Data Breaches News and Analysis
Ransomware attacks vs Kimchuk, Visser reveal supply chain threat to DOD
The operators behind DoppelPaymer ransomware reportedly attacked electronics manufacturer Kimchuk earlier this month, disrupting the company’s operations and stealing sensitive data that they have been publishing online as part of an extortion plot. Meanwhile, the cybercriminal outfit has continued to also publish information stolen earlier this year from Visser Precision, a parts maker and manufacturing solutions…
Tupperware site hacked with credit card skimmer
Tupperware hasn’t yet put a lid on a targeted cyberattack that uses a credit card skimmer to collect customer payment information at checkout on the tupperware[.]com site and some of its local sites. The threat actors hid “malicious code within an image file that activates a fraudulent payment form during the checkout process,” according to…
Canon breach exposes personal data of current, former GE employees, beneficiaries
A February breach at service provider Canon Business Process Services exposed the personal information of current and former GE employees and their beneficiaries. “While I’m usually a bit numb to the latest data breach, the sheer variety of exposed information is unique,” said Roger Grimes, data driven defense evangelist at KnowBe4. “GE and Canon haven’t…
FSB contractor breach exposes secret cyber weapons program leveraging IoT vulnerabilities
The hack of an FSB contractor has exposed details of the Russian intelligence agency’s cyber weapons program aimed at exploiting vulnerabilities in IoT devices. Digital Revolution, a Russian hacking group, has claimed credit for the April 2019 breach of subcontractor ODT (Oday) LLC, which was working with frequent Russian Ministry of Internal Affairs contractor InformInvestGroup…
Rogers’ vendor leaves database open
A third-party service provider to Rogers Communications left open a database used for marketing purposes, exposing customer PII. The Canadian telecom provider did not name the firm involved, nor the number of people affected, but reported that the incident was uncovered on Feb. 26, 2020 and involved the service provider leaving a database open to…
Blisk browser left open, 2.9 million records exposed
The web-development browser Blisk suffered a data breach leaking more than 2.9 million records through an open Elasticsearch database that was left open and that bypassed the security put in place by its users. The browser has been compromised in a way that it now leaks the data it was designed to gather from web…
Eight million EU retail sales records exposed on AWS MongoDB
A database hosed on Amazon Web Services holding eight million retail sales records from the European Union was left exposed compromising customer personal and financial information. The open MongoDB database had no password or other authentication set. It was operated by a third-party vendor who pulled sales data from a range of retailers, including Amazon…
Jury spares accused Vault 7 leaker from espionage conviction
A Manhattan federal jury yesterday failed to reach a verdict on any major charges leveled against Joshua Schulte, a former CIA software engineer from Lubbock, Texas, who was accused of stealing the agency’s hacking tools and delivering them to WikiLeaks for publication. Schulte, 31, was convicted on contempt of court and making false statements, but…
Virgin Media leaves database open, thousands of records exposed
The UK telecom and ISP Virgin Media is informing some customers of a data breach that took place when unauthorized persons accessed an incorrectly configured database. Virgin Media, which supplies telephone, TV and internet services in the UK, said names, home and email addresses, phone numbers and in some cases birth dates, were stored in…
How organizations can build a brand consumers can trust post-data breach
When companies suffer a data breach, it can be devastating to several parts of the business. And consumers are beginning to have more impact. IDC revealed that 80 percent of consumers will abandon a business if their personal data has been compromised. The first reaction of managers and leaders is usually to turn to IT…
Choppy waters: Data breach impacts Princess and Holland America cruise lines
The personal information of cruise passengers, crew and employees were compromised last year after an unauthorized party gained access to the email accounts of employees working for Princess Cruises and Holland America Line — both divisions of Carnival Corporation & plc. According to a disclosure notification posted on both cruise lines’ websites [1, 2], as…
J.Crew says year-old breach exposed customer account info
J.Crew notified a group of customers that an unauthorized third-party accessed their accounts nearly a year ago using their login credentials and obtained personal information, including the last four digits of payment card numbers, expiration dates, card types and billing addresses as well as order numbers, shipping confirmation numbers and shipment status. In a filing…
SC Product Reviews: Data loss prevention
Securing data has become a labor-intensive task due to tremendous increases in volume and the far-reaching vectors it traverses. Only recently have compliance standards and frameworks cracked down on information security practices and most organizations still do not sufficiently monitor their data or control its accessibility. The aggressive changes in security protocols and tightened compliance…
Data-stealing ransomware hits parts maker for Tesla, Boeing and Lockheed Martin
Visser Precision, a parts maker and manufacturing solutions provider for the aerospace, automotive, industrial and manufacturing industries, has reportedly suffered a combination ransomware attack and data breach that has compromised files pertaining to multiple business partners, including Tesla, SpaceX, Boeing and Lockheed Martin. In a statement, Denver, Colorado-based Visser confirmed it was “the recent target…
RSA 2020: Equifax CISO touts company’s transparency it as seeks breach redemption
Fresh off a financial settlement over its 2017 data breach that affected roughly half the U.S. population, Equifax is forging ahead with a $1 billion-plus investment in a new security plan — and CISO Jamil Farshchi was eager to tout the credit reporting agency’s progress so far in a session this week at the RSA…
Munson Healthcare data breach exposes PHI
The northern-Michigan based Munson Healthcare group reported several employee email accounts were hacked and being accessed for two and a half months last year exposing PHI. The breach was discovered on January 16, 2020 and the investigation into the incident revealed the email accounts in question were being accessed by an outside source between July…
Clearview AI client list breached
The facial recognition company Clearview AI is informing customers that a hacker stole its entire client list. Clearview AI gained unwanted notoriety earlier this year when it was disclosed that the company was obtaining billions of photos by scraping the internet for use by law enforcement agencies. Now the company has sent a notification to…
360,000 Quebec teachers PII possibly compromised
The PII of at least 51,400, and possibly as many as 360,000 educators, in Quebec Province was exposed when a malicious actor obtained login credentials to the Ministère de l’Éducation et de l’Enseignement supérieur network. The ministry received confirmation of the breach on February 19 noting in a statement that a single database was accessed…
MGM admits to 2019 data breach affecting 10.6 million customers
MGM Resorts has confirmed there was unauthorized access to one of the company’s cloud servers in 2019 that contained information on a reported 10.6 million guests, possibly including several high-profile guests. MGM did not confirm the number of people involved, but ZD Net working with the new security firm Under the Breach reportedly found data…
Cyberinsurance: The value from an incident response lens
Cyberinsurance is not new to the scene, and an increasing number of organizations are accepting its critical role in safeguarding them against costly cybersecurity incidents. Yet recently, we’ve seen ongoing discussion of its overall value to organizations, as well its net impact to the state of cybersecurity. As pundits discuss, debate, and ponder, crippling cyber…
