Fintech companies Wise and Affirm have revealed that the recent data breach suffered by Evolve Bank impacts some of their customers. The notorious ransomware group LockBit recently threatened to leak data allegedly stolen from the US Federal Reserve. The cybercriminals did leak data on June 26, but it turned out that the files actually originated from an Arkansas-based financial organization, Evolve Bank & Trust. READ MORE...
In February 2024, Prudential Financial reported it had fallen victim to a ransomware attack. The attack was discovered one day after it started, but not before some 2.5 million people had been impacted by the resulting data breach. At first, Prudential said it believed only 36,000 people had had their data stolen, but that number has now been revised to 2.5 million in a new breach notification. The company has also adjusted what information has stolen. READ MORE...
The Australian Federal Police (AFP) have charged a man for setting up fake free WiFi access points in order to steal personal data from people. The crime was discovered when an airline reported a suspicious WiFi network identified by its employees during a domestic flight. When the alleged perpetrator landed at Perth airport, his bags were searched and authorities found a portable wireless access device, a laptop, and a mobile phone in his hand luggage. READ MORE...
As one of today's most popular social media platforms, YouTube is often in the crosshairs of cybercriminals who exploit it to peddle scams and distribute malware. The lures run the gamut, but often involve videos posing as tutorials about popular software or ads for crypto giveaways. In other scenarios, fraudsters embed links to malicious websites in video descriptions or comments, disguising them as genuine resources related to the video's content. READ MORE...
Cisco has patched a command-line injection flaw in a network management platform used to manage switches in data centers, which, according to researchers from Sygnia, already has been exploited by the China-backed threat group known as Velvet Ant. The bug (CVE-2024-20399, CVSS 6.0) can allow authenticated attackers to execute arbitrary command as root on the underlying operating system of an affected device. READ MORE...
As the volume of digital business rises year over year, the potential for AI-enhanced digital fraud increases with it, according to TeleSign. A new TeleSign report highlights consumer concerns and uncertainty about how AI is being deployed, particularly regarding digital privacy, and emphasizes the need for ethical AI and ML use to combat fraud, hacking, and misinformation (aka "AI for good"). READ MORE...
The most devastating security failures often are the ones that we can't imagine - until they happen. Prior to 9/11, national security and law enforcement planners assumed airline hijackers would land the planes in search of a negotiated settlement - until they didn't. Before Stuxnet, control systems engineers assumed air-gapped systems could operate unmolested - until a virus was planted. READ MORE...
At least 700,000 OpenSSH servers are at risk of exploit from a remote code execution vulnerability, CVE-2024-6387, Qualys said Monday. Researchers at Qualys, which discovered the vulnerability, dubbed it "regreSSHion." Though Qualys researchers have not yet scored the CVE, they describe it as critical, presenting a significant security risk. The signal handler race condition in OpenSSH's server allows unauthenticated remote code execution as root on glibc-based Linux systems. READ MORE...