Recent research reveals that organizations have received alarmingly low scores in important sectors of cybersecurity. "The stats are well known about the increasing volume of cyber attacks and the growing number of vulnerabilities. In the face of such an onslaught, you would expect organizations to be upping their game. But the opposite appears to be the case, according to research by Computer Economics, a division of Avasant Research. Based on its IT Management Best practice

"Carnival Corp. announced Wednesday that it was the victim of a ransomware attack that likely got some personal information about the cruise company’s guests and employees. The attack was first detected Saturday. The attack accessed an encrypted portion of technology systems for one of the cruise line’s brands and certain data files were downloaded, the company said in a filing with the U.S. Securities and Exchange Commission. The SEC filing also didn’t say how many people’s

"See that little “closed lock” icon in your web browser, right next to the URL? That means you’re browsing via HTTPS, encrypting your traffic so third parties can’t spy on most of the information you’re sending. But secure-looking HTTPS websites can still house insecure HTTP forms for you to fill in your passwords and other personal data — and Google is planning to do something about that in Chrome 86, coming this October (via 9to5Google). Google’s also disabling autofill on

"The files were retained due to a now-fixed bug, says Instagram. When you delete something from Instagram you expect it to be gone for good. But when security researcher Saugat Pokharel requested a copy of photos and direct messages from the photo-sharing app, he was sent data he’d deleted more than a year ago, showing that the information had never been entirely removed from Instagram’s servers. Instagram says this was due to a bug in its system that it’s now fixed, and Pokh

"Google is experimenting with showing domain names only in Chrome’s address bar instead of full URLs. The feature will be tested in the upcoming Chrome 86 release, with Google hoping the change could protect users against scams and phishing attacks using misleading URLs. Domain names and URLs are one of the most basic forms of web security we have, letting us quickly know where we are online. Sometimes, though, they can be used to mislead. Hackers and scammers often create fa

"TikTok’s Android app collected users’ MAC addresses for 18 months in violation of the platform rules, as discovered by a Wall Street Journal investigation on Tuesday. The addresses would have served as a unique identifier for each user’s device, making them valuable for both advertising and potentially more invasive forms of tracking. By 2015, both iOS’s App Store and the Google Play Store had banned the collection of MAC addresses as a matter of policy, but TikTok was still

"The 2020 US presidential election is less than 100 days away, and in an effort to prevent the foreign election interference that played a role in the 2016 election, the US Department of State announced today that it’s offering up to $10 million for any information that can identify someone who’s been meddling in a US election. Specifically, the State Department is offering the reward for “information leading to the identification or location of any person who works with or f

According to a statement from the Office of the Comptroller of the Currency (OCC), these actions were taken against Capital One “based on the bank’s failure to establish effective risk assessment processes prior to migrating significant information technology operations to the public cloud environment and the bank’s failure to correct the deficiencies in a timely manner”. The breach occurred in March 2019, when a former employee of Capital One named Paige Thomson exfiltrated

"A US fintech giant has admitted that it suffered a breach of customers’ personal data via a third party supplier, after researchers found a database containing millions of records for sale online. LA-based Dave offers digital banking services, and in 2019 hit a valuation of $1bn after just two years in business. However, reports emerged over the past week that its customers’ details were being traded on the dark web. Prolific cybercrime trader ShinyHunters released the trove

"Technical information relating to Avon’s web and mobile sites was inadvertently left exposed on an unsecured Microsoft Azure server. Avon, the cosmetics brand that suffered an alleged ransomware attack in June 2020, has found itself at the centre of a new and significant security incident after inadvertently leaving a Microsoft Azure server exposed to the public internet without password protection or encryption. According to SafetyDetectives, the leaky server contained API

"Garmin is finally giving its users more information about the system outage the company has been dealing with since the morning of July 23rd. The company has just confirmed earlier reports that it was the victim of an external cyber attack that encrypted some of the company’s systems. This attack led to disruption to a host of Garmin’s systems, including “website functions, customer support, customer facing applications and company communications.” Crucially, Garmin says it

"Thousands of organizations become victims to at least one form of cybercrime every year in the U.S, most of which come from foreign countries. This time, the FBI is warning big firms, government, and critical bodies against multiple threats targeting them. What happened? Last week, the FBI spotted new network protocols being abused by cybercriminals to launch large-scale Distributed Denial of Service (DDoS) attacks. According to the report, the FBI has listed three network p

"The COVID-19 pandemic has led to a major boost in cybersecurity job vacancies in the US, data from the Cybersecurity Jobs Report: Q2, has revealed. The study, produced by the International Consortium of Minority Cybersecurity Professionals (ICMCP) and CyberVista, indicates that the shift to remote working in the crisis has led to organizations investing more heavily in protecting themselves from cyber-threats. An estimated 62% of the US workforce has transitioned to working

"Names, credit card data, addresses, and information on transactions as recent as yesterday are being sold online. The personal information of what could be hundreds of thousands of Instacart customers is being sold on the dark web. This data includes names, the last four digits of credit card numbers, and order histories, and appears to have affected customers who used the grocery delivery service as recently as yesterday. As of Wednesday, sellers in two dark web stores were

"Using fake or hacked accounts of high-profile celebrities and brands has been an old trait of cybercriminals to lure victims into various scams. But this time, the massive coordinated attack on the Twitter accounts of the world’s most recognized brands could be called the worst hack of a major social media platform yet. Largest ever crypto scam via Twitter Some hackers took the cryptocurrency scams to a new level, by hijacking the Twitter accounts of a large number of high-p

"LONDON/OTTAWA (Reuters) - Hackers backed by the Russian state are trying to steal COVID-19 vaccine and treatment research from academic and pharmaceutical institutions around the world, Britain’s National Cyber Security Centre (NCSC) said last Thursday. A co-ordinated statement from Britain, the United States and Canada attributed the attacks to group APT29, also known as Cozy Bear, which they said was almost certainly operating as part of Russian intelligence services. “We

"Walmart has become the latest big-name brand accused of violating California’s new data breach regulations. The retail giant is the subject of a new complaint alleging that customers now face “significant injuries and damage” after an unspecified incident. Customer names, addresses, financial and other information were among the haul for attackers, according to the suit filed in the US District Court for the Northern District of California. “As a result of defendants’ wrongf

"Nearly one million records containing the personal information of online students have been leaked after cloud misconfigurations by five e-learning platforms, according to WizCase. The VPN comparison site found four misconfigured and unencrypted AWS S3 buckets and one unsecured Elasticsearch server, compromising the details of countless e-learners, including many children, as well as their parents and teachers. The personal information (PII) exposed included full names, home

"The Federal Bureau of Investigation has issued a warning to air travelers to be wary of bogus US airport websites when booking flights online. Cyber-supervisory special agent Conal Whetten spoke to members of the press on Wednesday to raise awareness regarding the creation of a number of websites cleverly faked to look like the real deal. Whetten said these spoofed domains, which grow increasingly sophisticated as cyber-criminals hone their skills for mimicry, posed a real t

"A new phishing campaign uses a trio of enterprise cloud services, Microsoft Azure, Microsoft Dynamics, and IBM Cloud, as part of an attempt to steal your login credentials. BleepingComputer recently analyzed a new phishing campaign that pretends to from a help desk named “servicedesk.com” that mimics similar wording used by real IT helpdesk domains in corporate environments. The email imitates a “quarantined mail” notification frequently sent out in workplaces by email secu