Cosmetics giant Yves Rocher is warning that a major data leak exposed the personal data of millions of its customers and sensitive internal company information to the public. The data exposure stems from a database left unprotected by a third-party consultant to the firm. Researchers with vpnMentor on Monday said that they discovered an unprotected Elasticsearch server owned by Aliznet, which provides consulting services to large firms including IBM, Salesforce, Sephora and Louboutin.
ISBuzz Team
Scammers are mimicking new security measures designed to keep you safe online, by sending fake emails that attempt to steal your banking credentials and personal data. Banks, card providers and retailers across the EU are asking customers to provide up-to-date contact information, as part of new checks for online card payments known as strong customer authentication (SCA), Which? reported.
It has been reported that a database containing sensitive information of about 90,000 German Mastercard “Priceless Specials” loyalty program members shared online following a breach discovered on August 20 was added to data breach site Have I Been Pwned on September 1. MasterCard has notified German and Belgium regulators of a data breach affecting customers of its ‘Priceless Specials’ loyalty programme after discovering it on the 19 August. The Belgian Data Protection Authority stated that customer data from the loyalty programme had appeared on the internet for “a certain period of time”.
Security professionals are quick to laud Two-Factor Authentication (or 2FA) and think their organization is protected from common schemes like credential stealing or login theft just by having it in place. But 2FA can be intercepted by hackers in multiple ways and fail to protect against numerous other types of phishing threats including scareware, social engineering scams, rogue software, and phishing exploits via weaponized documents. While this two-step security approach is certainly something that any cybersecurity expert would advocate, it merely makes more determined cybercriminals employ a sophisticated two-step phishing attack to outwit it – one site to capture usernames…
Dehashed login details for customers of Poshmark, an online marketplace for buying and selling used clothes and accessories, have been circulating online following the data breach a few months ago. At the beginning of the year, Poshmark announced that it had 40 million community members. According to data breach platform Have I Been Pwned, login details of more than 36 million customers were acquired by an unauthorized party. The data includes email addresses, hashed passwords, gender, geographic location, names, and usernames.
Phishers behind a new campaign have switched to using compromised SharePoint sites and OneNote documents to redirect potential victims from the banking sector to their landing pages. The attackers take advantage of the fact that the domains used by Microsoft’s SharePoint web-based collaborative platform are almost always overlooked by secure email gateways which allows their phishing messages to regularly reach their targets’ inboxes The emails sent as part of this new phishing campaign are delivered from compromised accounts and will ask the targets to review a legal assessors proposal via an URL embedded within the message This URL links to an…
Mobile phone train apps used in major cities in Britain could be manipulated to create free tickets and defraud operators, it has emerged, after activists hacked two public transport apps. The hackers, who claimed they were campaigning for public transport to be free, said they were able to use the First Bus app and Manchester’s Metrolink app, called “get me there”, to create tickets free of charge. The apps create QR codes that function as virtual tickets when a user pays for a fare and can be scanned, similar to barcodes. https://twitter.com/TelegraphTech/status/1168917604033028100
Scammers leveraged artificial intelligence software to mimic the voice of a chief executive and successfully request $243,000. As part of an incident in March, an attacker called the CEO of a UK-based energy business pretending to be the head of its German parent company. Analysts believe AI-based software was used to impersonate the chief executive’s voice The caller issued an “urgent” request to the CEO, demanding he transfer $243,000 to a Hungarian supplier within an hour’s time The transfer went through and the money was later moved to other countries https://twitter.com/AlyssaM_InfoSec/status/1169082778325065729
On Friday afternoon Jack Dorsey’s Twitter account was hacked – later identified as a SIM swap attack. With this type of fraud a hacker either convinces or bribes a carrier employee to switch the number associated with a SIM card to another device, at which point they can intercept any two-factor authentication codes sent by text message. Clearly everyone, even Twitter’s very own CEO is at risk of SIM swap fraud. And it’s a growing problem. In January this year, the City of London Police’s ActionFraud division showed a 63% rise in victims reporting the crime in 2017 compared to…
It has been reported that a coin-mining malware infection previously only seen on Arm-powered IoT devices has made the jump to Intel systems. Akamai senior security researcher Larry Cashdollar says one of his honeypot systems recently turned up what appears to be an IoT malware that targets Intel machines running Linux. It is fine-tuned for intel processors by establishing a SSH (port 22) connection and deliver it as a gzip archive. It creates three different directories with different versions of the same files. Each directory contains a variation of the XMrig v2.14.1 cryptocurrency miner in either x86 32bit or 64bit format and some of the binaries…