Thu.Mar 09, 2023

article thumbnail

Hackers Sell U.S. Lawmaker Data Stolen From Insurance Market

Data Breach Today

Target Does Not Appear to Have Deliberately Targeted Members of Congress A hacker has been selling data stolen from an online health insurance marketplace used by members of Congress and residents of Washington, D.C. The cause size and scope of the breach are still unknown. The data pertains to "numerous" lawmakers as well as spouses, dependents and employees.

Insurance 273
article thumbnail

Who’s Behind the NetWire Remote Access Trojan?

Krebs on Security

A Croatian national has been arrested for allegedly operating NetWire , a Remote Access Trojan (RAT) marketed on cybercrime forums since 2012 as a stealthy way to spy on infected systems and siphon passwords. The arrest coincided with a seizure of the NetWire sales website by the U.S. Federal Bureau of Investigation (FBI). While the defendant in this case hasn’t yet been named publicly, the NetWire website has been leaking information about the likely true identity and location of its owne

Access 230
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

CHS to Notify 1 Million in Breach Linked to Software Flaw

Data Breach Today

Hospital Chain Faults Zero-Day Vulnerability in 3rd-Party File Transfer Software Community Health Systems will soon begin notifying up to 1 million individuals estimated to have been affected by data compromise when attackers exploited a zero-day vulnerability in vendor Fortra's GoAnywhere MFT, which is secure managed file transfer software.

Security 259
article thumbnail

IceFire Ransomware Portends a Broader Shift From Windows to Linux

Dark Reading

IceFire has changed up its OS target in recent cyberattacks, emblematic of ransomware actors increasingly targeting Linux enterprise networks, despite the extra work involved.

article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

SPAC Woes Continue With Hub Security's Sluggish Nasdaq Debut

Data Breach Today

Meager Product Sales, Limited Presence in Americas Among Red Flags for Hub Security The economic downturn has laid bare just how much of a disaster special purpose acquisition companies have been for the cyber industry. Despite this, confidential computing security vendor Hub decided to try its luck with a SPAC. So far, Hub's time on the Nasdaq Stock Exchange hasn't gone well.

Security 144

More Trending

article thumbnail

Breach Roundup: A Barcelona Hospital, AT&T and Hatch Bank

Data Breach Today

Plus, Chick-fil-A, Acer & the Online Insurance Marketplace Serving the US Congress Hackers disrupted medical care at a major Barcelona hospital, found out the wireless plans of 9 million AT&T users and stole data of almost 140,000 Hatch Bank customers. Patrons of Chick-fil-A got a nasty surprise. Plus, a breach hit Acer and another one affected members of the U.S.

Insurance 144
article thumbnail

IT Governance Podcast 2023-5: WH Smith, the Data Protection and Digital Information Bill, TikTok

IT Governance

This week, we discuss a data breach affecting WH Smith, the latest proposals to reform data protection law in the UK, TikTok’s response to being banned by the European Commission and European Parliament, and the proposed US RESTRICT Act, and a woman who has been sentenced for defrauding Luton Borough Council in a cyber attack. The post IT Governance Podcast 2023-5: WH Smith, the Data Protection and Digital Information Bill, TikTok appeared first on IT Governance UK Blog.

article thumbnail

Vendor Faces Lawsuit in Wake of an Apparent 'Royal' Attack

Data Breach Today

Software Firm's Data Exfiltration Health Data Breach Affected Nearly 251,000 A healthcare revenue cycle management software vendor is facing a proposed class action lawsuit in the aftermath of a December data exfiltration attack affecting nearly 251,000 patients. Ransomware group Royal took credit for the attack, allegedly leaking samples of the stolen data on its leak site.

article thumbnail

Critical RCE Bug Opens Fortinet's Secure Web Gateway to Takeover

Dark Reading

Users should patch an unauthenticated remote code execution bug impacting FortiOS and FortiProxy administrative interfaces ASAP, Fortinet says.

Security 110
article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

Cybersecurity Poised for Spending Boost in Biden Budget

Data Breach Today

White House Proposes Big Boost for CISA and Cybersecurity Aid for Ukraine An overview of the White House's spending blueprint for the coming federal fiscal year shows big proposed increases for cybersecurity. CISA would receive $145 million more that current amounts. Ukraine would receive hundreds of millions to counter "Russian malign influence" including in cyberspace.

article thumbnail

Phishing for Ring Customers

KnowBe4

INKY warns that a phishing campaign is targeting users of the Ring video security system. The scammers are sending brief phishing emails instructing recipients to click on the attached HTML file in order to update their membership. The file will open a webpage hosted locally on the victim’s machine, which helps the attackers avoid detection by security filters.

article thumbnail

Cryptohack Roundup: Tender.fi, Algodex

Data Breach Today

Also: Uranium Finance Hacker Moves Funds; BitKeep Moves to Refund Victims Every week, ISMG rounds up cybersecurity incidents in the world of digital assets. Between March 3 and March 9, Tender.fi paid a white hat reward to a thief, a Uranium Finance hacker began to launder stolen funds, Algodex revealed security breaches and BitKeep was working to reimburse hack victims.

article thumbnail

Akamai mitigated a record-breaking DDoS attack that peaked 900Gbps

Security Affairs

Akamai has mitigated the largest DDoS (distributed denial of service) attack ever, which peaked at 900.1 gigabits per second. Akamai reported that on February 23, 2023, at 10:22 UTC, it mitigated the largest DDoS attack ever. The attack traffic peaked at 900.1 gigabits per second and 158.2 million packets per second. The record-breaking DDoS was launched against a Prolexic customer in Asia-Pacific (APAC). “On February 23, 2023, at 10:22 UTC, Akamai mitigated the largest DDoS attack ever la

IT 96
article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

US Intelligence Ranks China as Top National Security Threat

Data Breach Today

Beijing Regularly Employs Cyber Operations and Economic Espionage, Assessment Warns The Chinese government's geopolitical ambitions and willingness to use cyber operations to achieve them pose one of the biggest threats to U.S. national security, the U.S. intelligence community warns. Russia, Iran and North Korea also pose major threats, as do cybercrime and especially ransomware.

Security 144
article thumbnail

BMW exposes data of clients in Italy, experts warn

Security Affairs

Cybernews researchers discovered that BMW exposed sensitive files that were generated by a framework that BMW Italy relies on. Original post at: [link] Hackers have been enjoying their fair share of the spotlight by breaching car manufacturers’ defenses. The latest Cybernews discovery showcases that popular car brands sometimes leave their doors open, as if inviting threat actors to feast on their client data.

article thumbnail

US Lawmakers Face Cyberattacks, Potential Physical Harm After DC Health Link Breach

Dark Reading

The threat actor who posted the data for sale has claimed credit for multiple other breaches, including one at grocery platform Weee! that exposed data on more than 1.1 million customers.

Sales 90
article thumbnail

Recently discovered IceFire Ransomware now also targets Linux systems

Security Affairs

The recently discovered Windows ransomware IceFire now also targets Linux enterprise networks in multiple sectors. SentinelLabs researchers discovered new Linux versions of the recently discovered IceFire ransomware that was employed in attacks against several media and entertainment organizations worldwide. The ransomware initially targeted only Windows-based systems, with a focus on technology companies.

article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

Iranian APT Targets Female Activists With Mahsa Amini Protest Lures

Dark Reading

A top Iranian, state-sponsored threat is a spear-phishing campaign that uses a fake Twitter persona to target women interested in Iranian political affairs and human rights.

article thumbnail

8220 Gang used new ScrubCrypt crypter in recent cryptojacking attacks

Security Affairs

A threat actor tracked as 8220 Gang has been spotted using a new crypter called ScrubCrypt in cryptojacking campaigns. Fortinet researchers observed the mining group 8220 Gang using a new crypter called ScrubCrypt in cryptojacking attacks. “Between January and February 2023, FortiGuard Labs observed a payload targeting an exploitable Oracle Weblogic Server in a specific URI.” reads the analysis published by Fortinet. “This payload extracts ScrubCrypt, which obfuscates and encry

Mining 91
article thumbnail

Proposed FCC Rule Redefines Data Breaches for Communications Carriers

Dark Reading

If the proposed rule is approved, organizations would need to disclose all data breaches, even one that does not cause any harm, to affected customers.

article thumbnail

Another Malware with Persistence

Schneier on Security

Here’s a piece of Chinese malware that infects SonicWall security appliances and survives firmware updates. On Thursday, security firm Mandiant published a report that said threat actors with a suspected nexus to China were engaged in a campaign to maintain long-term persistence by running malware on unpatched SonicWall SMA appliances. The campaign was notable for the ability of the malware to remain on the devices even after its firmware received new firmware. “The attackers put sig

article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

5 Critical Components of Effective ICS/OT Security

Dark Reading

These agile controls and processes can help critical infrastructure organizations build an ICS security program tailored to their own risk profile.

article thumbnail

Best Enterprise Vulnerability Scanning Vendors

eSecurity Planet

The largest businesses, government agencies, non-profit corporations, universities, and other similar sized organizations qualify as enterprises. These complex multi-location entities often deploy local networks, virtual computing environments, cloud infrastructure, and a variety of devices that classify into the internet of things (IoT) and operational technology (OT) categories.

Cloud 70
article thumbnail

Avast Introduces Avast One Platinum

Dark Reading

New premium service provides all-in-one personal protection beyond device security to include identity restoration and unlimited 24/7 tech support.

article thumbnail

Best 3 Cloud, Container and Data Lake Vulnerability Scanning Tools

eSecurity Planet

As organizations move to the cloud and implement virtualized infrastructure, IT and security teams need to scan those assets for vulnerabilities. This article will highlight three specialized tools that can be considered for any organization’s vulnerability scanning tool arsenal. AWS Vulnerability Scanning Tool: Amazon Inspector Cloud & Kubernetes Specialist – Wiz Data Lakes and Large-Scale Data Storage Vulnerabilities: IBM Guardium Vulnerability Assessment Additionally, this article w

Cloud 66
article thumbnail

Entity Resolution Checklist: What to Consider When Evaluating Options

Are you trying to decide which entity resolution capabilities you need? It can be confusing to determine which features are most important for your project. And sometimes key features are overlooked. Get the Entity Resolution Evaluation Checklist to make sure you’ve thought of everything to make your project a success! The list was created by Senzing’s team of leading entity resolution experts, based on their real-world experience.

article thumbnail

Medusa Gang Video Shows Minneapolis School District's Ransomed Data

Dark Reading

Much like a hostage's proof-of-life video, the ransomware gang offers the film as verification that it has the goods, and asks $1 million for the data.

article thumbnail

‘Pig Butchering’ Scams Are Now a $3 Billion Threat

WIRED Threat Level

The FBI’s latest Internet Crime Report highlights the stunning rise of investment-themed crimes over the past 18 months.

article thumbnail

AT&T Vendor Breach Exposes Data on 9M Wireless Accounts

Dark Reading

AT&T is notifying customers of a Customer Proprietary Network Information compromise, exposing years-old upgrade details.

79