Cyber Training Group International (CTGI)

Tag: data breach

  • Mega Facebook data breach sees Meta fined $277m

    Mega Facebook data breach sees Meta fined $277m

    There’s some bad news for Meta, in the form of a $277 million fine related to a data breach which impacted no fewer than 500 million users. The fine, issued by the Irish Data Protection Commission, is a result of the fallout from scraped data posted to a hacking forum in 2019. As The Guardian notes, this brings the current running tally of fines to close to a billion dollars in fines from the EU since September 2021. How did we arrive at this increasingly spectacular figure?

    Making contact in the worst way possible

    It all went wrong for Meta this time around thanks to a Contacts Import tool, designed to connect phone numbers with Facebook IDs. Attackers figured out a way to scrape user information and then used it to build up a profile of the users.

    This data eventually worked its way onto the forum. It contained a wealth of data including name, gender, DOB, mobile number, emails, and more.

    From the Data Protection Commission website statement:

    “The decision, which was adopted on Friday, 25 November 2022, records findings of infringement of Articles 25(1) and 25(2) GDPR. The decision imposed a reprimand and an order requiring MPIL to bring its processing into compliance by taking a range of specified remedial actions within a particular timeframe.”

    Which articles were infringed?

    Article 25(1) and Article 25(2) are the rules where Meta found itself in hot water with the DPC, which are summarised below:

    Article 25(1): 

    “…the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.”

    Article 25(2):

    “The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons.”

    This infringement of the GDPR articles was enough to eventually result in the eye-watering fine given to Meta. Quite the blow, considering it wasn’t so long ago that a $419m fine was applied as a result of breaches of children’s privacy rights on Instagram.

    Scrape it to make it

    Scraping data remains a major thorn in the side for social networks and other sites responsible for the safety of user data. Just recently, Twitter has felt the fallout of scraped user data which includes phone numbers and email addresses. Elsewhere, LinkedIn is going legal to prevent users scraping data only available for logged in members.

    Will these fines have any lasting impact on social media giants to change behaviour and proactively shore up the defences which are breached time and again? Or will the increasingly visible phrase “Just the cost of doing business here” become the norm as big business sets aside large amounts for a rainy and fine laden day?

    We have to hope it’s the former and not the latter, because the last thing we need to see creeping in against the onset of large fines is complacency. It’s crucial that companies entrusted with our data do everything possible to prevent the scraping of data, from tools specifically about making data connections in the first place.

    Credits: Malware Bytes Lab

  • Major password manager suffers another security breach

    Major password manager suffers another security breach

    LastPass maintains that passwords remain safely encrypted.

    Password manager LastPass announced Wednesday it had suffered its second data breach in three months. CEO Karim Toubba said the company recently detected unusual activity within a third-party cloud storage service that is shared by LastPass and affiliate GoTo. He said an investigation was immediately launched into the incident by security firm Mandiant and that law enforcement had been alerted.

    “We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture,” Toubba said.

    LastPass is working to identify what specific information has been accessed and the scope of the incident. 

    Products and services remain fully functional, and LastPass said it continues to deploy enhanced security measures and monitoring capabilities across its infrastructure. Toubba said further updates would be provided as LastPass learns more details. 

    In August, LastPass said an unauthorized party had gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.

    Following an investigation, Toubba said in September that the threat actor’s activity had been limited to a four-day period and confirmed that there is no evidence this incident involved any access to customer data or encrypted password vaults. “We recognize that security incidents of any sort are unsettling but want to assure you that your personal data and passwords are safe in our care,” he said then.

    Credits: Fox News

  • Nine WiFi routers used by millions were vulnerable to 226 flaws

    Nine WiFi routers used by millions were vulnerable to 226 flaws

    Security researchers analyzed nine popular WiFi routers and found a total of 226 potential vulnerabilities in them, even when running the latest firmware.

    The tested routers are made by Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys, and are used by millions of people.

    The front-runners in terms of the number of vulnerabilities are the TP-Link Archer AX6000, having 32 flaws, and the Synology RT-2600ac, which has 30 security bugs.

    High-severity flaws affecting TP-Link Archer AX6000
    High-severity flaws affecting TP-Link Archer AX6000
    Source: IoT Inspector

    The testing process

    Researchers at IoT Inspector carried out the security tests in collaboration with CHIP magazine, focusing on models used mainly by small firms and home users.

    “For Chip’s router evaluation, vendors provided them with current models, which were upgrade to the latest firmware version,” Florian Lukavsky, CTO & Founder at IoT Inspector, told BleepingComputer via email.

    “The firmware versions were automatically analyzed by IoT Inspector and checked for more than 5,000 CVEs and other security issues.”

    Their findings showed that many of the routers were still vulnerable to publicly disclosed vulnerabilities, even when using the latest firmware, as illustrated in the table below.

    Router models and flaws categorized as per their severity
    Router models and flaws categorized as per their severity
    Source: CHIP
    Left column translated by BleepingComputer

    While not all flaws carried the same risk, the team found some common problems that affected most of the tested models:

    • Outdated Linux kernel in the firmware
    • Outdated multimedia and VPN functions
    • Over-reliance on older versions of BusyBox
    • Use of weak default passwords like “admin”
    • Presence of hardcoded credentials in plain text form

    Jan Wendenburg, the CEO of IoT Inspector, noted that one of the most important ways of securing a router is to change the default password when you first configure the device.

    “Changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network.” explained Wendenburg.

    “The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto ‘plug, play and forget’.”

    Also Read: HACKERS DEPLOY LINUX MALWARE, WEB SKIMMER ON E-COMMERCE SERVERS

    Extracting an encryption key

    The researchers didn’t publish many technical details about their findings, except for one case concerning the extraction of the encryption key for D-Link router firmware images.

    The team found a way to gain local privileges on a D-Link DIR-X1560 and get shell access via the physical UART debug interface.

    Next, they dumped the whole filesystem using built-in BusyBox commands and then located the binary responsible for the decryption routine.

    By analyzing the corresponding variables and functions, the researchers eventually extracted the AES key used for the firmware encryption.

    Deriving the AES key on CyberChef
    Deriving the AES key on CyberChef
    Source: IoT Inspector

    Using that key, a threat actor can send malicious firmware image updates to pass verification checks on the device, potentially planting malware on the router.

    Such problems can be solved with full-disk encryption that secures locally stored images, but this practice is not common.

    Manufacturers responded quickly

    All of the affected manufacturers responded to the researchers’ findings and released firmware patches.

    CHIP’s author Jörg Geiger commented that the router vendors addressed most of the security flaws identified by the working group, but not all of them.

    The researchers have told Bleeping Computer that the unpatched flaws are mostly lower importance vulnerabilities. However, they clarified that no follow-up tests were done to confirm that the security updates fixed the reported issues.

    The vendor responses to CHIP (translated) were the following:

    • Asus: Asus examined every single point of the analysis and presented us with a detailed answer. Asus has patched the outdated BusyBox version, and there are also updates for “curl” and the web server. The pointed out that password problems were temp files that the process removes when it is terminated. They do not pose a risk.
    • D-Link: D-Link thanked us briefly for the information and published a firmware update that fixes the problems mentioned.
    • Edimax: Edimax doesn’t seem to have invested too much time in checking the problems, but at the end there was a firmware update that fixed some of the gaps.
    • Linksys: Linksys has taken a position on all issues classified as “high” and “medium”. Default passwords will be avoided in the future; there is a firmware update for the remaining problems.
    • Netgear: At Netgear they worked hard and took a close look at all problems. Netgear sees some of the “high” issues as less of a problem. There are updates for DNSmasq and iPerf, other reported problems should be observed first.
    • Synology: Synology is addressing the issues we mentioned with a major update to the Linux kernel. BusyBox and PHP will be updated to new versions and Synology will soon be cleaning up the certificates. Incidentally, not only the routers benefit from this, but also other Synology devices.
    • TP-Link: With updates from BusyBox, CURL and DNSmasq, TP-Link eliminates many problems. There is no new kernel, but they plan more than 50 fixes for the operating system

    If you are using any of the models mentioned in the report, you are advised to apply the available security updates, enable “automatic updates”, and change the default password to one that is unique and strong.

    Additionally, you should disable remote access, UPnP (Universal Plug and Play), and the WPS (WiFi Protected Setup) functions if you’re not actively using them.

    Bleeping Computer has contacted all of the affected manufacturers requesting a comment on the above, and we will update this piece as soon as we receive their response.

    Credits: BleepingComputer.com

  • Hackers deploy Linux malware, web skimmer on e-commerce servers

    Hackers deploy Linux malware, web skimmer on e-commerce servers

    Security researchers discovered that attackers are also deploying a Linux backdoor on compromised e-commerce servers after injecting a credit card skimmer into online shops’ websites.

    The PHP-coded web skimmer (a script designed to steal and exfiltrate customers’ payment and personal info) is added and camouflaged as a .JPG image file in the /app/design/frontend/ folder.

    The attackers use this script to download and inject fake payment forms on checkout pages displayed to customers by the hacked online shop.

    “We found that the attacker started with automated eCommerce attack probes, testing for dozens of weaknesses in common online store platforms,” the Sansec Threat Research Team revealed.

    “After a day and a half, the attacker found a file upload vulnerability in one of the store’s plugins. S/he then uploaded a webshell and modified the server code to intercept customer data.”

    Linux malware undetected by security software

    The Golang-based malware, spotted by Dutch cyber-security company Sansec on the same server, was downloaded and executed on breached servers as a linux_avp executable.

    Once launched, it immediately removes itself from the disk and camouflages itself as a “ps -ef” process that would be used to get a list of currently-running processes.

    Also Read: These 23 fake Android apps are dangerous spyware, so delete them now

    While analyzing the linux_avp backdoor, Sansec found that it waits for commands from a Beijing server hosted on Alibaba’s network.

    They also discovered that the malware would gain persistence by adding a new crontab entry that would redownload the malicious payload from its command-and-control server and reinstall the backdoor if detected and removed or the server restarts.

    Until now, this backdoor remains undetected by anti-malware engines on VirusTotal even though a sample was first uploaded more than one month ago, on October 8th.

    The uploader might be the linux_avp creator since it was submitted one day after researchers at Dutch cyber-security company Sansec spotted it while investigating the e-commerce site breach.

  • PRIVACY REPORT: WHAT ANDROID DOES IN THE BACKGROUND

    PRIVACY REPORT: WHAT ANDROID DOES IN THE BACKGROUND

    We’ve come a long way from the Internet of the 90s and early 00s. Not just in terms of technology, capabilities, and culture, but in the attitude most of us take when accessing the ‘net. In those early days most users had a militant drive to keep any personal or identifying information to themselves beyond the occasional (and often completely fictional) a/s/l, and before eBay and Amazon normalized online shopping it was unheard of to even type in a credit card number. On today’s internet we do all of these things with reckless abandon, and to make matters worse most of us carry around a device which not only holds all of our personal information but also reports everything about us, from our browsing habits to our locations, back to databases to be stored indefinitely.

    It was always known that both popular mobile operating systems for these devices, iOS and Android, “phone home” or report data about us back to various servers. But just how much the operating systems themselves did was largely a matter of speculation, especially for Apple devices which are doing things that only Apple can really know for sure. While Apple keeps their mysteries to themselves and thus can’t be fully trusted, Android is much more open which paradoxically makes it easier for companies (and malicious users) to spy on users but also makes it easier for those users to secure their privacy on their own. Thanks to this recent privacy report on several different flavors of Android (PDF warning) we know a little bit more on specifically what the system apps are doing, what information they’re gathering and where they’re sending it, and exactly which versions of Android are best for those of us who take privacy seriously.

    THE REAL RESEARCH CONFIRMS SUSPICIONS

    The report takes a look at six different “flavors” of Android and what each one is doing behind the scenes. The researchers studied operating systems from Samsung, Xiaomi, Huawei, and Realme which all also produce their own devices, but also looked at two alternative Android-based operating systems — LineageOS and /e/OS — that can be installed on some devices and customized for privacy if the user chooses. /e/OS is built with privacy in mind, while LineageOS is more of a drop-in replacement which doesn’t specifically focus on privacy. It should be no surprise that the four Android versions customized by the device manufacturers report a ton of user data, or that any device with a Google Apps (GApps) package reports a seemingly unending stream of user information back to Google servers, but some of the specific results that the research team found are definitely worth noting.

    First, the paper points out that all of these companies are trivially able to link devices to users. Companies match IMEI numbers and other identifiers of devices to other user data that makes linking these accounts together a simple game of connect-the-dots. Largely the reason for doing this is to target ads, but all of these companies will also share this information indiscriminately with various governmental agencies. They also aren’t perfectly secure, so any black-hat attacker who gets access to this information will have it as well. This shouldn’t be too surprising, but the new information here is that researchers also found this data is shared among companies. For example, Samsung and Google seem to share each other’s data amongst themselves. Swiftkey, a popular keyboard app, also sends information to Microsoft via Google. It’s quite a complex web of data sharing and services from one company to support another’s data gathering efforts. Some of these data gathering efforts also include details such as timestamped app usage and personal contact gathering. While a lot of the information the operating systems are actually gathering is sometimes obfuscated, it’s clear that anything done on any of these devices might as well be recorded as if it was a Twitch stream as there’s evidence to suggest that literally everything could be monitored by someone (or some piece of software), right down to a user’s keystrokes.

    The researchers contrast this rampant data gathering activity with /e/OS, a privacy-oriented version of Android. /e/OS is a fork of LineageOS which is specifically devoted to privacy, includes no Google-related software, and gathers essentially no user data on its own apart from information about available updates and some other necessary information. LineageOS is only marginally better than the Android offerings from the major manufacturers when the GApps package is installed with it, largely because the Google system apps are so pervasive at gathering user data. It is possible to use LineageOS without the GApps package but the researchers did not take this approach and largely focused on /e/OS as the de-Googled version of study.

    Also Read: ROBINHOOD CUSTOMERS WORRIED ABOUT THE DATA HACK: AN IDENTITY THEFT PROTECTION SERVICE CAN HELP

    BEYOND THIS STUDY

    While /e/OS is certainly an excellent choice for privacy-conscious users of smartphones, there are a few others worth mentioning that were not included in the study. Drawing the conclusion from this research that the real privacy violator is GApps (as long as you can avoid the other spyware from Samsung et. al.), it is possible to install LineageOS on a wider array of devices than /e/OS currently supports. Since installing GApps is something that is typically sideloaded after installing LineageOS and is an optional step, this can simply be omitted.

    LineageOS logo

    Additionally, if you absolutely can’t live without Google Maps or Gmail, there is a way of accessing Google services without actually installing them on your device. A software package called MicroG is available which is an open-source replacement for GApps and allows the user to access Google services that otherwise would be available but restricts tracking and gathering of user data by Google in key ways. There is a fork of LineageOS called “LineageOS for MicroG” which includes this package instead of GApps by default, although there have been squabbles between the maintainers of this project and LineageOS over concerns with the way that MicroG accesses the Google services by signature spoofing.

    GrapheneOS Logo

    For those with Google Pixel devices specifically, there are two other privacy options. GrapheneOS is the Cadillac of privacy-focused versions of Android and has a number of improvements to enhance security as well, such as app sandboxing, implementation of secure/verified boot, disabling of peripherals via toggles, and other enhancements. CalyxOS is based on GrapheneOS and is similar but does allow for the use of MicroG and has some less-intense security practices than GrapheneOS. The only downsides with these flavors of Android is that they are built almost exclusively for the Google Pixel and at a minimum requires trust that Google didn’t build a hardware backdoor of some sort into their phones.

    ANDROID ISN’T THE ONLY OPTION

    There are a few other options for improving online privacy when using a smartphone. Linux-only phones such as the Pinephone are available but are not as fully-featured as Android. Some versions of Linux are also available for phones that would otherwise run Android. It’s also probable that an iPhone is a security and privacy improvement over a factory Android device from any major service carrier or device manufacturer, although the fact that their software is closed-source and behind a walled garden makes this extremely difficult to verify. Still, if a user isn’t willing to jump through all of these hoops to install /e/OS, GrapheneOS, or Ubuntu Touch, or if their phone has a locked bootloader making it impossible to flash a new OS (or if their device just isn’t supported), it’s preferable to choose an iPhone only if all other options are exhausted. Of course, the only other option is to not own a smartphone at all, which is arguably the easiest way of improving the privacy concerns with these devices.

    The paper goes into great detail on methodology and also includes information on how they determined what data was being sent for those curious about specifics. It’s also worth noting that they point out that none of this research investigates any specific apps that might be installed on a phone and only looks at the operating system apps. If you install random freemium games, banking apps, or Facebook on your GrapheneOS install, for example, it’s likely to void any and all of your privacy efforts. The paper itself is worth a read though even for those who haven’t considered their online privacy before, even if they did grow up in the 90s.

    Credit: hackaday.com

  • Hackers are stealing 2FA codes with terrifyingly effective voice bots

    Hackers are stealing 2FA codes with terrifyingly effective voice bots

    Every time a massive data breach makes the news, we remind you about the best practices you need to employ to protect your online properties. You should never use weak passwords and recycle them. Instead, pick a password manager that lets you generate unique passwords for every different service, website, and app. And use two-factor authentication (2FA) or one-time passwords (OTP) whenever you can. That way, when hackers inevitably hack one of your accounts, your other properties are protected. But you should remain vigilant when it comes to defending your online accounts.

    Unique passwords and 2FA/OPT aren’t enough, as hackers have found a clever way to trick you into giving them that unique code they need to break into your account. And you might not even realize that you’ve opened the doors to your Amazon, PayPal, Coinbase, or bank account to attackers who might steal money from you. It’s all possible thanks to a new type of customizable bots that place automated calls with the sole scope of stealing that temporary password.

    How bots hack your 2FA codes

    Even without bots, 2FA protection isn’t foolproof. Some hackers might try social engineer attacks to convince you to give up that temporary code or password. But not all of them might be that convincing.

    On the other hand, the bot is a lot more sophisticated and will make you believe that you’re talking to the automated security system belonging to the service that hackers want to penetrate. Motherboard demonstrated the attack with a simple example, an incoming call supposedly coming from PayPal’s fraud prevention system.

    An automated voice tells the PayPal account holder that someone tried to spend a particular sum of money. PayPal needs to verify the account holder’s identity to block the transfer, and they’ll ask for the 2FA/OTP.

    ‘In order to secure your account, please enter the code we have sent your mobile device now,’ the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, ‘Thank you, your account has been secured and this request has been blocked.’

    The bot then proceeded to inform the user there’s no reason to worry about:

    ‘Don’t worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up,’ the voice said.

    What actually happens

    Hackers who obtained someone’s personal data — such as their real name, email address, and phone number — might use it to determine whether they have a PayPal account with that address. They can apply the same procedure to any sort of online account. Once they find a match, they can feed the victim’s phone number to a bot that’s tailored for that service.

    Motherboard explains that these bots can cost a few hundreds of dollars per month and target specific services like Amazon and PayPal. Others can target specific banks like Bank of America and Chase. And some of them let you customize the experience to any type of account.

    The bot sounds just like one of the bots you’re might be talking to during regular customer service calls. They’ll invite you to press certain keys and then to input your 2FA/OTP code. But as soon as you do, the code reaches the hacker who initiated the attack.

    Also Read: ROBINHOOD CUSTOMERS WORRIED ABOUT THE DATA HACK: AN IDENTITY THEFT PROTECTION SERVICE CAN HELP

    The reason you get a code via text message on your phone is that the hacker has tried to log into your account, fully knowing they won’t be able to get into it. The bot makes it sound that it’s a service like PayPal that’s generating the unique 2FA/OTP code. And you’ll have no way of knowing it’s a hacker targeting you. Especially as you rush to deal with the threat.

    Once inside your account, the hackers can steal money or cryptocurrency. The video below shows one such conversation with a bot.

    https://youtu.be/Age9FQOwljc

    What you can do to protect your 2FA codes

    If you’re worried about 2FA/OTP bots attacks, you should make sure you understand how they work, and Motherboard’s coverage is a great place to start. You’ll want to inform your friends and family about the increased usage of this sort of hack.

    Next time you receive a call inviting you to input 2FA codes, you should hang up. Never send those codes to anyone. Instead, log into those services to monitor your activity. And call customer support. You might want to change the email associated with that account to prevent these attacks from happening. Once hackers know what email you use for PayPal or Bank of America, they might still target you with similarly sophisticated attacks.

    Credits: bgr.com

  • Robinhood customers worried about the data hack: An identity theft protection service can help

    Robinhood customers worried about the data hack: An identity theft protection service can help

    Robinhood’s latest data hack is a reminder of how we can protect our identity from being stolen.

    On Nov. 8, investment platform Robinhood announced that a data breach revealed the personal information of more than 7 million of its customers. According to a statement made by the company, the security attack did not expose Social Security numbers, bank account numbers or debit card numbers, and no customers experienced “financial loss” from the incident.

    The data breach was largely contained to only customer names and emails. A limited number of customers had additional personal information exposed such as birth date and zip code, and the company says roughly 10 customers had “more extensive account details revealed” (though details were not disclosed).

    If you are a Robinhood user, you can learn more about keeping your account secure by going to the help center on the company’s website. You may want to take an extra step, however, by investing in an extra level of protection for your personal information. Here’s where identity theft services are a good idea.

    How to further protect yourself from identity fraud

    Identity theft can come in all sorts of ways, a stolen Social Security number or seized credit card information, and it can be costly. A 2020 Identity Fraud Study by Javelin Strategy and Research found that identity fraud cost consumers a whopping $16.9 billion in 2019. You may not spot fraud right away but yet the longer it drags on, the more expensive the identity theft can be to resolve.

    Robinhood users who got off the hook this time but want to quickly spot potential fraud in the future may want to consider signing up for an identity theft protection service.

    These services can tell if a fraudster has your info by checking if your personal information is misused or if it appears on the dark web, social media or other databases. If you’re the victim of fraud, many services also offer advice from specialists, as well as insurance that can offset legal fees and other expenses related to restoring your identity.

    The best identity theft protection services

    Select reviewed dozens of identity theft protection and credit monitoring services that safeguard your information and provide insurance. The best services, like IdentityForce®, offer up to $1 million for eligible expenses associated with resolving and restoring your identity.

    In fact, we ranked IdentityForce the ‘best overall’ because its two UltraSecure and UltraSecure+Credit plans both provide standard coverage up to $1 million to help you recover out-of-pocket expenses and lost wages when your identity is compromised. Robinhood customers should take note that with either plan they can also receive alerts for potential fraud on their bank, credit card and investment accounts, as well as the use of their medical ID, Social Security number and address. Find out what other coverage you get, plus pricing details, in our full review of IdentityForce.

    Below, we rank the top identity theft services — in addition to IdentityForce — that can alert you of potential breaches to your personal information. (Read more about our methodology for selecting the best identity theft protection services.)

    It’s important to understand that these services can’t prevent fraud from happening. You’ll need to be proactive and safeguard your personal information to reduce your exposure to identity theft.

    Also Read: THESE 23 FAKE ANDROID APPS ARE DANGEROUS SPYWARE, SO DELETE THEM NOW

    Our methodology

    To determine which identity theft protection services offer the most benefits to consumers, Select analyzed and compared over a dozen services that offer a variety of plans.

    When ranking the best identity theft protection services, we focused on the following features:

    • Cost: Typically, these services bill monthly but some have deals where you can pay annually.
    • Identity theft insurance: We considered whether the services offered identity theft insurance and looked at the amount you’re covered up to. We found that the best services offer up to $1 million for eligible expenses associated with resolving and restoring your identity.
    • Wide variety of identity monitoring: The more platforms the service checks for breaches to your personal information, the better.
    • Credit monitoring: We ranked services that monitor your credit reports higher than those they don’t. The best plans offer triple-bureau monitoring.
    • Family plans: If you can enroll your family members, that’s an added plus.
    • Mobile app: The ability to access services from a smartphone was crucial.

    Keep in mind that identity theft protection services can only alert you of breaches to your personal information, not prevent any fraud.

    Credit: cnbc.com

  • A huge trove of credit card records and Social Security numbers just got hacked

    A huge trove of credit card records and Social Security numbers just got hacked

    Not a week goes by anymore, it seems like, when we don’t have multiple hacks to report on, as well as a fresh data breach or systems intrusion on the part of attackers constantly probing for weaknesses anywhere that consumer records are stored.

    Many of these episodes garner headlines simply because of the scale of the data breach and the target of the attack. Facebook is one example of this, as the social network is still facing an onslaught of criticism online over the revelation from this past weekend that the company has suffered yet another embarrassingly massive data leak — encompassing personal information from more than 533 million Facebook users across 106 countries. Meantime, hackers themselves are also getting hacked, as word of a separate breach at a hub for stolen data has also just been reported.

    Threat research firm Group-IB posted a report on Thursday documenting how Swarmshop — described as a “neighborhood” store for stolen personal and payment records, such as credit card data — saw a major cache of its user and administrator data leaked online to another underground hacker forum. Appropriately, the title of the Group-IB report summarizing what happened here is “What Goes Around Comes Around,” but make no mistake — there’s just as good of a chance that your data may be caught up in this as there is that hackers acquired stolen data on other hackers.

    According to the report on this hack, the Swarmshop database that was posted on a different underground forum contained 12,344 records of the card shop administrators, sellers, and buyers. That’s per a Twitter thread from Group-IB, which goes on to note that this database also “exposed all compromised data traded on the website, including 623,036 payment card records, 498 sets of online banking account credentials and 69,592 sets of US Social Security Numbers and Canadian Social Insurance Numbers.”

    Given the nature of the treasure trove of data that Swarmshop represents, it should probably come as no surprise that this is also not the first time that the stolen data hub has found itself in the crosshairs of other cybercriminals. In January 2020, the site’s records were leaked on an underground forum, reportedly by a user motivated by revenge. Meantime, here’s what else we know about this new hack — the data dump included records on more than 623,000 payment cards, almost 63% of which were issued by US banks.

    “While underground forums get hacked from time to time, cardshop breaches do not happen very often,” Group-IB CTO Dmitry Volkov said. “In addition to buyers’ and sellers’ data, such breaches expose massive amounts of compromised payment and personal information of regular users. Although the source remains unknown, it must be one of those revenge hacks cases. This is a major reputation hit for the card shop as all the sellers lost their goods and personal data. The shop is unlikely to restore its status.”

    Culled from bgr.com