Equifax recently reported that it has removed 3rd-party code from its credit report assistance Web site that prompted visitors to download spyware disguised as an update for Adobe’s Flash Player software.
On Wednesday, security expert and blogger Randy Abrams documented how browsing a page at Equifax’s consumer information services portal caused his browser to be served with a message urging him to download Adobe Flash Player.
“As I tried to find my credit report on the Equifax website I clicked on an Equifax link and was redirected to a malicious URL,” Abrahms wrote. “The URL brought up one of the ubiquitous fake Flash Player Update screens.”
Since the incident was reported, Equifax took the web page offline to conduct further analysis and despite early reports, the company confirmed its systems were not compromised and did not affect their consumer online dispute portal.
The NSA may have suffered yet another databreach: Russian state hackers stole classified cyberattack and defense tools & information off of the home computer of an NSA contractor. The hack reportedly occurred via Kaspersky Lab antivirus software on the contractor's home computer, where the AV flagged the NSA cyberspying tools and code. The breach wasn't detected until the spring of 2016, and how the NSA contractor's Kaspersky Lab software was apparently abused and exploited - or not - is under debate by experts. Just how the NSA contractor's Kaspersky Lab software was apparently abused and exploited — or not — is under debate by experts; it could be a case of the application's detection of the tools on the contractor's system inadvertently landing in the wrong hands, they say, or the software could have been hijacked and hacked by the attackers during a software update, for instance, or a more nefarious scenario.
In the wake of the massive Equifax system compromise, in which the personal information of at least 145million people may have been stolen, many people have questioned the ubiquitous use of social security numbers (SSNs) for authentication. The problem underlying identity theft is not the existence of social security numbers, but rather, how little authentication is done for a person requesting credit. Social security numbers are bad, but it's really hard to do better if you want to do things like match records for credit reports, accommodate failure recovery, and permit blind account setup. There are certainly cryptographic schemes that can handle some of these tasks; but if you need linkage and you need memorability to recover from lost credentials, any replacement for the social security number is going to have most or all of the same problems. A digital national ID card could perhaps solve that, but as noted, deploying such a system is very hard even apart from the privacy concerns attendant on such schemes.
Amazon-owned grocery chain has fallen victim to a credit card security breach.
Whole Foods Market (acquired for $13.7 billion) disclosed that hackers were able to gain unauthorized access to credit card information for its customers who made purchases at certain venues within some stores.
The company did not disclose details about the targeted locations or the total number of customers affected by the breach, but it did mention that hackers targeted some of its point-of-sale (POS) terminals in an attempt to steal customer data, including credit details. Whole Foods Market has hired a cybersecurity firm to help it investigate the credit card breach and contacted law enforcement authorities of this incident.
"When Whole Foods Market learned of this, the company launched an investigation, obtained the help of a leading cybersecurity forensics firm, contacted law enforcement, and is taking appropriate measures to address the issue," Whole Foods said in a statement on its website.
The world's "big four" accountancy firms has fallen victim to a sophisticated cyberattack.
Global tax & auditing firm Deloitte has confirmed the company had suffered a cyber attack that resulted in the theft of confidential information, including the private emails and documents of some of its clients.
Hackers managed to gain access to the Deloitte's email server through an administrator account that wasn't secured using two-factor authentication (2FA), granting the attacker unrestricted access to Deloitte's Microsoft-hosted email mailboxes.
Besides emails, hackers also may have had potential access to "usernames, passwords, IP addresses, architectural diagrams for businesses and health information."