vendors — including Huawei — is in doubt after senators studying the bill found what one senator called a "drafting error."

Bill C-26, first introduced back in 2022, has two key parts. The first section amends the Telecommunications Act to give the federal government "clear and explicit legal authority" to prohibit Canadian telecoms from using products and services from "high-risk suppliers."

The government — citing national security concerns — said at the time it would use those powers to bar Canada's next-generation mobile networks from using products and services from Huawei and ZTE, two Chinese state-backed telecommunications firms.

The second portion of Bill C-26 introduces the Critical Cyber Systems Protection Act. It would compel companies in vital, federally regulated sectors such as finance, telecommunications, energy and transportation to either shore up their cyber systems against attacks or face expensive penalties.

The bill has had a slow journey so far through Parliament and appears to have hit another roadblock.

Senators were prepared to do a clause-by-clause review of the proposed legislation on Monday. They paused that review when Independent Sen. John McNair, sponsor of the bill in the upper chamber, said he had been alerted to "drafting errors" in the bill with "potential significant impact."

The Senate's national security committee then moved in-camera to discuss.

A renumbering issue 

According to sources with knowledge of the file, one of the key goals of the bill — to introduce new cybersecurity measures — will be nullified if the draft isn't fixed.

That's because when the government wrote its foreign interference law Bill C-70, it made sweeping changes to the Canada Evidence Act. The foreign interference law was also meant to repeal and supersede a small section of Bill C-26 that also dealt with the Canada Evidence Act.

But sources — who spoke on the condition they not be named because they were not authorized to speak publicly — told CBC News that C-26's clauses were renumbered without anyone really noticing before now.

Because the section numbers no longer match, the foreign interference law, which was fast-tracked through Parliament this spring and is now law, actually repeals the entire second half of Bill C-26 — the cybersecurity portion. 

It's not clear what the next steps are. The Senate committee is meeting early next week to discuss the cybersecurity bill.

If senators feel they have to amend the bill, it will have to be sent back to the House of Commons, delaying an already delayed bill at a time when the lower chamber is gridlocked.

Matt Malone, Balsillie scholar at the Balsillie School of International Affairs, said the drafting hiccup reflects broader problems with Bill C-26,

"Especially in the way some of its broad and vague language leaves far too much room for government overreach," he said.

"A key flaw of Bill C-26 is the need for stronger oversight with the new order-making and information-collecting powers it grants the government."

Ottawa needs new law to enforce Huawei ban

Beyond the need to shore up vital systems against attacks, sources say there's also a concern about how a delay in passing C-26 might affect Canada's use of technology from Huawei and other companies red-flagged by the federal government.

While the government announced its intention to ban the use of Huawei and ZTE products and services more than two years ago, Bill C-26 gives it the legal authority to follow through.

In the federal government's own words, Ottawa will only be in a "position to apply these new order making powers" after the act receives royal assent and becomes law.

Ottawa originally asked Canadian companies to remove or terminate 5G equipment from Huawei and ZTE by June 2024. It also set a deadline of December 2027 for companies to get rid of existing 4G equipment provided by the two Chinese firms.

A source with knowledge of the file said the federal government reached out to the major telecommunication companies this summer for an update.

The source said all the major companies responded except for Telus Corp. 

CBC News also reached out to the three major telecommunications companies to see if they had removed any existing 5G Huawei equipment by the June deadline.

A spokesperson for Rogers said it launched a standalone 5G network in partnership with Ericsson and it's not affected by the Huawei ban. 

Bell also said the company does not use Huawei in its 5G network.

Telus did not answer CBC's question directly.

The company originally planned to roll out its 5G network using Huawei technology. Telus later announced partnerships  with Nokia, Ericsson and Samsung to build its 5G network.

"We remain and have always been compliant with current Canadian regulations, laws and cybersecurity requirements," Telus spokesperson Richard Gilhooley said in an email.

What's the worry about 5G?

New 5G networks promise to give people speedier online connections and provide the greater data capacity required to allow more people, and things, to connect online. Unlike previous generations, the technology that underpins 5G networks relies on multiple antennas to move signals around, bouncing them quickly between locations.

Critics have long warned that Huawei's participation in 5G networks, both in Canada and in allied countries, could give the company an inside look at how, when and where Canadians use internet-connected devices. Many have warned that the Chinese government could force the company to hand over that information.

China's National Intelligence Law says Chinese organizations and citizens must support, assist and co-operate with state intelligence work.

Huawei has long insisted it's an independent company that does not engage in espionage for Beijing.

The fate of a Liberal government bill aimed at safeguarding critical infrastructure from cyberattacks and allowing Ottawa to prohibit telecommunications providers from partnering with what it deems risky vendors, such as Huawei, is uncertain following the discovery of a "drafting error" by senators studying the bill.

Bill C-26, initially introduced in 2022, consists of two main components. The first part involves amending the Telecommunications Act to grant the federal government the legal authority to prevent Canadian telecom companies from utilizing products and services from "high-risk suppliers." This move was prompted by national security concerns, with intentions to block Huawei and ZTE, two Chinese state-backed telecommunications firms, from participating in Canada's next-generation mobile networks.

The second aspect of Bill C-26 introduces the Critical Cyber Systems Protection Act, which mandates companies in crucial federally regulated sectors like finance, telecommunications, energy, and transportation to enhance their cybersecurity defenses against attacks or face substantial penalties.

The bill has faced delays in Parliament and encountered another obstacle during a recent review by senators. Independent Sen. John McNair, the bill's sponsor in the upper chamber, raised concerns about "drafting errors" with potential significant consequences, prompting a pause in the review for further discussion behind closed doors.

Sources familiar with the issue revealed that a renumbering error in the bill could nullify its cybersecurity measures, as changes made to the Canada Evidence Act by the foreign interference law Bill C-70 inadvertently repealed a section of Bill C-26 related to cybersecurity. This oversight went unnoticed until now, jeopardizing the effectiveness of the cybersecurity provisions in Bill C-26.

The Senate committee is scheduled to convene early next week to address the drafting error and potential amendments to the bill. Any modifications would necessitate sending the bill back to the House of Commons, further delaying an already protracted legislative process.

In addition to fortifying critical systems against cyber threats, concerns have been raised about the impact of delaying Bill C-26 on Canada's plans to exclude technology from Huawei and other flagged vendors. The bill grants legal authority for banning Huawei and ZTE products and services, but this authority can only be exercised once the bill receives royal assent and becomes law.

The federal government had set deadlines for Canadian companies to remove Huawei and ZTE equipment from 5G networks by June 2024 and existing 4G equipment by December 2027. While some major telecommunication companies have transitioned away from Huawei technology, others have yet to provide updates on their compliance with the ban.

The rollout of 5G networks promises faster connectivity and increased data capacity, but concerns persist about Huawei's involvement due to fears of potential espionage and data privacy breaches. Critics warn that Huawei's ties to the Chinese government could compromise sensitive information and pose security risks.

Despite Huawei's assertions of independence and non-involvement in espionage activities, ongoing scrutiny surrounds its participation in global 5G networks amid escalating cybersecurity concerns.

Las Vegas(KLAS)-Cyber security will be on high alert this season during black Friday and cyber Monday online shopping. Victoria Doering, Chief Information Security Officer at Link Technologies stopped by to give you a head start on protecting yourself from scams.

Copyright 2024 Nexstar Media, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.

For the latest news, weather, sports, and streaming video, head to KLAS.

As the holiday season approaches, cyber security experts are warning shoppers to be extra vigilant during Black Friday and Cyber Monday online shopping. Victoria Doering, Chief Information Security Officer at Link Technologies, advises consumers to take proactive steps to protect themselves from potential scams.

Doering emphasizes the importance of being cautious when sharing personal information online and recommends using secure payment methods to avoid falling victim to cyber criminals. By staying informed and practicing safe online shopping habits, consumers can reduce their risk of becoming targets for fraud.

For more information and tips on staying safe while shopping online, visit KLAS for the latest news, weather, sports, and streaming video. Remember to stay alert and protect your personal information during this busy shopping season.