Ericsson Vendor Cyber Rating & Cyber Score

Incident Types: The types of cybersecurity incidents that have occurred include Breach, Vulnerability and Cyber Attack.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with defused cyber (security firm), and third party assistance with defused cyber, third party assistance with hudson rock, and third party assistance with external cybersecurity experts, and communication strategy with notified texas and california attorneys general; offered identity protection services, and third party assistance with cybersecurity experts engaged, and law enforcement notified with fbi notified, and containment measures with password resets, and remediation measures with additional security measures and staff training, and communication strategy with notification to affected individuals, credit monitoring offered, and incident response plan activated with yes, and third party assistance with cybersecurity experts, and remediation measures with enhancing cybersecurity protocols, and communication strategy with formal notification to the california attorney general’s office, and incident response plan activated with yes, and remediation measures with enhanced security measures, and communication strategy with regulatory notifications and public disclosure..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Stolen credentials from Infostealer logs, Stolen employee credentials via infostealer malware and Third-party vendor employee.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Browser-Saved Logins, Corporate Sso Credentials, , Employee credentials, Personal Data, Financial Data, Medical Records, , Personally Identifiable Information (Pii), Financial Information, Medical Records, , Personal Data, Financial Data, Medical Data, and Personal information.

Incident Response Plan: The company's incident response plan is described as Yes, Yes.

Third-Party Assistance: The company involves third-party assistance in incident response through Defused Cyber (security firm), Defused Cyber, Hudson Rock, , External cybersecurity experts, Cybersecurity experts engaged, Cybersecurity experts.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Additional security measures and staff training, Enhancing cybersecurity protocols, Enhanced security measures.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by password resets.

Key Lessons Learned: The key lessons learned from past incidents are The campaign underscores the shift from exploiting vulnerabilities to abusing legitimate authentication, highlighting the growing threat of identity-based attacks. Organizations must enforce strong MFA, monitor for credential leaks, and secure network edge devices to prevent such attacks.The incident underscores the critical importance of multi-factor authentication (MFA) and the risks posed by infostealer malware in enabling credential stuffing attacks. Identity is now the new perimeter, and stolen credentials can bypass traditional security measures.Risks of third-party vulnerabilities in handling sensitive data, particularly in sectors reliant on external service providers.The breach underscores the risks of social engineering attacks, where human error—not technical vulnerabilities—can serve as the primary entry point for cybercriminals.The incident underscores the growing threat to telecom providers and the need for robust vendor security protocols in high-risk sectors.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Implement stronger vendor security protocols and continuous monitoring of third-party systems., Implement additional security measures and staff training to prevent future incidents., Monitor financial accounts, consider fraud alerts or credit freezes and and enroll in identity protection services..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Defused Cyber, and Source: Defused Cyber, and Source: Hudson Rock, and Source: Incident disclosure, and Source: California Attorney General’s office notification, and Source: Industry expert (James Neilson, SVP of Global at OPSWAT).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notified Texas and California Attorneys General; offered identity protection services, Notification to affected individuals, credit monitoring offered, Formal notification to the California Attorney General’s office and Regulatory notifications and public disclosure.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Offered complimentary identity protection services through IDX (12 or 24 months of credit and dark web monitoring, $1 million identity fraud reimbursement policy, and managed identity recovery support). Enrollment deadline: 2026-06-09., 12 months of credit monitoring offered to affected individuals, Offering free identity protection services through IDX, including credit and dark web monitoring, identity theft recovery support, and up to $1 million in identity fraud reimbursement. Eligible individuals have until June 9, 2026 and to register..

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Defused Cyber (security firm), Defused Cyber, Hudson Rock, , External cybersecurity experts, Cybersecurity experts engaged, Cybersecurity experts.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Strengthen Mfa Policies, Deploy Endpoint Detection For Infostealer Malware, Secure And Monitor Network Edge Devices, Implement Credential Leak Monitoring, , Implement Mfa Across All Systems, Enhance Endpoint Security To Detect And Prevent Infostealer Malware, Monitor And Restrict Access To Critical Systems, , Additional security measures and staff training, Enhancing cybersecurity protocols, Enhanced security measures.

Last Attacking Group: The attacking group in the last incident were an TIM Red Team Research, Initial Access Brokers (IABs), cybercriminals leveraging Infostealer logs, Initial Access Brokers and State-sponsored threat actor.

Most Recent Incident Detected: The most recent incident detected was on 2026-02-23.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-04-28.

Most Recent Incident Resolved: The most recent incident resolved was on 2026-02-23.

Most Significant Data Compromised: The most significant data compromised in an incident were Browser-saved logins, corporate SSO credentials, Employee credentials, potential access to internal systems, Sensitive personal and financial data, Sensitive personal and financial information, Sensitive personal and financial data, Personal information of over 15 and000 individuals.

Most Significant System Affected: The most significant system affected in an incident was F5 BIG-IP devicesADFSOWASTS portalsFortinet FortiGate-60E firewalls and ADFSSecurity Token Services (STS)OWA portalsF5 BIG-IP interfacesVPNsSSO portalsRemote access gateways and .

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Defused Cyber (security firm), defused cyber, hudson rock, , External cybersecurity experts, Cybersecurity experts engaged, Cybersecurity experts.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Password resets.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Sensitive personal and financial data, Browser-saved logins, corporate SSO credentials, Personal information of over 15,000 individuals, Employee credentials, potential access to internal systems and Sensitive personal and financial information.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 31.3K.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was The campaign underscores the shift from exploiting vulnerabilities to abusing legitimate authentication, highlighting the growing threat of identity-based attacks. Organizations must enforce strong MFA, monitor for credential leaks, and secure network edge devices to prevent such attacks., The incident underscores the critical importance of multi-factor authentication (MFA) and the risks posed by infostealer malware in enabling credential stuffing attacks. Identity is now the new perimeter, and stolen credentials can bypass traditional security measures., Risks of third-party vulnerabilities in handling sensitive data, particularly in sectors reliant on external service providers., The breach underscores the risks of social engineering attacks, where human error—not technical vulnerabilities—can serve as the primary entry point for cybercriminals., The incident underscores the growing threat to telecom providers and the need for robust vendor security protocols in high-risk sectors.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Educate employees on password hygiene and the risks of password reuse, Educate employees on the risks of malware and credential theft., Monitor for infostealer malware infections on employee devices., Enhance monitoring of login attempts and anomalous access patterns., Segment network access to limit lateral movement in case of a breach., Implement stronger vendor security protocols and continuous monitoring of third-party systems., Implement adaptive behavioral WAFs and enhanced monitoring for authentication anomalies, Secure network edge devices (e.g., firewalls, VPNs) and close unnecessary open ports, Monitor for credential leaks and Infostealer infections on employee devices, Monitor financial accounts, consider fraud alerts or credit freezes, and enroll in identity protection services., Implement multi-factor authentication (MFA) for all corporate systems, especially SSO and remote access gateways., Implement additional security measures and staff training to prevent future incidents., Enforce strict password policies and regular credential rotation., Segment networks to limit lateral movement in case of a breach and Enforce strong multi-factor authentication (MFA) across all corporate systems.

Most Recent Source: The most recent source of information about an incident are Industry expert (James Neilson, SVP of Global at OPSWAT), Incident disclosure, Defused Cyber, Hudson Rock and California Attorney General’s office notification.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (as per Defused Cyber’s analysis).

Most Recent Customer Advisory: The most recent customer advisory issued were an Offered complimentary identity protection services through IDX (12 or 24 months of credit and dark web monitoring, $1 million identity fraud reimbursement policy, and managed identity recovery support). Enrollment deadline: 2026-06-09., 12 months of credit monitoring offered to affected individuals, Offering free identity protection services through IDX, including credit and dark web monitoring, identity theft recovery support, and up to $1 million in identity fraud reimbursement. Eligible individuals have until June 9, 2026 and to register.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Stolen credentials from Infostealer logs, Third-party vendor employee and Stolen employee credentials via infostealer malware.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Infostealer malware infections on employee devicesWeak MFA enforcement or password reuseExposed network edge devices (e.g., Fortinet FortiGate-60E with open ports)Lack of monitoring for credential leaks, Lack of multi-factor authentication (MFA)Infostealer malware infections on employee devicesUse of stolen credentials to bypass security measures, Third-party service provider compromise, Human error (social engineering via vishing), Third-party vendor compromise.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Strengthen MFA policiesDeploy endpoint detection for Infostealer malwareSecure and monitor network edge devicesImplement credential leak monitoring, Implement MFA across all systemsEnhance endpoint security to detect and prevent infostealer malwareMonitor and restrict access to critical systems, Additional security measures and staff training, Enhancing cybersecurity protocols, Enhanced security measures.