It's been discovered that a marketing company left almost two terabytes of sensitive data exposed on the internet for anybody to access. And what was inside that massive haul of data? The detailed personal information of 230 million consumers and 110 million business contacts - including phone numbers, addresses, dates of birth, estimated income,...

An American restaurant chain revealed it suffered a data breach affecting customers' payment card details at most of its locations. On 22 June, PDQ issued a statement explaining that a malicious attacker obtained unauthorized access to its computer system and acquired the names, credit card numbers,...

A recent report from the office of the U.S. Department of the Interior’s Inspector General indicates that several hydropower dams are vulnerable to internal threats. Specifically, an evaluation was conducted of five hydropower dams operated by the U.S. Bureau of Reclamation (USBR) and categorized as “critical infrastructure.” The USBR is the second...

A Japanese hotel chain company notified approximately 125,000 guests about a data breach that affected one of its software providers. On 26 June, Prince Hotels & Resorts published a statement on its website explaining that its reservations system in English, Simplified Chinese, Traditional Chinese...

Many organizations choose to filter web content in order to boost their employees’ productivity and protect themselves against security threats. But this practice begs two questions. First, to what online services/web sites do organizations commonly restrict access and why? Second, how effective is this practice in defending organizations against...

Healthcare organizations continue to face relentless cyberattacks owing to the immense value placed on patient health information on the dark web. Patient records have almost everything the attacker needs to carry out sophisticated insurance fraud schemes, purchase medical supplies or drugs, or commit other types of fraud including outright identity...

The Office of the Australian Information Commissioner (OAIC) received instructions to investigate HealthEngine's practice of sharing clients' personal information with lawyers. According to the Australian Broadcasting Corporation (ABC), a spokesperson for Australia's health minister Gregory Andrew Hunt confirmed that that OAIC and the Australian...

As I noted in a previous article, the build environment is a key area on which organizations should focus their container security efforts. Companies don’t usually think of the build environment when it comes to securing their containers. But it’s critical that they do. Attackers can exploit development practices like Continuous Integration (CI) and...

Computer security experts have discovered an unusual attack targeting users of Android devices. As researchers Yonathan Klijnsma and Aaron Inness explain on the RIskIQ blog, the attack starts with a relatively pedestrian fake warning message that popped-up on some Android users' devices as they browsed the web. The warning message is customized to...

A new variant of the SamSam ransomware family requires direct involvement from attackers in order to execute its malware payload. Uncovered by Malwarebytes, new versions of SamSam require attackers to execute a batch file that's responsible for loading up a .NET runner. They do so by manually entering a password as the file's command-line parameter...

The State of Security's countdown of the FBI’s 10 most-wanted black-hat hackers is nearly over. Just two criminals remain. At number two is Evgeniy Mikhailovich Bogachev, the leader of a cybercrime ring responsible for writing and promulgating Gameover Zeus. On 22 August 2012, a federal grand jury in Nebraska indicted Bogachev on several charges,...

In the midst of some of the most interesting times in geopolitical history, Tripwire wanted to see how the infosec community is currently feeling about nation-state attacks. It thus decided to conduct a survey while at Infosecurity Europe 2018 in London. Specifically, Tripwire surveyed 416 attendees to see what the future of nation-state attacks...

Welcome to the second installment of #TripwireBookClub, where we look at Serious Cryptography, published by No Starch Press. This was a book I was interested in because I don’t spend a lot of time digging into crypto these days, and the book seemed like a good dive into the topic. Serious Cryptography: A Practical Introduction to Modern Encryption...

A South Korean cryptocurrency exchange suffered a heist in which thieves made off with approximately $32 million in stolen assets. On 20 June, Bithumb disclosed the hack in a statement published to its website: We noticed that between last night and today early morning, about 35,000,000,000 KRW worth cryptocurrencies have been stolen. However, this...

GDPR has been in effect since May 25th, 2018. The purpose of the regulation is twofold: to enhance the privacy of an EU citizen’s related information and to strengthen the powers of the data protection institutions and regulators to act against any organization breaches the new rules. But is GDPR alone the panacea for fighting cybercrime and data...

Last time, I had the opportunity of speaking with Avi. Avi’s not a woman, but they’re a badass hacker with a natural intuition for cybersecurity that has been put to excellent use. This time, I had the pleasure of speaking with Susan Ballestero. She has unique experience with working in a security operations center and being an information security...

A disgruntled employee at Tesla has caused “extensive and damaging sabotage,” according to the company’s CEO Elon Musk. In an email sent to employees late Sunday night, Musk revealed an employee had broken into the company’s computer systems in an effort to disrupt operations. The message, as first reported by CNBC, stated the employee made direct...

A cancer center received an order to pay $4.3 million in a settlement for HIPAA violations that involved multiple data breaches. (Source: Houston Chronicle) On 18 June, the United States Department of Health and Human Services (HHS) announced in a press release that one of its Administrative Law...

Industrial control systems (ICS) first proliferated at a time when cybersecurity didn’t weigh heavily on organizations’ minds. Since then, there have been two significant developments in the industry. First, cybersecurity has become a mission-critical concern for businesses everywhere. Second, there’s been a shift to new network technologies that...

The commoditization of personal data in recent years has created huge opportunities for anyone with the skills to collect, catalogue and correlate every aspect of our lives. For many years now, there has been a war between browser vendors and unscrupulous advertisers looking for tricks to uniquely identify users and track their movements across...