Magazine menu Close Magazine menu

Data breaches

Latest stories

lighting up dark web

How police identify criminals selling data on the dark web

  • min read
    • In the north of England, a team of officers are getting creative. They're finding ways to identify criminals selling personal data, fake COVID-19 vaccines and child sexual abuse images on the dark web. Tomorrow Unlocked's film Lighting up the Dark Web follows the UK's Yorkshire and Humber Regional Cybercrime Unit (RCCU) in their quest to unmask a crime ring selling personal data for fraud. What is the dark web? The dark web is a network of computers where web traffic is anonymized. Many use it to access marketplaces and other sites to commit crime. The dark web can also be used for good. Dissidents, whistleblowers and investigative journalists use it to communicate anonymously online, and others use it to avoid online data collection. The sale of personal data is big business on the dark web. Fraudsters can buy names, dates of birth, credit card information and more. The FBI reports losses from fraud topped 4 billion US dollars in 2020. Linking dark web identities and real-world people In 2014, a trader called Data Pro was selling National Insurance numbers, dates of birth, credit card numbers and more on the dark web marketplace Evolution. RCCU suspected the source was a UK-based business. RCCU used 'slips' – when Data Pro occasionally used identifiable information – to link his clear web and dark web identities. How businesses can protect themselves from dark web criminals While the dark web seemed impossible to control in the past, law enforcement is now getting ahead. Businesses can also act to give fraudsters less opportunity to make dark web profits out of their data. First and foremost, protect your business's data from being stolen with strong data security practices, including encrypting your data and educating employees on how to avoid accidentally giving cybercriminals access. Your people are your most important security feature because most breaches start with basic errors like clicking a link in a rogue email or giving login details to someone who isn't who they said they were. If your data is already stolen and ends up on the dark web, dark web monitoring services like Have I Been Pwned may help you identify a breach and alert those whose information was stolen faster. As law enforcement becomes more cyber savvy, there are fewer places for cybercriminals to hide. Increasing international cooperation is also helping light up the darkest parts of the web. Businesses also have a part to play by reducing the opportunities for their data to be stolen and sold.
manage data leak

Infographic: Five vital steps to deal with a data breach

  • min read
    • Things can be frantic when you're dealing with a data breach. While swiftly diagnosing the problem and communicating clearly with everyone who needs to know, it's easy to miss something that could have serious consequences later. Use these five pointers to make sure you've done the right thing after a data breach. 1.  Assess the situation First, assess the data breach's risk to customers. Risk assessment lets you decide the next steps, including whether to report the breach. If it's a high risk to customers, you must inform them without undue delay, perhaps even before reporting to authorities. 2.  Be transparent and helpful Don't try to cover up the breach or hide details from those affected. If you hide things, you may see customers losing trust in your business on top of negative news coverage. When you tell customers what happened, give them advice on what to do next. 3.  Document everything Document every data breach, even if you don't have to report it. Record what happened, the steps you took and why the breach was reported or not reported. 4.  Learn from it Once you identify the cause, fix it. Next, make sure all staff receive training in how to prevent future breaches. Human error causes most data breaches. 5.  Make sure you notify everyone affected If you're processing data for other organizations, don't forget to tell them about the breach. They will have steps they must take too. Using these five pointers after a data breach will help your business get back on its feet sooner rather than later. Communicating swiftly and clearly with customers and partners is all-important in limiting the breach's impact on your business. It may happen to even the most cybersecurity-conscious organizations, but there's still a lot you can do to prepare. Equipping your employees with cybersecurity skills and knowledge is crucial to ensuring your customers' data stays safe in future.
data toxic waste

Data – the new oil, or potential for a toxic oil spill?

  • min read
    • Both of these statements were once controversial, but today, they're commonsense. If Equifax, the CIA, the NSA, The Office of Personnel Management, Facebook and dating sites can't keep our secrets secret, then neither can your business. In truth, industry's old, ill-placed confidence in the security of data was always an example of motivated reasoning. Collecting data is so cheap and storing it is so easy, and there were so many analysts and investors and hustling grifters exclaiming that "data is the new oil" that it seemed fiscally irresponsible not to collect everything you could, and retain it forever. Who knew how that data could be put to profitable use in the future? It was raining soup, so it was time to fill your boots – even if you couldn't find a market for soup-in-a-boot today, there was no doubt that such a market would appear in the foreseeable future. Given such a value proposition, it's not surprising that the people doing the collecting and the retaining of data talked themselves into the idea that both activities could be undertaken safely. But of course, they were wrong, and as history has caught up with them – as breach after breach has hit in ever-increasing waves – the rationale has changed. Now, rather than arguing that breaches are inevitable, the story goes that breaches aren't a big deal: every time there's a data breach, company spokespeople recite the catechism: "We take our customers' privacy very seriously. None of the data that leaked was compromising." Some of that is "privacy nihilism" – it was all going to leak eventually, so what's the difference? But there's a more insidious version of this, which argues that breach data isn't a problem because bad people can't do much with it. This isn't just nihilism; it's denialism. Breach apologists argue that the data they leak isn't compromising because it's anonymized, or because key identifiers were removed from it. This profoundly misunderstands how data is used – and abused. Re-identification of anonymized data-sets is a hot research topic for computer science today, with researchers creating automatic tools that piece together disparate data-sets to identify the people in them: for example, you can merge a health authority's database of anonymized prescribing data (doctor, medicine, date and time) with a breached database of taxi journeys that includes trips to hospitals that coincide with the prescribing times to infer who is taking antipsychotic medications, or antiretrovirals or cancer therapeutics. Many data-protection vendors have promised that they can inject noise into data-sets to prevent re-identification, but those promises rarely survive contact with security researchers who evaluate their claims. It's been years since the first significant re-identification theoretical work was done, and things keep getting worse for those who insist that anonymization is possible. Re-identification methods tell us a lot about how digital criminals operate and their incredible frugality and resourcefulness. Usernames and passwords can be recycled in credential-stuffing attacks that allow them to break into security cameras from Ring and Nest, order takeaway meals, or track and immobilize entire fleets of corporate vehicles. Breach identities can be used to overwhelm regulatory proceedings with plausible fake comments or to create fleets of Twitter identities. Criminals operate by combining and recombining data-sets, using one company's breach in combination with a public data source, and a third company's anonymous data release to wreak incredible havoc. They might even get enough data fragments to fraudulently obtain a duplicate deed for your house and sell it to someone else while you're on holiday. Never mind that no one can point to a specific piece of data you're liable to lose control over someday and say, "That, that's the data-point that will cost someone their house, or let their stalker find them or expose their retirement savings to thieves." It's similarly true that no one can point to a specific droplet of dioxin in a factory's illegal effluent pipe and say, "That, that is the carcinogen that will kill a young mother of three, some five miles downstream of the pipe." This doesn't stop companies that poison the water or the air from paying the price. The harms from breaches are stochastic (i.e., randomly determined), not deterministic. So far, remedies for those who have been injured by breaches have been severely limited, but they're getting stiffer. Home Depot's 2014 breach cost it $0.34/customer in direct compensation. But that was then. Breached Yahoo! customers may get compensated $100 each. Facebook just got hit with a $5B fine, and the party's just getting started. The harms from breaches are cumulative: like toxic waste in nature, breaches build up in the information environment, and they are effectively immortal in their potential for damage. As the public – and the law – come to grips with this, we're likely to see greater and greater remedies for those whose data has been released into the wild (forever). Remember, breaches affect everyone alike – all political persuasions, rich and poor, including the governing classes and lawmakers themselves. Inevitably, we will see the framework for breach remedies transformed to look more like the remedies for other probabilistic harms, such as environmental harms. When that happens, it might be too late for you: the data you're warehousing today might already have been ex-filtrated from your network without you even knowing that it's happened – until one of your customers finds out the hard way that you've compromised them, and seeks legal remedies. Your insurer isn't going to write policies for you – or errors and omissions policies for your board – if you're warehousing all this digital toxic waste in leaky digital barrels, not once the penalties for losing control over it start to turn into real money. Maybe you could still justify all that risk if the profits from all that data were commensurate with it. But as researchers keep discovering, the benefits from data are wildly oversold – the efficacy of ad targeting based on users' behavior is almost identical targeting based on the content of the pages where the ads appear, which requires no user data. But if you're an ad-tech company or a Big Tech platform like Facebook or Google, the mystique about the ability of data to convert customers allows you to sell your product as a massive premium, while intimidating potential competitors who think that they will never get started because they can never collect as much data as the companies that are already in the space. The people who claim data is the new oil are people who are selling the data, and the claims they make about the ways that this data lets you do amazing things are sales literature, not peer-reviewed studies. Data was never the new oil. It was always the new toxic waste: pluripotent, immortal – and impossible to contain. You don't want to be making more of it, and you definitely should be getting rid of the supply you've so unwisely stockpiled so far. Data minimization isn't just good practice; it's good business. Collect as little data as you can, and keep it as briefly as you can. If your privacy policy fits on the back of a napkin – because you're collecting almost nothing and processing it only for specific purposes, and then deleting it forever – you're on the right track! This article reflects the opinions of the author.
business reputation data breach

How to strengthen your IT security operations after a data breach

  • min read
    • The aftermath of a data breach can be measured in many ways, depending on who you are. For those outside the organization, the public perception that an organization has been compromised, known as reputational damage, is often quoted as the most significant long-term aspect of a data breach. To measure the effect of a breach on a company's health, Comparitech analyzed the long-term impact on the share prices of breached companies. This research is nuanced and worth reading in full, but one of the headlines from the September 2019 edition is telling: after about a month, share prices rebound and catch up, on average, to NASDAQ performance. And most importantly, the companies keep operating. The companies in the analysis include many brands we continue to use every day in our digital lives: Yahoo!, eBay, LinkedIn and Facebook. So what's the real cost of a data breach? According to research by Adrian Sanabria, a well-regarded former senior analyst in the information security community, there are a relatively small number of companies that are hacked out of existence. Examples of severe consequences for companies of all sizes are few and far between. So for the board, it's easy to under-estimate the impact of a breach by looking at share price or sales targets alone. However, the real impact and costs from loss of continuity go much further. For Kaspersky's Global Corporate IT Security Risks Survey, organizations of all sizes across the globe were asked about the broader costs they have to deal with when recovering from attacks. For enterprises, it's now, on average, a cool $1.4M to clean up a data breach. Beyond the financials, if you want your decision-makers to see all the consequences of a compromise, there are other factors to review. These are harder to define in absolute numbers, but they all affect the company's performance and reputation. Keep these points in mind when assessing risk or advocating for an additional budget for defense. Internal reputation damage The internal reputation of the security team can be hit hard. Regardless of the actual cause, they can be seen as responsible. This has even more risks to the long-term success of the team: Loss of continuity A CISO (Chief Information Security Officer) is often expected to resign after a significant breach; they carry the can as their position is viewed as taking responsibility for the failure. I would argue the removal of a single leader as a way to solve often systemic and complex problems is a strategy only good for Hollywood villains. Next time you're at the cinema, notice how successful their organizations are by the end of the movie. Scapegoating your CISO is an unwise strategy. It will take months, or even years, for the new CISO to be hired then acquire the knowledge of their predecessor, the established relationships, ways of working, and so on. The new CISO, as with any incoming C-suite leader, tend to make changes to make their mark, which can cause further disruptions in continuity and additional strains on the InfoSec team. Low morale Morale is tricky to measure and account for, but from the conversations I have with members of the InfoSec community, your IT staff can be despondent after a breach, particularly the security team. This may be in part due to the implication that their efforts didn't protect the company, and in part, due to burnout from the increased efforts to recover after a breach. The negative effect on Equifax staff is a particularly good example. Individuals were criticized in social media and even received death threats, and without appropriate support from the organization to safeguard team member's reputations and mental health. Increased auditor scrutiny For both your internal audit teams and the third party auditors you bring in, they will all increase their efforts to ensure they're not seen as missing something, and therefore being the party to blame for any future compromise. That sampling approach you used before that saved hours of unnecessary analysis? That won't be allowed anymore. More internal bureaucracy Organizations often respond to a breach by imposing new requirements on all staff, rather than by making the existing requirements easier to understand and follow. This may increase your employees' chances of understanding and following instructions or their willingness to bypass them to get their job done, which, in turn, could increase your organization's exposure to risk. So what should you do differently? With all these potential consequences and risks, here are some tactics you could try to have a happier ending after a breach. Keep your CISO Unless the incident can be directly attributed to an irreversible failure on the part of the CISO, don't fire them to appease customers or shareholders or any other aggrieved group holding a short-term view. Your CISO will have the experience and knowledge you need to see you through this issue. According to Kaspersky's 2019 survey based on more than 20 personal interviews with CISOs, unless the incident was directly their fault, the majority felt their employer would support them. Invest in building a cyber-aware culture Strengthen cyber-awareness training for all employees. This can help your employees work together more effectively in the face of a common enemy (cybercriminals), and appreciate the difficulties the security team faces keeping the organization safe. Plan your breach recovery strategy The best time to prepare for your recovery from a breach is before it happens. Take one step today, maybe start to look at how your organization would detect a breach, or how you can test the detection capabilities you have. Re-examine your existing strategies. For example, Kaspersky's IT Security Economics report highlights the benefits of having a DPO (Data Protection Officer) and SOC (Security Operations Center) in reducing the financial impact of an incident. When estimating impact, at any point before or after an incident, make sure you and your stakeholders appreciate these factors and consider them alongside the financial assessment. Ensure everyone has all the facts, not just those that are easiest to quantify. Any organization today has to "assume breach," from the smallest company keeping an offline backup away from the office to the largest enterprise looking to implement an advanced defense solution stack, which includes EDR (endpoint detection and response) and an anti-targeted attack solution. But a side effect of this wise approach can be an undue pessimism about the effect of being compromised. By giving your CISO confidence to make longterm plans because they'll survive short term problems, by improving the security awareness within your organization and by preparing in advance, you can make it through a compromise relatively unscathed. With a more planned and supportive approach to safeguarding the reputation and strengthening the performance of your InfoSec team, you will build a more secure and resilient organization in the long run. This article was published in Jan, 2020.
security bytes privacy reputation

How to build customer trust when a data breach happens

  • min read
    • Although common in all kinds of organizations and businesses, data breaches still make striking headlines. We all work hard to prevent them, but how should you communicate about data breaches when they happen? In the Security Bytes series, senior InfoSec professionals give their most savvy advice. This time, I asked several cybersecurity experts with incident response experience: Some chose to speak under a pseudonym, but all share sound advice that could help save your company's reputation when, despite your robust work to protect it, a cybercriminal succeeds in accessing your information. Hire the best PR firm Principal Security Consultant L0ra thinks a well-coordinated, experienced PR firm can best handle your company's reputation. She also believes the public responds well when companies admit their mistakes. "The biggest mistake companies make is glossing over their failures, but breaches happen every day. It isn't the first time. It won't be the last. "If the breach is large and public, immediately hire the best PR firm you can afford. "Sometimes, in response to a data breach, you get a raid. That's when a group of people comes at you on the internet. The number one rule for dealing with a raid is, log off and keep quiet. So you need a good PR firm to speak on your behalf." Communicate through the right people, and learn from mistakes Ray Hayes is Senior Software Engineer, Enterprise and Security at Microsoft. He highlights the importance of knowing who you're speaking with and learning from mistakes. "I don't speak about any incident off-the-cuff. I refer all inquiries to my leadership team. "If I'm asked informally about a major data breach or any other incident at my company, I make conversation, but keep it general, and make sure I know who I'm talking to. "Breach response is critical, but prevention is key. "Anyone starting a new job should think, "What could happen if the information I'm working on now was released?'" Involve everyone in planning – before it happens Security engineer Daniel says responding to data breaches must involve more than just the technical people. You need legal experts and business communicators too. "All companies should prepare for data breaches, especially those with data worth stealing. Small- and medium-sized businesses (SMBs) more often don't recognize the threat. "Before it happens, get everyone involved in making a crisis plan, not just IT. It's not only a technical problem. Involve legal, finance, safety and everyone else. They have valuable insight tech people often don't, and will have their own tasks to do when it happens." Tell customers affected, quickly and honestly James O, Director of Information Security, says informing your customers truthfully is a must. "Our insurance company gives us a Breach Coach to help our PR firm get the messages right. We also coordinate with internal communications to inform the families we serve, and start telling affected people as quickly as possible. We also report under our state data breach laws. "Companies could improve their data breach PR. When my data was accessed in a financial company's breach, I just got a form letter saying, here's your year of identity protection. "At least they included the root cause – leaving generic credentials on a public box – but that doesn't give me confidence that it won't happen again." Avoid the 'sophisticated attack' cliché Security Analyst http_error_418 says PR is vital, but companies must stop exaggerating cyberattackers' skills. "Companies often handle breaches with platitudes. They'll say the attacker was 'advanced' and 'sophisticated.' That's because, when it's later shown their app wasn't patched for eight years, investors are over the initial fright. "We also need to consider when transparency helps, and when it's overkill. "The public often don't fully understand what transparency reveals." Update regularly and learn from the best Cyber Threat Intel Analyst HackerPom points to an example of good practice. "When they know the facts, executives, PR and legal should give the media and customers regular updates. For a good example, look at Norsk Hydro's response to a bad data breach. Their communications were clear and straightforward." Better to overstate than understate the impact Joonatan Kauppi, Founder and CEO of Leijona Security, has several pieces of good advice. "If you're unsure of the impact, it's better to overstate than understate. If you downplay it, then word breaks that it's much more serious, you'll get worse press. "Bring the regulatory authorities into the loop straight away. "Inside the organization, start damage control, and don't skimp on costs. Gather the facts and inform your communicators. "Answer questions from security researchers and other InfoSec people. They ask the right stuff and are a good platform to communicate what happened. "Prepare for the flurry of questions you'll get from people or parties affected. Don't blame. Concentrate on reducing the impact of the breach." Make sure your plan fits all scenarios David Emm, Principal Security Researcher at Kaspersky, says to make sure you're planning for the full range of data that might be breached. "Balance technical and PR in responding to a breach. You can only do this well if you have a process for managing security incidents. Involve the right people across the organization – including IT, HR, legal and PR – and work out a plan before anything happens. The light of experience There are strong themes from these experts when it comes to how to communicate around data breaches. I'm hearing almost everyone say, plan for how you'll respond before it happens, involving people across the organization. Several say, to use the best PR available, and communicate with speed, honesty and regularity. By sharing the right information at the right time, in the right way, you'll get the right outcome: customers understanding how they're affected, and appreciating what you've learned. Article reflects the opinions of the author and speakers quoted. Published in 2019.
Cyber Defense

Hacking back: Could active cyber defense protect your business from data thieves?

  • min read
    • It's been said that the best defense is a good offense. Surely, the same should apply to cyber defense too? Falling victim to a cyberattack is always going to be bad news, but what if you could prevent the effects of a breach before they even manifest? Imagine being able to 'hack back' by probing an attacker's computer to destroy stolen data before it has a chance to end up on the illegal dark web marketplaces. It's something that government organizations are doing all the time. Law enforcement agencies like the FBI in the US, for example, have the authority to hunt down suspected hackers in this way. The rise of cyberwarfare Nation-states have perpetrated some of the biggest cyberattacks of all time. One of the most infamous examples is the WannaCry ransomware attack, alleged to be the work of North Korea. UK officials blamed the global NotPetya malware campaign on the Russian military, while Russia recently claimed to have thwarted cyberattacks against its critical infrastructure by the US. The list goes on. Many countries consider cyber-warfare a core part of their military strategy. Today, the digital world is the fifth theatre of war – after land, sea, air and space. It's easy to assume that nation-state attackers are only interested in going after big targets, namely government organizations of rival states. But, as attacks like WannaCry perfectly illustrate, any business or individual can be targeted, even if only via collateral damage. Amidst growing concerns of cybersecurity breaches targeting corporations, there's now growing momentum to give victims a way to fight back actively. It's the concept of 'hacking back,' part of the broader active cyber defense (ACD) methodology. But what are the implications, and why do they matter? Hacking back has cybersecurity experts worried Currently, almost all jurisdictions make it illegal for a private entity to access computers that don't belong to them, regardless of the scenario. But there have been attempts, particularly in the US congress, to make some exceptions to help protect victims of cyberattacks by allowing them to probe attacker's computers to stop attacks in progress, identify threat actors and destroy the stolen information. It's a debate that's been raging for years. Organizations, many of whom have fallen victim to cyberattacks themselves, have been clamoring to be legally allowed to engage in some form of proactive cyber self-defense. In 2017 in the US, growing pressure spawned a legislative proposal known as the Active Cyber Defense Certainty (ACDC) act. Although the bill has yet to enter into US law, it would make it legal, under certain circumstances, for organizations to go outside the boundaries of their networks to target attackers and send them packing on the highway to hell. Sounds great, doesn't it? Unfortunately, many cybersecurity experts aren't so sure. The proposed legislation has opened up a proverbial can of worms and has been hailed by many cybersecurity professionals as the worst idea ever in cybersecurity. While giving companies greater freedom to defend themselves sounds like a great idea, there's a very legitimate fear that allowing them to 'hack back' would only make the situation worse. Taking a cue from competitive video gaming – this could lead to a free-for-all cybersecurity deathmatch. The shortage of cybersecurity skills is a major concern, with around three-quarters of organizations claiming it negatively impacts their operations. It shouldn't be hard to see why that presents a severe problem when it comes to tackling sophisticated cyberattacks by hacking back. The ACDC act (the proposed legislation, not the popular Australian rock band) makes no mention of exactly what constitutes a qualified, legally sanctioned cyber defender. While a company like Google might have the necessary expertise, for smaller and less-equipped organizations, a lack of skills could lead to hacking back in an uncontrolled fashion. When that happens, the collateral damage could be catastrophic. It isn't likely, for example, that the perpetrators specifically wanted to target the UK's National Health Service with the WannaCry ransomware attack, but that didn't stop it from falling victim to their dirty deeds. Unfortunately, and especially without the right expertise, there's no real protection when things go wrong. It's notoriously easy to cause harm to networks belonging to innocent parties unintentionally. Even the US National Security Agency, who can hardly be described as newbies in cyber defense or hacking, had their EternalBlue exploit leaked by a hacker group who used it to carry out the WannaCry and NotPetya attacks. The foremost concern experts have is that legally allowing companies to hack back sets a dangerous precedent (a highway to hell, if you like) in which private companies and individuals end up being dragged into the world of cyber-warfare too. If the bill in the US, or a similar one in any other country, were to pass, it would ultimately encourage other nations to relax their anti-hacking laws. What we could end up with is a digital Wild West on a truly global scale. What should companies do instead of hacking back? While hacking back is the crux of the active cyber defense (ACD) debate, there are other things that organizations can do to defend themselves against cyberattacks proactively. It's also true that the overwhelming majority of data breaches occur due to human error, with the most common being mismanaged access rights or a failure to update software. Thus, organizations should first work on bolstering their defenses by establishing tougher administrative, physical and technological controls. At the same time, organizations, particularly large enterprises, which tend to be the target of highly sophisticated, often nation-state attacks, need real-time defense. Methods like real-time detection and mitigation are becoming increasingly important with the rise of zero-day exploits targeting critical networks. One increasingly popular form of active cyber defense is the so-called 'honeypot.' Honeypots are digital decoys placed within a network to lure attackers away from what's important. These decoys contain fake accounts and information that encourages hackers to continue. But, once the hacker infiltrates the honeypot, victims can collect information about them to help bolster the defenses of their critical systems. In other words, a honeypot defense can serve as a sandbox for testing the efficacy of existing cyber-defense systems, as well as profiling attackers. Unfortunately, honeypots are a legal grey area at best as such methods could be considered entrapment. A similar method, which is legal in many jurisdictions, is to use beacons, which do much the same thing but don't track the hacker's behavior once they've left the system. Beacons are web links where company servers can collect information about intruders, such as IP addresses, which they can then add to their blacklists as likely threats. However, in the EU, at least, this method may also constitute a breach of GDPR due to its covert nature. Another ACD strategy, and one that's legal, is address-hopping. This is especially common among financial institutions, given the highly sensitive and sought-after nature of the information they hold. Address-hopping involves changing the IP address at random while data is transmitted. It's similar to the age-old military strategy of regularly changing radio frequencies to keep ahead of enemy forces. Establishing the standards in cybersecurity Active cyber defense is an area where organizations need to tread carefully. Many forms of reconnaissance alone, such as beacons, can be construed as hack backs. Other strategies are outright illegal. But private entities still have every right to monitor and control activities in their networks and, in doing so, identify recurring attack patterns and learn more about their assailants. That's far better (from a legal, ethical and technical standpoint) than breaking into suspected assailants' networks to follow them around the web.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries