Category: Data Breach

Massive Data Release on Internet

Collection #1 is a data set that was dumped onto the Internet. It contains 773 million email IDs and 21 million passwords and anybody can see the data.

Security researcher Troy Hunt runs the Have I Been Pwned website that lets people check if their email address has been in a data breach and he has analysed the data and uploaded it to his website haveibeenpwned.com so anyone can check if their details are included in this or any other high profile data breach. He does make the actual data available to anybody.

His analysis shows that Collection #1 is a set of email addresses and passwords totalling 2,692,818,238 rows. It’s made up of many different individual data breaches from literally thousands of different sources”

After cleaning the data and removing duplicates, it seems that 772,904,991 unique email addresses, along with 21,222,975 unique passwords are available in plain text. This does not include passwords that were found still in their hashed form.

Importantly, anyone who gets their hands on the cache can easily test the plain-text passwords against actual accounts. Approximately 140 million email accounts and some 10.6 million passwords were not known from past breaches.

If one or more of your accounts are in this data breach, then it is likely that one or more of your old passwords are available for others to see. Make sure you are not still using passwords from years ago.

Check if your accounts are included in the breach and if necessary change passwords and delete unnecessary accounts.

Do enter your email address and click on the subscribe button on top right to keep up to date with new posts.

Fightback Ninja Signature

Morrison’s to Pay Staff after Data Breach

In 2014, the personal details of thousands of Morrison’s staff including salaries, bank account details and home addresses were stolen and published online.

At the time, Morrisons said that all the staff details published were put on an unspecified location on the web for a few hours and were taken down immediately when they were discovered. It said in a statement: “We can confirm there has been no loss of customer data and no colleague will be left financially disadvantaged.” It was working with police to identify the source of the theft.

The hacker posted the information – including names, addresses, bank account details and salaries – online and sent it to newspapers.

It turned out that it was an employee, Andrew Skelton, who had posted the data online. He was caught and jailed for eight years in 2015 after being found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data.

However, Morrisons faced a huge payout to staff whose personal data were posted on the Internet after workers brought a claim against the company for “upset and distress”.

The High Court ruling that Morrisons is liable for the data breach then the Court of Appeal upheld the original decision against the supermarket. Morrisons said it would now appeal to the Supreme Court.

This case is the first data leak class action in the UK.

Morrisons had argued that it could not be held liable for the criminal misuse of its data, but three Court of Appeal judges rejected the company’s appeal, saying they agreed with the High Court’s earlier decision.

They said Morrisons was “vicariously liable for the offences committed by Mr Skelton against the claimants”.

Skelton was given eight years in prison for fraud, securing unauthorised access to computer material and disclosing personal data at a criminal trial in 2015.

The case continues.

If you have any experiences with scammers, spammers or time-waster do let me know, by email.

Fightback Ninja Signature

Marriot Hotels Data Breach

The personal information of Marriot Hotel group customers has been hacked. This started in 2014 and has only just been found out.

It may affect up to 500 million people. The company do not yet know the exact number but they have started to email all those thought to have been affected.

Marriot is providing all US, Canadian and British customers with free use of the WebWatcher internet security service which can monitor your Internet devices.

The data stolen includes name, address, phone number, email address, passport number, date of birth, hotel stay information and possibly more. It also includes financial information for some customers.

This is an extremely serious data breach and may lead to financial theft and identity theft.

Law enforcement agencies are investigating what happened but it may time for the picture to become clear.

Many hackers use a long slow approach to siphoning out data from a company and it can very difficult to determine exactly what they took.

If your data has been stolen then you will be contacted by Marriot.

However, scammers will also send out fake messages claiming to from Marriot about the data breach so if you have been a Marriot customer since 2014 then be careful with any messages or calls you receive.

What Can You Do?

  1. Check the website setup by Marriot about this at answers.kroll.co.uk
  2. You can call their support line on 0808 189 1065 if concerned
  3. Check your payment card transactions regularly and look for anything out of the ordinary
  4. If your login and password have been used on other accounts then consider changing them

If you have had any problems with your data being compromised – do let me know by email.

Fightback Ninja Signature

Google and Google+

Google has said that it found a software glitch in its Google+ social network in March 2018 that could have exposed the personal data of as many as half a million users, but decided not to tell the public until months later.

Google found the flaw in March during an extensive privacy and security review according to Ben Smith, Google vice president of engineering. An internal committee decided not to disclose the potential breach of Google+ because there wasn’t evidence of any misuse of the exposed data, which included names, email addresses, ages and occupations. The bug was immediately fixed at the time, he said.

The Federal Trade Commission, as the nation’s chief privacy watchdog, has the authority to investigate data breaches. The FTC can fine companies when they violate terms of a consent decree.

Google has said it plans to shut down Google+ for consumers (but leave it running for businesses) and introduce new privacy tools restricting how developers can use information on products ranging from email to file storage.

Google+ was never anywhere near as successful as Facebook and social media networks. Even so, many users still have a profile that has personal information on it. Google will shut it down over the coming months for consumers, but keep the version built for businesses open and operating.

The other changes Google is making include requiring apps to ask separately for each type of information they want from a user, such as access to calendars or address books. On Gmail, Google’s ubiquitous email service, only apps that improve email functionality will be allowed to request access.

Do leave a comment on this post – click on the post title then scroll down to leave your comment.

Fightback Ninja Signature

Tesco Bank Fined for Data Breach

Tesco Bank was fined £16.4m by the City watchdog over a cyber-attack it suffered that netted cyber criminals £2.26m.

The Financial Conduct Authority (FCA) said deficiencies at the bank had left account holders vulnerable to the incident. The bank had received a specific warning that was not properly addressed until the attack had started and the response was “too little, too late”.

This is the first time the FCA has issued a fine for a cyber-related incident.

Tesco Bank said that since the incident in November 2016 it had “significantly enhanced” security measures, and apologised to customers.

Mark Steward, executive director of enforcement and market oversight at the FCA, said the fine “reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks”. Banks must ensure resilience against such crime reducing the risk of a cyber attack occurring in the first place, not only reacting to an attack.

Tesco Bank said the cyber attack in 2016 did not involve the theft or loss of any customers’ data but led to 34 transactions where funds were debited from customers’ accounts, and other customers having normal service disrupted.

The bank’s chief executive Gerry Mallon said: “We are very sorry for the impact that this fraud attack had on our customers.”

Banks and other financial institutions must learn that it’s cheaper to build proper protection that wait for a catastrophe to happen.

Do leave a comment on this post – click on the post title then scroll down to leave your comment.

Fightback Ninja Signature