Blog

Data breaches are becoming an expensive predicament for all of us, even if your data isn’t directly stolen in a breach.

The latest IBM 2024 Cost of a Data Breach Report, released in July, reveals that when companies suffer these breaches, they often pass the hefty costs onto their customers. And data breaches are becoming extremely pricey, especially for small and medium sized businesses.

The cost of data breaches

According to the report, the global average cost of a data breach in 2024 has skyrocketed to $4.88 million! That’s a staggering 10% jump from the previous year! This study was carried out by the Ponemon Institute and sponsored and analyzed by IBM. It took a deep dive into data breaches at 604 organizations worldwide. They talked to over 3,500 security and business leaders who lived through these breaches to get the inside scoop. 

Why are data breaches so expensive? Lost business, including downtime and customers going elsewhere, is a huge factor driving the increase. So is the cost of responding to the breach, including staffing up customer service help desks and regulatory fines for failing to protect data.

Who pays the price? You do.

Here’s where it gets personal: more than half of the organizations hit by data breaches pass those costs directly to consumers by charging more for goods and services. That’s right, when a company gets hacked, most will raise their prices to cover the damages. This year, 63% of businesses said they’re upping prices because of data breaches, compared to 57% last year. While many factors contribute to products becoming more expensive, data breaches are part of the equation in many cases now.

The human factor

One big reason these breaches are so costly is that cybersecurity teams are often understaffed. Over half of the companies surveyed said they’re struggling with severe staffing shortages in their security departments. And as companies rush to adopt new AI technologies, the pressure on these already overwhelmed teams is only increasing.

What are hackers stealing?

The report found that nearly half (46%) of all data breaches involve customer personal information like Social Security numbers, emails, phone numbers, and home addresses. Intellectual property, like trade secrets, was stolen in 43% of breaches.

The financial fallout

The costs associated with data breaches aren’t just about fixing the security hole. Businesses hemorrhage money due to system downtime, losing customers, and damaging their reputation. They also spend big on setting up call centers, providing credit monitoring services, and paying regulatory fines. This year, these lost business and response costs totaled a whopping $2.8 million per breach, the highest in the last six years.

What helps and what hurts

The report also examined what factors can make these costs go up or down.  

What saved money?  

• Employee training
• Using AI to catch threats early and make responses faster 

What increased costs? 

• Complex security systems
• Not having enough skilled security staff
• Breaches via third-party vendors (like supply chains) were top cost drivers 

What can we do? 

Understanding the dynamics of data breaches and increased customer prices is crucial. Businesses need to invest in strong cybersecurity measures and train their employees well. Making security systems easier for everyone to understand and addressing the cybersecurity skills gap can also help reduce the impact of breaches. The 2024 report is a stark reminder of how interconnected our economy is and why robust cybersecurity is more important than ever.

Credits: Stay Safe Online

An enormous amount of sensitive information including Social Security numbers for millions of people could be in the hands of a hacking group after a data breach and may have been released on an online marketplace, The Los Angeles Times reported this week.

The hacking group USDoD claimed it had allegedly stolen personal records of 2.9 billion people from National Public Data, according to a class-action lawsuit filed in U.S. District Court in Fort Lauderdale, Florida, reported by Bloomberg Law. The breach was believed to have happened in or around April, according to the lawsuit.

Here’s what to know about the alleged data breach.

Social security hack:National Public Data confirms massive data breach included Social Security numbers.

What information is included in the data breach?

The class-action law firm Schubert, Jonckheer & Kolbe said in a news release that the stolen file includes 277.1 gigabytes of data, and includes names, address histories, relatives and Social Security numbers dating back at least three decades.

According to a post from a cybersecurity expert on X, formerly Twitter, USDoD claims to be selling the 2.9 billion records for citizens of the U.S., U.K. and Canada on the dark web for $3.5 million.

Since the information was posted for sale in April, others have released different copies of the data, according to the cybersecurity and technology news site Bleeping Computer.

A hacker known as “Fenice” leaked the most complete version of the data for free on a forum in August, Bleeping Computer reported.

The news you need to start your day smart. Sign up for USA TODAY’s Daily Briefing newsletter.

2025 COLA:Estimate dips with inflation, but high daily expenses still burn seniors

What is National Public Data?

National Public Data is a Florida-based background check company operated by Jerico Pictures, Inc. USA TODAY has reached out to National Public Data for comment.

The company has not publicly confirmed a data breach, but The Los Angeles Times reported that it has been telling people who contacted via email that “we are aware of certain third-party claims about consumer data and are investigating these issues.”

What to do if you suspect your information has been stolen

If you believe your information has been stolen or has appeared on the dark web, there are a few steps you can take to prevent fraud or identity theft.

We recommend taking the following steps:

• Make sure your antivirus is up to date and perform security scans on all your devices. If you find malware, most antivirus programs should be able to remove it, but in some cases you may need professional help.
• Update your passwords for bank accounts, email accounts and other services you use, and make sure they are strong and different for every account. Include uppercase and lowercase letters, numbers and punctuation marks, and never use personal information that a hacker could guess.
• Use multifactor authentication for any accounts or services that offer it to ensure you are the person logging in.
• Check your credit report, and report any unauthorized use of of your credit cards. If you notice any suspicious activity, you can ask credit bureaus to freeze your credit.
• Be careful with your email and social media accounts, and beware of phishing, an attempt to get your personal information by misrepresenting who a message or email is from.

Credits: USA Today

More and more websites and services are making multi-factor-authentication (MFA) mandatory, which makes it much harder for cybercriminals to access your accounts. That’s a great thing. But as security evolves, so do cybercriminals who are always looking for new ways to scam us.

A type of phishing we’re calling authentication-in-the-middle is showing up in online media. While these techniques, named after man-in-the-middle (MitM) attacks, have existed for a while, they appear to be gaining traction now.

It works like this: A user gets lured to a phishing site masquerading as a site they normally use, such as a bank, email or social media account. Once the user enters their login into the fake site, that information gets redirected by the cybercriminals to the actual site, without the user knowing.

The user is then prompted for their MFA step. They complete this, usually by entering a code or accepting a push notification, and this information is then relayed to the criminals, allowing them to login to the site.

Once the criminals are into an account, they can start changing settings like the account’s email address, phone number, and password, so the user can no longer log in, or they can simply clean out a bank account. This may help you understand why many platforms ask for your PIN or other authentication again when you try to change one of these important settings.

Victims are lured to phishing sites like these via links from social media or emails where it can be hard to identify the real link.  Phishing sites can even show up in sponsored search results, in the same way as we reported about tech support scams.

How to protect yourself from authentication-in-the-middle attacks

• Keep your wits about you. Being aware of how scammers work is the first step to avoiding them. Don’t assume sponsored search results are legit, and trust that if something seems suspicious then it probably is.
• Use security software. Many security programs block known phishing sites, although domains are often short-lived and get rotated quickly. Malwarebytes Browser Guard can help protect you.
• Use a password manager. Password managers will not auto-fill a password to a fake site, even if it looks like the real deal to you.
• Consider passkeys. Multi-factor authentication is still super-important to enable, and will protect you from many types of attacks, so please continue to use it. However, authentication-in-the-middle attacks only work with certain types of MFA, and passkeys won’t allow the cybercriminals to login to your account in this way. Many services have already begun using passkeys and they’re no doubt here to stay.

Credit: malwarebytes.com

For the most popular operating system in the world—which is Android and it isn’t even a contest—there’s a sneaky cyberthreat that can empty out a person’s bank accounts to fill the illicit coffers of cybercriminals.

These are “Android banking trojans,” and, according to our 2024 ThreatDown State of Malware report, Malwarebytes detected an astonishing 88,500 of them last year alone.

While the 2024 ThreatDown State of Malware report focuses heavily on the corporate security landscape today, make no mistake: Android banking trojans pose a serious threat to everyday users. They are well-disguised, hard to detect in regular use, and are a favorite hacking tool for cybercriminals who want to automate the theft of online funds for themselves.

What are Android banking trojans?

The idea behind Android banking trojans—and all cyber trojans—is simple: Much like the fabled “Trojan Horse” which, the story goes, carried a violent surprise for the city of Troy, Android banking trojans can be found on the internet disguised as benign, legitimate mobile apps that, once installed on a device, reveal more sinister intentions.  

By masquerading as everyday mobile apps for things like QR code readers, fitness trackers, and productivity or photography tools, Android banking trojans intercept a person’s online interest in one app, and instead deliver a malicious tool that cybercriminals can abuse later on.

But modern devices aren’t so faulty that an errant mobile app download can lead to full device control or the complete revelation of all your private details, like your email, social media, and banking logins. Instead, what makes Android banking trojans so tricky is that, once installed, they present legitimate-looking permissions screens that ask users to grant the new app all sorts of access to their device, under the guise of improving functionality.

Take the SharkBot banking trojan, which Malwarebytes detects and stops. Last year, Malwarebytes found this Android banking trojan hiding itself as a file recovery tool called “RecoverFiles.” Once installed on a device, “RecoverFiles” asked for access to “photos, videos, music, and audio on this device,” along with extra permissions to access files, map and talk to other apps, and even send payments via Google Play.

These are just the sorts of permissions that any piece of malware needs to dig into your personally identifiable information and your separate apps to steal your usernames, passwords, and other important information that should be kept private and secure.

Still, the tricks behind “RecoverFiles” aren’t yet over.

Not only is the app a clever wrapper for an Android banking trojan, it could also be considered a hidden wrapper. Once installed on a device, the “RecoverFiles” app icon itself does not show up on a device’s home screen. This stealth maneuver is similar to the features of stalkerware-type apps, which can be used to non-consensually spy on another person’s physical and digital activity.

But in the world of Android banking trojan development, cybercrminals have devised far more devious schemes than simple camouflage.

Slipping under the radar

The problem with the Ancient Greeks’ Trojan Horse strategy is that it could only work once—if you don’t sack Troy the first time, you better believe Troy is going to implement some strict security controls on all future big horse gifts.

The makers of Android banking trojans have to overcome similar (and far more advanced) security measures from Google. As the Google Play store has become the go-to marketplace for Android apps, cybercriminals try to place their malicious apps on Google Play to catch the highest number of victims. But Google Play’s security measures frequently detect malware and prevent it from being listed.

So, what’s a cybercriminal to do?

In these instances, cybercriminals make an application that is seemingly benign, but, once installed on a device, executes a line of code that actually downloads malware from somewhere else on the internet. This is how cybercriminals recently snuck their malware onto Google Play and potentially infected more than 100,000 users with the Anatsa banking trojan.

What was most concerning in this attack was that the malicious apps that made it onto the Google Play store reportedly worked for their intended purposes—the PDF reader read PDFs, the file manager managed files. But hidden within the apps’ coding, users were actually downloading a set of instructions that directed their devices to install malware.

These malicious packages are sometimes called “malware droppers” as the apps “drop” malware onto a device at a later time.  

What does it all mean for me?

There’s a lot of technical machinery at work inside any Android banking trojan that is put in place to accomplish a rather simple end goal, which is stealing your money.

All the camouflage, subterfuge, and hidden code execution is part of a longer attack chain in which Android banking trojans steal your passwords and personally identifiable information, and then use that information to take your money.

As we wrote in the 2024 ThreatDown State of Malware report:

“Once it has accessibility permissions, the malware initializes its Automated TransferSystem (ATS) framework, a complex set of scripts and commands designed to perform automated banking transactions without user intervention. The ATS framework uses the harvested credentials to initiate unauthorized money transfers to accounts held by the attacker. This mimics real user behavior to bypass fraud detection systems.”

Staying safe from Android banking trojans

Protecting yourself from Android banking trojans is not as simple as, say, spotting grammatical mistakes in a phishing email or refusing to click any links sent in text messages from unknown numbers. But just because Android banking trojans are harder to detect by eye does not mean that they’re impossible to stop.

Malwarebytes Premium provides real-time protection to detect and stop Android banking trojans that are accidentally installed on your devices. It doesn’t matter if the banking trojan is simply a malicious app in a convenient package, or if the banking trojan is downloaded through a “malware dropper”—Malwarebytes Premium provides 24/7 cybersecurity coverage and stops dangerous attacks before they can be carried out.

A malicious package uploaded to the npm registry has been found deploying a sophisticated remote access trojan on compromised Windows machines.

The package, named “oscompatible,” was published on January 9, 2024, attracting a total of 380 downloads before it was taken down.

oscompatible included a “few strange binaries,” according to software supply chain security firm Phylum, including a single executable file, a dynamic-link library (DLL) and an encrypted DAT file, alongside a JavaScript file.

This JavaScript file (“index.js”) executes an “autorun.bat” batch script but only after running a compatibility check to determine if the target machine runs on Microsoft Windows.

If the platform is not Windows, it displays an error message to the user, stating the script is running on Linux or an unrecognized operating system, urging them to run it on “Windows Server OS.”

The batch script, for its part, verifies if it has admin privileges, and if not, runs a legitimate Microsoft Edge component called “cookie_exporter.exe” via a PowerShell command.

Attempting to run the binary will trigger a User Account Control (UAC) prompt asking the target to execute it with administrator credentials.

In doing so, the threat actor carries out the next stage of the attack by running the DLL (“msedge.dll”) by taking advantage of a technique called DLL search order hijacking.

The trojanized version of the library is designed to decrypt the DAT file (“msedge.dat”) and launch another DLL called “msedgedat.dll,” which, in turn, establishes connections with an actor-controlled domain named “kdark1[.]com” to retrieve a ZIP archive.

The ZIP file comes fitted with the AnyDesk remote desktop software as well as a remote access trojan (“verify.dll”) that’s capable of fetching instructions from a command-and-control (C2) server via WebSockets and gathering sensitive information from the host.

It also “installs Chrome extensions to Secure Preferences, configures AnyDesk, hides the screen, and disables shutting down Windows, [and] captures keyboard and mouse events,” Phylum said.

While “oscompatible” appears to be the only npm module employed as part of the campaign, the development is once again a sign that threat actors are increasingly targeting open-source software (OSS) ecosystems for supply chain attacks.

“From the binary side, the process of decrypting data, using a revoked certificate for signing, pulling other files from remote sources, and attempting to disguise itself as a standard Windows update process all along the way is relatively sophisticated compared to what we normally see in OSS ecosystems,” the company said.

The disclosure comes as cloud security firm Aqua revealed that 21.2% of the top 50,000 most downloaded npm packages are deprecated, exposing users to security risks. In other words, the deprecated packages are downloaded an estimated 2.1 billion times weekly.

This includes archived and deleted GitHub repositories associated with the packages as well as those that are maintained without a visible repository, commit history, and issue tracking.

“This situation becomes critical when maintainers, instead of addressing security flaws with patches or CVE assignments, opt to deprecate affected packages,” security researchers Ilay Goldman and Yakir Kadkoda said.

“What makes this particularly concerning is that, at times, these maintainers do not officially mark the package as deprecated on npm, leaving a security gap for users who may remain unaware of potential threats.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

Network and security giant Cloudflare and password manager maker 1Password said hackers briefly targeted their systems following a recent breach of Okta’s support unit.

Both Cloudflare and 1Password said their recent intrusions were linked to the Okta breach, but that the incidents did not affect their customer systems or user data.

“We immediately terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing,” said 1Password chief technology officer Pedro Canahuati in a blog post. “We’ve confirmed that this was a result of Okta’s support system breach,” said Canahuati.

Okta, which provides single sign-on technology to companies and organizations, said late on Friday that hackers had broken into its customer support unit and stole files uploaded by its customers for diagnosing technical problems. These files include browser recording sessions that can contain sensitive user credentials, such as cookies and session tokens, which if stolen can allow hackers to impersonate user accounts.

Okta spokesperson Vitor De Souza told TechCrunch that about 1% of its 17,000 corporate customers — or 170 organizations — were affected by its breach.

In an attached report detailing the security incident, 1Password said the hackers used a session token from a file that had been uploaded by a member of the IT team earlier in the day to Okta’s support unit system for troubleshooting. The session token allowed the hackers to use the IT member’s account without needing their password or two-factor code, granting the hacker limited access to 1Password’s Okta dashboard.

1Password said the incident occurred on September 29, two weeks before Okta went public with details of the incident.

Cloudflare also confirmed in a blog post on Friday that hackers similarly targeted its systems using a session token stolen from Okta’s support unit. Cloudflare’s chief information security officer Grant Bourzikas said Cloudflare’s incident, which began on October 18, resulted in “no access from the threat actor to any of our systems or data,” in large part because Cloudflare uses hardware security keys that evade phishing attacks.

Security company BeyondTrust said it was also affected by Okta’s breach, but that it also quickly shut down its intrusion. In a blog post, BeyondTrust said it notified Okta of the incident on October 2, but accused Okta of not acknowledging the breach for almost three weeks.

This is Okta’s latest security incident, following the theft of some of its source code in December 2022, and an incident earlier in January 2022 where hackers posted screenshots of Okta’s internal network.

Okta’s stock price dropped more than 11% on Friday — wiping at least $2 billion off the company’s value — following news of the breach, which was first reported by security journalist Brian Krebs.