The details surrounding this investigation are still rather vague, in part because both organizations limiting their comments on it. From several sources, it’s been determined that someone was able to infiltrate the Astros’ database, giving them access to sensitive information such as team statistics, scouting reports, potential trades, and other data considered valuable and confidential. No perpetrator has been named specifically, but some details point to the Cardinals, or someone within the Cardinal organization, as having breached the Astros’ server. While the extent of the hack is unknown, some believe it goes as far back as 2012.
As with any security breach situation, it’s important to figure out how it happened in the first place. While once again details are scarce, the major connection between the two teams is Astros general manager Jeff Luhnow, who used to scout for the Cardinals from 2003 to 2011. The FBI has stated that they believe the Cardinals were able to access the Astros’ database by using passwords Luhnow used to have when he was employed in St. Louis. If the Cardinals had passwords at hand, accessing the sensitive data would have been relatively easy.
If it turns out the Cardinals did indeed hack a rival team’s server, the result would be a serious black mark on the organization, outside any penalties handed down by the government and the league. As serious as the situation is, businesses also have a number of things they can learn from it if they wish to increase their own security efforts. All of it starts with passwords. As it appears in this case, old passwords were used to infiltrate another organization’s systems. This reinforces the need for companies to ensure their employees are using complicated passwords that are tough for potential cyber criminals to crack. Strong passwords include those of at least eight characters that incorporate lower and upper case letters, symbols, and numbers. Simply having a strong password isn’t enough, though. That password should be changed on a regular basis so a similar situation like the baseball hacking scandal doesn’t happen.
Businesses should also review their employee exit policies. They should make sure departing workers don’t take sensitive company passwords and access credentials with them. They also need to retrieve any company data employees may possess. This is especially important in the age of bring your own device (BYOD) policies, where workers may have corporate data on their personal mobile devices. In fact, the issue of BYOD security should always be reviewed since mobile devices represent a potential weak link providing unauthorized access to business networks and systems.
Another point businesses can take away from this situation is the importance of paying attention to similar companies. If a businesses in the same industry is the victim of a security leak, other organizations should go on high alert since they may feature some of the same security measures which were just compromised. Companies can also learn from the security woes of similar businesses, taking into account their mistakes and improving their own features to prevent future breaches from happening.
Perhaps the biggest takeaway from the baseball hacking scandal is the fact that no business is safe from cyber attacks. Whether from a rival organization, foreign government, or independent hacker, security threats are everywhere and no company is exempt from being targeted. The baseball hack is the first of its kind, and now sports organizations realize they could become victims too. Businesses shouldn’t have to wait for the worst to happen before acting. As long as they are aware of the threats and take appropriate measures now, they’ll be better prepared for preventing cyber attacks in the future.