Categoria: Data Breaches

GoDaddy Says Recent Hack Part of Multi-Year Campaign

GoDaddy recently discovered a hacker attack where a sophisticated threat group infected websites and servers with malware.

The post GoDaddy Says Recent Hack Part of Multi-Year Campaign appeared first on SecurityWeek.

Atlassian Investigating Security Breach After Hackers Leak Data

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

The post Atlassian Investigating Security Breach After Hackers Leak Data appeared first on SecurityWeek.

Pepsi Bottling Ventures Discloses Data Breach

Pepsi Bottling Ventures, the largest privately-held bottler of Pepsi-Cola products in the United States, says data was stolen from its systems following a malware attack.

The post Pepsi Bottling Ventures Discloses Data Breach appeared first on SecurityWeek.

Patient Information Compromised in Data Breach at San Diego Healthcare Provider

San Diego healthcare services provider Sharp HealthCare is informing patients that some of their information was compromised in a recent data breach.

A not-for-profit healthcare provider, Sharp operates multiple hospitals and facilities in San Diego County, has 19,000 employees and works with roughly 2,700 affiliated physicians.

The incident took place on January 12, when an unauthorized party gained access to a server running the Sharp.com website, the company says in a data breach notice.

According to the healthcare services provider, the unauthorized access lasted for a few hours only, but, during this time, the attackers accessed a file containing patient data.

The compromised information, the company says, includes names, payment amounts, which Sharp facilities received the payments, and Sharp identification numbers and/or invoice numbers.

Payment card data, Social Security numbers, contact information, health insurance details, birth dates, clinical information, or details about received services were not accessed.

“Additionally, this incident did not involve unauthorized access to Sharp’s medical record systems or the FollowMyHealth patient portal,” the healthcare provider says.

According to the organization, the incident only impacted Sharp patients who used the online bill payment service to pay a bill or invoice between August 12, 2021, and January 12, 2023. According to The San Diego Union Tribune, roughly 63,000 individuals were impacted.

“We have no indication that anyone’s information has been misused. However, as a precaution, we are mailing notification letters to individuals whose information was involved in this incident,” Sharp says.

Stolen personal and medical information is often shared or traded on underground hacker forums and later used by cybercriminals in phishing and other types of cyberattacks.

The post Patient Information Compromised in Data Breach at San Diego Healthcare Provider appeared first on SecurityWeek.

20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder

PeopleConnect-owned background check services Instant Checkmate and TruthFinder have disclosed data breaches affecting a total of more than 20 million users.

In individual data breach notices published on February 3, the organizations informed users that the incident was discovered after cybercriminals started sharing databases stolen from the two companies on underground forums.

The databases – or ‘lists’, as the two companies call them – contain names, email addresses, phone numbers, encrypted passwords, and password reset tokens that are either expired or inactive.

“We have confirmed that the list was created several years ago and appears to include all customer accounts created between 2011 and 2019. The published list originated inside our company,” the announcements read.

The two organizations note that the leaked information does not include details on user activity or payment data.

While Instant Checkmate and TruthFinder also note that no “readable or usable passwords or other means to compromise user accounts” leaked either, it is not uncommon for cybercriminals to try to crack stolen encrypted passwords.

“As a best practice we would recommend that you not respond to suspicious communications. We will never ask you for your password, social security number or payment information via email or telephone,” the companies say.

Investigations were launched into both incidents, but no evidence of malicious activity has been found as of now on their networks. According to the two announcements, the data breach was the result of the “inadvertent leak or theft” of the impacted database.

While neither Instant Checkmate nor TruthFinder shared information on the number of affected individuals, the data has already been added to Troy Hunt’s breach notification service Have I been pwned.

The leaked databases include the information of more than 11.9 million Instant Checkmate accounts, and the details of over 8.1 million TruthFinder accounts.

The post 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder appeared first on SecurityWeek.

Google Fi Data Breach Reportedly Led to SIM Swapping

The Google Fi telecommunications service has informed customers about a data breach that appears to be related to the recently disclosed T-Mobile cyberattack.

Google Fi, which provides wireless phone and internet services, has told customers that the breach is related to its primary network provider, without naming it.

However, T-Mobile is Google Fi’s primary network provider, which means the incident is likely related to the hacker attack disclosed by the wireless carrier in mid-January.

Google Fi said there had been unauthorized access to a third-party customer support system containing a “limited amount” of customer data. This data includes phone number, account activation date, mobile service plan, SIM card serial number, and account status.

The company says names, dates of birth, email addresses, payment card details, social security numbers, financial account information, passwords or PINs were not exposed. Hackers also did not gain access to the content of calls or SMS messages.

“There was no access to Google’s systems or any systems overseen by Google,” customers were told.

Most of the impacted customers do not need to take any action — except be on the lookout for phishing attempts. However, one Google Fi user reported on Reddit that their notification also informed them that their mobile phone service had been transferred from their SIM card to another SIM card for nearly two hours on January 1.

The notification from Google Fi, according to the impacted customer, read, “During the time of this temporary transfer, the unauthorized access could have involved the use of your phone number to send and receive phone calls and text messages. Despite the SIM transfer, your voicemail could not have been accessed. We have restored Google Fi service to your SIM card.”

The customer confirmed that their SIM card had been targeted in a SIM swapping attack on January 1, and claimed that the hacker used it to access three online accounts, including email, financial account, and the Authy authenticator app.

“I tried reporting this repeatedly to Google Fi, including with detailed evidence, and their customer support reps didn’t believe me and didn’t follow up,” the customer said. “They thought this was a standard password compromise or something, even though I could clearly see from activity logs that the hacker reset my passwords rather than logging in and then changing them, and I could see in the Google Fi activity logs the SMSes I didn’t receive that they used to compromise my accounts.”

As for T-Mobile, the company said it detected a data breach on January 5. The threat actor, which has not been identified, apparently abused an API to access customer account data such as name, billing address, phone number, email, date of birth, and service information. Roughly 37 million current postpaid and prepaid customer accounts are impacted.

The post Google Fi Data Breach Reportedly Led to SIM Swapping appeared first on SecurityWeek.

British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers

British sports fashion retail firm JD Sports on Monday revealed that it has discovered a data breach impacting roughly 10 million of its customers.

According to the company, the cyber incident affects information provided by customers who placed online orders between November 2018 and October 2020. The JD, Size, Millets, Blacks, Scotts and MilletSport brands are impacted.

Based on the company’s brief description of the incident, it’s possible that hackers stole names, billing addresses, delivery addresses, phone numbers, email addresses, order details, and last four digits of the customers’ payment cards.

There is no indication that full payment card data or account passwords were compromised.

The company has called in external cybersecurity experts to investigate the incident and authorities in the UK have been notified. The investigation is ongoing.

In its statement, JD Sports warned customers that they may be targeted in scams and phishing attacks.

The post British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers appeared first on SecurityWeek.

820k Impacted by Data Breach at Zacks Investment Research

Stock research firm Zacks Investment Research is in the process of notifying customers that their personal information was compromised in a data breach.

Founded in 1978, Zacks Investment Research is one of the largest providers of stock research, analysis and recommendations for firms in the US.

Earlier this week, the company informed the Maine Attorney General’s Office that the personal information of 820,000 individuals was compromised after a third-party gained unauthorized access to its systems.

The data breach, the firm says, was discovered in December 2022, but the unauthorized access occurred sometime between November 2021 and August 2022.

The notification letter to the impacted customers, a copy of which was submitted to the Maine Attorney General, reveals that the unauthorized third-party had access to an older database containing information about customers who had signed up for a Zacks product between November 1999 and February 2005.

The compromised personal information includes names, addresses, phone numbers, email addresses, and passwords for Zacks.com.

“We have no reason to believe any customer credit card information, any other customer financial information, or any other customer personal information was accessed,” the company says.

Zacks says it has implemented security measures to stop the breach and that it has reset the passwords for the impacted accounts.

“When you log into your Zacks account, you will be prompted to change your password. You should also change the password for all other online accounts for which you used the same e-mail address and password as your Zacks account,” the company tells users.

Zacks told the Maine Attorney General that it will begin notifying impacted customers on January 27.

The post 820k Impacted by Data Breach at Zacks Investment Research appeared first on SecurityWeek.

GoTo Says Hackers Stole Encrypted Backups, MFA Settings

IT management software firm GoTo on Tuesday said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach that also affected its LastPass affiliate.

GoTo chief executive Paddy Srinivasan confirmed the security breach was far worse than originally reported and included the theft of account usernames, salted and hashed passwords, a portion of Multi-Factor Authentication (MFA) settings, as well as some product settings and licensing information.

In a notice posted online, Srinivasan the encrypted backups were related to multiple GoTo-owned software products:

“Our investigation to date has determined that a threat actor exfiltrated encrypted backups from a third-party cloud storage service related to the following products: Central, Pro, join.me, Hamachi, and RemotelyAnywhere.

We also have evidence that a threat actor exfiltrated an encryption key for a portion of the encrypted backups. The affected information, which varies by product, may include account usernames, salted and hashed passwords, a portion of Multi-Factor Authentication (MFA) settings, as well as some product settings and licensing information.

In addition, while Rescue and GoToMyPC encrypted databases were not exfiltrated, MFA settings of a small subset of their customers were impacted.”

Srinivasan said the company has no evidence of exfiltration affecting any other GoTo products or any of GoTo’s production systems.

Even though all account passwords were salted and hashed in accordance with best practices, Srinivasan said GoTo plans to reset the passwords of affected users and/or reauthorize MFA settings where applicable.

“In addition, we are migrating their accounts onto an enhanced Identity Management Platform, which will provide additional security with more robust authentication and login-based security options,” the GoTo CEO said.

In August last year, GoTo affiliate LastPass disclosed a data breach that included the theft of source code and proprietary technical information. In November, GoTo said it was also affected by that hack, which is linked to an unnamed third-party cloud security vendor.

In a worrisome update in late December, the password management outfit admitted the hackers behind the August breach stole a massive stash of customer data, including password vault data that could be exposed by brute-forcing or guessing master passwords.

LastPass said the hackers broke into its network in August and used information from that hack to return and hijack customer data that included company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.

In addition, the unidentified actor was also able to copy a backup of customer vault data from an encrypted storage container.

The exposed container contained both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.

The post GoTo Says Hackers Stole Encrypted Backups, MFA Settings appeared first on SecurityWeek.

Zendesk Hacked After Employees Fall for Phishing Attack

Customer service solutions provider Zendesk has suffered a data breach that resulted from employee account credentials getting phished by hackers.

Cryptocurrency trading and portfolio management company Coinigy revealed last week that it had been informed by Zendesk about a cybersecurity incident.

According to the email received by Coinigy, Zendesk learned on October 25, 2022, that several employees were targeted in a “sophisticated SMS phishing campaign”. Some employees took the bait and handed over their account credentials to the attackers, allowing them to access unstructured data from a logging platform between September 25 and October 26, 2022.

Zendesk told Coinigy that, as part of its ongoing review, discovered on January 12, 2023, that service data belonging to the company’s account may have been in the logging platform data. Zendesk said there was no indication that Coinigy’s Zendesk instance had been accessed, but its investigation is still ongoing.

Zendesk does not appear to have published any statement or notice related to this incident on its website and the company has not responded to SecurityWeek’s inquiry.

However, based on the available information, it’s possible that the attack on Zendesk is related to a campaign named 0ktapus, in which a threat actor that appears to be financially motivated targeted more than 130 organizations between March and August 2022, including major companies such as Twilio and Cloudflare.

The 0ktapus attackers used SMS-based phishing messages to obtain employee credentials and victims included cryptocurrency companies.

Twilio and Cloudflare discovered breaches in August, but there was no indication that the campaign was not ongoing, so it’s possible that the same hackers targeted Zendesk a few months later.

While Coinigy appears to have been notified by Zendesk about the data breach only in January 2023, other victims appear to have been informed much sooner.

The US-based cryptocurrency exchange Kraken informed customers about a Zendesk breach that involved phishing and unauthorized access to the Zendesk logging system back in November. Kraken said at the time that while accounts and funds were not at risk, the attackers did view the content of support tickets, which contained information such as name, email address, date of birth and phone number.

This is not the first data breach disclosed by Zendesk. In 2019, the company revealed that it had become aware of a security incident that hit roughly 10,000 accounts.

The post Zendesk Hacked After Employees Fall for Phishing Attack appeared first on SecurityWeek.