HealthEquity Data Breach Exposes Protected Health Information
HealthEquity, a healthcare fintech firm, experienced a data breach when a partner’s account was compromised, leading to unauthorized access to sensitive health data. The breach was detected through anomalous behavior on the partner’s device, prompting an investigation that revealed the unauthorized access and data exfiltration. HealthEquity is notifying affected individuals, offering credit monitoring, and ensuring business operations remain uninterrupted.
Infostealer Malware Logs Used To Identify Child Abuse Website Members
Recorded Future’s Insikt Group utilized infostealer malware logs to identify 3,324 unique accounts accessing child sexual abuse material (CSAM) websites, aiding law enforcement in tracking and arresting pedophiles. The logs contained stolen credentials, browser history, and system information, allowing analysts to link CSAM account holders to their legitimate online accounts. By leveraging this data, the Insikt Group was able to unmask individuals like a convicted sex offender in Ohio and a volunteer at children’s hospitals in Illinois who were maintaining accounts on multiple CSAM sites.
Formula 1 Governing Body Discloses Data Breach After Email Hacks
The FIA, governing body of Formula 1, revealed a data breach caused by attackers compromising several FIA email accounts through a phishing attack. Personal data was accessed, prompting the organization to take swift action and notify data protection regulators in Switzerland and France. FIA has implemented additional security measures to prevent future attacks and is committed to upholding data protection and information security standards.
Hackers Abused API to Verify Millions of Authy MFA Phone Numbers
Hackers exploited an unsecured API endpoint to verify millions of Authy MFA phone numbers, potentially exposing users to SMS phishing and SIM swapping attacks. Twilio confirmed the breach and urged users to update their Authy apps for security. The attackers compiled a list of phone numbers using the unauthenticated API, similar to how they abused Twitter and Facebook APIs, highlighting the importance of securing APIs to prevent data breaches.
Cybercriminal Arrested for ‘Evil Twin’ Wi-Fi That Steals Airline Passenger Data
Australian authorities arrested a man for using a portable Wi-Fi device to set up fraudulent Wi-Fi networks on flights, stealing passenger data. The suspect targeted unsuspecting passengers to enter personal information like email addresses and social media credentials. To protect against such attacks, travelers are advised to avoid entering personal details on public Wi-Fi networks, use reputable virtual private networks, disable Wi-Fi when not in use, and avoid sensitive activities like banking on public networks.
Dating App Grindr Ordered to Pay Millions for Sharing User Data
Grindr has been fined approximately €6.5 million by the Norwegian Data Protection Authority (DPA) for illegally sharing users’ personal data with third parties without valid consent. The fine, which is the highest ever imposed by the Norwegian DPA, stems from the company’s failure to obtain proper user consent for sharing sensitive data such as GPS location, IP address, and the fact that individuals were Grindr users, which strongly suggests their sexual orientation. The DPA found that the consents collected by Grindr were neither voluntary, specific, nor informed, violating GDPR regulations.
Patelco Credit Union Scrambling to Restore Systems Following Ransomware Attack
Patelco Credit Union has been hit by a ransomware attack that has significantly disrupted its operations, forcing it to take several critical systems offline to contain the breach. The credit union is actively working to restore these systems and has engaged external cybersecurity firms to aid in the recovery and investigation process. This incident underscores the persistent threat of ransomware attacks on financial institutions, emphasizing the need for robust incident response plans and comprehensive cybersecurity measures to protect sensitive data and maintain operational resilience.
Saudi Ride-hailing Company Exposes Drivers’ Licenses and Passports
Blink, a ride-hailing company, recently exposed the sensitive data of over 160,000 users, including driver’s licenses and passports, due to misconfigured cloud storage. This breach highlights the ongoing risks associated with improper cloud storage configurations, where even companies providing security solutions can fall victim to significant data exposure incidents. Cybersecurity professionals must emphasize rigorous security audits and proper access controls for cloud storage solutions to prevent such breaches and protect user data.
300k Affected by Year-Old Data Breach at Florida Community Health Centers
A data breach at Florida Community Health Centers has affected approximately 300,000 individuals, exposing sensitive personal and medical information. The breach, which occurred over a year ago, involved unauthorized access to names, addresses, dates of birth, Social Security numbers, and medical records. This incident highlights the critical need for healthcare organizations to enhance their cybersecurity measures and promptly address vulnerabilities to protect patient data.
Cyber Extortion Soars: SMBs Hit Four Times Harder
Orange Cyberdefense’s Cy-Xplorer 2024 report highlights a 77% year-on-year growth in cyber extortion victims, with small and medium businesses being targeted 4.2 times more often than larger enterprises. The report reveals that threat actors are now employing opportunistic approaches, targeting organizations with lower cyber preparedness levels. Additionally, a new trend of ‘revictimization’ has been observed, where ransomware victims are targeted multiple times in different compromise campaigns.
Authorized Push Payment Fraud Singled Out as Biggest Financial Crime Threat
A recent industry study revealed that 65% of payments professionals in the UK see fraud, particularly authorized push payment (APP) scams, as the most pressing financial crime threat. APP fraud, where scammers deceive victims into transferring money, was identified as the most impactful type of fraud by 27% of respondents. Despite a 12% increase in APP fraud cases in 2023, losses decreased by 5%, but concerns are rising over new rules that will hold payment service providers liable for losses due to APP fraud.
Disclaimer: Titles and summaries are AI-generated. Please refer to the linked content for more details.