Tag Archives: Data Breach

Posted on Author Atlantic Computer Services Categories Blog

Home Chef Company Data Breach Affected 8 Million Customers

Are you a Home Chef customer? If so, be advised that the company recently announced a data breach.

It was discovered after the hackers who broke in sold more than 8 million user records on the Dark Web.

The group, calling themselves “The Shiny Hunters” has been busy of late.

They’ve been selling databases containing records stolen from a total of eleven different companies, with prices ranging from $500 to $2500 per database.

Home Chef was made aware that the database containing their customers’ information was available for sale nearly two weeks ago. However, the company waited an inordinate amount of time before coming forward and publicly announcing the breach, a delay which has cost them in the eyes of their customers.

Part of the company’s notice on their website reads, in part, as follows:

“Protection of customer data is a top priority for Home Chef and we work hard to safeguard our customers’ information. We recently learned of a data security incident impacting select customer information.”

The FAQ accompanying the notification goes on to outline that the stolen data includes the following information. It included the customer names, email addresses, phone numbers, the last four digits of any credit card numbers on file, encrypted passwords, and a variety of other general profile information.

Home Chef stressed that only the last four digits of a customer’s card was accessed, and reiterated that they don’t store complete payment information in their databases.

That’s all well and good, but the company is finding it hard to convincingly sell the idea that protection of customer data is a top priority. After all, they waited two weeks to inform their customers that their information was for sale on the Dark Web. That is why, despite the fact that this breach is relatively small compared to others we’ve seen over the past twelve months, the company is taking flak for it.

In any event, if you’re a Home Chef customer, be sure to head to their website and see if yours was one of the accounts accessed. Even if it wasn’t, the prudent course of action would be to change your password at the very least.

0
Posted on Author Atlantic Computer Services Categories Blog

Hackers Are Demanding Extra Ransomware Payments From Victims

Hackers who use ransomware to conduct their attacks have a new trick up their sleeves. A ransomware family has begun employing the tactic of not only demanding payment to unlock infected systems, but also demanding an additional payment.

They’re demanding an extra payment to keep them from publishing copies of the files they stole before encrypting everything.

Hackers have been making the claim for years that they were doing more than just encrypting files, but actually exfiltrating data too. It wasn’t until recently, though (November 2019) that a group actually published stolen data as proof that this was, in fact, occurring.

Although this tactic is only currently in use by a hackers deploying the Ako Ransomware, you can bet that the idea will spread like wildfire. After all, there’s no real downside as far as the hackers are concerned, and they can coax a bit more money out of the companies, individuals, and organizations they successfully attack.

Bleeping Computers recently interviewed an Ako operator, who confirmed that the tactic was in use and had been successful. The operator said that the tactic was only used on certain victims, depending on the size of the company and the type of data that was stolen. They were very upfront and matter of fact about it.

This underscores two important points:

First, ransomware attacks are data breaches. The hackers aren’t just encrypting your files, they’re making off with copies too.

Second, backups are incredibly important! Having up to date backups won’t prevent a hacker who successfully breaches your system from releasing the data they stole if you don’t pay. At the very least, however, you can get your company up and running again in short order without having to pay to have your files decrypted. Sadly, too many companies still don’t have a robust backup plan in place. If that describes your company, it’s well past time to change that.

The risks are tremendous, and they are growing.

0
Posted on Author Atlantic Computer Services Categories Blog

Over 5 Million Marriott Customers Vulnerable In Latest Data Breach

Are you a frequent guest at Marriott hotels?

If so, be advised that the company has recently reported a massive data breach that could impact up to 5.2 million guests who have stayed at the hotel.

According to the official statement the company released regarding the matter:

“At the end of February 2020, we noticed that an unexpected amount of guest information may have been accessed using the login credentials of two employees at a franchise property.

We believe this activity started in mid-January 2020. Upon discovery, we immediately ensured the login credentials were disabled, began an investigation, implemented heightened monitoring and arranged resources to inform and assist guests.”

Based on the evidence gathered over the course of the company’s investigation so far, they believe that the information exposed includes details like:

  • Contact information, including phone numbers, email addresses, customer names and mailing addresses
  • Loyalty account information, including account numbers and point balances but not passwords
  • Other personal details including company affiliation, gender and date of birth
  • Partnerships and affiliations, including linked airline loyalty programs and numbers
  • Room and language preferences

As part of their response to the incident, Marriott is offering guests whose information was compromised the option to enroll in the IdentityWorks personal information monitoring service for 1 year, free of charge.

Sadly, this is not the first time in the company’s recent history when something like this has happened. In November 2018, the company announced a massive breach in its Starwood Hotels guest reservation database that resulted in more than 339 million guest records being compromised.

By comparison, this is a much smaller incident, but is still large enough to be troubling. If you’ve stayed at a Marriott hotel at any point over the last few years, be aware that your information may have been compromised. Head to the company’s self help portal on their website to verify whether or not you are at risk.

0
Posted on Author Atlantic Computer Services Categories Blog

Financial Institution Worker Put User Information At Risk

Noam Rotem, a researcher for vpnMentor, recently made a startling discovery. A database connected to a now defunct app called MCA Wizard was found unsecured on the web. It contained a staggering 425 GB of sensitive corporate financial data.

The app, developed via a partnership between Argus Capital Funding and Advantage Capital Funding, is no longer available on the Apple or Google Play stores.

When it was available for download, however, it served as an MCA (Merchant Cast Advance), designed to provide businesses with short term loans based on their projected credit card-based sales.

The database contained more than half a million highly sensitive documents originating from Argus and Advantage and belong to a wide range of the clients of the two companies. Among other things, the documents include bank statements, credit reports, copies of driver’s licenses, tax returns, social security information, and much more.

In recent years, vpnMentor’s mapping project has unearthed several databases similar to the one most recently discovered, but none have been quite so large or potentially damaging. The company attempted to reach out to both Argus and Advantage, but the emails they sent to inform the companies about the database bounced back as undeliverable.

Some days after making the attempt to contact the two companies, the database was pulled offline, so clearly someone was watching. Although to date, all attempts to contact the two companies has failed.

While it’s fantastic news that the database is now offline, the sensitive nature of the files it contained could have ruinous consequences for the businesses and individuals identified in those documents. There’s more than enough details in the files to allow hackers to steal the identities of thousands of wealthy individuals and forge credentials in the name of hundreds of legitimate businesses.

Kudos to Noam Rotem and the folks at vpnMentor. If you do, or have done business with Argus or Advantage, know that some of your company’s sensitive information may have been compromised.

0
Posted on Author Atlantic Computer Services Categories Blog

T-Mobile Is The Latest To Get Hit By Data Breach

Are you a T-Mobile customer? If so, be advised, the company recently published a Notice of Data Breach on their website to inform all clients that an email vendor they utilize was hacked. The notice said that the hack exposed the financial and personal information of a small fraction of the company’s customers.

In addition to posting the notice on their website, the company has also begun sending text messages to all impacted customers. Users who had their financial information exposed are directed to a link that includes the following information:

“The personal information accessed could include names and addresses, Social Security numbers, financial account information and government identification numbers, as well as phone numbers, billing and account information, and rate plans and features.”

Users whose financial information was not exposed are directed via text message to a different page that bears the message:

“The information accessed may have included customer names and addresses, phone numbers, account numbers, rate plans and features and billing information. Your financial information (including credit card information) and Social Security number were not impacted.”

If your financial information was impacted, you should have already received a free two-year subscription to the myTrueIdentity online credit monitoring service. Those whose financial information was not exposed are not being offered anything.

Although nothing about the T-Mobile notification indicates that passwords were impacted, if you received a notification from the company, just to be safe, it would be an excellent idea to reset your password.

This is a good time to issue a general reminder that one of the most common and persistent problems people have in the online world stems from the tendency to use the same password across multiple websites. If that’s something you’re still in the habit of doing, this is an excellent time to consider a different approach.

0
1 … 15 16 17 18 19