ReportWire

Tag: Hacking

  • Finland parliament website targeted ahead of NATO entry

    Finland parliament website targeted ahead of NATO entry

    [ad_1]

    HELSINKI — Finland’s parliamentary website was paralyzed by a denial-of-service attack on Tuesday, just before the country made its historic entry into NATO, a move that more than doubles NATO’s border with Russia and has angered Russian President Vladimir Putin.

    The attacks — in which participants flood targets with junk data — made the parliament’s site hard to use, with many pages not loading and some functions not available for a time.

    A pro-Russian hacker group known as NoName057 (16) claimed responsibility, saying the attack was retaliation for Finland joining NATO. The hacker group, which has reportedly acted on Moscow’s orders, has taken part in a slew of cyberattacks on the U.S. and its allies in the past. The claim could not be immediately verified.

    For the most part, Finns went about their business as usual on the bright cold day, belying the historic nature of Finland becoming the 31st member of NATO. Its membership was formalized with a series of steps in Brussels.

    It’s a moment that most Finns had never previously wanted as they balanced friendly ties with both the West and Russia. But all that changed with Russia’s full-scale and brutal invasion of its neighbor Ukraine last year, creating a sudden and strong sense of insecurity that pushed the nation toward membership in the security alliance.

    There were few outward signs of the geopolitical shift aside from the Finnish and NATO flags, both blue and white, fluttering against the backdrop of Helsinki’s deep blue sky.

    The NATO flags were raised alongside the national flags in front of the Ministry of Foreign Affairs, a building that was originally built for the military of the Russian Empire in the 19th century. A regular flow of curious onlookers could be seen near the gates of the foreign ministry, trying to catch a glimpse of the flags.

    Aki Luhtanen, a professor of psychiatric nursing who was among those stopping by the Foreign Ministry, said Russia’s war on Ukraine feels very close and NATO membership offers protection now and for the long term.

    “I think we should be aware and afraid of Russia,” Luhtanen said. “And I think in the future (it) is very, very important to belong to NATO.”

    It was on that same ministry building that Finnish authorities projected the colors of the Ukrainian flag after Russia’s invasion last year, in an early sign of strong support for Kyiv.

    Newspapers, leaders and commentators alike agreed that Tuesday was a historic day for the nation of 5.5 million people that shares a a 1,340-kilometer (832-mile) border with Russia.

    “Until now, we have defended our country alone,” Defense Minister Antti Kaikkonen told public broadcaster YLE on arrival in Brussels. “From now on, we can rely on getting outside help should things get tough. And of course, we are ready to help should someone be in trouble.”

    Kaikkonen will join President Sauli Niinisto and Haavisto, the foreign minister, for the events in Brussels.

    “This is historically very significant for Finland. Finland has never been militarily aligned before in its history,” said Juhana Aunesluoma, professor of political history at the University of Helsinki. “Of course, many things changed when Finland joined the European Union in 1995, but Finland remained militarily nonaligned.”

    The ceremony in Brussels falls on NATO’s very own birthday, the 74th anniversary of the signing of its founding Washington Treaty on April 4, 1949. It also coincides with a meeting of the alliance’s foreign ministers.

    [ad_2]

    Source link

  • Health data breach hitting Congress ‘could be extraordinary’

    Health data breach hitting Congress ‘could be extraordinary’

    [ad_1]

    WASHINGTON — House leaders say the impact of a hack of health insurance marketplace used by members of Congress “could be extraordinary,” exposing sensitive personal data of lawmakers, their employees and families.

    DC Health Link, which runs the exchange, said an unspecified number of customers were affected and it was notifying them and working with law enforcement to quantify the damage. It said it was offering identity theft service to those affected and extending credit monitoring to all customers.

    Some 11,000 of the exchange’s more than 100,000 participants work in the House and Senate or are relatives.

    In a letter to the exchange’s director posted on Twitter, House Speaker Kevin McCarthy and Minority Leader Hakeem Jeffries said the breach “significantly increase the risk that Members, staff and their families will experience identity theft, financial crimes, and physical threats.”

    They said the FBI had informed them that it was able to purchase the stolen data on the dark web, where it was offered for sale for an unspecified amount Monday on a hacker forum popular with cybercriminals.

    The FBI said in a brief statement Wednesday evening it said it was aware of the incident and was assisting.

    In the letter, McCarthy and Jeffries said “the individuals selling the information appear unaware of the high-level sensitivity of the confidential information in their possession, and its relation to Members of Congress” but that would change as media reports publicized the breach.

    They said the FBI had not yet determined the extent of the breach but that thousands of House members, employees and their families have enrolled in health insurance through DC Health Link since 2014. “The size and scope of impacted House customers could be extraordinary.”

    It was not clear whether and how the FBI could guarantee that copies of the stolen data are not circulating in the cybercrime underworld.

    In the sale offer, a broker on the online crime forum claimed to have records on 170,000 DC Health Link customers and said they were stolen Monday. Reached on Wednesday via encrypted chat, the broker said they were acting on behalf of a seller known as “thekilob.”

    By Thursday, the offer and sample stolen data posted to the forum had been removed. The data listed Social Security numbers, addresses, names of employers, phone numbers, emails and addresses for a dozen DC Link participants. The AP reached one by phone on Wednesday evening.

    “Oh my God,” the man said when informed the information was public. All 12 people listed work for the same company or are family members.

    In an email to all Senate email account holders on Wednesday, the sergeant at arms recommended that anyone registered on the health insurance exchange freeze their credit to prevent identity theft.

    An email sent out by the office of the Chief Administrative Office of the House on behalf of McCarthy and Jeffries called the breach “egregious” and urged members to use credit and identity theft monitoring resources.

    In an emailed statement on Wednesday, Rep. Joe Morelle of New York said House leadership was informed by Capitol Police that DC Health Link “suffered an extraordinarily large data breach of enrollee information” that posed a “great risk” to members, employees and their family members. He said the FBI was still determining the “cause, size, and scope of the data breach.”

    The hack follows several recent breaches affecting U.S. agencies. Hackers broke into a U.S. Marshals Service computer system and activated ransomware on Feb. 17 after stealing personally identifiable data about agency employees and targets of investigations.

    An FBI computer system was recently breached at the bureau’s New York field office, CNN reported in mid-February. Asked about that intrusion, the FBI issued a statement calling it “an isolated incident that has been contained.” It declined further comment, including when it occurred and whether ransomware was involved.

    There was no indication the DC Health breach was ransomware-related.

    ___

    Bajak reported from Boston.

    [ad_2]

    Source link

  • Congress members warned of significant health data breach

    Congress members warned of significant health data breach

    [ad_1]

    WASHINGTON — Members of the House and Senate were informed Wednesday that hackers may have gained access to their sensitive personal data in a breach of a Washington, D.C., health insurance marketplace. Employees of the lawmakers and their families were also affected.

    DC Health Link confirmed that data on an unspecified number of customers was affected and said it was notifying them and working with law enforcement. It said it was offering identity theft service to those affected and extending credit monitoring to all customers.

    The FBI said it was aware of the incident and was assisting the investigation.

    A broker on an online crime forum claimed to have records on 170,000 DC Health Link customers and was offering them for sale for an unspecified amount. The broker claimed they were stolen Monday. Reached by The Associated Press on an encrypted chat site, the broker did no say whether the data had been purchased and said they could not provide additional data to back the claim. They said they were acting on behalf of the seller, who they identified as “thekilob.”

    Sample stolen data was posted on the site for a dozen apparent customers. It included Social Security numbers, addresses, names of employers, phone numbers, emails and addresses. The AP reached one of the dozen by dialing a listed number.

    “Oh my God,” the man said when informed the information was public. All 12 people listed work for the same company or are family members.

    In an email to all Senate email account holders, the sergeant at arms said it was informed that the stolen data included full names of the insured and family members. An email sent out by the office of the Chief Administrative Office of the House on behalf of House Speaker Kevin McCarthy and Minority Leader Hakeem Jeffries called the breach “egregious” and promised to provide updates. It urged members to use credit and identity theft monitoring resources.

    The Senate email recommended that anyone registered on the health insurance exchange freeze their credit to prevent identity theft.

    In an emailed statement, Rep. Joe Morelle of New York said House leadership was informed by Capitol Police that DC Health Link “suffered an extraordinarily large data breach of enrollee information” that posed a “great risk” to members, employees and their family members. “At this time the cause, size, and scope of the data breach impacting the DC Health Link still needs to be determined by the FBI,” Morelle said.

    The hack follows several recent breaches affecting U.S. agencies. Hackers broke into a U.S. Marshals Service computer system and activated ransomware on Feb. 17 after stealing personally identifiable data about agency employees and targets of investigations.

    An FBI computer system was recently breached at the bureau’s New York field office, CNN reported in mid-February. Asked about that intrusion, the FBI issued a statement calling it “an isolated incident that has been contained.” It declined further comment, including when it occurred and whether ransomware was involved.

    There was no indication the Health breach was ransomware-related.

    ___

    AP Technology Writer Frank Bajak in Boston contributed to this report.

    [ad_2]

    Source link

  • UN experts: North Korean hackers stole record virtual assets

    UN experts: North Korean hackers stole record virtual assets

    [ad_1]

    UNITED NATIONS — North Korean hackers working for the government stole record-breaking virtual assets last year estimated to be worth between $630 million and more than $1 billion, U.N. experts said in a new report.

    The panel of experts said in the wide-ranging report seen Tuesday by The Associated Press that the hackers used increasingly sophisticated techniques to gain access to digital networks involved in cyberfinance, and to steal information that could be useful in North Korea’s nuclear and ballistic missile programs from governments, individuals and companies.

    With growing tensions on the Korean Peninsula, the report said North Korea continued to violate U.N. sanctions, producing weapons-grade nuclear material, and improving its ballistic missile program, which “continued to accelerate dramatically.”

    In 2022, the Democratic People’s Republic of Korea – the North’s official name – launched at least 73 ballistic missiles and missiles combining ballistic and guidance technologies including eight intercontinental ballistic missiles, the panel said. And 42 launches, including the test of a reportedly new type of ICBM and a new solid-fueled ICBM engine, were conducted in the last four months of the year.

    North Korea’s leader Kim Jong Un ordered an “exponential increase of the country’s nuclear arsenal” in January, and the panel said “a new law discussed an increased focus on tactical nuclear capability, a new first-use doctrine, and the `irreversible nature’ of the DPRK’s nuclear status.”

    “The ability to carry out an unexpected nuclear strike on any regional or international target, described in DPRK’s new law on nuclear doctrine and progressively in public statements since 2021, is consistent with the observed production, testing, and deployment of its tactical and strategic delivery systems,” the experts said in the report to the U.N. Security Council.

    The panel said that South Korean authorities quoted in media reports “estimated that state sponsored DPRK cyber threat actors had stolen virtual assets worth around $1.2 billion globally since 2017, including about $630 million in 2022 alone.”

    The experts monitoring sanctions against North Korea said an unnamed cybersecurity firm “assessed that in 2022, DPRK cybercrime yielded cyber currencies worth over $1 billion at the time of the threat, which is more than double the total proceeds in 2021.”

    The variation in the U.S. dollar value of cryptocurrency in recent months is likely to have affected these estimates, the panel said, “but both show that 2022 was a record-breaking year for DPRK virtual asset theft.”

    The panel said three groups that are part of the Reconnaissance General Bureau, North Korea’s primary foreign intelligence organization, “continued illicitly to target victims to generate revenue and solicit information of value to the DPRK including its weapons programs” – Kimsuky, Lazarus Group and Andariel.

    Between February and July 2022, the panel said, the Lazarus Group “reportedly targeted energy providers in multiple member states using a vulnerability” to install malware and gain long-term access. It said this “aligns with historical Lazarus intrusions targeting critical infrastructure and energy companies … to siphon off proprietary intellectual property.”

    Lazarus Group’s primary focus is on specific types of industry, aerospace and defense and conventional finance and cryptocurrencies, with the objective of accessing the internal knowledge bases of the compromised companies, the experts said. They quoted the cybersecurity section of an internet technology company as saying Lazarus has been targeting engineers and technical support employees “using malicious versions of open source applications.”

    In December 2022, the panel said, South Korea’s national police agency announced that Kimsuky had targeted 892 foreign policy related experts “in an effort to steal personal data and email lists.”

    The police reported that the hackers didn’t manage to steal sensitive information, but they “laundered IP addresses of the victims and employed 326 detour servers and 26 member states to make tracing difficult,” the experts said. The police noted it was the first time they detected Kimsuky using ransomware, saying 19 servers and 13 businesses were affected, of which two paid 2.5 million South Korean won ($1,980) in Bitcoin to the hackers.

    On military-related issues, the experts said they investigated the “apparent export” of military communications equipment from a North Korean company under U.N. sanctions to Ethiopia’s defense ministry in June 2022.

    The panel said it has not yet received a reply from Ethiopia’s government about a photo published by the Ethiopian media in November allegedly showing a piece of equipment from the Global Communications Co., known as Glocom, being used by a top military official. Eritrea also hasn’t responded to questions about its alleged procurement of Glocom equipment, the experts said.

    North Korea may also have illegally traded arms and related material with a number of countries, including sending artillery shells, infantry rockets and missiles to Russia – claims Pyongyang and Moscow have consistently denied, the panel said. And the experts said they are investigating the reported sale of weapons from a North Korean company on the U.N. sanctions list to the Myanmar military through a Myanmar company.

    [ad_2]

    Source link

  • Phishing attacks are increasing and getting more sophisticated. Here’s how to avoid them

    Phishing attacks are increasing and getting more sophisticated. Here’s how to avoid them

    [ad_1]

    cyano66 | iStock | Getty Images

    Phishing is on the rise, and anyone who uses email, text messaging, and other forms of communication is a potential victim. 

    These attacks, in which a cybercriminal sends a deceptive message that’s designed to fool a user into providing sensitive information such as credit card numbers or to launch malware on the user’s system, can be extremely effective if done well. 

    These types of attacks have become increasingly sophisticated — making them more dangerous — and more common. An October 2022 study by messaging security provider SlashNext analyzed billions of link-based URLs, attachments, and natural language messages in email, mobile and browser channels over a six-month period, and found more than 255 million attacks. That’s a 61% increase in the rate of phishing attacks compared with 2021. 

    The study revealed that cybercriminals are shifting their attacks to mobile and personal communication channels to reach users. It showed a 50% increase in attacks on mobile devices, with scams and credential theft at the top of the list of payloads. 

    “What we’ve been seeing is an increase in the use of voicemail and text as part of two-pronged phishing and BEC [business email compromise] campaigns,” said Jess Burn, senior analyst at Forrester Research. “The attackers leave a voicemail or send a text about the email they sent, either lending credibility to the sender or increasing the urgency of the request.” 

    The firm is receiving a lot of inquiries from clients about BEC attacks in general, Burn said. “With geopolitical strife disrupting ransomware gang activity and cryptocurrency — the preferred method of ransom payment — imploding as of late, bad actors are going back to old-fashioned fraud to make money,” he said. “So BEC is on the rise.” 

    Criminals using phishing attacks based on tax season, shopping deals

    One of the iterations of phishing that people need to be aware of is spearphishing, a more targeted form of phishing that often uses topical lures.

    “While it is not a new tactic, the topics and themes might evolve with world or even seasonal events,” said Luke McNamara, principal analyst at cyber security consulting firm Mandiant Consulting. “For example, as we are in the holiday season, we can expect to see more phishing lures related to shopping deals. During regional tax seasons, threat actors might similarly try to exploit users in the process of filing their taxes with phishing emails that contain tax themes in the subject line.” 

    Phishing themes can also be generic, such as an email that appears to be from a technology vendor about resetting an account, McNamara said. “More prolific criminal campaigns might leverage less specific themes, and conversely more targeted campaigns by threat actors involved in activity like cyber espionage might utilize more specific phishing lures,” he said.

    What people should do to ward off phishing attempts

    Individuals can take steps to better defend themselves against phishing attacks. 

    One is to be vigilant when giving out personal information, whether it’s to a person or on a website.

    “Phishing is a form of social engineering,” Burn said. “That means that phishers use psychology to convince their victims to take an action they may not normally take. Most people want to be helpful and do what someone in authority tells them to do. Phishers know this, so they prey upon those instincts and ask the victim to help with a problem or do something immediately.” 

    If an email is unexpected from a specific sender, if it’s asking someone to do something urgently, or if it’s asking for information or financial details not normally provided, take a step back and look closely at the sender, Burn said. 

    “If the sender looks legitimate but something still seems off, don’t open any attachments and mouse or hover over any hyperlinks in the body of the email and look at the URL the link points to,” Burn said. “If it doesn’t seem like a legitimate destination, do not click on it.” 

    If a suspicious-looking message comes in from a known source, reach out to the person or company via a separate channel and inquire as to whether they sent the message, Burn said. “You’ll save yourself a lot of trouble and you’ll alert the person or company to the phishing scam if the email did not originate from them,” he said. 

    It’s a good idea to stay up on the latest phishing techniques. “Cyber criminals constantly evolve their methods, so individuals need to be on alert,” said Emily Mossburg, global cyber leader at Deloitte. “Phishers prey on human error.” 

    Another good practice is to use anti-phishing software and other cyber security tools as protection against potential attacks and to keep personal and work data safe. This includes automated behavior analytics tools to detect and mitigate potential risk indicators. “The use of these tools among employees has increased significantly,” Mossburg said. 

    Another technology, multi-factor authentication, “can provide one of the best layers of security to secure your emails,” McNamara said. “It provides another layer of defense should a threat actor successfully compromise your credentials.”

    [ad_2]

    Source link

  • Seoul: North Korean hackers stole $1.2B in virtual assets

    Seoul: North Korean hackers stole $1.2B in virtual assets

    [ad_1]

    SEOUL, South Korea (AP) — North Korean hackers have stolen an estimated 1.5 trillion won ($1.2 billion) in cryptocurrency and other virtual assets in the past five years, more than half of it this year alone, South Korea’s spy agency said Thursday.

    Experts and officials say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its fragile economy and fund its nuclear program following harsh U.N. sanctions and the COVID-19 pandemic.

    South Korea’s main spy agency, the National Intelligence Service, said North Korea’s capacity to steal digital assets is considered among the best in the world because of the country’s focus on cybercrimes since U.N. economic sanctions were toughened in 2017 in response to its nuclear and missile tests.

    The U.N. sanctions imposed in 2016-17 ban key North Korean exports such as coal, textiles and seafood and also led member states to repatriate North Korean overseas workers. Its economy suffered further setbacks after it imposed some of the world’s most draconian restrictions against the pandemic.

    The NIS said state-sponsored North Korean hackers are estimated to have stolen 1.5 trillion won ($1.2 billion) in virtual assets around the world since 2017, including about 800 billion won ($626 million) this year alone. It said more than 100 billion won ($78 million) of the total came from South Korea.

    It said North Korean hackers are expected to conduct more cyberattacks next year to steal advanced South Korean technologies and confidential information on South Korean foreign policy and national security.

    Earlier this month, senior diplomats from the United States, South Korea and Japan agreed to increase efforts to curb illegal North Korean cyber activities. In February, a panel of U.N. experts said North Korea was continuing to steal hundreds of millions of dollars from financial institutions and cryptocurrency firms and exchanges.

    Despite its economic difficulties, North Korea has carried out a record number or missile tests this year in what some experts say is an attempt to modernize its arsenal and boost its leverage in future negotiations with its rivals to win sanctions relief and other concessions.

    [ad_2]

    Source link

  • Seoul: North Korean hackers stole $1.2B in virtual assets

    Seoul: North Korean hackers stole $1.2B in virtual assets

    [ad_1]

    South Korea’s spy agency says North Korean hackers have stolen an estimated 1.5 trillion won ($1.2 billion) in cryptocurrency and other virtual assets in the past five years, more than half of it this year alone

    SEOUL, South Korea — North Korean hackers have stolen an estimated 1.5 trillion won ($1.2 billion) in cryptocurrency and other virtual assets in the past five years, more than half of it this year alone, South Korea’s spy agency said Thursday.

    Experts and officials say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its fragile economy and fund its nuclear program following harsh U.N. sanctions and the COVID-19 pandemic.

    South Korea’s main spy agency, the National Intelligence Service, said North Korea’s capacity to steal digital assets is considered among the best in the world because of the country’s focus on cybercrimes since U.N. economic sanctions were toughened in 2017 in response to its nuclear and missile tests.

    The U.N. sanctions imposed in 2016-17 ban key North Korean exports such as coal, textiles and seafood and also led member states to repatriate North Korean overseas workers. Its economy suffered further setbacks after it imposed some of the world’s most draconian restrictions against the pandemic.

    The NIS said state-sponsored North Korean hackers are estimated to have stolen 1.5 trillion won ($1.2 billion) in virtual assets around the world since 2017, including about 800 billion won ($626 million) this year alone. It said more than 100 billion won ($78 million) of the total came from South Korea.

    It said North Korean hackers are expected to conduct more cyberattacks next year to steal advanced South Korean technologies and confidential information on South Korean foreign policy and national security.

    Earlier this month, senior diplomats from the United States, South Korea and Japan agreed to increase efforts to curb illegal North Korean cyber activities. In February, a panel of U.N. experts said North Korea was continuing to steal hundreds of millions of dollars from financial institutions and cryptocurrency firms and exchanges.

    Despite its economic difficulties, North Korea has carried out a record number or missile tests this year in what some experts say is an attempt to modernize its arsenal and boost its leverage in future negotiations with its rivals to win sanctions relief and other concessions.

    [ad_2]

    Source link

  • AIIMS Delhi cyber attack: 5 main servers hacked, China suspected to be involved

    AIIMS Delhi cyber attack: 5 main servers hacked, China suspected to be involved

    [ad_1]

    The cyber attack on Delhi’s All India Institute of Medical Sciences (AIIMS) which compromised the personal information of millions of patients was reportedly carried out by Chinese hackers and it targeted five major servers of the leading hospital.

    According to a report by India Today, quoting sources, the stolen data was said to be sold on the dark web. To be precise, over 1,600 searches for stolen AIIMS data were available on the dark web and that included stolen data of VVIPs, including politicians and celebrities.

    India Today quoted IFSO sources as saying that a total of five servers were compromised and the FSL team is now investigating the data leak. However, the IFSO officials were reportedly saying that no data was lost.

    The Ministry of Electronics and Information Technology’s Indian Computer Emergency Response Team, Delhi Cybercrime Special Cell, Indian Cybercrime Coordination Centre, Intelligence Bureau, Central Bureau of Investigation, National Forensic Sciences University, National Critical Information Infrastructure Protection Centre, and National Investigation Agency, among others, are investigating the cyber attack.

    Hackers allegedly demanded from AIIMS Rs 200 crore in cryptocurrencies. It is feared that the ransomware attack may have compromised the data of 3–4 crore patients.

    The emergency, outpatient, inpatient, and laboratory wings’ patient care services are currently administered manually because the servers are still down.

    Additionally, the AIIMS network sanitization is ongoing. There are organised antivirus programmes for computers and servers. On nearly 1,200 of the 5,000 computers, it is installed. According to PTI, 20 out of 50 servers have been scanned, and this work is ongoing 24/7.

    Also Read: AIIMS Delhi says e-hospital data restored on servers, services continue to run on manual mode

    Also Read: Cyber attack at AIIMS Delhi: Hackers demand Rs 200 cr in crypto, says report

    [ad_2]

    Source link

  • The biggest security risks of using fitness trackers and apps to monitor your health

    The biggest security risks of using fitness trackers and apps to monitor your health

    [ad_1]

    Fitness trackers, which help keep tabs on sleep quality, heart rate and other biological metrics, are a popular way to help Americans improve their health and well-being. 

    There are many types of trackers on the market, including those from well-known brands such as Apple, Fitbit, Garmin and Oura. While these devices are growing in popularity — and have legitimate uses — consumers don’t always understand the extent to which their information could be available to or intercepted by third parties. This is especially important because people can’t simply change their DNA sequencing or heart rhythms as they could a credit card or bank account number. 

    “Once the toothpaste is out of the tube, you can’t get it back,” said Steve Grobman, senior vice president and chief technology officer of computer security company McAfee.

    The holiday season is a popular time to purchase consumer health devices. Here’s what you should know about the security risks tied to fitness trackers and personal health data.

    Stick to a name brand, even though they are hacked

    Fitness devices can be expensive, even without taking inflation into account, but don’t be tempted to skimp on security to save a few dollars. While a less-known company may offer more bells and whistles at a better price, a well-established provider that is breached is more likely to care about its reputation and do things to help consumers, said Kevin Roundy, senior technical director at cybersecurity company Gen Digital.

    To be sure, data compromise issues, from criminal hacks to unintended sharing of sensitive user information, can — and have — hit well-known players, including Fitbit, which Google bought in 2021, and Strava. But even so, security professionals say it’s better to buy from a reputable manufacturer that knows how to design secure devices and has a reputation to upkeep. 

    “A smaller company might just go bankrupt,” Roundy said. 

    Fitness app data is not protected like health information

    There can be other concerns beyond having a person’s sensitive information exposed in a data breach. For example, fitness trackers generally connect to a user’s phone via Bluetooth, leaving personal data susceptible to hacking.  

    What’s more, the information that fitness trackers collect isn’t considered “health information” under the federal HIPAA standard or state laws like California’s Confidentiality of Medical Information Act. This means that personally revealing data can potentially be used in ways a consumer might never expect. For instance, the personal information could be shared with or sold to third parties such as data brokers or law enforcement, said Emory Roane, policy counsel at Privacy Rights Clearinghouse, a consumer privacy, advocacy and education organization. 

    Some fitness trackers may use consumers’ health and wellness data to derive revenue from ads, so if that’s a concern, you’ll want to make sure there’s a way to opt out. Review the provider’s terms of service to understand the its policies before you buy the fitness tracker, Roundy said.

    Default social, location settings may need to be changed

    A fitness tracker’s default settings may not offer the most stringent security controls. To boost protection, look at what settings can be adjusted, such as those related to social networking, location and other sharable information, said Dan Demeter, security researcher at cybersecurity provider Kaspersky Lab.

    Depending on the state, consumers can also opt out of the sale or sharing of their personal information to third parties, and in some cases, these rights are being expanded, according to Roane.

    Certainly, device users should be careful about what they post publicly about their location and activities, or what they allow to become public by default. This data could be searchable online and used by bad actors. Even if they aren’t acting maliciously, third parties such as insurers and employers could get access to this type of public information.

    “Users expect their data to be their data and use it how they want it to be used,” Roane said, but that’s not necessarily the case. 

    “It’s not only about present data, but also about past data,” Demeter said. For instance, a bad actor could see all the times the person goes running — what days and hours — and where, and use it to their advantage. 

    There are also a number of digital scams where criminals can use information about your location to make an opportunity seem more plausible. They can claim things like, “I know you lost your wallet at so and so place, which lends credibility to the scammer’s story,” Grobman said. 

    Location data can prove problematic in other ways as well. Roane offers the example of a women seeking reproductive health care in a state where abortion is illegal. A fitness tracker with geolocation services enabled could collect information that could be subpoenaed by law enforcement or be purchased by data brokers and sold to law enforcement, he said.

    Use strong password, two-factor authentication, and never share credentials

    Be sure to secure your account by using a strong password that you don’t use with another account and enabling two-factor authentication for the associated app. And don’t share credentials. That’s never a good idea, but it can have especially devastating consequences in certain circumstances. For example, a domestic violence victim could be tracked by her abuser, assuming he had access to her account credentials, Roane said.

    Also be sure to keep the device and the app up-to-date with security fixes.

    While nothing is foolproof, the goal is to be as secure as possible. “If somebody tries to profit from our personal information, we just make their lives harder so it’s not that easy to hack us,” Demeter said.

    [ad_2]

    Source link

  • Cyber attack at AIIMS Delhi: Hackers demand Rs 200 cr in crypto, says report

    Cyber attack at AIIMS Delhi: Hackers demand Rs 200 cr in crypto, says report

    [ad_1]

    Hackers have allegedly demanded approximately Rs 200 crore in cryptocurrency from the All India Institute of Medical Sciences (AIIMS), Delhi, whose server has been down for six days in a row, news agency PTI reported quoting sources.

    It is feared that the breach discovered on Wednesday morning may have compromised the data of 3–4 crore patients.

    The report quoted sources as saying that because the server was still down, patient care services in the emergency, outpatient, inpatient, and laboratory wings were managed manually.

    The ransomware attack is being looked into by the Delhi Police, the Ministry of Home Affairs, and the India Computer Emergency Response Team (CERT-IN).

    The Intelligence Fusion and Strategic Operations (IFSO) division of the Delhi Police has filed a case of extortion and cyberterrorism.

    Internet access has reportedly been disabled on hospital computers based on the recommendations of the investigating agencies.

    Several VIPs, including former prime ministers, ministers, bureaucrats, and judges, had their data stored.

    “Hackers have allegedly demanded around Rs 200 crore in cryptocurrency,” one of the sources told PTI.

    The NIC e-hospital database and application servers have been back online in the interim. Other e-hospital servers at AIIMS that are necessary for the provision of hospital services are being scanned and cleaned by the NIC team.

    The databases and applications have been scanned and prepared for four physical servers set up for restoring e-hospital services.

    In addition, the AIIMS network is being sanitised. Antivirus solutions for servers and computers have been planned. It has been installed on nearly 1,200 of the 5,000 computers available. Twenty out of fifty servers have been scanned, and this activity is ongoing 24 hours a day, seven days a week.

    Also Read: AIIMS Delhi’s server down since morning; ransomware attack suspected  

    Also Read: ‘Various govt agencies are investigating,’ says AIIMS Delhi on server hack issue

    [ad_2]

    Source link

  • UK politicians demand probe into Liz Truss phone hack claim

    UK politicians demand probe into Liz Truss phone hack claim

    [ad_1]

    LONDON — The British government insisted Sunday it has robust cybersecurity for government officials, after a newspaper reported that former Prime Minister Liz Truss’ phone was hacked while she was U.K. foreign minister.

    The Mail on Sunday said that the hack was discovered when Truss was running to become Conservative Party leader and prime minister in the summer. It said the security breach was kept secret by then-Prime Minister Boris Johnson and the head of the civil service.

    The newspaper, citing unnamed sources, said Russian spies were suspected of the hack.

    The U.K. government spokesperson declined to comment on security arrangements, but said it had “robust systems in place to protect against cyber threats,” including regular security briefings for ministers.

    Opposition parties demanded an independent investigation into the hack, and into the leak of the information to a newspaper.

    “Was Liz Truss’s phone hacked by Russia, was there a news blackout and if so why?” said Liberal Democrat foreign affairs spokesperson Layla Moran. “If it turns out this information was withheld from the public to protect Liz Truss’ leadership bid, that would be unforgivable.”

    Labour Party law-and-order spokesperson Yvette Cooper said “the story raises issues around cybersecurity.”

    “It’s why cybersecurity has to be taken so seriously by everyone across government, the role of hostile states,” she told Sky News. “But also the allegations about whether a Cabinet minister has been using a personal phone for serious government business, and serious questions about why this information or this story has been leaked or briefed right now.”

    [ad_2]

    Source link

  • Australian health insurer says data of all customers hacked

    Australian health insurer says data of all customers hacked

    [ad_1]

    CANBERRA, Australia — Australia’s largest health insurer said on Wednesday a cybercriminal had hacked the personal data of all its 4 million customers, as the government introduced legislation that would increase penalties for companies that fail to protect clients’ private information.

    Medibank said “significant amounts of health claims data” had also been accessed in the breach, which was reported to police a week ago when trade in the company’s shares was halted.

    The thief has demanded ransom and has reportedly threatened to expose the diagnoses and treatments of high-profile customers.

    Medibank said its priority was to discover the specific data stolen in relation to each customer and to share that information with those customers.

    The company had previously said the breach was thought to be limited to its subsidiary AHM and foreign students.

    “Our investigation has now established that this criminal has accessed all our private health insurance customers’ personal data and significant amounts of their health claims data,” Medibank chief executive David Koczkar said in a statement to the Australian Securities Exchange.

    “This is a terrible crime – this is a crime designed to cause maximum harm to the most vulnerable members of our community,” Koczkar added, with an apology to customers.

    The government has been planning urgent legislative reforms on cybersecurity regulation since a hacker stole the personal data of almost 10 million current and former customers of Optus, Australia’s second-largest wireless telecommunications carrier.

    Optus became aware on Sept. 21 that personal data of more than one-third of Australia’s population of 26 million had been stolen.

    In introducing amendments to the Privacy Act to Parliament on Wednesday, Attorney-General Mark Dreyfus mentioned both companies and MyDeal, an online retail intermediary that lost the data of 2.2 million customers in a hack revealed two weeks ago.

    “As the Optus, Medibank and MyDeal cyberattacks have recently highlighted, data breaches have the potential to cause serious financial and emotional harm to Australians, and this is unacceptable,” Dreyfus told Parliament.

    “Governments, businesses and other organizations have an obligation to protect Australians’ personal data, not to treat it as a commercial asset,” Dreyfus added.

    The government is critical of companies that amass more customer data than necessary to make money from it in ways unrelated to the services for which the information was provided.

    The penalties for serious breaches of the Privacy Act would increase from 2.2 million Australian dollars ($1.4 million) now to AU$50 million ($32 million) under the proposed amendments.

    A company could also be fined the value of 30% of its revenues over a defined period if that amount exceeded AU$50 million ($32 million).

    Medibank said on Wednesday it did not have cyber insurance and estimated the hack would reduce its earnings by between AU$25 million ($16 million) and AU$35 million ($22 million) by early next year.

    The Medicare trading halt was lifted on Wednesday and shares slid more than 14% in early trading.

    [ad_2]

    Source link

  • FTC seeks to hold Drizly CEO accountable for alleged security failures, even if he moves to another company

    FTC seeks to hold Drizly CEO accountable for alleged security failures, even if he moves to another company

    [ad_1]

    The Drizly application on a smartphone.

    Tiffany Hagler-Geard | Bloomberg | Getty Images

    In a new proposed settlement, the Federal Trade Commission is seeking to hold a tech CEO accountable to specific security standards, even if he moves to a new company.

    The agency announced Monday that its four commissioners had voted unanimously to issue a proposed order against alcohol delivery platform Drizly and its CEO James Cory Rellas for allegedly failing to implement adequate security measures, which eventually resulted in a data 2020 breach exposing personal information on about 2.5 million consumers.

    Uber acquired Drizly for $1.1 billion in 2021.

    The FTC claims that despite being alerted to the security concerns two years before the breach, Drizly and Rellas did not do enough to protect their users’ information.

    While settlements like this are not that uncommon for the FTC, its decision to name the CEO and have the stipulations follow him beyond his tenure at Drizly exemplifies an approach favored by Democratic Chair Lina Khan. Some progressive enforcers have argued that naming tech executives in their lawsuits should create a stronger deterrence signal for other potential violators.

    The proposed order, which is subject to a 30 day public comment period before the commission votes on whether to make it final, would require Rellas to implement an information security program at future companies where he’s the CEO, a majority owner or a senior officer with information security responsibilities, provided the company collects consumer information from more than 25,000 people.

    Though Republican Commissioner Christine Wilson voted with the agency’s three Democrats to impose the proposed settlement against Drizly, she objected to naming Rellas as an individual defendant. In a statement, Wilson wrote that naming Rellas will not result in putting “the market on notice that the FTC will use its resources to target lax data security practices.”

    “Instead, it has signaled that the agency will substitute its own judgement about corporate priorities and governance decisions for those of companies,” she wrote, adding that given CEOs’ broad overviews of their businesses, it’s best left to companies rather than regulators to determine what the chief executive should pay regular attention to.

    In a joint statement, Khan and Democratic Commissioner Alvaro Bedoya responded to Wilson’s argument, writing that “Overseeing a big company is not an excuse to subordinate legal duties in favor of other priorities. The FTC has a role to play in making sure a company’s legal obligations are weighed in the boardroom.”

    Khan’s FTC has named other executives in past complaints, like when it named Meta CEO Mark Zuckerberg as a defendant in a lawsuit seeking to block the company’s proposed acquisition of virtual reality company Within Unlimited. But it later dropped him from the complaint after the company said Zuckerberg would not try to personally buy Within.

    The order against Drizly would also require the company to destroy personal data it has collected but no longer needs, limit future data collection and establish a comprehensive security program including training for employees and controls on who can access data.

    “We take consumer privacy and security very seriously at Drizly, and are happy to put this 2020 event behind us,” a Drizly spokesperson said in a statement.

    Subscribe to CNBC on YouTube.

    WATCH: The changing face of privacy in a pandemic

    [ad_2]

    Source link

  • Australia flags new corporate penalties for privacy breaches

    Australia flags new corporate penalties for privacy breaches

    [ad_1]

    CANBERRA, Australia — Australia on Saturday proposed tougher penalties for companies that fail to protect customers’ personal data after two major cybersecurity breaches left millions vulnerable to criminals.

    The penalties for serious breaches of the Privacy Act would increase from 2.2 million Australian dollars ($1.4 million) now to AU$50 million ($32 million) under amendments to be introduced to Parliament next week, Attorney-General Mark Dreyfus said.

    A company could also be fined the value of 30% of its revenues over a defined period if that amount exceeded AU$50 million ($32 million).

    Dreyfus said “big companies could face penalties up to hundreds of millions of dollars” under the new law.

    “It is a very, very substantial increase in the penalties,” Dreyfus told reporters.

    “It’s designed to make companies think. It’s designed to be a deterrent so that companies will protect the data of Australians,” he added.

    Parliament resumes on Tuesday for the first time since mid-September.

    Since Parliament last sat, unknown hackers stole personal data from 9.8 million customers of Optus, Australia’s second-largest wireless telecommunications carrier. The theft has left more than one-third of Australia’s population at heightened risk of identity theft and fraud.

    Unknown cybercriminals this week demanded ransom from Australia’s largest health insurer, Medibank, after claiming to have stolen 200 gigabytes of customers’ data including medical diagnoses and treatments. Medibank has 3.7 million customers. The company said the hackers had proved they hold the personal records of at least 100.

    The thieves have reportedly threatened to make public medical conditions of high-profile Medibank customers.

    Dreyfus said both breaches had shown “existing safeguards are inadequate.”

    As well as failing to protect personal information, the government is concerned that companies are unnecessarily holding too much customer data for too long in the hope of monetizing that information.

    “We need to make sure that when a data breach occurs the penalty is large enough, that it’s a really serious penalty on the company and can’t just be disregarded or ignored or just paid as a part of a cost of doing business,” Dreyfus said.

    Dreyfus hopes the proposed amendments will become law in the final four weeks that Parliament will sit this year.

    Any new penalties will not be retroactive and will not effect Optus or Medibank.

    [ad_2]

    Source link

  • Biden signs executive order with new framework to protect data transfers between the U.S. and EU

    Biden signs executive order with new framework to protect data transfers between the U.S. and EU

    [ad_1]

    President Joe Biden signed an executive order to implement a new framework to protect the privacy of personal data shared between the U.S. and Europe, the White House announced Friday.

    The new framework fills a significant gap in data protections across the Atlantic since a European court undid a previous version in 2020. The court found the U.S. had too great an ability to surveil European data transferred through the earlier system.

    The court case, known as Schrems II, “created enormous uncertainty about the ability of companies to transfer personal data from the European Union to the United States in a manner consistent with EU law,” then-Deputy Assistant Commerce Secretary James Sullivan wrote in a public letter shortly after the decision. The outcome made it so U.S. companies would need to use different “EU-approved data transfer mechanisms” on an ad hoc basis, creating more complexity for businesses, Sullivan wrote.

    The so-called Privacy Shield 2.0 seeks to address European concerns about possible surveillance by U.S. intelligence agencies. In March, after the U.S. and EU agreed in principle to the new framework, the White House said in a fact sheet that the U.S. “committed to implement new safeguards to ensure that signals intelligence activities are necessary and proportionate in the pursuit of defined national security objectives.”

    The new framework will allow individuals in the EU to seek redress through an independent Data Protection Review Court made up of members outside of the U.S. government. That body “would have full authority to adjudicate claims and direct remedial measures as needed,” according to the March fact sheet.

    Before a matter reaches the DPRC, the civil liberties protection officer in the Office of the Director of National Intelligence will also conduct an initial investigation of complaints. Its decisions are also binding, subject to the independent body’s assessment.

    The executive order directs the U.S. intelligence community to update policies and procedures to fit the new privacy protections in the framework. It also instructs the Privacy and Civil Liberties Oversight Board, an independent agency, to examine those updates and conduct an annual review of whether the intelligence community has fully adhered to binding redress decisions.

    “The EU-U.S. Data Privacy Framework includes robust commitment to strengthen the privacy and civil liberties safeguards for signals intelligence, which will ensure the privacy of EU personal data,” Commerce Secretary Gina Raimondo told reporters Thursday.

    Raimondo said she will transfer a series of documents and letters from relevant U.S. government agencies outlining the operation and enforcement of the framework to her EU counterpart, Commissioner Didier Reynders.

    The EU will then conduct an “adequacy determination” of the measures, the White House said. It will assess the sufficiency of the data protection measures in order to restore the data transfer mechanism.

    American tech companies and industry groups applauded the measure, with Meta‘s president of global affairs, Nick Clegg, writing on Twitter, “We welcome this update to US law which will help to preserve the open internet and keep families, businesses and communities connected, wherever they are in the world.”

    Linda Moore, president and CEO of industry group TechNet, said in a statement, “We applaud the Biden Administration for taking affirmative steps to ensure the efficiency and effectiveness of American and European cross-border data flows and will continue to work with the Administration and members of Congress from both parties to pass a federal privacy bill.”

    But some consumer and data privacy watchdogs critiqued the extent of the data protections.

    BEUC, a European consumer group, said in a release that the framework “is likely still insufficient to protect Europeans’ privacy and personal data when it crosses the Atlantic.” The group added that “there are no substantial improvements to address issues related to the commercial use of personal data, an area where the previous agreement, the EU-US Privacy Shield, fell short of GDPR requirements,” referring to Europe’s General Data Protection Regulation.

    Ashley Gorski, senior staff attorney at the ACLU National Security Project, said in a statement that the order “does not go far enough. It fails to adequately protect the privacy of Americans and Europeans, and it fails to ensure that people whose privacy is violated will have their claims resolved by a wholly independent decision-maker.”

    — CNBC’s Chelsey Cox contributed to this report.

    Subscribe to CNBC on YouTube.

    WATCH: Why the U.S. government is questioning your online privacy

    [ad_2]

    Source link

  • Former Uber security chief guilty of data breach coverup

    Former Uber security chief guilty of data breach coverup

    [ad_1]

    SAN FRANCISCO (AP) — The former chief security officer for Uber was convicted Wednesday of trying to cover up a 2016 data breach in which hackers accessed tens of millions of customer records from the ride-hailing service.

    A federal jury in San Francisco convicted Joseph Sullivan of obstructing justice and concealing knowledge that a federal felony had been committed, federal prosecutors said.

    Sullivan remains free on bond pending sentencing and could face a total of eight years in prison on the two charges when he is sentenced, prosecutors said.

    “Technology companies in the Northern District of California collect and store vast amounts of data from users,” U.S. Attorney Stephanie M. Hinds said in a statement. “We will not tolerate concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users.”

    It was believed to be the first criminal prosecution of a company executive over a data breach.

    A lawyer for Sullivan, David Angeli, took issue with the verdict.

    “Mr. Sullivan’s sole focus — in this incident and throughout his distinguished career — has been ensuring the safety of people’s personal data on the internet,” Angeli told the New York Times.

    An email to Uber seeking comment on the conviction wasn’t immediately returned.

    Sullivan was hired as Uber’s chief security officer in 2015. In November 2016, Sullivan was emailed by hackers, and employees quickly confirmed that they had stolen records on about 57 million users and also 600,000 driver’s license numbers, prosecutors said.

    After learning of the breach, Sullivan began a scheme to hide it from the public and the Federal Trade Commission, which had been investigating a smaller 2014 hack, authorities said.

    According to the U.S. attorney’s office, Sullivan told subordinates that “the story outside of the security group was to be that ‘this investigation does not exist,’” and arranged to pay the hackers $100,000 in bitcoin in exchange for them signing non-disclosure agreements promising not to reveal the hack. He also never mentioned the breach to Uber lawyers who were involved with the FTC’s inquiry, prosecutors said.

    “Sullivan orchestrated these acts despite knowing that the hackers were hacking and extorting other companies as well as Uber,” the U.S. attorney’s office said.

    Uber’s new management began investigating the breach in the fall of 2017. Despite Sullivan lying to the new chief executive officer and others, the truth was uncovered and the breach was made public, prosecutors said.

    Sullivan was fired along with Craig Clark, an Uber lawyer he had told about the breach. Clark was given immunity by prosecutors and testified against Sullivan.

    No other Uber executives were charged in the case.

    The hackers pleaded guilty in 2019 to computer fraud conspiracy charges and are awaiting sentencing.

    Sullivan was convicted of of obstruction of proceedings of the Federal Trade Commission and misprision of felony, meaning concealing knowledge of a felony from authorities.

    Meanwhile, some experts have questioned how much cybersecurity has improved at Uber since the breach.

    The company announced last month that all its services were operational following what security professionals called a major data breach, claiming there was no evidence the hacker got access to sensitive user data.

    The lone hacker apparently gained access posing as a colleague, tricking an Uber employee into surrendering their credentials. Screenshots the hacker shared with security researchers indicate they obtained full access to the cloud-based systems where Uber stores sensitive customer and financial data.

    It is not known how much data the hacker stole or how long they were inside Uber’s network. There was no indication they destroyed data.

    [ad_2]

    Source link

  • Australian police make first arrest in Optus hack probe

    Australian police make first arrest in Optus hack probe

    [ad_1]

    CANBERRA, Australia — A police investigation of a cyberattack on an Australian telecommunications company in which the personal data of more than one third of Australia’s population was stolen has resulted in its first arrest, investigators said Thursday.

    Police launched Operation Hurricane in cooperation with the U.S. Federal Bureau Investigation after Optus, Australia’s second-largest wireless carrier, lost the personal records of 9.8 million current and former customers on Sept. 21.

    The hacker dumped the records of 10,000 of those customers on the dark web last week as part of an attempt to extort $1 million from Optus, a subsidiary of Singapore Telecommunications Ltd., also known as Singtel.

    A 19-year-old Sydney man was arrested on Thursday and charged with using the dumped data in a text message blackmail scam, police said in a statement.

    The man, who has not been identified publicly, has yet to appear in court on two charges that carry prison sentences of up to 10 and seven years.

    Police allege he sent text messages to 93 Optus customers demanding 2,000 Australian dollars ($1,300) be deposed in a bank account or the data would be used in a financial crime. None of the targets paid.

    One of the extortion targets, identified only as Belinda and described as a mother of a 5-year-old child with cancer, told Nine Network News last week, “To be honest, it’s just not what we need.”

    “I guess they’re just trying to hopefully pressure people into paying,” she told Nine.

    Australian Federal Police Assistant Commissioner Justine Gough said the investigation is continuing.

    “The Hurricane investigation is a high priority for the AFP and we are aggressively pursuing all lines of inquiry to identify those behind the attack,” Gough said.

    “Just because there has been one arrest does not mean there won’t be any more arrests,” she added.

    The Australian government announced changes to its telecommunications law to protect vulnerable Optus customers.

    The changes to the Telecommunications Regulations allow Optus and other providers to better coordinate with financial institutions and governments to detect and mitigate the risk of cybersecurity incidents, fraud, scams and other malicious cyber activities, a government statement said.

    Optus ran full-page ads in Australian newspapers on Saturday under the headline, “We’re deeply sorry.”

    The ad included a link to an Optus website that details actions that customers can take to avoid identity theft and fraud.

    The government can change regulations without legislative approval. But the government hopes to pass changes to the Privacy Act in Parliament during the final four weeks of its 2022 session in response to the Optus breach.

    The changes would include increased penalties for companies with lax cybersecurity protections and curbs on the quantities and types of customer data that businesses can amass, as well as the duration for which personal information can be kept.

    [ad_2]

    Source link

  • Australia updates law to protect data after Optus hack

    Australia updates law to protect data after Optus hack

    [ad_1]

    CANBERRA, Australia — The Australian government announced changes Thursday to its telecommunications law to protect vulnerable customers after personal details were stolen in a major cyberattack on the nation’s second-largest wireless carrier.

    The changes to Telecommunications Regulations allow Optus and other providers to better coordinate with financial institutions and governments to detect and mitigate the risk of cybersecurity incidents, fraud, scams and other malicious cyber activities, Treasurer Jim Chalmers and Communications Minister Michelle Rowland said in a joint statement.

    “What this is all about is to try and reduce the impact of this data breach on Optus customers and to enable financial institutions to implement enhanced safeguards and monitoring,” Rowland told reporters.

    More than one in three Australians had personal data stolen when Optus lost the records of 9.8 million current and former customers including passport, driver’s license and national health care identification numbers in a hack discovered on Sept. 21.

    The hacker dumped the records of 10,000 of those customers on the dark web last week as part of an attempt to extort $1 million from Optus, a subsidiary of Singapore Telecommunications Ltd., also known as Singtel.

    Optus ran full-page ads in Australian newspapers on Saturday under the headline: “We’re deeply sorry.”

    The ad included a link to an Optus website that details actions customers can take to avoid identity theft and fraud.

    The government can change regulations without reference to the Parliament. But the government hopes to pass changes to the Privacy Act through the Parliament during its final four sitting weeks of 2022 in response to the Optus breach.

    The changes would include increased penalties for companies with lax cybersecurity protections and curbs on the quantities and types of customer data that businesses can amass, as well as the duration for which personal information can be kept.

    [ad_2]

    Source link

  • Cyberattack steals passenger data from Portuguese airline

    Cyberattack steals passenger data from Portuguese airline

    [ad_1]

    LISBON, Portugal (AP) — Portugal’s national airline TAP Air Portugal says hackers obtained the personal data of some of its customers and have published the information on the dark web.

    No payment data was taken in the cyberattack, the flag carrier said in a statement late Wednesday.

    The attack began almost a month ago and is being investigated by Portuguese authorities, with the help of specialists from Microsoft, the airline said.

    The hackers obtained the name, nationality, sex, date of birth and address, email and telephone contact details, the airline said, without elaborating.

    Portuguese newspaper Expresso said a hacker group called Ragnar Locker was offering the information of 1.5 million TAP Air Portugal customers on the dark web.

    [ad_2]

    Source link