ReportWire

Tag: Security

  • LAPD is assisting CHP in protecting Kamala Harris after Trump pulls Secret Service

    [ad_1]

    Los Angeles police Metropolitan Division officers, meant to be working crime-suppression assignments in hard-hit areas of the city, are instead providing security for former Vice President Kamala Harris, sources told The Times.

    The department is “assisting the California Highway Patrol in providing protective services for former Vice President Kamala Harris until an alternate plan is established,” said Jennifer Forkish, L.A. police communications director. “This temporary coordinated effort is in place to ensure that there is no lapse in security.”

    A dozen or more officers have begun working a detail to protect Harris after President Trump revoked her Secret Service protection as of Monday. Sources not authorized to discuss the details of the plan said the city would fund the security but that the arrangement was expected to be brief, with Harris hiring her own security in the near future.

    Trump ended an arrangement that had extended Harris’ security coverage beyond the six months that vice presidents are usually provided after leaving office. California officials then put into place a plan for the California Highway Patrol to provide dignitary protection for Harris. At some point, the LAPD was added to the plan, according to the sources, as California law enforcement scrambled to take over from the Secret Service on Monday.

    A security detail was captured outside Harris’ Brentwood home by a FOX 11 helicopter as the station broke the story of the use of L.A. police.

    The Los Angeles Police Protective League, the union that represents rank-and-file LAPD officers, criticized the move.

    “Pulling police officers from protecting everyday Angelenos to protect a failed presidential candidate who also happens to be a multi-millionaire, with multiple homes and who can easily afford to pay for her own security, is nuts,” its board of directors said in a statement to The Times. Mayor Karen Bass “should tell Governor Newsom that if he wants to curry favor with Ms. Harris and her donor base, then he should open up his own wallet because LA taxpayers should not be footing the bill for this ridiculousness.”

    Newsom, who would need to sign off on CHP protection, has not confirmed the arrangement to The Times. Izzy Gordon, a spokesperson for Newsom, simply said, “The safety of our public officials should never be subject to erratic, vindictive political impulses.”

    Newsom’s office and Bass’ office had discussions last week on how best to address the situation, according to sources not authorized to talk about the details.

    Bass, in a statement last week, commented on Trump scrapping the security detail for Harris, saying, “This is another act of revenge following a long list of political retaliation in the form of firings, the revoking of security clearances, and more. This puts the former Vice President in danger and I look forward to working with the governor to make sure Vice President Harris is safe in Los Angeles.”

    Her office did not respond to comment on the LAPD deployment on Thursday.

    Two law enforcement sources told The Times that the Metro officers had been slated to go to the San Fernando Valley for crime-suppression work before their assignment changed.

    Deploying LAPD officers to protect Harris was a source of controversy within the department in years past.

    During L.A. Police Chief Charlie Beck’s tenure, when Harris was a U.S. senator, plainclothes officers served as security and traveled with her from January 2017 to July 2018. It was an arrangement that then-Mayor Eric Garcetti said he was unaware of until Beck’s successor ended it. Beck said at the time through a spokesman that the protection was granted based on a threat assessment.

    Beck’s successor, Michel Moore, ended the protection in July 2018 after he said a new evaluation determined it was no longer needed. The decision came as The Times filed a lawsuit seeking records from Garcetti detailing the costs of security related to his own extensive travel.

    Trump signed a memorandum on Thursday ending Harris’ protection as of Monday, according to sources not authorized to discuss the security matter.

    Former vice presidents usually get Secret Service protection for six months after leaving office, while former presidents are given protection for life. But before his term ended, then-President Biden signed an order to extend Harris’ protection beyond six months, to July 2026. Aides to Harris had asked Biden for the extension. Without it, her security detail would have ended last month, according to sources.

    The Secret Service, the CHP and Los Angeles police do not discuss details of dignitary protection in terms of deployment, numbers, or travel teams. CNN first reported the removal of Harris’ protection detail.

    The curtailing of Secret Service protection comes as Harris is about to begin a book tour for her memoir, titled “107 Days.” The tour has 15 stops, which include visits to London and Toronto. The book title references the short length of her presidential campaign. The tour begins next month.

    Harris, the first Black woman to serve as vice president, was the subject of an elevated threat level — particularly when she became the Democratic presidential contender last year. The Associated Press reports, however, a recent threat intelligence assessment by the Secret Service conducted on those it protects, such as Harris, found no red flags or credible evidence of a threat to the former vice president.

    [ad_2]

    Richard Winton

    Source link

  • Don’t use your home Wi-Fi before fixing certain security risks

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Home Wi-Fi networks are the backbone of how most people get online, connecting laptops, phones, smart TVs and more. When properly secured, they offer a convenient and private way to browse the internet, stream content and work from home. But “private” doesn’t always mean “safe.” Wi-Fi security can be easily compromised if you have weak settings or outdated equipment.

    I recently heard from Carol in Smithtown, New York, who asked, “Is it safe to browse the internet on your own laptop using only your home Wi-Fi?”

    Her question points to a bigger concern. Many of us rely on home networks every day without really knowing if they’re as secure as they should be.

    Let’s break down what makes a home Wi-Fi network secure, the risks you should know about and the steps you can take to protect your privacy.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my Cyberguy.com newsletter.

    A user troubleshoots an internet router. (Kurt “CyberGuy” Knutsson)

    Why home Wi-Fi security is important

    Your home Wi-Fi is not just a way to get online but also the gateway to your personal and professional life. Everything from online banking to work emails to video calls passes through it. If your network isn’t secure, that information could be intercepted or exposed.

    One of the biggest misconceptions is that a home network is safe simply because it’s private. In reality, hackers often target residential networks because they tend to have weaker defenses than corporate ones.

    Someone nearby could connect to your network if your password is weak or your encryption is outdated. This not only slows your internet but also lets them use your connection for illegal activities. Sensitive information like passwords, credit card numbers and personal documents can be intercepted if the network is compromised.

    11 EASY WAYS TO PROTECT YOUR ONLINE PRIVACY IN 2025

    Attackers can use an insecure network to push malicious software onto your devices, sometimes without you even realizing it. Smart devices such as security cameras, thermostats and speakers can be taken over and used for spying or as part of larger cyberattacks.

    Even if you trust everyone in your household, your network is still exposed to risks from outside. And with so many devices connected today, including laptops, phones, tablets, TVs and IoT gadgets, there are more entry points for an attacker than ever before. Securing your Wi-Fi closes those doors before someone decides to try them. 

    Illustration of a hacker at work

    A hacker executes cybercrime. (Kurt “CyberGuy” Knutsson)

    Choose the right router for Wi-Fi protection

    Every piece of Wi-Fi security advice ultimately comes back to the same foundation: your router. It is the gatekeeper for your entire home network. If it is old, poorly configured, or missing important updates, even the strongest passwords and best digital habits will not fully protect you.

    Investing in a good router is one of the most important steps you can take to secure your home Wi-Fi. A modern, well-supported router gives you stronger encryption, better control over connected devices and regular updates that patch security flaws.

    Don’t stop at the hardware itself. Check regularly for firmware updates from the manufacturer. Some new routers update automatically, but many require you to log in and install patches manually. Outdated firmware leaves known vulnerabilities wide open.

    IS YOUR HOME WI-FI REALLY SAFE? THINK AGAIN

    Also, change the default router login password immediately. Most routers ship with basic credentials like “admin/admin.” Attackers know this and can easily hijack your settings if you never change them.

    If your router supports it, enable two-factor authentication (2FA) for logins. This extra step makes it much harder for attackers to gain control, even if they steal your password.

    If you are not sure where to begin, I have put together a list of some of the best and most secure routers you can buy right now by visiting Cyberguy.com.

    Enable strong Wi-Fi encryption

    Encryption ensures that the data flowing across your network is scrambled, making it useless to anyone who tries to intercept it. Without proper encryption, nearby attackers can capture and read your traffic.

    The current gold standard is WPA3, which provides the strongest protection. If your router doesn’t support it, WPA2 is still considered safe and widely used. Older options like WEP or an open, password-free network are highly insecure and should be avoided at all costs. It’s worth logging into your router’s settings just to confirm what level of encryption your network is using.

    Image of a home router in use

    Cables run out of an internet router. (Kurt “CyberGuy” Knutsson)

    Create a strong Wi-Fi password

    Your Wi-Fi password is the digital equivalent of the key to your home. A short or predictable password is like leaving a spare under the doormat, and anyone determined enough can find a way in. Instead, create a long passphrase that combines upper and lowercase letters, numbers and symbols. Aim for at least 12 to 16 characters.

    Consider using a password manager to generate and store complex passwords.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    Check who is connected to your network

    Even with a solid password, it’s smart to check who is actually connected to your network. Most routers allow you to view a list of active devices. If you spot something you don’t recognize, investigate. It could be a neighbor piggybacking on your connection or, in the worst case, an intruder.

    It also helps to disable Wi-Fi Protected Setup (WPS). This feature was designed to make connecting new devices easier, but it has security flaws that attackers can exploit. Some users go further by enabling MAC address filtering, which limits access to specific devices.

    To reduce risk even more, set up a separate guest network for smart devices and visitors. That way, if one device gets hacked, your laptops and phones remain protected.

    And remember, keep all your devices updated. From laptops and phones to smart bulbs and thermostats, every gadget is a potential entry point. A weak link in one device can put your entire network at risk.

    IS YOUR PHONE HACKED? HOW TO TELL AND WHAT TO DO

    Protect your privacy with a VPN

    A Virtual Private Network, or VPN, helps solve one of the biggest issues with online privacy, which is who can see what you’re doing. When you connect through a VPN, it creates an encrypted tunnel between your device and the websites or apps you use. Everything that travels through this tunnel is hidden from outsiders, including your internet provider.

    A reliable VPN is essential for protecting your online privacy and ensuring a secure, high-speed connection.

    For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at Cyberguy.com. 

    Don’t overlook antivirus protection

    While your Wi-Fi settings form the first line of defense, you should also protect the devices connected to your network. Install strong antivirus software to block malware that could spread through downloads, emails, or malicious links. This extra step ensures that even if a threat slips past your router’s defenses, your devices stay protected.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    CLICK HERE TO GET THE FOX NEWS APP 

    Kurt’s key takeaway

    So, to return to Carol’s question: Is it safe to browse the internet on your home Wi-Fi? The answer is yes, but only if you take the time to secure it. Strong router settings, proper encryption and a solid password do most of the heavy lifting. Building habits such as checking who is connected, keeping devices updated and using tools like a VPN adds even greater peace of mind.

    When was the last time you checked your router settings or updated its firmware? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my Cyberguy.com newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Parenting 101: 5 Lessons to keep kids safe online for the new school year

    [ad_1]

    The back-to-school season is exciting – new knowledge, new digital tools, and new discoveries. But it also brings higher cybersecurity risks for both schools and children. Cybersecurity experts are urging children, parents, and school communities to stay extra alert during this period.

    “The back-to-school period requires additional efforts to keep children and school communities safe online. A new beginning means new digital tools, online searches, and registrations for learning platforms. All of that increases cyber risks that must be taken seriously,” said Karolis Arbačiauskas, head of product at NordPass, in a media release

    A new study by NordPass, in collaboration with NordStellar, reveals a worrying truth: many educational institutions are still using shockingly weak passwords to protect sensitive data. Entries like “123456”, “Edifygroup@1”, and “principal@2021” appeared frequently, showing a widespread reliance on predictable or outdated credentials that are easy for hackers to guess.

    This is why the back-to-school season is the perfect moment to talk to children about cyber hygiene – the dos and don’ts in digital environments – and to help them build strong habits for digital security and privacy. “Learning about cybersecurity can be fun. Many families of cybersecurity professionals make it a game – they host a small party with snacks and guide their children through five simple but essential exercises,” said Arbačiauskas.

    Cybersecurity experts advise to take these steps to preserve your own cybersecurity and that of your family members (it can also be used as inspiration for your family’s Cyber Party):

    • Create strong and unique passwords. Make sure every account in your family – whether it’s yours, your parents’, your significant other’s, or your children’s – uses a strong and unique password. The easiest way to do it? Use a trusted password manager to generate, store, and share them securely.
    • Turn on multi-factor authentication (MFA). Add an extra layer of security wherever you can, especially to access school portals, email accounts, and social apps. MFA helps keep hackers out even if a password gets breached – and they get breached more often than you think. A recent study by NordPass revealed that many educational institutions still use shockingly weak passwords.
    • Update devices and apps. Keep phones, tablets, and laptops up to date with the latest software. Outdated apps can contain vulnerabilities that hackers take advantage of to get backdoor access into your device. Updates patch these security holes so that cybercriminals can no longer exploit them.
    • Talk about phishing. Discuss cybersecurity with your family and why it matters. Teach them to never click suspicious links or open unknown attachments – especially in emails or messages claiming to be from the school. When in doubt, verify with the sender by using a website checker.
    • Adjust privacy settings. Review and tighten privacy settings on social media, online games, and school platforms. Limit what personal info is publicly visible and who can contact your kids online.

    – JC

    [ad_2]

    Source link

  • Automated Sextortion Spyware Takes Webcam Pics of Victims Watching Porn

    [ad_1]

    Sextortion-based hacking, which hijacks a victim’s webcam or blackmails them with nudes they’re tricked or coerced into sharing, has long represented one of the most disturbing forms of cybercrime. Now one specimen of widely available spyware has turned that relatively manual crime into an automated feature, detecting when the user is browsing pornography on their PC, screenshotting it, and taking a candid photo of the victim through their webcam.

    On Wednesday, researchers at security firm Proofpoint published their analysis of an open-source variant of “infostealer” malware known as Stealerium that the company has seen used in multiple cybercriminal campaigns since May of this year. The malware, like all infostealers, is designed to infect a target’s computer and automatically send a hacker a wide variety of stolen sensitive data, including banking information, usernames and passwords, and keys to victims’ crypto wallets. Stealerium, however, adds another, more humiliating form of espionage: It also monitors the victim’s browser for web addresses that include certain NSFW keywords, screenshots browser tabs that include those words, photographs the victim via their webcam while they’re watching those porn pages, and sends all the images to a hacker—who can then blackmail the victim with the threat of releasing them.

    “When it comes to infostealers, they typically are looking for whatever they can grab,” says Selena Larson, one of the Proofpoint researchers who worked on the company’s analysis. “This adds another layer of privacy invasion and sensitive information that you definitely wouldn’t want in the hands of a particular hacker.”

    “It’s gross,” Larson adds. “I hate it.”

    Proofpoint dug into the features of Stealerium after finding the malware in tens of thousands of emails sent by two different hacker groups it tracks (both relatively small-scale cybercriminal operations), as well as a number of other email-based hacking campaigns. Stealerium, strangely, is distributed as a free, open source tool available on Github. The malware’s developer, who goes by the named witchfindertr and describes themselves as a “malware analyst” based in London, notes on the page that the program is for “educational purposes only.”

    “How you use this program is your responsibility,” the page reads. “I will not be held accountable for any illegal activities. Nor do i give a shit how u use it.”

    In the hacking campaigns Proofpoint analyzed, cybercriminals attempted to trick users into downloading and installing Stealerium as an attachment or a web link, luring victims with typical bait like a fake payment or invoice. The emails targeted victims inside companies in the hospitality industry, as well as in education and finance, though Proofpoint notes that users outside of companies were also likely targeted but wouldn’t be seen by its monitoring tools.

    Once it’s installed, Stealerium is designed to steal a wide variety of data and send it to the hacker via services like Telegram, Discord, or the SMTP protocol in some variants of the spyware, all of which is relatively standard in infostealers. The researchers were more surprised to see the automated sextortion feature, which monitors browser URLs a list of pornography-related terms such as “sex” and “porn,” which can be customized by the hacker and trigger simultaneous image captures from the user’s webcam and browser. Proofpoint notes that it hasn’t identified any specific victims of that sextortion function, but the existence of the feature suggests it was likely used.

    [ad_2]

    Andy Greenberg

    Source link

  • Moving exposes your personal data to scammers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Downsizing should feel like a fresh start. A smaller home, less upkeep, maybe even a retirement community with new friends. In fact, more than 3 million elderly Americans move every year. Are you considering downsizing as well?

    One woman told the internet about moving her mother into an assisted living home. Before the boxes were even packed, her mother fell for two back-to-back scams. It wasn’t bad luck; scammers had picked up on her address and pounced.

    This isn’t rare. Researchers have found that over 70% of cybercrimes trace back to exposed personal data. And moving creates one of the biggest exposures of all. Real estate listings, moving companies and address changes get scooped up by data brokers and published online, the perfect setup for criminals to strike.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS

    PODS moving truck and employee outside residential home, Queens, New York. (Lindsey Nicholson/UCG/Universal Images Group via Getty Image)

    How moving puts your personal data at risk

    When you buy, sell, or even just change your address, your information spreads across multiple systems:

    • Real estate records (public by default)
    • Utility company logs
    • Postal forwarding data
    • Transaction history and home value.

    Data brokers scoop all this up. Then they bundle it, resell it and suddenly your new life stage is an open secret. That’s exactly what scammers look for.

    10 SIGNS YOUR PERSONAL DATA IS BEING SOLD ONLINE

    Front Door with Delivery Boxes

    Cybercriminals look into multiple databases to gain information about a move. (iStock)

    Common scams that target you when downsizing

    Here’s why moving makes seniors a hot target:

    • Identity theft: Pair your new address with your date of birth (easy to find online), and thieves can open accounts in your name.
    • Cash-rich scams: Selling a house can make you look like you’re sitting on cash. Fraudsters know this.
    • Phishing tricks: Fake “utility setup” calls asking for your Social Security number.
    • Harassment: A new address published online can attract unwanted attention.

    Think of it this way: while you’re busy unpacking boxes, criminals are unpacking your data.

    HOW TO HAND OFF DATA PRIVACY RESPONSIBILITIES FOR OLDER ADULTS TO A TRUSTED LOVED ONE

    How to avoid becoming a moving scam victim

    Removing your data can protect you from cyber scams. (Kurt “CyberGuy” Knutsson)

    How to protect your personal data when you move

    While moving creates new opportunities, it also creates new risks. These simple steps will help you lock down your personal data before scammers can exploit it.

    1) Remove your info from data broker sites

    Data brokers automatically update your file when you move. That means your new address, phone number and even property transaction details can end up on people-search websites almost overnight. Once your profile is out there, scammers can buy or scrape it with ease.

    The good news: you don’t have to chase down every broker yourself. A personal data removal service does the legwork for you, contacting data brokers, demanding removal and following up to make sure your new details don’t creep back in. Think of it as hiring a moving company for your personal data.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice.  They aren’t cheap, and neither is your privacy.  These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.  It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet.  By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    2) Use the official USPS form only

    When you change your address, always use the official USPS website or your local post office. Some third-party sites look like they’re offering a convenient service, but they often collect extra data about you and sometimes even resell it. Going straight to the source means your sensitive details don’t take unnecessary detours.

    3) Watch real estate disclosures

    When you sell your home, more than just the price gets published. Your name, past addresses and even photos of your home can become part of the public record. Ask your realtor what’s automatically disclosed and whether anything can be limited or redacted. It’s worth being picky here: the less of your personal footprint that’s tied to your property, the better.

    4) Shred old paperwork

    Moving is the perfect excuse to purge. But don’t just throw out old bills, medical statements, or financial records; shred them. Dumpster-diving for personal data may sound outdated, but it’s still a method scammers use. A good shredder ensures your sensitive history doesn’t end up in the wrong hands.

    5) Share moving news privately

    It’s tempting to post a “Goodbye, old house!” photo online, but resist the urge. Publicly announcing a move tells scammers exactly when your home is empty and what your new address might be. Instead, share the news directly with family and close friends. A little less buzz online means a lot more safety offline.

    6) Freeze your credit before and after moving

    One powerful way to stay ahead of scammers is to freeze your credit. A freeze blocks new credit accounts from being opened in your name, even if criminals have your address or other details. The good news is that you can do this for free with all three major credit bureaus: Equifax, Experian and TransUnion.

    It only takes a few minutes online or by phone, and you can lift the freeze anytime if you need to apply for a loan or credit card. By freezing your credit before and after your move, you create a strong barrier that keeps thieves from turning stolen data into financial damage.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaways

    Moving should feel like a new beginning, not an invitation for scammers to strike. With a few smart steps, you can stay ahead of data brokers and fraudsters. From shredding documents to freezing your credit, every action adds a layer of protection. By protecting your information before and after your move, you gain peace of mind and start your next chapter on solid ground. The effort is small compared to the security it brings.

    Should more be done to stop companies from exposing and selling our personal data? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • TransUnion becomes latest victim in major wave of Salesforce-linked cyberattacks, 4.4M Americans affected

    [ad_1]

    NEWYou can now listen to Fox News articles!

    You might have recently noticed a wave of cyberattacks hitting companies whose services millions of Americans rely on every day. Among the victims are Google, Farmers Insurance, Allianz Life, Workday, Pandora, Cisco, Chanel and Qantas, all reporting breaches linked to Salesforce-connected applications.

    Now, credit reporting firm TransUnion has confirmed its own major incident, with more than 4.4 million U.S. consumers affected. Attackers exploited weaknesses in third-party integrations, not Salesforce itself. Security researchers tie this technique to the extortion group ShinyHunters and its affiliated crews.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM/NEWSLETTER.

    SCAMMERS ARE USING DOCUSIGN EMAILS TO PUSH APPLE PAY FRAUD

    Hackers stole 13 million records, exposing data of 4.4 million Americans in the latest TransUnion cyberattack. (Christopher Dilts/Bloomberg)

    What you need to know about the TransUnion data breach

    TransUnion has disclosed a major data breach that impacted 4,461,511 individuals in the United States, according to a filing with the Maine Attorney General’s Office. The incident occurred on July 28, 2025, and was discovered two days later on July 30.

    The breach resulted from unauthorized access to a third-party application used in TransUnion’s U.S. consumer support operations. The company stressed that its core credit database and credit reports were not compromised.

    Although TransUnion characterized the exposed information as “limited,” the stolen data is highly sensitive. It includes names, dates of birth, Social Security numbers, billing addresses, email addresses, phone numbers, reasons for customer transactions (such as requests for a free credit report), and customer support tickets and messages.

    Hackers claim they stole more than 13 million records in total, with about 4.4 million tied to U.S. consumers.

    In response, TransUnion is providing all affected individuals with 24 months of free credit monitoring and identity theft protection services.

    FARMERS INSURANCE DATA BREACH EXPOSES 1.1M AMERICANS

    entrance of google office building with people standing outside

    The breach at TransUnion follows several similar cyberattacks against tech companies, including Google and Cisco, and retail brands, such as Chanel and Adidas.  (Mike Kemp/In Pictures)

    Hackers target companies through Salesforce apps

    The breach appears to be part of a broader wave of Salesforce-related attacks that is hitting organizations across sectors, from tech and finance to retail and aviation. Alongside Google, Farmers Insurance, Allianz Life, Workday, Pandora, Cisco, Chanel and Qantas, brands like Adidas, Louis Vuitton, Dior, Tiffany & Co., Cartier and Air France-KLM have also reported incidents tied to weaknesses in Salesforce-linked applications.

    In most cases, attackers exploited malicious third-party integrations or OAuth-connected apps disguised as legitimate Salesforce tools to siphon sensitive records. This technique bypassed traditional login protections and gave intruders long-lasting access to customer relationship management data. The stolen information ranges from basic contact details and business notes to highly sensitive identifiers such as Social Security numbers, dates of birth and driver’s license information.

    Researchers say these intrusions align with activity from the extortion group ShinyHunters, with some overlap in tactics and infrastructure linked to other threat actors like Scattered Spider. Campaigns tracked under names such as UNC6395 and UNC6040 point to a larger “extortion-as-a-service” model, where criminal crews collaborate and share stolen data across underground forums.

    TransUnion’s response

    CyberGuy reached out to TransUnion for a comment and received the following response:

    “TransUnion recently experienced a cyber incident that affected a third-party application serving our U.S. consumer support operations. Upon discovery, we quickly contained the issue, which did not involve our core credit database or include credit reports.

    The incident involved unauthorized access to limited personal information for a very small percentage of U.S. consumers. We are working with law enforcement and have engaged third-party cybersecurity experts for an independent forensics review. Additionally, we will notify affected consumers and provide credit monitoring services.”

    As for the gap between when the breach occurred (July 28, 2025) and when it was officially recorded as “discovered” (July 30, 2025), a TransUnion spokesperson clarified that the company “identified and contained this event within hours” of it happening, but that it is common industry practice to designate a later “date of discovery” to reflect a more complete assessment following the initial response.

    MARY KAY’S ICONIC PINK CADILLAC SHIFTS TO FULLY ELECTRIC

    hacker wearing globes and using laptop

    Researchers have linked the latest cybercrimes to extortion group ShinyHunters and its affiliated crews. (Kurt “CyberGuy” Knutsson)

    8 ways you can stay safe from the TransUnion data breach

    The TransUnion breach exposed millions of people’s data, but there are steps you can take to protect yourself. Here are eight ways to stay safe.

    1) Delete personal data that puts you at risk

    Go through old online accounts, shopping profiles or cloud storage that may still hold sensitive data. Deleting what you no longer use reduces the amount of information that could be stolen in future breaches or sold on dark web forums. You can also get help from a data removal service.

    While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan.

    2) Avoid phishing scams and use strong antivirus software

    Data stolen in breaches often ends up fueling phishing campaigns. Attackers may use your name, email or phone number to make messages look more convincing. If you get an email or text claiming to be from TransUnion, your bank or any service asking you to “verify” details, don’t click on the link. Instead, log in through the official website or call customer service directly.

    The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com/LockUpYourTech.

    3) Save passwords securely

    If your login details were exposed, reusing the same password across sites puts multiple accounts at risk. Use a password manager to create and store strong, unique passwords for every service. Even if hackers get hold of one, they won’t be able to use it elsewhere. Consider using a password manager to generate and store complex passwords.

    Next, see if your passwords have been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords.

    HACKERS FOUND A WAY TO TURN OFF WINDOWS DEFENDER REMOTELY

    4) Turn on two-factor authentication

    Two-factor authentication (2FA) adds a critical extra step beyond just a password. If someone tries to break into your email, banking app or social media account, they’ll also need the one-time code from your authenticator app or text message. This makes stolen credentials much less useful.

    5) Keep your devices updated

    Hackers often rely on outdated software to spread malware or steal information. Installing the latest updates for your phone, computer and apps ensures security patches are in place, blocking known vulnerabilities that attackers might exploit.

    6) Freeze your credit right away

    One of the biggest risks after a breach is criminals opening new loans or credit cards in your name. A credit freeze with all three major bureaus, TransUnion, Equifax and Experian, prevents anyone from accessing your credit file without your approval. It’s free and can be temporarily lifted if you need to apply for credit.

    7) Monitor your accounts regularly

    Watch your bank and credit card statements for unfamiliar charges, no matter how small. Set up transaction alerts where available. You should also pull your free annual credit report to check for unauthorized accounts or inquiries, which could be signs of fraud.

    8) Consider identity theft protection services

    If your Social Security number, driver’s license or other sensitive identifiers were exposed, you may want to sign up for an identity theft protection service. These services monitor credit reports, dark web forums and financial activity for signs of misuse. Some also include insurance or recovery assistance if your identity is stolen, giving you added peace of mind beyond basic credit monitoring. If you’re one of the affected TransUnion users, make use of the 24 months of free credit monitoring and identity theft protection services. If not, you might get one yourself for the future.

    See my tips and best picks on how to protect yourself from identity theft at  Cyberguy.com/IdentityTheft.

    CLICK HERE TO GET THE FOX NEWS APP 

    Kurt’s key takeaway

    The reality is that the TransUnion breach isn’t just about stolen names and numbers. It’s about how exposed ordinary people are when a single company holds the keys to their financial identity. For years, consumers have had little choice but to trust credit bureaus they never opted into.

    Should companies like TransUnion be held legally accountable when millions of people are exposed to fraud? Let us know by writing to us at Cyberguy.com/Contact.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER.

    Copyright 2025 CyberGuy.com. All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Scammers Will Try to Trick You Into Filling Out Google Forms. Don’t Fall for It

    [ad_1]

    One of the lesser-known apps in the Google Drive online suite is Google Forms. It’s an easy, intuitive way to create a web form for other people to enter information into. You can use it for employee surveys, for organizing social gatherings, for giving people a way to contact you, and much more. But Google Forms can also be used for malicious purposes.

    These forms can be created in minutes, with clean and clear formatting, official-looking images and video, and—most importantly of all—a genuine Google Docs URL that your web browser will see no problem with. Scammers can then use these authentic-looking forms to ask for payment details or login information.

    It’s a type of scam that continues to spread, with Google itself issuing a warning about the issue in February. Students and staff at Stanford University were among those targeted with a Google Forms link that asked for login details for the academic portal there, and the attack beat standard email malware protection.

    How the Scam Works

    Google Forms are quick and easy to put together.

    David Nield

    These scams can take a variety of guises, but they’ll typically start with a phishing email that will try to trick you into believing it’s an official and genuine communication. It might be designed to look like it’s from a colleague, an administrator, or someone from a reputable organization.

    The apparent quality and trustworthiness of this original phishing email is part of the con. Our inboxes are regularly filled with requests to reset passwords, verify details, or otherwise take action. Like many scams, the email might suggest a sense or urgency, or indicate that your security has been compromised in some way.

    Even worse, the instigating email might actually come from a legitimate email address, if someone in your social circle, family, or office has had their account hijacked. In this case you wouldn’t be able to run the usual checks on the sender identity and email address, because everything would look genuine—though the wording and style would be off.

    This email (or perhaps a direct message on social media) will be used to deliver a Google Forms link, which is the second half of the scam. This form will most often be set up to look genuine, and may be trying to spoof a recognized site like your place of work or your bank. The form might prompt you for sensitive information, offer up a link to malware, or feature a phone number or email address to lead you into further trouble.

    [ad_2]

    David Nield

    Source link

  • DOGE Put Everyone’s Social Security Data at Risk, Whistleblower Claims

    [ad_1]

    As students returned to school this week, WIRED spoke to a self-proclaimed leader of a violent online group known as “Purgatory” about a rash of swattings at universities across the US in recent days. The group claims to have ties to the loose cybercriminal network known as The Com, and the alleged Purgatory leader claimed responsibility for calling in hoax active-shooter alerts.

    Researchers from multiple organizations warned this week that cybercriminals are increasingly using generative AI tools to fuel ransomware attacks, including real situations where cybercriminals without technical expertise are using AI to develop the malware. And a popular, yet enigmatic, shortwave Russian radio station known as UVB-76 seems to have turned into a tool for Kremlin propaganda after decades of mystery and intrigue.

    But wait, there’s more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    Since it was first created, critics have warned that the young and inexperienced engineers in Elon Musk’s so-called Department of Government Efficiency (DOGE) were trampling over security and privacy rules in their seemingly reckless handling of US government data. Now a whistleblower claims that DOGE staff put one massive dataset at risk of hacking or leaking: a database containing troves of personal data about US residents, including virtually every American’s Social Security number.

    The complaint from Social Security Administration chief data officer Charles Borges, filed with the Office of the Special Counsel and reviewed by The New York Times, states that DOGE affiliates explicitly overruled security and privacy concerns to upload the SSA database to a cloud server that lacked sufficient security monitoring, “potentially violating multiple federal statutes” in its allegedly reckless handling of the data. Internal DOGE and SSA communications reviewed by the Times shows officials waving off concerns about the data’s lack of sanitization or anonymization before it was uploaded to the server, despite concerns from SSA officials about the lack of security of that data transfer.

    Borges didn’t allege that the data was actually breached or leaked, but Borges emphasized the vulnerability of the data and the immense cost if it were compromised. “Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital health care and food benefits, and the government may be responsible for reissuing every American a new Social Security number at great cost,” Borges wrote.

    Nearly 10 months have passed since the revelation that China’s cyberespionage group known as Salt Typhoon had penetrated US telecoms, spying on Americans’ calls and texts. Now the FBI is warning that the net cast by those hackers may have been far broader than even previously thought, encompassing potential victims in 80 countries. The bureau’s top cyber official, Brett Leatherman, told The Wall Street Journal and The Washington Post that the hackers had shown interest in at least 600 companies, which the FBI notified, though it’s not clear how many of those possible targets the hackers breached or what level of access they achieved. “That global indiscriminate targeting really is something that is outside the norms of cyberspace operations,” Leatherman told the Journal. The FBI says that Salt Typhoon’s telecom hacking alone resulted in the spies gaining access to at least a million call records and targeted the calls and texts of more than a hundred Americans.

    Days after Donald Trump’s Alaska summit with Vladimir Putin, the White House moved to gut its own intelligence ranks. A senior CIA Russia analyst—29 years in service and slated for a coveted overseas post—was abruptly stripped of her clearance, The Washington Post reported. She was one of 37 officials forced out under an August 19 memo from Director of National Intelligence Tulsi Gabbard. The order listed no infractions. To colleagues, it looked like a loyalty purge. The firings have reportedly unsettled the CIA’s rank and file, sending a message that survival depends on hewing intelligence to fit the president’s views.

    On Monday, Gabbard unveiled what she calls “ODNI 2.0,” a restructuring that cuts more than 500 positions and shutters or folds whole offices she deems redundant. The Foreign Malign Influence Center and the Cyber Threat Intelligence Integration Center are being pared back, while the National Intelligence University will be absorbed into the Pentagon’s defense school. Gabbard says the plan will save $700 million a year and depoliticize intelligence. Critics noted, however, a fact sheet published by Gabbard on Monday itemized only a fraction of those savings, and tjeu warned that the overhaul could hollow out the very coordination ODNI was created post-9/11 to provide—discarding expertise and leaving the intelligence fragmented at a time of escalating threats.

    [ad_2]

    Andy Greenberg, Lily Hay Newman, Dell Cameron

    Source link

  • Hackers found a way to turn off Windows Defender remotely

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Most modern Windows PCs rely on Microsoft Defender as their first line of defense against malware. Over the years, it has evolved into a capable and often underrated antivirus that blocks a wide range of threats. But a hacker group has found a way to abuse a legitimate Intel CPU tuning driver in a “Bring Your Own Vulnerable Driver” (BYOVD) attack to completely disable Microsoft Defender.

    The technique has been observed since mid-July 2025 and is already being used in active ransomware campaigns. The method doesn’t rely on exploiting a software bug or delivering an obviously malicious file. Instead, it takes advantage of how the Windows driver system is designed to allow deep hardware access.

    Let’s discuss all you need to know about the attack and how you can stay safe.

    HOW SCAMMERS TARGET YOU EVEN WITHOUT SOCIAL MEDIA

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    The Akira ransomware group exploits a legitimate Intel CPU tuning driver in cyberattacks to completely disable Microsoft Defender on Windows systems. (Kurt “CyberGuy” Knutsson)

    How Akira ransomware disables Microsoft Defender

    The Akira ransomware group has developed a new way to bypass security tools by using a legitimate Intel CPU tuning driver called rwdrv.sys from the performance-tweaking tool ThrottleStop. Security firm GuidePoint Security says attackers load this driver to gain kernel-level access to Windows systems, then install a second malicious driver, hlpdrv.sys, which changes the DisableAntiSpyware registry setting via regedit.exe to shut down Microsoft Defender.

    Once Defender is disabled, attackers can run other malicious programs undetected. GuidePoint says this method has been consistently spotted in Akira campaigns since mid-July.

    A Windows PC

    The Akira ransomware group has been infiltrating Windows operating systems by exploiting a legitimate driver to gain access. (Kurt “CyberGuy” Knutsson)

    Akira ransomware targets Microsoft Defender and SonicWall VPNs

    The same group has also been linked to attacks targeting SonicWall VPN devices. SonicWall has stated that these incidents likely involve a known vulnerability, CVE-2024-40766, rather than a brand-new zero-day. The company recommends restricting VPN access, enabling multi-factor authentication, and disabling unused accounts as immediate defenses.

    Akira attacks often involve stealing data, setting up hidden remote access, and deploying ransomware to encrypt files across an organization. Security experts warn that fake or lookalike websites are increasingly being used to distribute these malicious tools.

    FBI WARNS SENIORS ABOUT BILLION-DOLLAR SCAM DRAINING RETIREMENT FUNDS, EXPERT SAYS AI DRIVING IT

    Researchers at GuidePoint have published a YARA detection rule, along with file names, service names, SHA-256 hashes, and file paths to help identify this activity. They recommend administrators actively monitor for these indicators, apply filtering and blocking rules as new IoCs emerge, and only download software from official or verified sources.

    We reached out to Microsoft for a comment, but did not hear back before our deadline.

    A split image shows a hacker and a Windows laptop.

    Antivirus software, two-factor authentication and data removal services are just a few ways Windows users can protect themselves from hackers. (Cyberguy.com)

    6 ways to protect yourself against Akira ransomware and similar threats

    The Microsoft Defender attack is smart and dangerous, but you’re not without defenses. Here are a few tips to help you stay safe:

    1) Use strong antivirus software

    Even with regular updates, Windows systems can be left exposed if built-in defenses are disabled. A strong antivirus software with real-time protection, kernel-level monitoring, and frequent updates can provide backup security. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at CyberGuy.com.

    2) Limit exposure

    Many exploits rely on user interaction, such as clicking a shady link, downloading a compromised file, or mounting an untrusted virtual disk. Stick to reputable websites, avoid opening unsolicited email attachments, and use a browser with built-in security features (like Microsoft Edge or Chrome with Safe Browsing enabled).

    3) Avoid running unexpected commands

    Never paste or run commands (like PowerShell scripts) you don’t understand or that were copied from random websites. Attackers often trick users into unknowingly running malware this way.

    GOOGLE CONFIRMS DATA STOLEN IN BREACH BY KNOWN HACKER GROUP

    4) Keep your software updated

    Regularly update your operating system, browsers, and all software applications. Updates often include patches for security vulnerabilities that malware can exploit.

    5) Use two-factor authentication (2FA)

    Enable 2FA on all your accounts. This adds an extra layer of security by requiring a second form of verification, making it harder for attackers to gain access even if they have your password.

    6) Invest in personal data removal services

    Even with strong device security, your personal information may still be exposed online through data brokers and people-finder sites.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice.  They aren’t cheap – and neither is your privacy.  These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.  It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet.  By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    Akira’s trick shows a bigger flaw in how Windows trusts certain tools. A driver meant for harmless CPU tuning ends up being the key to turning security off. Since it’s from a legitimate source, Windows just lets it through without asking questions. We tend to think hackers always break in from the outside. Here, they’re already inside the circle of trust, using the system’s own rules.

    Should Microsoft be doing more to stop ransomware groups from disabling Defender? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • The Internet Revolutionized Porn. Age Verification Could Upend Everything

    [ad_1]

    Across a four-day span in late August, porn star Siri Dahl invites her followers to “cum on in” on OnlyFans, goes live on YouTube (“100% raw, organic, grass-fed” content, she advertises with a wink), hawks “Corn Star” T-shirts via her personal store, posts about appearing in a live podcast taping of Lovett or Leave It on X, where she has nearly half a million followers, and uploads eight videos to Pornhub, alternating between role-play (“Sexy Mean Starfish Babe Gives You Femdom Ass Worship”) and kink-friendly (“Cozy naked yoga by the fireplace”) content.

    It’s a typical week for Dahl: demanding, a little all over the place, and very online, but one she’s totally in control of.

    It’s also very different from the world of studio porn where she got her start. Dahl debuted in adult entertainment in 2012, with credits in projects by Vivid Entertainment, Naughty America, and Girlfriends Films. At the time, she says, the industry was still very much a boys club; she had no independence and even less say over the direction of her career. “It was like five CEOs who completely dictated what was attractive and what kind of person was allowed to become a porn star,” she says. “Performers were essentially at the bottom. I’d be on set for 12 hours all for one check, and there are no royalties in porn. The power dynamic was inverted compared to what it is now.”

    Today, Dahl does a little bit of everything: girl on girl, solo and fetish content, naked workout videos, group scenes. She’s on “basically every fan platform”—Fansly, LoyalFans, and ManyVids, with OnlyFans being her “biggest income generator.” She also uploads free content to Pornhub, where she makes ad revenue based on views. Some of her most popular work is role-playing a badly-behaved stepmom: “MOMMY’S BOY – Naughty MILF Siri Dahl Caught Naked in the Kitchen!” is her most-watched video on Pornhub, with 29 millions views. She’s grateful for the autonomy the internet has given her over her career.

    But that could come to a crashing end, with the widespread adoption of age-verification laws in the US and UK, which require visitors to upload an ID or other personal documentation to validate that they are not a minor before viewing sexually explicit material.

    Already Dahl has seen “an absolutely massive drop in traffic,” she says from her home in Los Angeles. “I’ve made 30 percent less money this year than I did last year.” (She declined to say exactly how much.)

    So far at least 24 US states have sanctioned some form of ID verification, each with unique stipulations. Legislators argue that these laws are intended to keep minors safe from content deemed harmful to them. Critics say that argument doesn’t hold any weight because there are “easy solutions” to the moral panic conservatives have created around the issue. They say the laws infringe on privacy rights and set an irreversibly dark precedent for the future of free speech.

    Perhaps even more terrifying is what it all signals: the death of the free web and an ushering in of a more puritanical version of America.

    That’s been a goal of Project 2025 all along. A line from the 900-page Heritage Foundation document, a right-wing blueprint of sorts for President Donald Trump’s second term, says “people who produce and distribute [porn] should be imprisoned.” In a video recording leaked last August by the Centre for Climate Reporting, Trump ally Russell Vought, who coauthored Project 2025, says the age verification laws are a “back door” route to a federal ban. “We’d have a national ban on pornography if we could,” says Vought, who is director of the Office of Management and Budget in the Trump administration, in the video. “We’ve got a number of states that are passing this, and you know what happens is, the porn company then says, ‘We’re not going to do business in your state,’ which is entirely what we were after,” he explains. In the same video, Vought says his wider goal is creating a “culture that values babies and the life that’s created and is focused on the birth rates and makes them a positive good as opposed to a burden.”

    [ad_2]

    Jason Parham

    Source link

  • Cybersecurity expert reveals simple trick to stop companies from tracking your online shopping

    [ad_1]

    NEWYou can now listen to Fox News articles!

    We’re conditioned to think our email address is harmless. Most of us think it’s just an ID, a way to get receipts and shipping updates, but that’s not it.

    Your email is the skeleton key to your online identity. It’s what companies use to build behavioral profiles, target ads, link purchases, and sometimes worse, facilitate fraud after a breach. And when you reuse the same email address everywhere, you make that key universal.

    To keep things private, I use an alias for online shopping to stay anonymous, cut down on spam, and more. Let’s discuss what aliases are, why they matter, and how they quietly turn the tables in your favor.

    Sign Up For My Free Cyberguy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    A woman browses the Amazon website on her laptop on Sep. 29, 2024. (Serene Lee/SOPA Images/LightRocket)

    How Email Aliases Help You Stay Anonymous Online

    Each time you enter your main email on a shopping site, you give that company a lasting way to connect your behavior across different platforms, devices, and timeframes. They might hash or encrypt your email, but the behavioral patterns remain. You can still be tracked, but aliases interrupt that chain.

    Instead of sharing my actual email address, I create a unique one for each website. The emails still reach me through forwarding, but the company never sees my real address. That small change prevents them from linking my activity with other accounts or sites. It is not a perfect solution, but it adds just enough friction to disrupt the tracking systems.

    Every alias I use becomes a kind of tracker. If one starts getting spam, I know which site sold or lost my data. Most people don’t know where the breach happened, they just assume “it happens.” I take a different approach. When an alias starts getting unwanted emails, I do not try to unsubscribe or set up filters or waste time guessing. I simply disable the alias, and the problem is gone.

    person receiving spam email on laptop

    A spam phishing email is displayed on a laptop screen on March 21, 2022. Retail companies often sell shopper data, leading to unwanted spam and phishing messages. (Peter Dazeley)

    Stop Companies From Tracking You With Email Aliases

    The average e-commerce site uses between 15 and 30 third-party scripts, analytics trackers, ad pixels, behavioral beacons, according to a study. Even if the site itself is honest, its stack probably isn’t. Your email passes through layers of infrastructure, mailing tools, CRM platforms, shipping plugins. And all it takes is one misconfiguration or a careless developer for your data to end up in the wrong hands.

    An alias reduces the blast radius. If the site gets breached your core identity remains untouched.

    Aliases don’t just protect privacy, they improve behavior. When I started using them, I found myself thinking more clearly about where I was signing up and why. The mental pause required to generate a new alias made me more deliberate. And it gave structure to the mess. I could set rules like all product warranties go to products@myalias.com, all newsletters to news@myalias.com.

    Create Email Aliases For Better Online Privacy

    An alias alone isn’t enough to stay safe out there. You also need a secure email provider to start with. By creating email aliases, you can protect your information and reduce spam. These aliases forward messages to your primary address, making it easier to manage incoming communications and avoid data breaches. 

    For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com.

    person shopping online through best buy phone app

    A woman browses Best Buy on her smartphone while online shopping. (Serene Lee/SOPA Images/LightRocket)

    Kurt’s Key Takeaway

    We’ve made progress when it comes to password hygiene. Many of us now use password managers and enable two-factor authentication, but when it comes to email, the habits haven’t changed much. Most people still rely on a single email address for everything, including shopping, banking, subscriptions, work, even family communication. That’s not just inefficient, but also a security risk. Using email aliases is a simple way to fragment your digital identity. It adds complexity for attackers and reduces the chances of a single breach affecting multiple accounts.

    Would you still use your main email for everything if you knew it made you easier to track? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO GET THE FOX NEWS APP

    Sign Up For My Free Cyberguy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • How scammers target you even without social media

    [ad_1]

    NEWYou can now listen to Fox News articles!

    “I don’t use Facebook. I don’t even have an email. How could scammers possibly know anything about me?”

    That’s the question I hear from people over 60 all the time. If you assume that by staying off social media and avoiding the internet, you’re invisible to fraudsters, think again.

    The truth is, even if you’ve never posted a single thing online, scammers can still know your age, home address, relatives’ names, property value, and even when you’ve suffered the loss of a loved one. How? Because the everyday details of your offline life are quietly being collected, digitized, and sold.

    And scammers are taking full advantage.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS

    Scammers can still know a lot about you, even if you have never posted anything online. (Fernando Gutierrez-Juarez/picture alliance via Getty Images)

    How scammers target seniors without social media

    Here’s the uncomfortable reality: you don’t have to “put yourself out there” for your information to appear online. Much of it becomes public record automatically, thanks to the way our legal and government systems work.

    Some of the biggest sources include:

    • Obituaries: When a loved one passes away, obituaries often list family members, ages, locations, and relationships. To scammers, it’s a family tree of potential targets.
    • Real estate records: Property purchases, sales, and even mortgage details are public. This can tell scammers whether you own your home outright, what it’s worth, and if you might be cash-rich.
    • Probate filings: When estates go through probate, details about beneficiaries and assets are recorded. Scammers can identify heirs and target them with fraudulent “inheritance assistance.”
    • Property tax documents: These are often searchable by anyone. They reveal not only your address but also your financial standing.
    • Court filings: Divorce, bankruptcy, and civil disputes often contain personal details, which are public by law.

    On their own, these may not seem dangerous. But combined, they create a shockingly detailed portrait of your life.

    THE DATA BROKER OPT-OUT STEPS EVERY RETIREE SHOULD TAKE TODAY

    A man leaning on a fence using a tablet

    Public records can provide a portrait of your life. (Barbara Eddowes via Getty Images)

    Bereavement scams and emotional tricks scammers use

    One of the cruelest scams I’ve seen lately is what I call the bereavement scam.

    Here’s how it works:

    A scammer scrapes local obituaries to see who’s recently lost a spouse or child. They then reach out, by phone, email, or even mail, pretending to be a funeral home, a grief counselor, or a charity. Because they reference real names, dates, and relationships, their outreach sounds painfully authentic.

    • Example: “We saw you lost your husband on March 3rd. We’d like to offer you a free grief support service…”
    • Or: “Your loved one’s final medical expenses may qualify for reimbursement. We just need your banking details to confirm.”

    When you’re in mourning, your guard is down. Scammers know this, and they exploit grief to steal money and identities.

    Other emotionally charged scams follow the same playbook

    • Fake Medicare calls referencing your age and location.
    • Phony financial advisors offering to “help” with retirement rollovers.
    • Romance scams targeting widows and widowers who live alone.
    • Fake agent scams trick victims into paying thousands of dollars through phone threats

    The unifying factor is that these criminals don’t need Facebook to learn about you. They already have a dossier built from public and brokered data.

    What’s even worse is that scammers can target your loved ones even years after your passing. They can call or text your close relatives claiming to offer free memorial services, annuities, or other common strategies when people are most vulnerable. Your exposed personal data fuels such morbid scams.

    9 ONLINE PRIVACY RISKS YOU PROBABLY DON’T KNOW ABOUT

    A man typing on a laptop

    A man typing on his laptop (Kurt “Cyberguy” Knutsson)

    The shocking sources of your personal data

    Here’s the part most people don’t realize: scammers rarely dig through dusty courthouse files themselves. They don’t have to. That work has already been done by data brokers. Data brokers are companies whose entire business model is gathering and selling personal information. They collect from:

    • Public records (like those obituaries and real estate filings)
    • Consumer databases (credit headers, magazine subscriptions, surveys)
    • “People search” websites (Spokeo, Whitepages, BeenVerified, and dozens more).

    The result is a searchable profile that might include:

    • Full name and aliases
    • Current and past addresses
    • Phone numbers and email addresses
    • Relatives and their contact info
    • Age, income range, home value
    • Legal or financial history

    Once a broker has your data, they sell it. And once it’s sold, it spreads. Even if you’ve never had a social media account, companies may build a ‘shadow profile’ of you from leaked data, online purchases, or details shared by others, leaving it ready to be abused.

    How to protect yourself from scammers and data brokers

    The good news is, you’re not powerless. While you can’t stop public records from existing, you can make it much harder for scammers to access and weaponize your data. Here’s how:

    1) Reduce your digital footprint

    • Request removal from people search sites and data brokers.
    • This prevents your profile from being sold to scammers.
    • Doing this manually can take hours and has to be repeated, but it works.

    2) Stay alert for emotional manipulation

    • If someone contacts you after a loss, assume caution.
    • Verify charities and funeral services before engaging.
    • Never share banking or personal details over the phone or email.

    3) Automate data removal

    • Instead of manually contacting hundreds of data brokers, you can use a service like Incogni.
    • It sends and tracks removal requests across 420+ brokers, and keeps repeating the process so your data doesn’t resurface.
    • With their Unlimited plan, you can request data removal from any other shady website and disappear from the internet.
    • For seniors, this is often the safest and most practical solution.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice.  They aren’t cheap, and neither is your privacy.  These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.  It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaways

    Not being on Facebook doesn’t mean you’re invisible. Scammers don’t need you to share your life online. Your offline life is already online without your consent. The obituary in the local paper, the deed to your home, the probate record of your loved one’s estate, these are all turned into data points, sold to brokers, and resold to whoever wants them. That’s why protecting your personal data isn’t about avoiding the internet. It’s about reducing what’s already out there. The less data scammers can find, the harder it is for them to fool you with realistic, emotionally charged attacks. And that’s a big step toward keeping your money, your identity, and your retirement safe.

    Do you believe it’s time for the government and companies to step in and protect your data privacy?  Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Over 2B users face phishing risks after Google data leak

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A tech leader like Google often seems invincible when it comes to cybersecurity attacks, but that is not the case. Earlier this month, the search giant confirmed that attackers had accessed one of its corporate Salesforce instances. According to a Google spokesperson, this system stored basic, and largely publicly available business information, such as contact details and notes from small and medium-sized companies. It did not store customer data from Google Cloud or consumer products like Gmail, Drive or Calendar.

    Google says it terminated the malicious activity, completed an impact analysis, and provided mitigations. Therefore, no further action is required by users.

    NEW GOOGLE AI MAKES ROBOTS SMARTER WITHOUT THE CLOUD

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM/NEWSLETTER 

    Cybercriminals are exploiting Google’s recent Salesforce data breach to launch vishing calls and phishing attacks against Gmail users worldwide. (Kurt “CyberGuy” Knutsson)

    Vishing calls target Gmail users

    Hackers have reportedly accessed Google’s Salesforce database systems, exposing customer and company names. Google confirmed the incident and clarified that the information was mostly public business contact data and did not include passwords or payment information. The company stressed that the breach affected only a corporate Salesforce system, not consumer Gmail or Google Cloud accounts.

    Still, attackers are exploiting the news of the breach to fuel phishing and vishing scams, tricking people into giving up sensitive information. According to PC World, some users have already reported an increase in phishing attempts that reference Google services.

    STOP GOOGLE FROM FOLLOWING YOUR EVERY MOVE

    One of the main tactics involves scam phone calls, also known as vishing. A Reddit post highlighted a wave of calls coming from the 650 area code, which is linked to Google’s headquarters. In these calls, scammers pose as Google employees and warn victims of a supposed security breach. They then instruct users to reset their Gmail password and share it with them. This locks the rightful owner out of the account and gives the attacker complete control.

    Gmail loading screen.

    A user launches Gmail. (Kurt “CyberGuy” Knutsson)

    Old infrastructure exploited with “dangling buckets”

    Separately from the Salesforce incident, Google Cloud customers are also facing another type of attack. Hackers are trying to exploit outdated access addresses using a method called the dangling bucket. This can allow them to inject malware or steal data. Both businesses and individuals are vulnerable to losing control over sensitive information if targeted in this way.

    Gmail and Google Cloud serve nearly 2.5 billion people, which makes the scale of the risk significant. Although the initial breach did not expose passwords, attackers are using the news of the incident to trick people into revealing their login details.

    Google homepage

    A Google search window is on a laptop. (Kurt “CyberGuy” Knutsson)

    6 ways you can stay safe from scammers targeting Google accounts

    Google accounts are often a prime target for scammers. The good news is that protecting yourself doesn’t require advanced technical skills. A few practical steps can drastically reduce your chances of becoming a victim.

    1) Avoid clicking on phishing links

    Phishing remains the most common way scammers steal Google account credentials. A fake email or text may claim your account has been locked or that you need to verify suspicious activity. Clicking the link usually takes you to a counterfeit login page that looks almost identical to the real Google sign-in screen.

    To avoid falling for these tricks, check the sender’s email address carefully, hover over links before clicking, and avoid entering your Google password on any page that doesn’t start with accounts.google.com.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com/LockUpYourTech 

    2) Save passwords securely

    Reusing weak passwords across multiple sites is an open invitation for scammers. If one site is breached, your Google account becomes vulnerable. A strong, unique password is your first line of defense.

    The easiest way to manage this is with a password manager. It can generate complex passwords, store them securely, and fill them in automatically when you need them. This way, you never have to remember dozens of different logins, and attackers can’t guess their way in.

    Next, see if your email has been exposed in past breaches. Our #1 password manager pick (see Cyberguy.com/Passwords) includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords

    WHAT TO DO IF YOU GET A PASSWORD RESET EMAIL YOU DIDN’T ASK FOR

    3) Delete personal data that puts you at risk

    Scammers often use information they find online to craft convincing attacks. If your email address, phone number, or even past passwords are floating around on data broker sites, criminals have more tools to impersonate you or trick you into revealing more.

    Using a data removal service helps clean up your digital footprint. By reducing the amount of exposed information about you, it becomes much harder for scammers to target you directly.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    4) Turn on two-factor authentication

    Even the strongest password can be stolen, but two-factor authentication (2FA) adds an extra barrier. When enabled, Google will ask for a one-time code or prompt on your phone before granting access. That means even if a scammer manages to get your password, they can’t log in without also having your device.

    Google offers several 2FA methods, from SMS codes to app-based prompts and even hardware security keys. For the best protection, choose app-based or hardware verification rather than text messages.

    5) Keep your devices updated

    Many scams rely on exploiting outdated software. If your phone, browser, or operating system isn’t up to date, attackers may use known vulnerabilities to install malware or hijack your session.

    Set your devices to update automatically whenever possible. This ensures you’re always running the latest security patches, reducing the number of openings a scammer can use.

    6) Regularly check Google account security settings

    Google provides built-in tools to help users spot suspicious activity. By visiting your Google Account’s security page, you can see devices that have signed in, recent account activity, and whether recovery options like your phone number and backup email are up to date.

    Running a Google Security Checkup only takes a few minutes and gives you a clear overview of any weaknesses. Think of it as a health check for your digital life.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    The incident is a reminder that even tech giants with vast resources are not immune to security lapses. While Google insists that no passwords were exposed, the wave of phishing and vishing scams shows how quickly criminals can weaponize even partial leaks. What began as a breach of business data has spiraled into a threat facing millions of everyday users, raising questions about how secure Google’s ecosystem really is.

    Do you believe regulators should step in with stricter rules for how cloud providers handle security lapses? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM/NEWSLETTER

    Copyright 2025 CyberGuy.com.  All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • The truth behind those mysterious shipment emails in your inbox

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Over the past year, more people have reported receiving order shipment emails for purchases they never made. These messages usually come from legitimate retailers, often sportswear brands or electronics stores, and contain real tracking numbers and delivery details. The products are being shipped to different names at different addresses, but for some reason, the buyer’s contact email is yours.

    It might seem like a harmless clerical error or someone accidentally typing the wrong email address. But when it happens repeatedly, and across multiple unrelated orders, it starts to look less like a coincidence and more like a tactic.

    Arthur from Cape Coral, Florida, recently reached out with an experience that mirrors what others have been describing:

    “My wife’s e-mail address is showing up in emails from various sports entities to notify her of shipping dates, etc. So far, three separate individuals have ordered products, shipped to a different name at a different address, but used her email as the contact. They didn’t use our credit card to place the order. What could be going on? I don’t believe it’s a coincidence.”

    HOW TO DETECT FAKE AMAZON EMAILS AND AVOID IMPERSONATION SCAMS

    Arthur is right to question what’s happening. Scammers are deliberately using real email addresses to push fraudulent purchases through retailer systems with fewer checks. They rely on your email to carry out the scam, even if they have not stolen your payment details.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER 

    Some scammers use valid, active email addresses to bypass retailer fraud filters. (Kurt “CyberGuy” Knutsson)

    What’s likely happening with those shipment emails in your inbox

    It is unlikely that someone is accidentally typing your email address every single time. Rather, scammers are deliberately using valid, active email addresses like yours to bypass retailer fraud filters. Numerous sources confirm that fake order and shipping confirmation emails are a common tactic in fraud operations, with criminals exploiting the trust systems placed in legitimate email addresses.

    When a stolen credit card is used, pairing it with a real email that has not triggered spam alerts increases the chance the transaction will go unnoticed by anti-fraud systems. Retailers often check whether an email address is active or bounces. If the system sees a functioning address, it may be less suspicious than an obviously fake one.

    Once the order is placed, products are frequently sent to drop addresses or freight-forwarding services, as confirmed by official investigations into brushing scams. These services act as intermediaries, making the scam harder to trace. In that context, your email is simply a means to an end, a validated contact point that helps the operation move forward smoothly.

    A laptop with the Google search screen on it

    Scammers can obtain email addresses when reputable companies experience data breaches. (Kurt “CyberGuy” Knutsson)

    How bad actors are able to get your email

    Your email address may have ended up in the hands of scammers through several common methods. The most likely cause is a data breach. Many well-known companies have experienced leaks in which customer emails and other information were exposed. 

    Once your email is part of a leaked database, it often circulates on the dark web or in underground forums, where it is freely traded and reused. Even if you were not part of a breach, scammers often use a technique called credential stuffing. This involves testing stolen login details across different websites to confirm which email addresses are active.

    REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS

    Remove yourself from the web

    The best thing you can do to prevent this from happening is to invest in a data removal service. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. 

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    A person types on their laptop.

    If you are receiving order confirmations for things you never bought, your email address could be a tool used by scammers in a larger fraud operation. (Kurt “CyberGuy” Knutsson)

    7 ways to secure your email from scammers

    These simple but powerful steps can help you protect your inbox, safeguard your identity and stay one step ahead of scammers misusing your email.

    1. Protect and monitor your email

    Start by locking down your email account with a strong, unique password that you don’t reuse anywhere else. Enable two-factor authentication (2FA) so hackers can’t get in even if they’ve stolen your password. A password manager makes this much easier by generating and securely storing complex passwords, helping you avoid the risks of reuse. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    2. Watch for suspicious messages

    Scan your inbox regularly for order confirmations, shipping notices or account sign-ups you don’t recognize. If something looks off, report it directly to the retailer or platform; it could be part of a larger scam using your email address. Never click on suspicious links, even if the message looks legitimate, and protect your devices with strong antivirus software to catch threats before they spread.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com/LockUpYourTech 

    3. Be picky about where you share your email

    Avoid entering your email on shady giveaway sites or sketchy online forms. When in doubt, skip the sign-up or use a throwaway email. The fewer places your email lives, the harder it is for scammers to get hold of it.

    4. Create a second email address for shopping

    Set up a dedicated email for online purchases, newsletters and subscriptions. This helps keep your main inbox clean and makes it easier to spot strange activity. Sometimes, it’s best to create various email aliases so that you don’t have to worry about all your info getting taken in a data breach.  An email alias address is a great way for you to stop receiving constant spam mail by simply deleting the email alias address. These aliases forward messages to your primary address, making it easier to manage incoming communications and avoid data breaches.

    For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com/Mail

    HOW TO TELL IF A LOGIN ALERT IS REAL OR A SCAM

    5. Monitor your credit and identity regularly

    Even if no purchases appear under your name, scams involving your email can be a red flag for future identity misuse. Set up alerts with your bank and consider a credit monitoring service to catch unauthorized activity early.

    See my tips and best picks on how to protect yourself from identity theft at  Cyberguy.com/IdentityTheft

    6. Review connected accounts and revoke access

    In your email settings (e.g., Gmail, Outlook), check for any connected apps, services or delegated access you don’t recognize and remove them. This ensures no third party is piggybacking off your account.

    7. File an identity theft report if the problem escalates

    If this email misuse leads to fraudulent financial activity, users should file a report with the FTC at IdentityTheft.gov or their local authorities. 

    Kurt’s key takeaway

    If you are receiving order confirmations for things you never bought, do not shrug it off. Your email is likely being misused as part of a larger fraud operation, not by accident but intentionally. Scammers are taking advantage of active, trustworthy email addresses to slip past retailer defenses and carry out unauthorized purchases. The repeated use of your email shows that fraud networks are already circulating it, even if your financial information remains untouched.

    Are you comfortable with how much of your personal information is floating around online? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

    Copyright 2025 CyberGuy.com.  All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Air France and KLM breach tied to hacker group

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Air France and KLM are warning customers about a new data breach that hit their customer service platform. Hackers accessed personal details including names, emails, phone numbers, loyalty program information and recent transactions. While no financial details were stolen, experts warn that this information is still a gold mine for cybercriminals.

    The airlines say they acted quickly to cut off the attackers’ access. They also stressed that their internal networks remain secure.

    “Air France and KLM detected unusual activity on an external platform we use for customer service,” the companies said in a joint statement. “This activity led to unauthorized access to customer data. Our IT security teams, along with the relevant external party, took immediate action to stop it. We have also put measures in place to prevent it from happening again. Internal Air France and KLM systems were not affected.”

    Authorities in France and the Netherlands have been notified. Meanwhile, impacted customers are being told to stay alert.

    “Customers whose data may have been accessed are currently being informed,” the airlines added. “We are advising them to be extra vigilant for suspicious emails or phone calls.”

    NOTORIOUS HACKER GROUP SETS SIGHTS ON AIRLINE INDUSTRY IN ALARMING SECURITY THREAT

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM/NEWSLETTER

    Air France airliner (Kurt “CyberGuy” Knutsson)

    A larger cybercrime trend

    This attack is part of a broader wave of data theft linked to the ShinyHunters group. In recent months, they have targeted Salesforce customer service systems used by major global brands. High-profile victims include Adidas, Qantas, Louis Vuitton and even Google.

    Ricardo Amper, CEO of Incode Technologies, a global leader in identity verification and AI-powered fraud prevention, calls this a dangerous shift.

    “This signals hackers like ShinyHunters evolving from brute-force hacks to AI-amplified social engineering, targeting third-party platforms where humans are the weak link. They’re not just stealing data; they’re using generative AI to craft convincing impersonations. It’s an AI arms race.”

    KLM airliner (Kurt "CyberGuy" Knutsson)

    KLM airliner (Kurt “CyberGuy” Knutsson)

    WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

    How hackers pulled this off

    Attackers now use advanced AI tools that make impersonation both fast and inexpensive. These tools allow them to convincingly mimic real people.

    “Attackers today are digital con artists with an unprecedented toolkit,” Amper explains. “With AI, they can convincingly impersonate real people using cloned voices, speech patterns and even realistic video deepfakes. With just 10-20 seconds of someone’s voice, they can create an audio clone that sounds exactly like them. Armed with this, attackers call customer service reps, posing as an executive, a partner or a high-value customer, and request sensitive account changes or data access.”

    These AI-driven impersonations bypass the “red flags” that once alerted employees.

    “The best AI deepfakes are nearly impossible for humans to detect in real time,” says Amper. “Pauses, awkward phrasing, bad audio, those giveaways are disappearing.”

    Why customer service platforms are prime targets

    Customer service portals hold a wealth of personal information and often have the power to reset accounts or override security settings. This combination makes them especially attractive to hackers.

    “Customer service platforms are considered a treasure trove because they store detailed personal data, transaction histories, and sometimes have capabilities to reset passwords or override security settings,” Amper notes. “Unlike core financial systems, many lack robust security controls, making them accessible to attackers armed with partial user information.”

    What this means for you

    Air France-KLM’s breach shows just how quickly cybercriminals are adapting. With AI-powered impersonation, even experienced customer service representatives can be tricked. Your best defense is to stay vigilant, use stronger authentication and actively monitor your accounts for any unusual activity.

    A woman booking airline travel on her laptop (Kurt "CyberGuy" Knutsson)

    A woman booking airline travel on her laptop (Kurt “CyberGuy” Knutsson)

    What hackers do with the stolen data

    Once hackers gain access to this data, they can quickly convert it into profit.

    “This starts when attackers use stolen data such as loyalty program numbers, recent transactions or service request information to impersonate customers in future interactions,” Amper says. “Loyalty points and frequent flyer miles act as digital currency that can be monetized or redeemed for rewards. These pieces of information are treated as puzzle pieces to build complete identity profiles.”

    These profiles often appear for sale on the dark web. Criminals can also reuse them to break into other accounts or launch highly targeted scams.

    How to protect yourself after a breach

    Amper warns that scammers often move quickly after a breach, sending fake alerts that seem legitimate.

    “Post-breach, watch for phishing lures tailored to you, like emails citing your recent Air France flight, urging a ‘security update’ with a dodgy link. Scammers thrive on urgency.”

    If you were notified, or even suspect that your data was part of this breach, take these steps immediately:

    1) Enable phishing-resistant MFA

    Use app-based authentication, security keys or biometrics wherever possible. Unlike basic text message codes, these methods are far harder for cybercriminals to intercept, even if they already have some of your personal information from the breach.

    2) Watch for tailored phishing attempts and use strong antivirus software

    Scammers may reference real flights, loyalty program balances or recent transactions to trick you into clicking malicious links. Pair your caution with strong antivirus tools which can block dangerous websites, phishing attempts and malware before they get a chance to run. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at CyberGuy.com/LockUpYourTech

    3) Monitor loyalty and financial accounts closely

    Frequent flyer miles and loyalty points are like digital currency. They can be stolen, sold or redeemed for real-world goods. Check your airline, hotel and bank accounts regularly for unusual activity.

    GET FOX BUSINESS ON THE GO BY CLICKING HERE

    4) Use strong, unique passwords

    Never reuse the same password across accounts. If hackers compromise one account, they can try the same password elsewhere in a “credential stuffing” attack. A reputable password manager can create and store complex, unique logins.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords

    5) Sign up for an identity theft protection service

    Credit bureaus and specialized services can alert you if your information appears on the dark web or is linked to suspicious activity. Identity Theft companies can monitor personal information like your Social Security number (SSN), phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. 

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com/IdentityTheft

    6) Use a personal data removal service

    Personal data removal services can help scrub your personal information from data broker sites. Removing these records makes it harder for attackers to gather the details they need to impersonate you. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    7) Scan your credit reports weekly

    Review your reports from major credit bureaus for suspicious accounts or inquiries you didn’t initiate.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaways

    Your frequent flyer miles, email address and phone number might not seem as valuable as your credit card, but in the wrong hands, they’re keys to unlocking more of your personal life. Protect them like cash.

    What would you do if a scammer could call your airline and sound exactly like you? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM/NEWSLETTER

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Nearly a million patients hit by DaVita dialysis ransomware attack

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Healthcare institutions have become a favorite target for bad actors, largely because of how easy they make it for attackers. In June, researchers discovered a healthcare data breach that exposed the personal information of around 8 million patients. All of this information was publicly accessible online without any passwords or authentication protocols.

    The latest healthcare organization to fall victim to a breach is DaVita, which has put nearly a million people at risk. Headquartered in Denver, Colorado, DaVita provides dialysis treatment to about 200,000 patients across the U.S. and 13 other countries.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

    DIOR DATA BREACH EXPOSES US CUSTOMERS’ PERSONAL INFORMATION

    A healthcare professional working on her laptop  (Kurt “CyberGuy” Knutsson)

    What you need to know DaVita ransomware attack

    Kidney dialysis giant DaVita says nearly 916,000 people had personal and medical information exposed in an April ransomware attack (via Comparitech). The breach, which the company disclosed in state filings, compromised names, Social Security numbers, dates of birth, health insurance details, medical records, tax ID numbers, addresses and even images of checks made out to the company.

    DaVita says the incident disrupted internal operations and primarily affected its laboratories. In its latest notice to victims, the company says the cyberattack began March 24, 2025, and continued until April 12. It has not confirmed whether a ransom was paid.

    Ransomware gang Interlock claimed responsibility on April 25, posting screenshots of alleged stolen documents and saying it took 1.5TB of DaVita’s data. The group lists the company on its public leak site, where it pressures victims by threatening to sell or release stolen files.

    DaVita is offering eligible breach victims free identity restoration services through Experian, with a Nov. 28 enrollment deadline. The company has not confirmed how attackers gained access to its network or the size of the ransom demand.

    CyberGuy reached out to DaVita for comment but did not receive a response before publication.

    person typing on tablet

    A healthcare professional working on a tablet   (Kurt “CyberGuy” Knutsson)

    Who’s behind the DaVita breach

    Interlock, which first appeared in October 2024, has claimed responsibility for the DaVita attack and at least 23 other ransomware attacks, plus dozens more that remain unverified. Healthcare targets have included Texas Digestive Specialists, Kettering Health and Naper Grove Vision Care, all of which reported data breaches in 2025.

    WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

    The DaVita incident is the second-largest U.S. healthcare ransomware attack by number of records this year, behind Frederick Health’s January breach. According to Comparitech, there have been 53 confirmed ransomware attacks on American healthcare providers in 2025 alone, compromising more than 3.2 million patient records.

    patient vitals

    A screen showing a patient’s vitals  (Kurt “CyberGuy” Knutsson)

    6 ways to protect yourself from DaVita ransomware attack

    The DaVita data breach exposed sensitive patient information. If you are affected or just want to stay one step ahead, these actions can help minimize your risk.

    1. Don’t click on suspicious links or attachments and use strong antivirus software

    The DaVita data breach likely gives attackers access to your contact details, which they can misuse. Avoid clicking on unexpected emails or messages, even if they look legitimate.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com/LockUpYourTech

    2. Use a personal data removal service

    Since your personal details were exposed in the DaVita breach, you’re more vulnerable to targeted fraud. Consider using a personal data removal service to scrub your personal details from data broker websites that sell your information.

    While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan 

    GET FOX BUSINESS ON THE GO BY CLICKING HERE

    3. Use strong, unique passwords for every account

    Reusing passwords increases your risk. A single leaked password can unlock multiple accounts. Use a password manager to generate and store secure passwords.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords

    4. Sign up for an identity theft protection service

    DaVita is offering free identity theft and credit monitoring services to those affected by the breach. But even if you weren’t a victim of this specific breach, it’s still smart to protect yourself.

    Identity theft protection services can alert you to suspicious activity, help you recover if your identity is stolen and often provide tools to freeze or lock your credit. That prevents fraudsters from opening new accounts in your name, and you can lift the freeze temporarily when needed.

    See my tips and best picks on how to protect yourself from identity theft at  Cyberguy.com/IdentityTheft

    5. Enable two-factor authentication (2FA)

    Adding a second layer of login protection, like a text message or app-based code via 2FA, can make it much harder for DaVita attackers to access your accounts, even if your password is exposed.

    6. Monitor your credit and financial accounts

    Keep an eye out for strange charges or unfamiliar accounts. Set up alerts through your bank and review your credit report regularly to catch fraud early.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    The investigation into the DaVita breach is ongoing, and the company has not disclosed how the hackers got in. Nearly a million people now face the possibility of their personal information being used for malicious purposes. Ransomware attacks on hospitals and clinics can lock critical systems, delay care and push providers back to paper records. In severe cases, they can force appointment cancellations and patient diversions and potentially endanger lives.

    Should U.S. law require healthcare organizations to meet stricter cybersecurity standards? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Google confirms data stolen in breach by known hacker group

    [ad_1]

    NEWYou can now listen to Fox News articles!

    When a hospital or nonprofit falls victim to a cyberattack, it’s hard to place blame. Cybersecurity isn’t their strength, and many lack the budget for a dedicated security team, let alone a chief technology officer.

    But when a tech giant like Google experiences a data breach, it raises serious questions. Is data security slipping down the company’s priority list? Or are today’s cybercriminals so advanced that even Google’s top engineers are struggling to keep up?

    Here’s what happened: Google recently confirmed that hackers stole customer data by breaching one of its internal databases. The breach targeted a system that used Salesforce, a popular cloud-based platform companies use to manage customer relationships, store business contact information and track interactions. The attack has been linked to a known threat group.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

    DIOR DATA BREACH EXPOSES US CUSTOMERS’ PERSONAL INFORMATION

    A Google sign on the side of a building (Kurt “CyberGuy” Knutsson)

    What you need to know about Google data breach

    Google has confirmed that a hacking group known as ShinyHunters stole customer data from one of its internal Salesforce databases used to manage business client relationships. The company disclosed the breach in a blog post published in early August, noting that the stolen data included “basic and largely publicly available business information, such as business names and contact details.”

    WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

    The breach was carried out by ShinyHunters, a well-known cybercriminal group formally tracked as UNC6040. The group has recently been linked to a string of high-profile incidents involving companies such as AT&T, Ticketmaster, Allianz Life and Pandora. In this case, the attackers targeted Google’s corporate Salesforce system, which the company uses to store contact information and notes about small and medium-sized businesses.

    According to Google’s Threat Intelligence Group, the attackers relied on voice phishing, or “vishing,” impersonating company employees in phone calls to IT support and persuading them to reset login credentials. This technique has proven effective against multiple organizations in recent months.

    google hackers 2

    A man using the Google search engine on his laptop   (Kurt “CyberGuy” Knutsson)

    No company is safe from cyberattacks

    Google did not specify how many customers were affected by the breach. When asked for comment, a company spokesperson pointed CyberGuy back to the blog post and declined to elaborate. It is also unclear whether Google has received any sort of ransom demand from the group.

    Cisco, Qantas and Pandora have all reported similar breaches in recent months, which now appear to be part of a broader campaign targeting cloud-based customer relationship management tools.

    In its blog post, Google warned that ShinyHunters may be preparing a public leak site. Ransomware gangs often use this tactic to extort companies, threatening to publish stolen data. The group reportedly shares infrastructure and personnel with other cybercriminal collectives, including The Com, which runs extortion campaigns and has, in some cases, issued threats of physical violence. 

    google hackers 3

    Google search engine (Kurt “CyberGuy” Knutsson)

    9 ways to stay safe from voice phishing and social engineering attacks

    While organizations like Google may be prime targets, individuals are often the weakest link that attackers exploit. But with a few smart practices, you can dramatically reduce your risk.

    1. Never share login credentials over the phone

    The Google breach happened because employees gave up sensitive information over a phone call. No legitimate IT team will ever ask you to share your password or 2FA codes over the phone. If someone does, it’s a major red flag.

    2. Always verify who’s calling

    If someone claims to be from your company’s IT department or a service provider, hang up and call back using an official number. Never trust the number displayed on caller ID.

    3. Enable two-factor authentication (2FA)

    Even if credentials are compromised, two-factor authentication (2FA) can block unauthorized access by adding an extra layer of security. It ensures that a password alone isn’t enough to break into your accounts.

    GET FOX BUSINESS ON THE GO BY CLICKING HERE

    4. Beware of phishing links too

    Phishing emails and messages often include links that take you to fake websites designed to steal your login credentials or personal information. These messages usually create a sense of urgency, asking you to verify an account, reset a password or claim a reward. Instead of clicking the link, take a moment to inspect the message.

    The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com/LockUpYourTech

    5. Use a data removal service

    Attackers are able to carry out phishing, smishing and vishing attacks because your personal data is readily available online. The less of it that’s publicly accessible, the harder it becomes for them to craft convincing scams.

    While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    6. Keep your software and browsers up to date

    Attackers often exploit outdated software with known vulnerabilities. Make sure your operating system, browsers, plugins and apps are always running the latest version. Enable auto updates wherever possible to avoid missing critical patches.

    7. Use a password manager with phishing detection

    A good password manager doesn’t just store strong, unique passwords; it can also alert you if you’re on a suspicious site. If your password manager refuses to autofill your login, it could mean the site is fake.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords

    8. Monitor your accounts for unusual activity

    If you suspect a breach, watch your accounts for unauthorized logins, password reset emails or other suspicious behavior. Set up alerts when possible. Many online services offer login notifications or dashboards that show recent access history.

    9. Report phishing attempts

    If you receive a vishing or phishing attempt, report it to your organization’s IT/security team or the appropriate government agency (like reportfraud.ftc.gov in the U.S.). Reporting helps shut down these scams faster and can protect others.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    While the data exposed in Google’s case may be limited, the breach highlights a persistent vulnerability in corporate systems: people. ShinyHunters seems to be getting more effective at exploiting that weakness. What’s even more concerning is the rise of vishing, also known as voice phishing. Vishing isn’t new, but its growing success shows just how fragile even well-defended systems can be when human error is involved.

    How confident are you in your company’s cybersecurity awareness training? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER 

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Google AI email summaries can be hacked to hide phishing attacks

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Artificial intelligence is everywhere these days — in your phone, your car, even your washing machine. I saw one just the other day featuring built-in AI. And while that might sound a little over the top, there’s no denying that artificial intelligence has made life easier in a lot of ways.

    From boosting productivity to unlocking new creative tools, it’s changing how we work and live. The most common version you’ve probably encountered? Generative AI, think chatbots like ChatGPT. But as helpful as this tech can be, it’s not without its problems.

    If you’ve used Google’s Workspace suite, you may have noticed the company’s AI model, Gemini, integrated across apps like Docs, Sheets and Gmail. Now, researchers say attackers can manipulate Gemini-generated email summaries to sneak in hidden phishing prompts.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER  

    HOW AI IS NOW HELPING HACKERS FOOL YOUR BROWSER’S SECURITY TOOLS

    Google Gemini app on a mobile device  (Kurt “CyberGuy” Knutsson)

    How Gemini summaries can be hacked

    Researchers at Mozilla’s 0Din have discovered a vulnerability in Google’s Gemini for Workspace that allows attackers to inject hidden instructions into email summaries. The issue, demonstrated by Marco Figueroa, shows how generative AI tools can be misled through indirect prompt injection. This technique embeds invisible commands inside the body of an email. When Gemini summarizes the message, it interprets and acts on those hidden prompts.

    WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

    The attack does not rely on suspicious links or attachments. Instead, it uses a combination of HTML and CSS to conceal the prompt by setting the font size to zero and the color to white. These commands remain invisible in Gmail’s standard view but are still accessible to Gemini. Once you request a summary, the AI can be tricked into presenting fake security alerts or urgent instructions that appear to come from Google.

    In a proof of concept, Gemini falsely warned a user that a Gmail password had been compromised and included a fake support phone number. Since Gemini summaries are integrated into Google Workspace, you are more likely to trust the information, making this tactic especially effective.

    google sign

    A Google sign on a building   (Kurt “CyberGuy” Knutsson)

    What is Google doing about the flaw?

    While Google has implemented defenses against prompt injection since 2024, this method appears to bypass current protections. The company told CyberGuy it is actively deploying updated safeguards.

    GET FOX BUSINESS ON THE GO BY CLICKING HERE

    In a statement, a Google spokesperson said, “Defending against attacks impacting the industry, like prompt injections, has been a continued priority for us, and we’ve deployed numerous strong defenses to keep users safe, including safeguards to prevent harmful or misleading responses. We are constantly hardening our already robust defenses through red-teaming exercises that train our models to defend against these types of adversarial attacks.”

    Google also confirmed that it has not observed active exploitation of this specific technique.

    google gemini

    Google Gemini app on the home screen of a mobile device    (Kurt “CyberGuy” Knutsson)

    6 ways you can stay safe from AI phishing scams

    So, how can you protect yourself from phishing scams that exploit AI tools like Gemini? Here are six essential steps you can take right now to stay safe:

    1. Do not blindly trust AI-generated content

    Just because a summary appears in Gmail or Docs does not mean it is automatically safe. Treat AI-generated suggestions, alerts or links with the same caution you would any unsolicited message. Always verify critical information, such as security alerts or phone numbers, through official sources.

    2. Avoid using summary features for suspicious emails

    If an email seems unusual, especially if it is unexpected or from someone you do not recognize, avoid using the AI summary feature. Instead, read the full email as it was originally written. This lowers the chance of falling for misleading summaries.

    3. Beware of phishing emails and messages

    Watch for emails or messages that create a sense of urgency, ask you to verify account details or provide unexpected links or contact information, even if they appear trustworthy or come from familiar sources. Attackers can use AI to craft realistic-looking alerts or requests for sensitive information, sometimes concealed within automatically generated summaries. So, always pause and scrutinize suspicious prompts before responding. 

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com/LockUpYourTech 

    4. Keep your apps and extensions updated

    Ensure that Google Workspace and your browser are always running the latest version. Google regularly releases security updates that help prevent newer types of attacks. Also, avoid using unofficial extensions that have access to your Gmail or Docs.

    5. Invest in a data removal service

    AI-driven scams like the Gemini summary attack don’t happen in a vacuum. They often begin with stolen personal information. That data might come from past breaches, public records or details you’ve unknowingly shared online. A data removal service can help by continuously scanning and requesting the removal of your information from data broker sites. While no service can wipe everything, reducing your digital footprint makes it harder for attackers to personalize phishing attempts or link you to known breach data. Think of it as one more layer of protection in a world where AI makes targeted scams even easier.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    6. Disable AI summaries for now if you’re concerned

    If you’re worried about falling for an AI-generated phishing attempt, consider disabling Gemini summaries in Gmail until Google rolls out stronger protections. You can still read full emails the traditional way, which can lower your risk of being misled by manipulated summaries.

    How to disable Gemini features on desktop

    • Open Gmail on desktop.
    • Click the Settings gear icon in the upper right.
    • Click See all settings.
    • Scroll to “Google Workspace smart features” and click Manage Workspace smart feature settings.
    • Disable the toggle for Smart features in Google Workspace.
    • Then, click Save.
    • Note: This will turn off Gemini summaries as well as other smart features.

    How to disable Gemini features on mobile

    On iPhone:

    If you use the Gemini mobile app specifically:

    • Open the Gemini app.
    • Tap your Profile picture.
    • Tap Gemini Apps Activity.
    • At the top, tap Turn off.

    On Android:

    Settings may vary depending on your Android phone’s manufacturer

    • Open the Gmail app on your Android.
    • Tap the Menu icon (three horizontal lines) in the upper left corner.
    • Scroll down and tap Settings.
    • Select the relevant email account.
    • Scroll down and tap Google Workspace smart features and uncheck the box to turn them off.

    Key caveats to know:

    • Disabling Smart Features may remove other convenient functionalities, such as predictive text and automatic appointment detection.
    • The Gemini icon or summary buttons may still appear, even after disabling these features. Some users report having to physically hide them via browser tools.

    There is no centralized single “off switch” to completely remove all Gemini AI references everywhere, but these steps significantly reduce the feature’s presence and risk.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    This vulnerability highlights how phishing tactics are evolving alongside AI. Instead of relying on visible red flags like misspelled URLs or suspicious attachments, attackers are now targeting trusted systems that help users filter and interpret messages. As AI becomes more deeply embedded in productivity tools, prompt injection could emerge as a subtle but powerful vector for social engineering, hiding malicious intent in the very tools designed to simplify communication.

    How comfortable are you letting AI summarize or filter your emails, and where do you draw the line? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER
     

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Trump names himself chair of L.A. Olympics task force, sees role for military during Games

    [ad_1]

    WASHINGTON — In past Olympic Games held on American soil, sitting presidents have served in passive, ceremonial roles. President Trump may have other plans.

    An executive order signed by Trump on Tuesday names him chair of a White House task force on the 2028 Games in Los Angeles, viewed by the president as “a premier opportunity to showcase American exceptionalism,” according to a White House statement. Trump, the administration said, “is taking every opportunity to showcase American greatness on the world stage.”

    At the White House, speaking in front of banners adding the presidential seal to the logo for LA28, Trump said he would send the military back to Los Angeles if he so chose in order to protect the Games. In June, Trump sent the National Guard and U.S. Marines to the city amid widespread immigration enforcement actions, despite widespread condemnation from Mayor Karen Bass and other local officials.

    “We’ll do anything necessary to keep the Olympics safe, including using our National Guard or military, OK?” he said. “I will use the National Guard or the military. This is going to be so safe. If we have to.”

    Trump’s executive order establishes a task force led by him and Vice President JD Vance to steer federal coordination for the Games. The task force will work with federal, state and local partners on security and transportation, according to the White House.

    Those roles have been fairly standard for the federal government in past U.S.-hosted Olympic Games. But Trump’s news conference could present questions about whether a president with a penchant for showmanship might assume an unusually active role in planning the Olympics, set to take place in the twilight of his final term.

    There is ample precedent for military and National Guard forces providing security support during U.S.-hosted Olympic Games. But coming on the heels of the recent military deployment to Los Angeles, Trump’s comments may prove contentious.

    French President Emmanuel Macron was a key figure in preparations for last year’s Paris Games, including expressing his vocal support for the ambitious Olympic opening ceremony plan to parade athletes down the Seine River on boats. Many officials were concerned about potential threats along the 3.7-mile stretch, but authorities responded by increasing security measures that included up to 45,000 police officers and 10,000 soldiers.

    The task force, to be housed within the Department of Homeland Security, will “assist in the planning and implementation of visa processing and credentialing programs for foreign athletes, coaches, officials, and media personnel,” the executive order said. City officials have expressed concern that the president’s border policies could deter international visitors and complicate visa processing for Olympic teams.

    Tensions with L.A.

    More concentrated involvement from Trump could spell further strain with Los Angeles city officials, who sought to make nice in the wake of devastating January fires, but have fiercely bucked Trump’s recent immigration offensive. Trump swiped at Bass during his remarks on Tuesday, calling her “not very competent” and criticizing the pace of city permitting for fire rebuilding.

    “We’ve had a productive working relationship with the federal government since Los Angeles was awarded the Games in 2017 and we will continue preparing with all partners to host the best Games in history – Games that will benefit the entire nation for decades to come,” Bass spokesperson Zach Seidl said.

    Known for her coalition-building skills, Bass is not, by nature, a public brawler. In the aftermath of the Palisades fire, she appeared determined to preserve her fragile relationship with the president — and the billions of dollars of federal aid her city was depending on — responding diplomatically even as he publicly attacked her.

    But that determined cordiality crumbled when masked immigration agents and military personnel descended on the city. With troops stationed in the city and U.S. Immigration and Customs Enforcement and other federal authorities arresting undocumented immigrants at courthouses, car washes and Home Depot parking lots, Bass took on Trump forcefully.

    At news conferences and in interviews, she accused the president of waging “an all-out assault on Los Angeles,” inciting chaos and fear and using the city as “a test case for an extremist agenda.”

    Casey Wasserman, chairman of LA28, attended the White House event, thanking Trump for “leaning in” to planning for an Olympics that was awarded to Los Angeles during his first term.

    “You’ve been supportive and helpful every step of the way,” Wasserman said, noting that the Games would amount to hosting seven Super Bowls a day for 30 days. “With the creation of this task force, we’ve unlocked the opportunity to level up our planning and deliver the largest, and yes, greatest Games for our nation, ever.”

    Wasserman will also have a delicate political balancing act, managing a Games in a deep-blue city with a famously mercurial Republican president in office.

    President Trump holds a full set of medals from the 1984 Olympics in Los Angeles during Tuesday’s event at which he announced an executive order regarding federal involvement in the 2028 Los Angeles Games.

    (Julia Demaree Nikhinson / Associated Press)

    A Hollywood scion and sports and entertainment mogul, Wasserman has long been a prominent Democratic donor known for his close relationship with the Clintons.

    But in recent months he has diversified his giving, with hefty donations to the National Republican Senatorial Committee, the National Republican Congressional Committee and House Speaker Mike Johnson’s leadership fund. Wasserman has publicly praised Trump’s commitment to the Games and traveled to Mar-a-Lago in January to meet with the incoming president.

    Presidents have long played a role in the Games. In 1984, Ronald Reagan formally opened the Summer Olympics in Los Angeles, becoming the first American president to do so. Reagan attended several Olympic events, but repeatedly emphasized the federal government’s role was focused on security, according to the White House Historical Assn.

    The Olympic Charter requires the host country’s head of state to officially open the Games, but before Reagan, the duty had been fulfilled by local political leaders or vice presidents representing the president.

    Ever-tightening security

    The federal government has historically provided significant funding when the Games are hosted on U.S. soil, with financial support going toward both security and infrastructure.

    Leading up to the 1996 Games in Atlanta, the federal government spent $227 million on security and transportation, playing “very much a junior partner” to the Olympic Committee, then-Vice President Al Gore said at the time. Still, a bombing at the Centennial Olympic Park during the Games that summer shook the security establishment.

    The 2002 Winter Olympics in Salt Lake City were the first Games to be classified as a “National Special Security Event,” the government’s highest security rating for any event that designates the U.S. Secret Service as the lead agency for implementing security. That standard has remained in place for U.S.-held Olympic Games ever since. The Secret Service will also lead security coordination for the 2028 Games.

    The federal government was particularly involved in the Salt Lake City Games, which were held just months after the 9/11 attacks.

    Los Angeles leaders are actively involved in the security planning, and are currently in negotiations with LA28 for the use of the city’s police, traffic officers, and other employees during the Olympics and Paralympics.

    Security, trash removal, traffic control, paramedics and more will be needed during the 17-day Olympics and the two-week Paralympics the following month.

    Under the 2021 Games agreement between LA28 and the city, LA28 must reimburse Los Angeles for any services that go beyond what the city would provide on a normal day. The two parties must agree by Oct. 1, 2025, on “enhanced services” — additional city services needed for the Games, beyond that normal level — and determine rates, repayment timelines, audit rights and other processes.

    Overtime for Los Angeles police officers, and any other major expenses, would be acutely felt by a city government that recently closed a nearly $1-billion budget deficit, in part by slowing police hiring.

    Wilner reported from Washington, Wick and Nguyen from Los Angeles. Times staff writer Dakota Smith contributed to this report.

    [ad_2]

    Michael Wilner, Julia Wick, Thuc Nhi Nguyen

    Source link

  • Dynomighty Micro Wallet Finder

    [ad_1]

    | |

    Dynomighty’s Micro Wallet Finder is a 2mm-thick, Apple ‘Find My’-certified device that combines a location finder, RFID protection, and an audible skimming alarm to detect and alert you to card skimmers nearby. Rechargeable via MagSafe with 6-8 months of battery life, it also has a ScanKeep QR code for lost item recovery or use as a digital business card.

    When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases.

    Dynomighty Micro Wallet FinderDynomighty Micro Wallet Finder

    Dynomighty Micro Wallet FinderDynomighty Micro Wallet Finder

    Dynomighty Micro Wallet FinderDynomighty Micro Wallet Finder

    Dynomighty Micro Wallet FinderDynomighty Micro Wallet Finder

    Crowdfunded projects pose a degree of risk for buyers, so be sure to do your research before paying your hard-earned money.

    [ad_2]

    Paul Strauss

    Source link