Tag: data breach

Protect Your Online Identity after A Data Breach

If you are informed that your personal information has been compromised by a data breach at an organisation you have an account with then you need to take steps to protect your online identity quickly.

The message from that business will normally explain what data has been compromised and will make recommendations on what you should do. These may include:-

  • Change your password with that organisation immediately and make sure it is a strong password. (see https://fightback.ninja/how-to-keep-your-passwords-safe/ for further information on strong passwords)
  • Alternatively, you may not trust that organisation again and choose to delete your account with them.
  • Review any other accounts at other places that use the same password – change them also immediately.
  • Again, if you find accounts you can do without – then delete them.
  • Monitor your bank and other financial accounts regularly and contact the relevant institution if you spot anything suspect.
  • Review your online security generally
    • Strong passwords
    • Only keep necessary accounts
    • Do not use shared passwords if possible
    • Monitor all financial transactions
  • Consider taking out an identity protection service. There are various types of these available so choose carefully which suits your needs the best

Do Share this post on social media – click on the post title then scroll down to the social media share buttons.

Fightback Ninja Signature

Dixons Fined for Data Breach

Dixons Carphone has been fined £500,000 by the data watchdog over a computer hack which compromised the personal information of at least 14 million people.

The Information Commissioner’s Office found that hackers were able to access the names, postcodes, email addresses and failed credit checks of millions of people.

The data also included the details of 5.6 million payment cards used between July 2017 and April 2018.

Dixons Carphone says it has no confirmed evidence of any customers suffering fraud or financial loss as a result of the hack.

What Should Business Do to Protect Itself?

  1. Invest in expert cyber security and keep it up to date
  2. Maintain all computer devices with anti-virus and anti-malware and keep that up to date
  3. Regularly check all financial accounts. If you spot anything unusual, contact your provider immediately.
  4. Train staff on security procedures e.g. how to spot phishing attempts
  5. Stay up to date with protection against latest threats
  6. Remember that human beings are usually the weakest link in security.

Do enter your email address and click on the subscribe button on top right to keep up to date with new posts.

Fightback Ninja Signature

Protection Against Data Breaches

Company data breaches can cause a lot of damage – financial and otherwise to customers and to the reputation of the business. Some companies never recover from a large scale data breach, so it is vitally important to protect your business against the possibility.

Data breaches happen through targeted attacks, theft, or even by accident.

Typically, a hacker gains access to an organisation’s private network and then can steal information on staff, customers and suppliers or research in progress, product data etc.

These attacks can be quick or take a lot of preparation and may take months or even longer to detect or in some cases are never detected.

How to Protect Against Data Breaches

  • Take all cyber security steps necessary – preferably with a qualified expert in charge
  • Insist on strong passwords across the organisation as weak passwords are the easiest way for hackers to gain entry to the systems.
  • Staff training. All staff who use the computers need to know how to recognise phishing attempts by email and by phone.
  • Robust security procedures can reduce the likelihood of human error or oversight.
  • Up to date security systems and updates – unpatched software leaves an open door to hackers.
  • Hackers sometimes gain access to larger company systems by first targeting smaller companies that are supplier to the larger company. Take precautions.
  • Frequent reviews of all security processes and systems is essential as new flaws turn up every day.

Do enter your email address and click on the subscribe button on top right to keep up to date with new posts.

Fightback Ninja Signature

 

Massive Data Release on Internet

Collection #1 is a data set that was dumped onto the Internet. It contains 773 million email IDs and 21 million passwords and anybody can see the data.

Security researcher Troy Hunt runs the Have I Been Pwned website that lets people check if their email address has been in a data breach and he has analysed the data and uploaded it to his website haveibeenpwned.com so anyone can check if their details are included in this or any other high profile data breach. He does make the actual data available to anybody.

His analysis shows that Collection #1 is a set of email addresses and passwords totalling 2,692,818,238 rows. It’s made up of many different individual data breaches from literally thousands of different sources”

After cleaning the data and removing duplicates, it seems that 772,904,991 unique email addresses, along with 21,222,975 unique passwords are available in plain text. This does not include passwords that were found still in their hashed form.

Importantly, anyone who gets their hands on the cache can easily test the plain-text passwords against actual accounts. Approximately 140 million email accounts and some 10.6 million passwords were not known from past breaches.

If one or more of your accounts are in this data breach, then it is likely that one or more of your old passwords are available for others to see. Make sure you are not still using passwords from years ago.

Check if your accounts are included in the breach and if necessary change passwords and delete unnecessary accounts.

Do enter your email address and click on the subscribe button on top right to keep up to date with new posts.

Fightback Ninja Signature

Morrison’s to Pay Staff after Data Breach

In 2014, the personal details of thousands of Morrison’s staff including salaries, bank account details and home addresses were stolen and published online.

At the time, Morrisons said that all the staff details published were put on an unspecified location on the web for a few hours and were taken down immediately when they were discovered. It said in a statement: “We can confirm there has been no loss of customer data and no colleague will be left financially disadvantaged.” It was working with police to identify the source of the theft.

The hacker posted the information – including names, addresses, bank account details and salaries – online and sent it to newspapers.

It turned out that it was an employee, Andrew Skelton, who had posted the data online. He was caught and jailed for eight years in 2015 after being found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data.

However, Morrisons faced a huge payout to staff whose personal data were posted on the Internet after workers brought a claim against the company for “upset and distress”.

The High Court ruling that Morrisons is liable for the data breach then the Court of Appeal upheld the original decision against the supermarket. Morrisons said it would now appeal to the Supreme Court.

This case is the first data leak class action in the UK.

Morrisons had argued that it could not be held liable for the criminal misuse of its data, but three Court of Appeal judges rejected the company’s appeal, saying they agreed with the High Court’s earlier decision.

They said Morrisons was “vicariously liable for the offences committed by Mr Skelton against the claimants”.

Skelton was given eight years in prison for fraud, securing unauthorised access to computer material and disclosing personal data at a criminal trial in 2015.

The case continues.

If you have any experiences with scammers, spammers or time-waster do let me know, by email.

Fightback Ninja Signature

Tesco Bank Fined for Data Breach

Tesco Bank was fined £16.4m by the City watchdog over a cyber-attack it suffered that netted cyber criminals £2.26m.

The Financial Conduct Authority (FCA) said deficiencies at the bank had left account holders vulnerable to the incident. The bank had received a specific warning that was not properly addressed until the attack had started and the response was “too little, too late”.

This is the first time the FCA has issued a fine for a cyber-related incident.

Tesco Bank said that since the incident in November 2016 it had “significantly enhanced” security measures, and apologised to customers.

Mark Steward, executive director of enforcement and market oversight at the FCA, said the fine “reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks”. Banks must ensure resilience against such crime reducing the risk of a cyber attack occurring in the first place, not only reacting to an attack.

Tesco Bank said the cyber attack in 2016 did not involve the theft or loss of any customers’ data but led to 34 transactions where funds were debited from customers’ accounts, and other customers having normal service disrupted.

The bank’s chief executive Gerry Mallon said: “We are very sorry for the impact that this fraud attack had on our customers.”

Banks and other financial institutions must learn that it’s cheaper to build proper protection that wait for a catastrophe to happen.

Do leave a comment on this post – click on the post title then scroll down to leave your comment.

Fightback Ninja Signature