Description: In August 2023, a hacker reportedly was successful in breaching Retool, an IT company specializing in business software solutions, impacting 27 cloud customers. The attacker appears to have initiated the breach by sending phishing SMS messages to employees and later used an AI-generated deepfake voice in a phone call to obtain multi-factor authentication codes. The breach seems to have exposed vulnerabilities in Google's Authenticator app, specifically its cloud-syncing function, further enabling unauthorized access to internal systems.
Entidades
Ver todas las entidadesAlleged: unknown developed an AI system deployed by Unknown hacker, which harmed Retool employee who was the victim of the unknown hacker , Retool , Google y 27 of Retool's clients.
Estadísticas de incidentes
ID
567
Cantidad de informes
1
Fecha del Incidente
2023-08-27
Editores
Sean McGregor, Daniel Atherton
Applied Taxonomies
Risk Subdomain
A further 23 subdomains create an accessible and understandable classification of hazards and harms associated with AI
2.2. AI system security vulnerabilities and attacks
Risk Domain
The Domain Taxonomy of AI Risks classifies risks into seven AI risk domains: (1) Discrimination & toxicity, (2) Privacy & security, (3) Misinformation, (4) Malicious actors & misuse, (5) Human-computer interaction, (6) Socioeconomic & environmental harms, and (7) AI system safety, failures & limitations.
- Privacy & Security
Entity
Which, if any, entity is presented as the main cause of the risk
Human
Timing
The stage in the AI lifecycle at which the risk is presented as occurring
Post-deployment
Intent
Whether the risk is presented as occurring as an expected or unexpected outcome from pursuing a goal
Intentional
Informes del Incidente
Cronología de Informes
Un hacker utilizó IA para deepfake la voz de un empleado e irrumpió en una empresa de TI.
La violación, que atrapó a 27 clientes de la nube, ocurrió el mes pasado en Retool, una empresa que ayuda a los clientes a crear software empresarial.…
Variantes
Una "Variante" es un incidente que comparte los mismos factores causales, produce daños similares e involucra los mismos sistemas inteligentes que un incidente de IA conocido. En lugar de indexar las variantes como incidentes completamente separados, enumeramos las variaciones de los incidentes bajo el primer incidente similar enviado a la base de datos. A diferencia de otros tipos de envío a la base de datos de incidentes, no se requiere que las variantes tengan informes como evidencia externa a la base de datos de incidentes. Obtenga más información del trabajo de investigación.
Incidentes Similares
Did our AI mess up? Flag the unrelated incidents
The man who was fired by a machine
· 20 informes
False positives still cause threat alert fatigue
· 1 informe
A Lesson Worth $11 Million
· 1 informe
Incidentes Similares
Did our AI mess up? Flag the unrelated incidents
The man who was fired by a machine
· 20 informes
False positives still cause threat alert fatigue
· 1 informe
A Lesson Worth $11 Million
· 1 informe