Displaying items by tag: Data Breach

Using a famous idiom, it looks like the shoe is on the other foot as BreachForums has found themselves the victim of a data breach and release of data. The breach took place in November of 2022 and culminated with the arrest of one of the owners of the forum. The responsible parties were able to attack and exfiltrate data from the site including user information, IP addresses and internal messages sent between users and the forum.

The popular socialization platform, Discord, is alerting users to a data breach that occurred due to the compromise of a support agent account. The breach appears to be limited in scope to the ticket queue that the third-party agent was responsible for. The ticket queue contained email addresses, attachments and all messages that might have been exchanged during ticket resolution with this agent.

T-Mobile has disclosed their second breach of 2023. According to the mobile provider a threat actor gained access to their systems in February and was not detected until March. This allowed the attacker access to a small amount of customer data, 836 records. T-Mobile is stating that the data did not contain financial information, but it did contain enough Personally Identifying Information (PII) that the affected customers are exposed to identity theft.

Although not a new story the recent revelations around the CFPB (Consumer Financial Protection Bureau) data breach are very important. This incident is one of those times when you can either learn an important lesson, or you can ignore it and walk into a much bigger shitshow. The outcome of this one is something that only time will tell, but it is not something that anyone should just ignore.

Yesterday we reported that the source code stealing group, Lapsus$, claimed they have breached and stollen source code from Microsoft. They made the announcement on their Telegram account by posting a screenshot of the projects they claimed to have access to. Now, as with other leaks, they have dropped a compressed file (7zip) via Torrent which appears to contain around 37GB of source code.

The latest report from the ITRC (Identity Theft Resource Center) has been released and it shows us some sadly unsurprising data. According to the report, 2021 data compromises are up 68% (1,862) compared to 2020 numbers and 23% higher than the highest year on record 2017 (1,506). The report adds that compromise of sensitive personal data is also up but has not topped 2017 as the record year for that type of data loss. Attack trends have changed slightly with attackers appearing to target specific data rather than just trying to dump everything. This has led to an overall reduction in the total number of actual victims while the number of repeat victims is still very high.

You have to love how easy it is to find information out in the wilds of the internet. In the last couple of weeks a number of cloud-databases have been found to be leaking data to the interment due to an almost total lack of security. The latest one seems to be a group of 191… Million voters in the US. Yup, if you have voted in any election since 2000 your personal information is out there on the open internet. The information that is out contains names, addresses, party affiliation and voter ID numbers… it is not as bad as it could be, but it is still bad.

Hey remember the group that launched the DDoS attack on Steam? Well they are back and have decided to make a little bit bigger of a statement than just throwing packets at a group of servers. This time they appear to have managed to grab a large number of user information from companies like Blizzard, Ubisoft and many others. They have taken this information and (unsurprisingly) dumped it to paste bin. If you do not know who we are talking about it is the DerpTrolling “hacker” group and they have been on a mission to shame just about every game publishing/distribution company on the planet.

Since the beginning of 2014 the IT world has been rocked by more than a few major breaches. The number of credit cards and user information now up for sale is staggering. So how have these attacks managed to get in and make off with so much data so quickly? Of course there are the usual suspects in these cases, weak passwords and users downloading malware on their systems that allow a potential attacker into their system.

Global auction service eBay was hacked. The company began sending alerts to its users to change their passwords. The attack compromised the personal data of eBay users - names, (encrypted) passwords, email addresses, and phone numbers. However, the company assures that the financial information of users are safe, and there is no indication that the PayPal was hacked too.