breach
Latest
Card skimming hack targets 201 campus stores in North America
The infamous Magecart card skimming hack has been used to make life miserable for college students. Trend Micro has discovered that a hacking group, currently nicknamed Mirrorthief, relied on the scripting technique to steal card data from 201 online campus stores across the US and Canada on April 14th. The team slipped its scripts into the checkout pages of the sites (all created by a common developer, PrismRBS) to harvest full card details, names, addresses and phone numbers. The number of people affected by the heist isn't yet clear.
Hackers in Microsoft's webmail breach could read some users' messages
For some users, that Microsoft webmail breach was worse than first thought. Microsoft has confirmed a Motherboard source's claims that the hackers had access to a portion of the email content, not just email addresses and subject lines. About 6 of the affected users had their messages exposed, according to a spokesperson. It's not clear if the intruders read the email before Microsoft blocked access, but the company told the The Verge in a statement that the subset received "additional guidance and support."
Microsoft webmail breach exposed email addresses and subject lines
You'll want to keep an eye out for suspicious activity if you use Microsoft's webmail services. The company has confirmed to TechCrunch that "cybercriminals" compromised a "limited number" of its web-based email accounts between January 1st and March 28th by using a customer support rep's credentials. The breach didn't expose sign-in details or message contents, but it did offer access to email addresses (including names of addresses in conversations), subject lines and custom folder names.
Hackers obtain millions of cards from Planet Hollywood's parent company
More than a few restaurant-goers in the US will want to check their bank statements. Earl Enterprises has confirmed that hackers used point-of-sale malware to scoop up credit and card data at some of its US restaurants between May 2018 and March 2019, including virtually all Buca di Beppo locations, a few Earl of Sandwich locations and Planet Hollywood's presences in Las Vegas, New York City and Orlando. It's a fairly large data breach -- KrebsOnSecurity discovered that a trove of 2.15 million cards were on sale in the black market as of February.
Iranian hackers stole terabytes of data from software giant Citrix
Citrix is best-known for software that runs behind the scenes, but a massive data breach is putting the company front and center. The FBI has warned Citrix that it believes reports of foreign hackers compromising the company's internal network, swiping business documents in an apparent "password spraying" attack where the intruders guessed weak passwords and then used that early foothold to launch more extensive attacks. While Citrix didn't shed more light on the incident, researchers at Resecurity provided more detail of what likely happened in a conversation with NBC News.
2018 in cybersecurity: Regrets, we have a few
This was the year security slips, privacy fails and outright stupidity went from bad to surreal. It was a year in which warnings went unheeded and companies lost whatever trust we gave them. It was a nesting doll of security disasters. A clown car of willful negligence. A long 12 months of totally unsexy, nonconsensual edge-play with our data.
House committee says Equifax data breach was 'entirely preventable'
Congress clearly didn't buy Equifax's attempt to pin its massive data breach on one lone technician. The House Oversight and Government Reform Committee has released a staff report declaring that the breach was "entirely preventable" and the result of widespread, systemic flaws in Equifax's security policies. The company didn't have "clear lines of authority" in its IT structure that would have properly enacted policies, for one thing. It also had "complex and outdated" systems that didn't keep pace with its growth, wasn't prepared to help victims and made basic security missteps. Equifax let more than 300 security certificates expire, for example, making it difficult to spot intrusions.
Quora breach leaks data on over 100 million users
Today's big data breach has been announced by Q&A site Quora, affecting over 100 million registered users. What did the "unauthorized third party" get? According to CEO Adam D'Angelo: Account information, e.g. name, email address, encrypted (hashed) password, data imported from linked networks when authorized by users Public content and actions, e.g. questions, answers, comments, upvotes Non-public content and actions, e.g. answer requests, downvotes, direct messages (note that a low percentage of Quora users have sent or received such messages) Quora found the breach on November 30th and said it is still investigating. It has logged all users out, and forcing all accounts with a password to reset that password. It also said that the password data was salted and hashed to prevent attackers from using it, but to be cautious, users should also reset passwords on their other accounts if they shared the same one. There are emails going out notifying users of the breach, but right now all of the information available is organized in this FAQ.
Income, tax and immigration data stolen in Healthcare.gov breach
The Centers for Medicare and Medicaid Services (CMS) now has details about the data stolen in the breach of Healthcare.gov that occurred last month. According to the government agency, a significant amount of personal information including partial Social Security numbers, tax information and immigration status was compromised in the breach. No financial information was stolen.
Yahoo agrees to pay $50 million to data breach victims
Yahoo will have to cough up $50 million in damages as part of a settlement following massive data breaches that took place in 2013 and 2014. The first breach affected three billion accounts, while the second affected 500 million accounts -- neither were disclosed until 2016. Hacked information included passwords that were encrypted but could be cracked.
WSJ: Facebook believes spammers were behind its massive data breach
More than two weeks after Facebook revealed a massive data breach, we still don't know who was using the flaw in its site to access information on tens of millions of users. Now the Wall Street Journal reports, based on anonymous sources, that the company believes spammers perpetrated the hack in an attempt to make money via deceptive advertising.
Pentagon data breach compromises up to 30,000 workers
The Pentagon still has to grapple with data security woes despite efforts to harden its sites and networks. Defense Department officials have revealed that a travel record data breach at an unnamed contractor exposed the personal info of military and civilian staffers, including credit cards. An AP source said that this didn't compromise classified material, but it affected "as many as" 30,000 workers. There's a chance that number might get larger, according to the source.
Here’s how to see if you were affected by Facebook’s breach
Today, Facebook provided additional information on the data breach it disclosed last month. Whereas it initially said up to 50 million users might have been affected, it now reports that 30 million were impacted by the breach. By exploiting a system vulnerability, attackers were able to steal digital keys called access tokens from those 30 million users, and Facebook has now laid out how those users were affected. The company is also notifying those impacted, but if you don't want to wait to be notified, you can check if your account was affected through this link.
Facebook says recent data breach wasn't 'related to the midterms'
Even though the number of users affected by Facebook's most recent hack was lowered to 29 million, from 50 million, it's still safe to say the attack was worse than originally thought. That's because we now know that the breach, which Facebook revealed a couple of weeks ago, exposed very detailed information of 14 million of those users, including their username, birthdate, gender, location, relationship status, religion, hometown, self-reported current city, education, work, the devices they used to access Facebook and the last 10 places they checked into (or were tagged in) on the site. The attackers, whose identities Facebook won't reveal because of an ongoing FBI investigation, were also able to view which people/Pages were followed by these 14 million users, as well as their 15 most recent searches on Facebook.
Google exposed data for hundreds of thousands of users
Google exposed private data from hundreds of thousands of Google+ users and then chose not to inform those affected by the issue. The Wall Street Journal reports that sources close to the matter claim the decision to keep the exposure under wraps was made among fears of regulatory scrutiny. Google says it discovered and immediately fixed the issue in March of this year.
Facebook will never be completely secure
Yesterday, Facebook announced that it found -- and fixed -- a stunning security breach that put 50 million people's accounts at risk. In the words of Facebook executives, the attack was "sophisticated" and its reach was "broad." And, more chillingly, we don't know who was behind it or what they intended to do with that account data.
Senator calls for investigation into Facebook’s latest breach
Facebook revealed today that it was hit with a data breach that affected 50 million users, and now Senator Mark Warner has called the incident "deeply concerning." In a statement released shortly after the reports surfaced, Warner said, "A full investigation should be swiftly conducted and made public so that we can understand more about what happened."
Firefox Monitor will tell you when your passwords are compromised
After a few months of testing, Mozilla has launched its free Firefox Monitor service that notifies users when their credentials are stolen as part of a data breach. The website, which is essentially an external interface to Troy Hunt's Have I Been Pwned (HIBP) database, also allows users to sign up for notifications in case their email addresses are found in future breaches.
Newegg fell victim to month-long card skimming hack
It's not just British companies succumbing to large-scale payment data breaches in recent weeks. RiskIQ and Volexity have discovered that hackers inserted Magecart card skimming code into Newegg's payment page between August 14th and September 18th, intercepting credit card data and sending it to a server with a similar-looking domain.
State Department email breach leaks employees' personal data
The latest government data breach affected State Department employee emails. On September 7th, workers were notified that their personally identifiable information was obtained by an unnamed actor, according to a recent report from Politico. It apparently impacted "less than one percent" of employees and direct victims of the breach were alerted at the time. Apparently, this didn't affect classified information, so at least there's that.
