Security Affairs

DECEMBER 30, 2020

T-Mobile has disclosed a data breach exposing customers’ account’s information. The T-Mobile security staff discovered “malicious, unauthorized access” to their systems. T-Mobile discovered that the attackers had access to the CPNI (Customer Proprietary Network Information).

Data breaches 136

Data breaches Mobile Telecommunications Wireless 136

Security Boulevard

MAY 15, 2024

TABLE OF CONTENTS Understanding HIPAA Mental health apps collect a wealth of personal information Information collection extends past user disclosure Mental health apps may share your information with third parties Can users protect their privacy while using mental health apps?

Advertising 52

Advertising Insurance Accountability Data Analyst 52

Security Affairs

JULY 12, 2021

For the third time in the past four months, LinkedIn seems to have experienced another massive data scrape conducted by a malicious actor. Once again, an archive of data collected from hundreds of millions of LinkedIn user profiles surfaced on a hacker forum, where it’s currently being sold for an undisclosed sum.

Social Engineering 137

Social Engineering Data collection Media Passwords 137

Security Affairs

NOVEMBER 15, 2022

“Google misled its users into thinking they had turned off location tracking in their account settings, when, in fact, Google continued to collect their location information. Location data represent the core of the digital advertising business of the IT giant. ” reads the DoJ’s press release.

Consumer Protection 88

Consumer Protection Accountability Data collection Advertising 88

Security Affairs

NOVEMBER 3, 2020

The scripts developed by the cyber criminal were used to parse log data collected from botnet and searched for personally identifiable information (PII) and account credentials. In some cases, the man manually chacked the stolen information. ” reads the press release published by the DoJ.

Accountability 104

Accountability Banking Advertising Data collection 104

Security Affairs

NOVEMBER 27, 2021

Italy’s antitrust regulator has fined both Apple and Google €10 million each for what it calls are “aggressive” data practices and not providing consumers with clear information on commercial uses of their personal data during the account creation phase.

Data collection 89

Data collection Accountability Hacking Information Security 89

Security Affairs

DECEMBER 29, 2023

Altogether, Meduza makes a great competitor to Azorult , Redline , Racoon , and Vidar Stealer used by cybercriminals for account takeover (ATO), online-banking theft, and financial fraud. The author behind Meduza distributed the following notification about the update on multiple underground communities and Telegram group: Attention!

Password Management 128

Password Management Cryptocurrency Passwords Authentication 128

Security Affairs

SEPTEMBER 1, 2023

“In one case, we observed a SapphireStealer sample where the data collected using the previously described process was exfiltrated using the Discord webhook API, a method we previously highlighted here.” The FUD-Loader malware downloader was also published by the same GitHub account. ” continues the report.

Malware 107

Malware Data collection Architecture Hacking 107

Security Affairs

OCTOBER 17, 2023

’ The CERT-UA also reported that the state-sponsored hackers used compromised VPN accounts that weren’t protected by multi-factor authentication. Authentication data collected by POEMGATE can be used for lateral movement and other malicious activities on the compromised networks. “Note (!)

Telecommunications 108

Telecommunications Authentication Data collection Passwords 108

Security Affairs

APRIL 6, 2023

A package containing features such as 3-D Secure support and support for configuring a phishing website, may cost up to $300. User personal data for sale. Crooks offers data collected through phishing campaign to the subscribers. ” continues the analysis. ” Phishing-as-a-Service. .

Phishing 93

Phishing Scams Social Engineering Banking 93

Hot for Security

MARCH 17, 2021

If you were a victim of the Zynga data breach, you’ve probably changed the password for your account already. But have you considered resetting the passwords for any online accounts with similar login credentials? Users who sign up on the platform mainly provide their personal information directly during the setup process.

Data breaches 105

Data breaches Passwords Accountability Media 105

Security Affairs

JANUARY 2, 2023

Google misled its users into thinking they had turned off location tracking in their account settings, when, in fact, Google continued to collect their location information. According to the article, there are two settings responsible for the location data collection, the “Location History” and “Web & App Activity”.

Consumer Protection 92

Consumer Protection Surveillance Data collection Accountability 92

Security Affairs

NOVEMBER 15, 2022

Avast experts were able to capture several PNG files embedding a data-stealing payload. They pointed out that data collection from victims’ machines using DropBox repository, and attackers use DropBox API for communication with the final stage. They steal data via the DropBox account registered on active Google emails.”

Data collection 91

Data collection Malware Accountability Hacking 91

Security Affairs

AUGUST 28, 2021

This is an enormous amount of data collected from a few small, not well-known mobile games.” ” On Thursday, the team said that users of the following games were involved in the data leak: Rainbow Story: Fantasy MMORPG, Metamorph M, and Dynasty Heroes: Legends of Samkok. Together, they account for over 1.6

Data breaches 121

Data breaches Mobile Data collection Hacking 121

Security Affairs

APRIL 15, 2023

The collected data is sent to the C2 server every two days, but the cycle depends on the remote configuration. The level of data collection depends on the permissions granted to the app using the malicious library.

Data collection 96

Data collection Mobile Malware Education 96

Security Affairs

JANUARY 17, 2021

It is time to re-evaluate Cyber-defence solutions New Zealand central bank hit by a cyber attack TeamTNT botnet now steals Docker API and AWS credentials Connecting the dots between SolarWinds and Russia-linked Turla APT Experts found gained access to the Git Repositories of the United Nations Russian hacker Andrei Tyurin sentenced to 12 years in prison (..)

Banking 82

Banking Data collection Malware Data breaches 82

Security Affairs

SEPTEMBER 3, 2019

The data breach impacted 562,000 subscribers, the forum has been taken offline after the incident. We’ve been alerted that portions of the PHPBB user table from our forums showed up in a leaked data collection.” New breach: XKCD had 562k accounts breached last month. The xkcd forums are currently offline.

Data breaches 84

Data breaches Passwords Advertising Data collection 84

Security Affairs

MAY 15, 2019

A new story of a violation of the user’s privacy made the lines, Twitter revealed that due to a bug is collected and shared iOS location data with a third-party advertising company, Fortunately, only one partner of the micro-blogging firm was involved and the data collection and sharing occurred in certain circumstances.

Advertising 72

Advertising Accountability Data collection Mobile 72

Security Affairs

MAY 12, 2021

An example of this can be traced back to June 2019, when an unauthorized user gained access to Quest Diagnostic’s sensitive data through a billing vendor by the name of the American Medical Collection Agency (AMCA). The culprit gained access to sensitive data of 11.9 SecurityAffairs – hacking, user data).

Data collection 89

Data collection Data breaches VPN Risk 89

Security Affairs

SEPTEMBER 5, 2022

Early occurrences of EvilProxy have been initially identified in connection to attacks against Google and MSFT customers who have MFA enabled on their accounts – either with SMS or Application Token. Once the funds for the subscription are received, they will deposit to the account in customer portal hosted in TOR. Google 2FA.

Phishing 99

Phishing Accountability Hacking Advertising 99

Security Affairs

OCTOBER 27, 2022

Data collected by Microsoft Defender for Endpoint shows that nearly 3,000 devices in almost 1,000 organizations have seen at least one RaspberryRobin payload-related alert in the last 30 days. DEV-0950 group used Clop ransomware to encrypt the network of organizations previously infected with the Raspberry Robin worm.

Ransomware 99

Ransomware Malware Data collection Encryption 99

SecureList

OCTOBER 18, 2023

Using a vulnerability in a legitimate driver and a rootkit, they interfered with the antivirus, intercepted user credentials (many of which were cached on the terminal server, including accounts with administrator privileges on many systems), and began actively moving around the network.

Malware 114

Malware Phishing Internet Internet 114

Security Affairs

MARCH 7, 2021

jailbreaking tool Attackers took over the Perl.com domain in September 2020 Bug bounty hunter awarded $50,000 for a Microsoft account hijack flaw Clop ransomware gang leaks data allegedly stolen from cybersecurity firm Qualys Cyber Defense Magazine – March 2021 has arrived.

Data breaches 67

Data breaches Data collection Ransomware Hacking 67

Centraleyes

NOVEMBER 16, 2023

SOC 2, or System and Organization Controls 2, was developed by the American Institute of Certified Public Accountants (AICPA). The AICPA is a professional organization of certified public accountants in the United States, and it is responsible for creating and maintaining the SOC framework, including SOC 2. Who Developed SOC 2 and Why?

Risk 52

Risk Data collection Backups Accountability 52

Security Affairs

OCTOBER 27, 2022

A simple human error can lead to devastating attacks, from data exfiltration to ransomware,” Sasnauskas said. While these don’t expose either old or new passwords, the logs show the account holder’s email address, and the exact time the password change query was sent can be seen. Information stored on the server is extremely sensitive.

IoT 116

IoT Engineering Passwords Media 116

Security Affairs

SEPTEMBER 18, 2020

Web-phishing targeting various online services almost doubled during the COVID-19 pandemic , it accounted for 46 percent of the total number of fake web pages. They are followed by banking Trojans , whose share in the total amount of malicious attachments showed growth for the first time in a while. Opened email lets spy in.

Phishing 104

Phishing Ransomware Spyware Banking 104

Security Affairs

FEBRUARY 3, 2022

Attackers also used legitimate versions of WinRAR appear for data exfiltration and batch scripts to automate the data collection process. In some cases threat actors staged stolen data for further exfiltration. ” concludes the report that includes IoCs and Yara Rules.

Manufacturing 92

Manufacturing Malware Data collection Encryption 92

SecureList

MARCH 29, 2021

The Internet can provide doxers with all kinds of helpful information, such as the names and positions of employees, including those who occupy key positions in the company. Such key positions include the CEO, HR department director, and chief accountant. Attacks using publicly accessible data: BEC.

Identity Theft 101

Identity Theft Phishing Accountability Banking 101

Security Affairs

DECEMBER 29, 2019

According to Twelve Security , the exposed data includes: User name and email of those who purchased cameras and then connected them to their home 24% of the 2.4 According to Twelve Security , the exposed data includes: User name and email of those who purchased cameras and then connected them to their home 24% of the 2.4

IoT 66

IoT Accountability Advertising Wireless 66

Security Affairs

NOVEMBER 19, 2019

Ransomware accounted for over half of all malicious mailings in H1 2019, Troldesh aka Shade being the most popular tool among cybercriminals. In 2017, password-protected archives accounted for only 0.08% of all malicious objects. Links account for 29%, while attachments—for 71%. rar archive files. Dangerous email.

Ransomware 70

Ransomware Antivirus Malware Banking 70

Malwarebytes

JANUARY 16, 2024

Together, CWRU and the FBI were able to identify that an IP address with which the malware was communicating had also been used to access the alumni email account of a man called Phillip Durachinsky. The IP address was linked to the malware using data collected by CWRU, Malwarebytes, and AT&T.)

Malware 84

Malware Passwords Identity Theft Data collection 84

Security Affairs

MAY 13, 2019

” The social network suspended apps and accounts associated with Rankwave and asked the court to order it to respect its rules for applications. Rankwave apparently misused data collected by his app for checking users’ social media “influencer score”. ” reported Techcrunch.

Advertising 61

Advertising Data collection Marketing Media 61

Centraleyes

APRIL 25, 2024

SOC 2): Service providers often undergo external audits based on SOC criteria, such as SOC 2, to demonstrate their services’ security, availability, processing integrity, confidentiality, and privacy. Collect Evidence Early On An effective strategy for excelling in external audits is to collect evidence early in the process.

Risk 52

Risk Accountability Technology Software 52

Centraleyes

DECEMBER 10, 2023

SOC 2 is the gold standard in Information Security certifications and shows the world just how seriously your company takes Information Security. The audit itself is conducted by an official auditor, often from the “Big-4” (the 4 largest accounting firms in the US) but the preparation isn’t required to be.

Risk 59

Risk Data breaches Software Information Security 59

CyberSecurity Insiders

MARCH 25, 2021

This is why it is essential to your device performance to make sure any endpoints include flexible, secure, default-settings and, in particular, optional mechanisms like password complexity, password expiration, and account lock-out, which forces users to modify the default credentials when setting up the device.

IoT 100

IoT Authentication Passwords Data collection 100

Security Affairs

NOVEMBER 28, 2020

A credible threat actor is offering access to the email accounts of hundreds of C-level executives for $100 to $1500 per account. Access to the email accounts of hundreds of C-level executives is available on the Exploit.in for $100 to $1500 per account. Exploit.in ” reported ZDNet. Pierluigi Paganini.

Accountability 106

Accountability Cybercrime Hacking Retail 106

Security Affairs

JANUARY 27, 2020

Upon discovery of this information, INTERPOL’s ASEAN Desk promptly notified Indonesian cyber police. To access their servers for stolen data collection and their JS-sniffers’ control, they always used VPN to hide their real location and identity. Press release is available here.

Cybercrime 77

Cybercrime Marketing eCommerce Mobile 77