OSIsoft Breached, All Domain Accounts, Emails, and Passwords Assumed Compromised

In a security breach notification sent to the Californian Office of the Attorney General on November 16,OSIsoft LLC disclosed a security breach which affected its employees, consultants,interns, and contractors.

OSIsoft is the maker of PI System, a real-time events and data management software suite for enterprises known to be used by more than "65% of the Fortune 500 industrial companies and captures data from 1.5 billion sensors at more than 19,000 sites across 127 countries" according to Bloomberg .

"Our security service provider has recovered direct evidence of credential theft activity involving 29 computers and 135 accounts," says OSIsoft . "We have concluded, however, that all OSI domain accounts are affected."

Given the seriousness of the breach,OSIsoft stated that all individuals affected by the security incident should assume that their email addresses and passwords have been breached, as well as theirOSI domain login account names.

Furthermore, the security incident has exposed personal credentials even thoughActive Directory (AD) uses cryptographic protection to secure all sensitive information.

According to OSIsoft, "If you configured your external accounts to use OSIsoft email address for password recovery, reused a previous OSIsoft password, or there is a systemic pattern with external accounts, you are at a higher risk of credential theft."

OSIsoft is still investigating the incident with the help of multiple security service providers, and theyalso state in the data breach notification that extrasecurity measures have been put in place to block further unauthorized access to their systems and to prevent other future breaches.

One of the security measures set up after the discovery of the security breach was the process of expediting multi-factor authentication (MFA) to stop unauthorized access toOSIsoft assets in the future.

"Criminals with stolen credentials could target your banking, e-commerce and other online accounts, if passwords were re-used or stored on your system," saidOSIsoft. "You should reset external accounts to use passwords that are different from your OSI domain account password."

OSIsoft also stated that all affected parties would receive extra information regarding the actions taken following discoveries during the ongoing investigation.