In one of the “odder” breaches that we have covered, NVIDIA has confirmed it was the victim of a breach that resulted in the loss of data. Information about the breach first crossed our paths about a week ago, but much of the information was speculation and some of the claims seemed very unusual. One of the most unusual was a claim by the alleged hacking group LAPSUS$ that NVIDIA had actually hacked them back.

CD Projekt RED has found themselves the victim of both data theft and now blackmail. At least that is what we are hearing from their Twitter account. According to CD Projekt, someone has made off with information that relates to their upcoming game Cyberpunk 2077. The Tweet goes on to say that the files are old and are not representative of the current version of the game. They also say they are not planning on giving in to the ransom demands. It is something of an interesting situation to be honest.

The one common thing that I keep hearing everyone talk about at Black Hat and even DEF CON is how to protect your data. It is pretty much a given that if someone wants to get into your network they are going to get in. The number of flaws, vulnerabilities and compromises that are out there are simply too many to protect against. So there needs to be some other method to make sure that any sensitive data that you have is keep out of the hands of the “bad guys”. There are many suggestions about this, but most of them still try to do the same things stop the barbarians at the gate.

If there is one thing I do not like it is the way that some members of the technical press show their bias. This morning, while I was trying to have a nice cup of coffee, I had to stomach several articles that seem to feel that NFC (near field communication) is now the wave of the future simply because it is rumored that Apple will have it in their next devices. This despite the fact that some of these same reporters claimed it was nothing when everyone else did it years ago.

Over the weekend a number of articles broke describing a “hack” that allowed nude photos of celebrities to be stolen and then reposted on the internet (4chan). Although the story held minimal interest at the time of its release we did not see it as big news since phone and cloud service hacks are far too common these days, just because it happened to be someone famous did not make it anymore news worthy. If anything it made it less as you should not be storing nude or explicit images of yourself on your phone or in any cloud service these days.

It won’t happen to me is the battle cry of far too many companies these days when it comes to security. We have watches this mind set over the course of the last two years as businesses try to get out of the expense (time and money) needed to update or properly protect their companies and customers from data theft. One of the very recent and troubling ones is the Backoff malware that has hit an estimated 1,000 US businesses. Even Dairy Queen has been hit and consumer payment card data stolen.

On October 4th Adobe was forced to send out almost three million emails with the unfortunate news that their network had been attacked, breached and data stolen. The data from that theft included account IDs as well as encrypted passwords and credit/debit card information and even source code for Adobe products. The attack happened not all that long after Adobe pushed their users to a subscription based license for their products. Once a large number of people had joined the Creative Cloud service Adobe was an even more attractive target and due to their history or ignoring security the attackers were able to get in and grab what they wanted.

Today (Sunday July 21 2013) Apple officially admitted that someone had hacked their developer site. The notification came out as a warning that some information including names, addresses and email information might have been accessed. What we find interesting is that this announcement comes on the heels of a multi-day outage to the same site. It looks like Apple might have known about the breach earlier and not told anyone until they confirmed that user data was compromised (in which case they might have been compelled to). This is not exactly what you want to hear from a company that prides themselves on the security and safety of their operating system AND their ecosystem.

Someone is claiming that the one million UDIDs posted by Anonymous actually were taken from them and not the FBI or Apple. The company Blue Toad from Orlando FL says that they checked the pastebin file and it was a 98% match for their database. This is an interesting twist in the events that have seen Apple, the FBI and even AT&T linked to surveillance of Apple phones through the use of the UDID (Unique Device IDentifier). Apple has already stated that the UDID will no longer be supported in the next version of their iOS software that is expected to be released to the world tomorrow.

We have said this once and we will say it again; 2012 will be remembered as the year of the breach. This year alone we have seen a significant number of services penetrated with relative ease and user account information pulled out at an alarming rate. So far this year we have watched as Linkedin, eHarmony, Last.fm, Formspring, League of Legends and more have been compromised and literally Millions of user account details have been posted to the Internet. It is a very disturbing trend considering the rather big push to the cloud for so many critical services (like hosting our personal records).