Office Depot and Support.com will pay $35 million to settle a legal action brought by the Federal Trade Commission (FTC) that alleged that alleged the two companies tricked customers into buying repair and technical services by saying malware was found on their computer. Office Depot is responsible for paying $25 million and Support.com $10 million…
Even after several alleged members were arrested last year, FIN7 continues to show signs of life, as evidenced by the recent discovery of an administration panel tool called “Astra” and two new malware samples used in campaigns by the cybercriminal group in 2018. Researchers from Flashpoint who uncovered the threat observed Astra-related activity from May…
The EU Payment Services Directive (PSD2) will revolutionize consumer authentication. Passwords have been dying a slow death for a while, but PSD2 is likely going to deal the final death blow. Can we all say, “hip hip hooray?” For those who feel that this is just an issue for the European market, think again. The…
Researchers in the last 48 hours have released a trio of reports, each of which details a newly discovered point-of-sale (POS) malware program that skims or scrapes payment card information from e-commerce websites or in-store checkout terminals. At least two of these three new threats, GMO and DMSniff, have already been observed actively attacking enterprises,…
The threat group Fin6 has been connected to a string of point-of-sale attacks against VMWare Horizon thin clients. The security firm Morphisec Labs reported the attacks have been taking place for eight to 10 weeks with a particular spike on Feb. 6 that saw numerous attempted downloads of the Cobalt Strike backdoor. Morphisec has tentatively connected…
Yanks and Brits may both have a soft spot in their hearts for beer and sports, but when it comes to trusting a company that has suffered a data breach, these two groups of people have quite different opinions. A study by the payment security firm PCI Pal found British folks are far less forgiving…
The Chinese state-sponsored threat actor APT10 used stolen remote access software credentials to infiltrate the network of Norwegian managed services provider Visma last year, likely in an effort to launch secondary attacks against the MSP’s clients. An investigation into the cyber espionage campaign revealed that APT10, aka Stone Panda, used similar tactics to invade the…
Researchers at Trend Micro and RiskIQ have pulled the curtain away from a new Magecart sub-group that managed to insert card skimmer code into more than 200 companies by using a third-party vendor as an unwitting accomplice. The new malicious team, tagged Magecart Group 12, managed to inject their malware into the JavaScript library of…
Neiman Marcus settled a class action lawsuit for $1.5 million that was brought after the department store suffered a data breach in 2014. The settlement was reached with the attorney generals in 43 states and the District of Columbia where the victims resided. The point-of-sale breach took place in 2013, but was not noticed by…
Warby Parker on Thursday disclosed that roughly 198,000 of its customers may have been affected by a credential stuffing attack targeting the eyeglass retail chain. According to a company press release, an unknown cybercriminal actor has been attempting to access Warby Parker customer accounts by leveraging usernames and passwords that were previously stolen from other…
