#cybercrime

Aug 18, 2020
1 min

Google is testing domain-only URLs in Chrome to help foil scams and phishing

"Google is experimenting with showing domain names only in Chrome’s address bar instead of full URLs. The feature will be tested in the upcoming Chrome 86 release, with Google hoping the change could protect users against scams and phishing attacks using misleading URLs. Domain names and URLs are one of the most basic forms of web security we have, letting us quickly know where we are online. Sometimes, though, they can be used to mislead. Hackers and scammers often create fa

Aug 12, 2020
1 min

TikTok collected device identifiers for over a year in violation of Android policies

"TikTok’s Android app collected users’ MAC addresses for 18 months in violation of the platform rules, as discovered by a Wall Street Journal investigation on Tuesday. The addresses would have served as a unique identifier for each user’s device, making them valuable for both advertising and potentially more invasive forms of tracking. By 2015, both iOS’s App Store and the Google Play Store had banned the collection of MAC addresses as a matter of policy, but TikTok was still

Jul 30, 2020
1 min

US Digital Bank Dave Admits Customer Data Breach

"A US fintech giant has admitted that it suffered a breach of customers’ personal data via a third party supplier, after researchers found a database containing millions of records for sale online. LA-based Dave offers digital banking services, and in 2019 hit a valuation of $1bn after just two years in business. However, reports emerged over the past week that its customers’ details were being traded on the dark web. Prolific cybercrime trader ShinyHunters released the trove

Jul 29, 2020
1 min

Cosmetics firm Avon faces new cyber security incident

"Technical information relating to Avon’s web and mobile sites was inadvertently left exposed on an unsecured Microsoft Azure server. Avon, the cosmetics brand that suffered an alleged ransomware attack in June 2020, has found itself at the centre of a new and significant security incident after inadvertently leaving a Microsoft Azure server exposed to the public internet without password protection or encryption. According to SafetyDetectives, the leaky server contained API

Jul 28, 2020
1 min

Garmin confirms a cyber attack took its systems offline

"Garmin is finally giving its users more information about the system outage the company has been dealing with since the morning of July 23rd. The company has just confirmed earlier reports that it was the victim of an external cyber attack that encrypted some of the company’s systems. This attack led to disruption to a host of Garmin’s systems, including “website functions, customer support, customer facing applications and company communications.” Crucially, Garmin says it

Jul 27, 2020
1 min

Black Threat Clouds Loom Over U.S. Organizations: The FBI Warns

"Thousands of organizations become victims to at least one form of cybercrime every year in the U.S, most of which come from foreign countries. This time, the FBI is warning big firms, government, and critical bodies against multiple threats targeting them. What happened? Last week, the FBI spotted new network protocols being abused by cybercriminals to launch large-scale Distributed Denial of Service (DDoS) attacks. According to the report, the FBI has listed three network p

Jul 20, 2020
1 min

Russia trying to steal COVID-19 vaccine data, say UK, U.S. and Canada

"LONDON/OTTAWA (Reuters) - Hackers backed by the Russian state are trying to steal COVID-19 vaccine and treatment research from academic and pharmaceutical institutions around the world, Britain’s National Cyber Security Centre (NCSC) said last Thursday. A co-ordinated statement from Britain, the United States and Canada attributed the attacks to group APT29, also known as Cozy Bear, which they said was almost certainly operating as part of Russian intelligence services. “We

Jul 20, 2020
1 min

Walmart Sued Under CCPA After Data Breach

"Walmart has become the latest big-name brand accused of violating California’s new data breach regulations. The retail giant is the subject of a new complaint alleging that customers now face “significant injuries and damage” after an unspecified incident. Customer names, addresses, financial and other information were among the haul for attackers, according to the suit filed in the US District Court for the Northern District of California. “As a result of defendants’ wrongf

Jul 20, 2020
1 min

One Million Online Student Records Exposed by E-Learning Sites

"Nearly one million records containing the personal information of online students have been leaked after cloud misconfigurations by five e-learning platforms, according to WizCase. The VPN comparison site found four misconfigured and unencrypted AWS S3 buckets and one unsecured Elasticsearch server, compromising the details of countless e-learners, including many children, as well as their parents and teachers. The personal information (PII) exposed included full names, home

Jul 20, 2020
1 min

FBI Issues Cybersecurity Warning to Air Travelers

"The Federal Bureau of Investigation has issued a warning to air travelers to be wary of bogus US airport websites when booking flights online. Cyber-supervisory special agent Conal Whetten spoke to members of the press on Wednesday to raise awareness regarding the creation of a number of websites cleverly faked to look like the real deal. Whetten said these spoofed domains, which grow increasingly sophisticated as cyber-criminals hone their skills for mimicry, posed a real t

Jun 16, 2020
1 min

Claire's: Magecart E-Commerce Hackers Stole Card Data

Magecart Gangs Targeting Larger Organizations During Lockdown, Researcher Warns "Jewelry and accessories retailer Claire's says e-commerce platform hackers, using Magecart tactics, have stolen an unknown amount of its customers' payment card data. The attackers appear to have infiltrated the company's Salesforce Commerce Cloud environment for at least seven weeks, although the security firm that spotted the breach says there's no indication that the underlying Salesforce plat

Mar 9, 2020
1 min

Judge Demands More Details on Facebook Data Breach Settlement

"SAN FRANCISCO (CN) – A federal judge on Thursday refused to approve a settlement over a 2018 data breach that would force Facebook to submit to independent audits of data security measures for the next five years. U.S. District Judge William Alsup accused lawyers for Facebook and a class of 4 million social network members of using “smoke and mirrors” to obscure what if anything in the agreement is new. “This is very vague to me as to what real benefit anybody is getting out

Mar 5, 2020
1 min

T-Mobile customers hit by another data breach exposing a bunch of sensitive information

"Many people think there's no such thing as bad publicity, but while T-Mobile ultimately emerged victorious from a fierce legal battle with 13 state AGs and the Attorney General for the District of Columbia, it's safe to say at least some of the attention garnered by the lawsuit opposing Magenta's merger with Sprint reflected poorly on the Deutsche Telekom-owned "Un-carrier." T-Mobile may however have a much bigger cause for concern already from a brand perception standpoint

Mar 4, 2020
1 min

Casinos in Las Vegas Hit by Suspected Ransomware Attack

“We are actively monitoring the situation” "Slot machines in two Las Vegas casinos were out of action for almost a week in an incident that bears all the hallmarks of a ransomware attack. Investigations are currently underway by the Nevada State Game Control Board, which told us it is “actively monitoring the situation”. Four Queens Hotel and Casino and Binion’s Casino in downtown Las Vegas are open for business but for several days were only able to trade in cash, while star

Feb 27, 2020
1 min

BARBARA CORCORAN 'SHARK' GETS HOOKED FOR $380K In Email Phishing Scam

"Shark Tank" star Barbara Corcoran is missing nearly $400,000 Wednesday morning after her office was victimized by email scammers who used a tiny typo to gain the upper hand. The scam started last week when an email chain was forwarded to Barbara's bookkeeper, a woman named Christine. Folks on Barbara's team tell us the email appeared to have been sent from Barbara's executive assistant, Emily ... and it informed Christine she had the green light to pay $388,700.11 to a compa

Nov 27, 2019
1 min

Sale of 4 Million Stolen Cards Tied to Breaches at 4 Restaurant Chains.

On Nov. 23, one of the cybercrime underground’s largest bazaars for buying and selling stolen payment card data announced the immediate availability of some four million freshly-hacked debit and credit cards. KrebsOnSecurity has learned this latest batch of cards was siphoned from four different compromised restaurant chains that are most prevalent across the midwest and eastern United States. Two financial industry sources who track payment card fraud and asked to remain ano