According to a statement from the Office of the Comptroller of the Currency (OCC), these actions were taken against Capital One “based on the bank’s failure to establish effective risk assessment processes prior to migrating significant information technology operations to the public cloud environment and the bank’s failure to correct the deficiencies in a timely manner”. The breach occurred in March 2019, when a former employee of Capital One named Paige Thomson exfiltrated

"A US fintech giant has admitted that it suffered a breach of customers’ personal data via a third party supplier, after researchers found a database containing millions of records for sale online. LA-based Dave offers digital banking services, and in 2019 hit a valuation of $1bn after just two years in business. However, reports emerged over the past week that its customers’ details were being traded on the dark web. Prolific cybercrime trader ShinyHunters released the trove

"Technical information relating to Avon’s web and mobile sites was inadvertently left exposed on an unsecured Microsoft Azure server. Avon, the cosmetics brand that suffered an alleged ransomware attack in June 2020, has found itself at the centre of a new and significant security incident after inadvertently leaving a Microsoft Azure server exposed to the public internet without password protection or encryption. According to SafetyDetectives, the leaky server contained API

"Names, credit card data, addresses, and information on transactions as recent as yesterday are being sold online. The personal information of what could be hundreds of thousands of Instacart customers is being sold on the dark web. This data includes names, the last four digits of credit card numbers, and order histories, and appears to have affected customers who used the grocery delivery service as recently as yesterday. As of Wednesday, sellers in two dark web stores were

"Walmart has become the latest big-name brand accused of violating California’s new data breach regulations. The retail giant is the subject of a new complaint alleging that customers now face “significant injuries and damage” after an unspecified incident. Customer names, addresses, financial and other information were among the haul for attackers, according to the suit filed in the US District Court for the Northern District of California. “As a result of defendants’ wrongf

"Nearly one million records containing the personal information of online students have been leaked after cloud misconfigurations by five e-learning platforms, according to WizCase. The VPN comparison site found four misconfigured and unencrypted AWS S3 buckets and one unsecured Elasticsearch server, compromising the details of countless e-learners, including many children, as well as their parents and teachers. The personal information (PII) exposed included full names, home

Magecart Gangs Targeting Larger Organizations During Lockdown, Researcher Warns "Jewelry and accessories retailer Claire's says e-commerce platform hackers, using Magecart tactics, have stolen an unknown amount of its customers' payment card data. The attackers appear to have infiltrated the company's Salesforce Commerce Cloud environment for at least seven weeks, although the security firm that spotted the breach says there's no indication that the underlying Salesforce plat

Up to 300,000 Nintendo Accounts were accessed. "Nintendo has revealed that an additional 140,000 user accounts were accessed by unauthorized means back in April. Previously, the company had said that only 160,000 accounts were affected and was slow to acknowledge the problem at the time. The news will come as a worry to those who are concerned about the security of their Nintendo Account and Nintendo Switch, although Nintendo stressed that less than one percent of all Nintend

"SINGAPORE: About 1.5 terabytes of sensitive data was reportedly stolen from a US subsidiary of ST Engineering Aerospace in a massive data breach that was discovered on Friday (Jun 5), according to cybersecurity firm CYFIRMA. In response to queries by CNA, CYFIRMA said its initial investigation showed the breach at VT San Antonio Aerospace started “as early as in March”. It said the stolen data includes contract details with various governments of countries like Peru and Arge

"Attorneys suing the company will now have access to the report in preparation for a potential trial. A judge has ruled that Capital One must release the forensic report prepared by Mandiant following a data breach, of which the company is now being sued over. On Tuesday, Judge John Anderson from the US District Court for the Eastern District of Virginia ruled that Capital One is required to provide a copy of the report to attorneys suing the firm on behalf of customers impac

New "Unc0ver" jailbreak unlocks devices, even those running the current iOS 13.5 release. A team of hackers, security researchers, and reverse engineers have released today a new jailbreak package for iOS devices. By default, Apple does not allow users to have full control over their iPhones and other iOS devices, citing security reasons. Jailbreaks are a type of custom software that works by exploiting bugs in the iOS operating system in order to grant users root access and

"A Detroit-area health care organization is alerting patients that their information may have been compromised in a recent data breach. Beaumont Health, a network of eight hospitals through the Detroit area, said in a letter Friday that “an unauthorized third party” accessed names, birth dates, Social Security numbers and medical conditions about some 112,000 people. Hackers also accessed bank account data and driver’s license numbers about some of those affected, the Detroit

"Health care professionals battling the coronavirus now face a second front in the war -- cyberattacks -- that threaten to disrupt operations and broadcast disinformation. Cyberattacks against health care agencies have skyrocketed in the past decade, with almost 70% of the population affected by a data breach through the theft of personal information and health data. The attacks occur, on average, at a rate of 1.4 a day, according to the HIPAA Journal. But the arrival of the

"SAN FRANCISCO (CN) – A federal judge on Thursday refused to approve a settlement over a 2018 data breach that would force Facebook to submit to independent audits of data security measures for the next five years. U.S. District Judge William Alsup accused lawyers for Facebook and a class of 4 million social network members of using “smoke and mirrors” to obscure what if anything in the agreement is new. “This is very vague to me as to what real benefit anybody is getting out

"Many people think there's no such thing as bad publicity, but while T-Mobile ultimately emerged victorious from a fierce legal battle with 13 state AGs and the Attorney General for the District of Columbia, it's safe to say at least some of the attention garnered by the lawsuit opposing Magenta's merger with Sprint reflected poorly on the Deutsche Telekom-owned "Un-carrier." T-Mobile may however have a much bigger cause for concern already from a brand perception standpoint

Security researchers have discovered a publicly exposed cloud database containing personal data and behavioral profiles on 120 million Americans. Security company UpGuard found the misconfigured Amazon S3 bucket on February 3 this year, eventually tracing it back to market analysis company Tetrad. Around half of the 747GB trove appears to have been sourced from client organizations. It included: data extracted from Chipotle employees’ mobile phones for tracking, a spreadsheet

The infection uses Lemon_Duck PowerShell malware variant to exploit vulnerabilities in embedded devices at manufacturing sites. "A new malware campaign built to exploit flaws in connected devices is targeting manufacturers around the world and affecting products from smart printers to heavy operational equipment. Researchers at TrapX Labs first saw this attack targeting Latin American manufacturers in October 2019. Since then, it has continued to expand, with a peak in Decemb

Twitter discloses security incident involving the abuse of one of its official API features. "In a statement published today, Twitter disclosed a security incident during which third-parties exploited the company's official API (Application Programming Interface) to match phone numbers with Twitter usernames. In an email seeking clarifications about the incident, Twitter told ZDNet that they became aware of exploitation attempts against this API feature on December 24, 2019,

"As a clear indication of how law enforcement views the commercial disclosure of stolen information, the FBI has seized the WeLeakInfo.com domain and international law enforcement arrested two individuals for selling subscriptions to data exposed in breaches. These accessed credentials were then used to conduct attacks in the UK, Germany, and the US. In coordination with the UK NCA, the Netherlands National Police Corps, the German Bundeskriminalamt, and the Police Service of

"The chief executive officer of a telemarketing company in Sherwood, Arkansas has let go 300 employees after the company failed to recover from a ransomware infection months back. In a deeply apologetic letter to employees, The Heritage Company CEO Sandra Franecke said two months ago their servers were attacked by hackers who demanded a ransom to unlock the systems. Despite paying the attackers what they demanded, the company struggled to get back on its feet. The company cou