U.S. officials are investigating an incident at a Pennsylvania water utility after hackers linked to Iran's Islamic Revolutionary Guard Corps - who have a history of making exaggerated and false claims about their hacking exploits - breached a device at a remote water station. The hackers, who call themselves the "Cyber Av3ngers," were able to gain control of at least one device at the Municipal Water Authority of Aliquippa, Pa. READ MORE...
The New York State Department of Financial Services reached a $1 million settlement with First American Title Insurance Co. for violations stemming from a 2019 data leak. The May 2019 breach exposed 885 million documents of non-public customer data due to a vulnerability in the company's proprietary EaglePro application, the state agency said. The documents dated back to 2003. READ MORE...
Okta's investigation into the breach of its Help Center environment last month revealed that the hackers obtained data belonging to all customer support system users. The company notes that the threat actor also accessed additional reports and support cases with contact information for all contact information of all Okta certified users. At the beginning of November, the company disclosed that a threat actor had gained unauthorized access to files inside its customer support system. READ MORE...
One of the cybercrime underground's more active sellers of Social Security numbers, background and credit reports has been pulling data from hacked accounts at the U.S. consumer data broker USinfoSearch, KrebsOnSecurity has learned. Since at least February 2023, a service advertised on Telegram called USiSLookups has operated an automated bot that allows anyone to look up the SSN or background report on virtually any American. READ MORE...
The LockBit 3.0 ransomware group successfully encrypted files and also allegedly exfiltrated data from Egyptian e-payment provider Fawry. Word of the breach went public when LockBit published on its dedicated leak site on Nov. 8 a sample of data that was allegedly stolen during the breach of Fawry's infrastructure. The following day, cybersecurity monitoring platform Hackmanac claimed that the LockBit 3.0 ransomware attack had extracted the personal details of Fawry customers. READ MORE...
Google has released an urgent security update to fix a number of vulnerabilities in Chrome browser, including a zero-day vulnerability (CVE-2023-6345) that is being actively exploited in the wild. CVE-2023-6345, reported by Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group, is due to an integer overflow in Skia - an open source 2D graphics library commonly used as a graphics engine for Google Chrome, ChromeOS, Android, Flutter, and others. READ MORE...
Slovenian power generation company Holding Slovenske Elektrarne (HSE) has been hit by ransomware and has had some of its data encrypted. HSE is a state-owned company that controls numerous hydroelectric, thermal and coal-fired power plants. The company has declined to share any details about the cyber intrusion, but has confirmed that operation of its power plants has not been affected. READ MORE...
The Qilin ransomware group has claimed responsibility for a cyber attack on Yanfeng Automotive Interiors (Yanfeng), one of the world's largest automotive parts suppliers. Yanfeng is a Chinese automotive parts developer and manufacturer focused on interior components and employs over 57,000 people in 240 locations worldwide. It sells interior components to General Motors, the Volkswagen Group, Ford, etc. The company constitutes a crucial part of the supply chain for these automakers. READ MORE...
Did Google Drive lose some people's data? That's the question swirling around the Internet right now as Google announces it's investigating "sync issues" for Google Drive for desktop. On Monday The Register spotted a trending post on the Google Drive forums where a user claimed that months of Drive data suddenly disappeared, and their files went back to a state from May 2023. READ MORE...
A Plex "feature" has infuriated some users after sharing with others what they are watching on the streaming service - and it appears this functionality is on by default. At the start of this month Plex rolled out something called Discover Together, with an "Activity" feature that shows "what you and your friends are watching, rating, and saving to your Watchlists." Crucially, this functionality, which is enabled until you switch it off, sends a weekly email to your friends detailing what you have been watching on your server, and vice-versa. READ MORE...