Experts say the trend towards ransoming sensitive private information could affect companies not just operationally but through reputation damage.
It comes as hackers bragged after discovering an IT Director's secret porn collection.
The targeted US firm has not publicly acknowledged that it was hacked.
In its darknet blog post about the hack last month, the cyber-criminal gang named the IT director whose work computer allegedly contained the files.
It also posted a screen grab of the computer's file library which included more than a dozen folders catalogued under the names of porn stars and porn websites.
The infamous hacker group wrote: "Thanks God for [named IT Director]. While he was [masturbating] we downloaded several hundred gigabytes of private information about his company's customers. God bless his hairy palms, Amen!"
The blog post has been deleted in the last couple of weeks, which experts say usually implies that the extortion attempt worked and the hackers have been paid to restore data, and not publish any more details.
The company did not respond to requests for comment.
The same hacker group is also currently trying to pressure another US utility company into paying a ransom, by posting an employee's username and password for a members-only porn website.
According to UK Finance, there was a 20% increase in bank transfer fraud linked to romance scams in 2020 compared to 2019.
And £68m was lost to such scams in 2020, said the UK's Action Fraud - another increase on the previous year.
Organisations warned people to be vigilant ahead of Valentine's Day.
It said insurance was "not an alternative" to doing everything possible to first minimise the risk. However, it added that firms could face financial ruin without the cover. Prof Ciaran Martin, former head of the National Cyber Security Centre, said the UK needed to rethink its policies on ransomware.
The scam email includes a link to "register" for the vaccine, but no registration for the real vaccination is required. The fake site also asks for bank details either to verify identification or to make a payment. The NHS says it would never ask for bank details, and the vaccine is free. Cyber-security consultant Daniel Card told BBC News that traffic data indicates thousands of people had clicked the link to the fake site - although it is unclear how many then filled in the form.
The scale of credit card, identity and cyber-fraud makes it the most prevalent crime, costing up to £190bn a year. UK intelligence agencies should play a greater role in responding, the RUSI argues in a report. Policing should be better resourced, working more closely with the private sector, it adds. The report argues that the scale of fraud against the private sector has an impact on the reputation of the UK as a place to do business. Meanwhile, the amount lost by the government in fraudulent claims represents a "heist" on the public purse, undermining faith and trust, it says.
The public body had about 1.2GB of data stolen from its digital systems on Christmas Eve. Sepa rejected a ransom demand for the attack, which has been claimed by the international Conti ransomware group. Contracts, strategy documents and databases are among the 4,000 files released. The data has been put on the dark web - a part of the internet associated with criminality and only accessible through specialised software. Sepa chief executive Terry A'Hearn said: "We've been clear that we won't use public finance to pay serious and organised criminals intent on disrupting public services and extorting public funds. "We have made our legal obligations and duty of care on the sensitive handling of data a high priority and, following Police Scotland advice, are confirming that data stolen has been illegally published online. "We're working quickly with multi-agency partners to recover and analyse data then, as identifications are confirmed, contact and support affected organisations and individuals."
"I thought I had just forgotten my password when I couldn't get back in, but a couple of days passed and I realised something wasn't right," says the Birmingham-based law student. She then received a message from a stranger on Instagram, alerting her to the fact that her account had been taken over by a scammer advertising Apple AirPod headphones for £50. She immediately used her brother's Depop account to comment on the offending post and contact the app. It was removed by the firm in a few hours and her password was reset. But when Ms Strike logged back in, she was shocked by what she found. "I felt sick - I scrolled and scrolled through hundreds of messages people had sent the scammer," she says. The fraudster had been instructing shoppers to pay them directly through PayPal's "Friends and Family" option, which sidesteps Depop's fees and doesn't offer any protection for buyers.
Threats from nation states and criminals to the health system are a growing concern. The huge logistical challenge of rolling out vaccines faces the risk of disruption to complex supply chains. And criminal ransomware poses a threat at a time when the pandemic has increased our reliance on technology.
UK victims of online romance fraud were conned out of more than £63m over the past year, according to figures obtained exclusively by Sky News. Action Fraud, run by the City of London Police, says 800 more cases were reported in 2020 than the previous year. Alex Rothwell, interim Detective Chief Superintendent, City of London Police, said: "Scammers typically assume a persona of strength and dependability - so they'll say that they are things like a doctor, or in the military serving overseas. "And of course in this past year, where the pandemic has made it genuinely harder to meet people in person, that may have been exploited by scammers to manipulate victims, who are more isolated, vulnerable and spending more time online." Online romance fraud can include cat-fishing, where a scammer uses a fake profile to woo a victim before asking them for money.
The Hospital Group, which has a long list of celebrity endorsements, has confirmed the ransomware attack. It said it had informed the Information Commissioner of the breach. On its darknet webpage, the hacker group known as REvil said the "intimate photos of customers" were "not a completely pleasant sight". It claimed to have obtained more than 900 gigabytes of patient photographs. The Hospital Group, which is also known as the Transform Hospital Group, claims to be the UK's leading specialist weight loss and cosmetic surgery group. It has 11 clinics specialising in bariatric weight loss surgery, breast enlargements, nipple corrections and nose adjustments.
The department is responsible for managing US nuclear weapons, but said the arsenal's security had not been compromised. Tech giant Microsoft also said on Thursday that it had found malicious software in its systems. Many suspect the Russian government is responsible. It has denied any role. The US treasury and commerce departments are among the other targets of the sophisticated, months-long breach, which was first acknowledged by officials on Sunday.
Co-founder Karin Sode told BBC News an entire database had been stolen by hackers and included information on previous customers. Data stolen included names, addresses, dates of birth, phone numbers, tariff and energy meter IDs, she said. But with the exception of that of 15 small-business customers, no financial information had been accessed. Those businesses' bank accounts and sort codes had been accessed, Ms Sode said. And they had been contacted separately by phone.
We're constantly urged to do as we're told because these software updates improve our apps by boosting cyber-security and removing glitches. So when, in the spring, a pop-up message hit the screens of IT staff using a popular piece of software called SolarWinds, around 18,000 workers in companies and governments diligently downloaded the update for their offices. What they couldn't have known was that the download was booby-trapped. SolarWinds itself didn't know either. The US company had been the victim of a cyber-attack weeks previously that had seen hackers inject a tiny piece of secret code into the company's next software update. After staying dormant for a couple of weeks, the powerful digital helper sprang to life inside thousands of computer networks in government, technology and telecom organisations across North America, Europe, Asia and the Middle East.
It's the first time the EU regulator has penalised a big US tech firm under GDPR legislation. It ruled that Twitter failed to notify it within 72 hours after identifying a data breach in January 2019, and it also did not adequately document what had happened. Twitter has accepted responsibility. In a statement, the firm blamed "an unanticipated consequence of staffing" during the period between Christmas Day 2018 and 1 Jan 2019 for its failure to comply with notifying the regulator within 72 hours of discovering the breach. "We respect the IDPC's decision, which relates to a failure in our incident response process," said Damien Kieran, Twitter's chief privacy officer and global data protection officer. The IDPC said it believed the fine was "an effective, proportionate and dissuasive measure".
Criminals are looking to defraud consumers by posing as well-known delivery companies, the banking trade body UK Finance has warned. Fraudsters have been sending emails saying they have not been able to deliver goods, and then ask for a fee to rearrange the delivery. They then try to extract financial details which are used to commit fraud. Customers are typically tricked into clicking on links to seemingly genuine websites requesting personal and financial information such as their address, date of birth, mobile number or bank details. In some cases, victims receive a call from the criminal later pretending to be from their bank's fraud team, trying to persuade them to move their money to a safe account or reveal their pass codes.
The warning came from security expert, Will Geddes. Speaking to talkRADIO on Monday the CEO of International Corporate Protection Group said Gmail ? which has more than 1.5 billion global users ? may have been sabotaged by hackers. He claimed the "sky is the limit" for anyone if they were able to hack the service. It comes after Google services, including YouTube, Google Meet, Hangouts, Google Maps, Google Docs, Google Drive and Google Calendar, went offline in a huge outage on Monday that lasted for roughly 40 minutes.
Figures showed a 36% rise in complaints about how banks dealt with fraud and scams this year compared to 2019. Debbie Enever from the ombudsman told BBC Radio 4's Money Box "work still needs to be done" on a voluntary code most banks signed up to last year. UK Finance, representing banks, said stopping fraud was a primary focus. It added that the voluntary code was "not working as intended" and called for legislation to better protect customers. This Contingent Reimbursement Model Code - or CRM - means that banks should refund victims, if they are not at fault, when they have been tricked by criminals into transferring money out of their own banks accounts.
Users took to social media to complain about the emails, which claim to be an order confirmation from the fast-food chain and contain links to malware. The emails also use the victims' names, and appear to come from the chain's Subcard loyalty scheme. Subway has not said whether its databases have been compromised or what the source of the scam is. But the firm has acknowledged that there is a problem. A spokesperson for the company said: "We are aware of some disruption to our email systems and understand some of our guests have received an unauthorised email."
The 29-year-old, who has since been diagnosed with bipolar disorder, was looking for work in the care sector. She answered a job advert on a big recruitment website. She sent off an application form and other details, only to be told that she had to pay for a DBS check - ensuring she had no criminal convictions - and training. "They were asking for £250 for the training," she said. "It all seemed above board and I thought it must be company policy. "I felt boxed in and thought I had to do it to get a job."
The National Cyber Security Centre (NCSC) - part of GCHQ - is launching a major campaign called Cyber Aware with its first ever TV ads. It says over last year's Christmas shopping period there was an average loss of £775 per incident from online shopping fraud. The NCSC is outlining six key things people can do to protect accounts. Online shopping has seen significant growth this year and is likely to reach new levels at Christmas - even with High Street shops now re-open again in many areas. And with that comes the risk from criminals.
Phil Lind is describing the moment he realised criminals had used multiple direct debits to steal nearly £1,000 from his mother, Ursula. It's thought the thieves got access to her account by tricking her into handing over her bank details on the phone. But they were able to steal from her again and again after getting round security at direct debit payment provider GoCardless, which collects payments on behalf of other businesses. In an email to Money Box, it apologised to Mrs Lind and said she was protected by the Direct Debit Guarantee and so would be refunded. But that's not good enough for her son Phil: "The fact that they [the frauds] just sailed through the direct debit system and affected the bank account - the financial impact is almost limitless."
Ransomware is a type of cyber-attack that locks down affected systems and make them unusable. And for Baltimore County public schools district, it meant all pupils learning remotely because of the pandemic could suddenly no longer access lessons. The district was hit last Wednesday, before Thanksgiving Day, but schools will remain shut on Monday and Tuesday. "Our focus today and for Monday and Tuesday is identifying and addressing student and staff device needs so that instruction can continue," it said in a Sunday evening update. But local newspaper the Baltimore Sun is reporting it could take weeks to restore the school district's computer systems fully.
Scammers have been cloning fund managers' websites, products and documents to steal almost £10m ($13.3m) from UK investors. Fraudsters are even creating fake price comparison websites, says the Investment Association (IA). The reported number of scams almost quadrupled from around 300 to 1,175. "In a year clouded in uncertainty, organised criminals have sought opportunity in misfortune by attempting to con investors out of their hard-earned savings," said Chris Cummings, chief executive of IA. Losses added up to £9.4m between March and mid-October, due to sophisticated "cloning" investment scams.
As the department issues thousands of SMS messages and emails as part of its annual Self Assessment tax return push, HMRC is warning customers completing their returns to take care to avoid being caught out by scammers. The annual tax return deadline is on 31 January 2021. The department knows that fraudsters use calls, emails or texts to contact customers. In the last 12 months, HMRC has responded to more than 846,000 referrals of suspicious HMRC contact from the public and reported over 15,500 malicious web pages to internet service providers to be taken down. Almost 500,000 of the referrals from the public offered bogus tax rebates. Many scams target customers to inform them of a fake ?tax rebate? or ?tax refund? they are due. The imposters use language intended to convince them to hand over personal information, including bank details, in order to claim the ?refund?. Criminals will use this information to access customers? bank accounts, trick them into paying fictitious tax bills, or sell on their personal information to other criminals.
But before the scam was spotted, officials unwittingly confirmed thousands of stolen identities. Fraudsters took advantage of looser rules introduced to cope with a surge of universal credit claims during the pandemic. BBC News has asked the Department for Work and Pensions for a response. In May, a junior civil servant working with High Street banks noticed dozens of claims for universal credit had been made asking for money to be paid into the same bank account. Further investigation identified more than 100,000 fraudulent claims. And officials admit they had confirmed thousands of people's identities to the gangs that had stolen them - and passed on their National Insurance numbers. The Department for Work and Pensions wants to write to those whose data has been compromised. But BBC News has learned it is struggling to identify many of them and is wary of sending out letters to last known addresses in case they end up in the wrong hands, exacerbating the data breach.
The club, who host West Bromwich Albion at Old Trafford on Saturday, say they are confident there has not been a breach of personal data of fans. United's media channels, the website and the official app are unaffected by the attack. "The club has taken swift action to contain the attack and is working with expert advisers to investigate the incident," said a club statement. The club say "extensive protocols and procedures" are in place for such incidents and they had "rehearsed the risk". "Our cyber defences identified the attack and shut down affected systems to contain the damage and protect data," the statement added. "We are not currently aware of any breach of personal data associated with our fans and customers. All critical systems required for matches to take place at Old Trafford remain secure and operational." United have informed the Information Commissioner's Office and forensic tracing is being carried out in a bid to establish further detail about the attack. On Saturday, a Greater Manchester Police spokesperson said: "We are aware and currently investigating a cyber-related incident at Manchester United Football Club."
The consumer group says devices being sold on marketplaces such as Amazon and eBay, could easily be hacked or switched off by criminals. It is asking the government for new legislation to safeguard consumers. Amazon has removed at least seven product listings in response to the findings.
People looking for games consoles, bicycles and clothing may be at a higher risk of encountering a scam, according to banking industry research. UK Finance, which represents the finance industry, warned of scams when items were never delivered. The average loss in such cases was £720 in the first half of the year.
The fine was issued by the Information Commissioner's Office (ICO) following a cyber-attack on the Ticketmaster website in 2018. The ICO said personal information and payment details had potentially been stolen from more than nine million customers in Europe. Ticketmaster said it would appeal against the ruling. An investigation found a vulnerability in a third-party chatbot built by Inbenta Technologies, which Ticketmaster had installed on its online payments page. A cyber-attacker was able to use the chatbot to access customer payment details. Following the breach, 60,000 Barclays bank customers were victims of fraud. Online bank Monzo had to replace 6,000 payment cards due to fraud.
The review covers the period from September 2019 to August 2020, so the pandemic occupied an even higher proportion of the agency's efforts after the first lockdown began. In total there were 723 incidents of all kinds, marking close to a 10% rise on the previous period. Of those, 194 were Covid-related. Some of the incidents related to countering nation-state attacks, but most were criminal in nature, the GCHQ division reported. It also disclosed that it had thwarted 15,354 campaigns that had used coronavirus themes as a "lure" to fool people into clicking on a link or opening an attachment containing malicious software. Some involved fake shops selling PPE (personal protective equipment), test kits and even vaccines.
The Information Commissioner's Office (ICO) said names, contact information, and passport details may all have been compromised in a cyber-attack. The breach included seven million guest records for people in the UK. The ICO said the company failed to put appropriate safeguards in place but acknowledged it had improved. The first part of the cyber-attack happened in 2014, affecting the Starwood Hotels group, which was acquired by Marriott two years later. But until 2018, when the problem was first noticed, the attacker continued to have access to all affected systems.
The social media app's owner Facebook could face a large fine if Instagram is found to have broken privacy laws. It comes amid reports Instagram failed to protect data, including allowing email addresses and phone numbers of those under 18 to be made public. Facebook said it rejected the claims but was cooperating with the DPC. A number of US tech giants have their European headquarters in Ireland, and the DPC is the lead European Union regulator under the EU General Data Protection Regulation (GDPR), which came into force in 2018. The DPC is responsible for protecting individuals' right to online privacy, and has the power to issue large fines.
The breach took place in 2018 and affected both personal and credit card data. The fine is considerably smaller than the £183m that the ICO originally said it intended to issue back in 2019. It said "the economic impact of Covid-19" had been taken into account. However, it is still the largest penalty issued by the ICO to date. The incident took place when BA's systems were compromised by its attackers, and then modified to harvest customers' details as they were input. It was two months before BA was made aware of it by a security researcher, and then notified the ICO.
Students starting university this year are being warned by HM Revenue and Customs (HMRC) that they could be targeted by a fresh wave of tax scams. As new students start the academic year, they can be particularly vulnerable to cybercrime. With universities taking a blended approach to online and face-to-face tuition this year, and an increase in remote working due to the pandemic, students could be left particularly exposed to the work of fraudsters. Freshers might also be more vulnerable to these types of scams due to their limited experience of the tax system. HMRC has written to universities, through Universities UK, asking them to help ensure their students know how to spot a scam. In August this year HMRC received reports from the public of more than 74,800 scam emails, text messages and phone calls. Nearly 41,300 of these specifically offered bogus tax rebates.
Services may be "unavailable" and people should only contact the council "if absolutely necessary", it tweeted. Officials are working with the UK National Cyber Security Centre to investigate the hack. In February, another local authority - Redcar and Cleveland Borough Council - said it had been hit by a ransomware attack, which cost it more than £10m. Hackney's mayor has only shared scant details of what is involved in its case so far. "This investigation is at an early stage, and limited information is currently available," he posted. "Our focus is on continuing to deliver essential frontline services, especially to our most vulnerable residents, and protecting data, while restoring affected services as soon as possible. In the meantime, some council services may be unavailable or slower than normal."
The data protection watchdog said numerous people had made it aware of a marketing email Klarna had sent out. It was followed by a message the email had been sent in error, and they had not been added to a marketing database. But recipients asked how the firm had their email address in the first place. One Twitter user, vlogger Christine Armstrong, tweeted: "Now why would Klarna have 'accidentally' sent me their newsletter when I have never used their services. Who sold them my email?"
Wisepay said a hack of its website meant an attacker was able to harvest payment details between 2 and 5 October via a spoof page. Attempted payments to about 300 schools have been affected by the scam. But the firm said only a small number of the pupils' parents would have used its system before it was taken offline. Its managing director said this was because the type of cashless payments made - covering things like exam fees and school meals - would not be done on a daily basis. "Actually, it's quite a small subset of users of the platform," insisted Richard Grazier.
Security experts revealed the vulnerability online - and reported it the LGBT dating app. It enabled full access to an individual's account, including images, messages and HIV status. Grindr said: "Thankfully, we believe we addressed the issue before it was exploited by any malicious parties." The flaw was discovered by French security researcher Wassime Bouimadaghene and documented by security experts Troy Hunt and Scott Helme.
Not long ago, a breach that compromised the data of a few million people would have been big news. Now, breaches that affect hundreds of millions or even billions of people are far too common. About 3.5 billion people saw their personal data stolen in the top two of 15 biggest breaches of this century alone. The smallest incident on this list involved the data of a mere 134 million people.
Hackers disabled computer systems at D?sseldorf University Hospital and the patient died while doctors attempted to transfer her to another hospital. Cologne prosecutors officially launched a negligent homicide case this morning saying hackers could be blamed. One expert said, if confirmed, it would be the first known case of a life being lost as a result of a hack. The ransomware attack hit the hospital on the night of 9 September, scrambling data and making computer systems inoperable.
The National Cyber Security Centre has issued an alert after a recent spike in attacks on educational institutions. These have been "ransomware" incidents which block access to computer systems. Paul Chichester, the NCSC's director of operations, says such attacks are "reprehensible". The return to school, college and university, already facing problems with Covid-19, now faces an increased risk from cyber-attacks, which the security agency says could "de-rail their preparations for the new term".
Bank branch staff stopped £19 million of fraud in the first half of 2020 through the Banking Protocol, a scheme that alerts local police to suspected scams. The scheme has prevented victims from losing £116 million of fraud and led to 744 arrests since it was introduced three years ago. A range of scams that trick elderly and vulnerable customers into withdrawing cash from their branch have been prevented, including courier scams, romance fraud and rogue traders. Customers helped through the initiative are typically aged 65 or above, with some over 100 years old. The Banking Protocol scheme is now being expanded to telephone and online banking.
The new incident saw a discharge letter being given to the wrong patient. It follows dozens of Covid-19 test results being sent to a local business by mistake, and confidential personal details relating to staff travel sent to a journalist. New interim chief executive Michael Dickson has requested an "external rapid review" of procedures. In a statement, Mr Dickson apologised and said it was "not acceptable" for such things to be happening.
The scammers phoned people with exact details of their restaurant bookings, asking them to "confirm" card details. They then tried to spend thousands of pounds at the catalogue retailer Argos. The Ritz told the BBC it was investigating a "potential data breach" and said it had alerted the Information Commissioner's Office (ICO).
During June 2020, Action Fraud received 164 reports from individuals falling victim to fraudulent investment schemes, commonly referred to as a ?money flipping? service offered by users on the Instagram social media platform. These reports have amounted to a combined financial loss of £358,809. Fraudsters approach (or are approached by) victims via the instant messaging feature of the platform after advertising their service. They claim to only require an initial investment of a few hundred pounds which they say will be used to trade on the stock market or to buy and trade foreign currency (Forex) until they have multiplied the investment several times within a matter of days which is paid to the victim after a small commission is deducted for the service. In reality, once the initial investment has been transferred the victim is given a series of excuses as to why their money and ?profits? cannot be returned unless more money is sent. Eventually all contact is severed and the victim is blocked by the suspect. Victims are usually requested to send the money by bank transfer or through a cryptocurrency platform which means it is nearly impossible to retrieve.
Then she got an email saying she'd won. "I was shaking," she said. But after the competition organisers started asking for personal details, Ms Richardson discovered it was a scam. She isn't the only person who has nearly been caught out - experts warn there has been a surge in fraudulent prize promotions since lockdown. Crooks are exploiting the fact that more of us are online for longer periods and are trying to trick consumers into revealing sensitive personal information. "Criminals know people are spending far more time online, and they're capitalising on that," said Jeremy Stern, chief executive of PromoVeritas, a company that helps firms run legitimate prize promotions. "We've seen a significant increase in the number of online scams."
The emails claim your account has been ?limited? as a result of a policy violation, but are designed to steal your details. The scam emails then ask customers to update their account or check the security of their account by clicking a link in the email. The links provided in the emails lead to genuine-looking websites that are actually phishing sites designed to steal PayPal login details, as well as personal and financial information. And thousands of people are being targetted. Action Fraud Tweeted: "We have received over 1,000 reports in 24 hours about these fake PayPal emails. "One person replied: "I got an email yesterday to say that illegal activity happened to my PP account. I?m still waiting for PP to reply whether it?s genuine or not." Another wrote: "I get multiple, daily!"
Spear-phishing is a targeted attack designed to trick people into handing out information such as passwords. Twitter said its staff were targeted through their phones. The successful attempt let attackers tweet from celebrity accounts and access their private direct messages. The accounts of Microsoft founder Bill Gates, Democratic presidential hopeful Joe Biden and reality star Kim Kardashian West were compromised, and shared a Bitcoin scam.
Human Rights Watch and the children's mental health charity, Young Minds, have also confirmed they were affected. The hack targeted Blackbaud, one of the world's largest providers of education administration, fundraising, and financial management software. The US-based company's systems were hacked in May. It has been criticised for not disclosing this externally until July and for having paid the hackers an undisclosed ransom. In some cases, the data was limited to that of former students, who had been asked to financially support the establishments they had graduated from. But in others it extended to staff, existing students and other supporters.
The National Cyber Security Centre (NCSC) said it was only the intervention of the unnamed club's bank that stopped the theft. It was one of several incidents highlighted as evidence that sport needed to improve its cybersecurity. "The impact of cybercriminals cashing in on this industry is very real," said the NCSC's Paul Chichester. A new report from the NCSC says the email address of a Premier League club's managing director had been hacked during a transfer negotiation, leading to the attempt to steal the £1m.
All three breaches by children's services staff involved sensitive personal details and were reported to the Information Commissioner's Office (ICO), according to an annual report. The human error breaches were among nearly 200 data security incidents at the council last year, which also saw staff lose an adoption letter in violation of data protection law. In one breach, a letter containing a foster child's address was accidentally disclosed to the birth mother, a council spokesperson said. In another, a council officer disclosed to a father the identity of a neighbour who had reported concerns about his ability to look after his children.
The official accounts of Barack Obama, Joe Biden and Kanye West also requested donations in the cryptocurrency. "Everyone is asking me to give back," a tweet from Mr Gates' account said. "You send $1,000, I send you back $2,000." Twitter said it was a "co-ordinated" attack targeting its employees "with access to internal systems and tools". "We know they [the hackers] used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf," the company said in a series of tweets. It added that "significant steps" were taken to limit access to such internal systems and tools while the company's investigation was ongoing
She discovered she'd become a victim of ID theft when she was refused a mortgage over a payday loan in her name that she knew nothing about. A bank account had also been opened by fraudsters using her identity. "I've been in tears at my desk at work in terms of the impact it's had on me and my stress levels. "At the time it made me so angry, the fact that we were having to go through all this trauma and stress and no one could give me answer. "It's just that it was so out of our control and that's the most frustrating thing about it." Gemma's not alone. Last year ID theft happened more than 223,000 times, up 18% on the year before, according to Cifas, the counter fraud organisation which runs the National Fraud Database and works with police and financial institutions to try to tackle fraud.
?My parents were called by scammers claiming to use ultra violet lamps to get rid of coronavirus,? explains Ian Meaker-Bayford, the son of two elderly West Sussex residents. ?I had warned them to be careful and my father declined to let them go round to his house. He is now in regular contact with West Sussex Trading Standards and I am so grateful to them.? This is just one of the many scams circulating at the moment and Trading Standards officers have contacted hundreds of vulnerable residents across the county to warn them. As part of Scams Awareness Fortnight (15-28 June) officers are advising residents to be aware of fake calls claiming to be from the NHS.
Some 2,208 customers had their card details taken, but email addresses of nine million were also accessed by the hackers. Samantha Burt, from Eastbourne, was told in early April that fraudsters had taken her credit card information. "To wake up and find out I am more likely to be a target, because they have more information on me than other customers is a bit of a worry," the 28-year-old told Radio 5live's Wake Up To Money. "I've been in complete limbo since 2 April." She said EasyJet's response had been "really frustrating", having waited on a dedicated phone line for an hour to get more information, but learning little. She took it on herself to contact her card provider and change all her passwords.
The company is training staff to trace cases of Covid-19 for the UK government. It made the error when it emailed new trainees to tell them about training. Serco said it had apologised and would review its processes "to make sure that this does not happen again". Contact tracing is a system used to slow the spread of infectious diseases like coronavirus. It is already being used in other countries including Singapore and Germany. In the UK, Health Secretary Matt Hancock said 21,000 contact tracers have been hired, some of whom are healthcare professionals. They will gather contacts from Covid-19 patients and trace those people by phone or email to slow the spread of the disease in the community. Serco is one of the companies hiring, training and operating the 15,000 contact tracers who do not have clinical training. But the mistake may leave the firm in breach of data protection rules. It is understood that at least one member of staff has raised the issue with the Information Commissioner.
He's talking about the scammers and criminals that inhabit the "dark web" who have found a new angle - anxiety over Covid-19. Mr Wright, who is now chief security adviser at security software company SentinelOne, used to teach behavioural analysts at the US National Security Agency (NSA) about the exploitation of human behaviour. He is now seeing some of those techniques being used on the dark web, an encrypted part of the internet that can be accessed using popular networks such as Tor. The Tor browser is privacy-focused, meaning it can obscure who is using it and what data is being accessed. It offers bad actors a way to operate with a degree of impunity, as law enforcement find it much more difficult to track down criminals that use it.
The discount airline - currently mired by the grounding of flights because of the coronavirus crisis and a leadership tussle led by its founder - said it discovered the data breach in late January and was in the process of notifying those affected. It stressed there was no evidence that data had been misused by criminals. The Information Commissioner's Office (ICO), Britain's data watchdog, said it was investigating the incident.
Interserve, which helped build Birmingham's NHS Nightingale hospital, and Bam Construct, which delivered the Yorkshire and the Humber's, have reported the incidents to authorities. Earlier this month, the government warned healthcare groups involved in the response to the virus were being targeted by malicious actors. he separate attacks were not linked. But Bam Construct said the "significant" cyber-attack on it "forms part of the wave of attacks on public and private organisations supporting the national effort on Covid-19".
The Local Government Association said some councils have seen a "significant surge" in reports of scams by those seeking to exploit virus fears. More than 500,000 sub-standard masks were seized by a London council, while other criminals have attempted to trick people into giving personal details. The LGA is calling on the public to report scams to their local council. Fraudsters are seeking to take advantage of public fears by selling bogus medical products and other counterfeit items.
The Suspicious Email Reporting Service was set up two weeks ago by the UK's National Cyber Security Centre (NCSC). It received 10,000 reports in just one day, after being promoted on ITV's Martin Lewis Money Show, Many of the scam websites claimed to sell coronavirus tests, face masks and even vaccines. Others were mock-ups of official government websites that tried to trick visitors into giving their payment information to scammers. NCSC chief executive Ciaran Martin praised the "phenomenal response" from the British public. "While cyber-criminals continue to prey on people's fears, the number of scams we have removed in such a short timeframe shows what a vital role the public can play in fighting back," he said.
The UK and US have warned that state-backed cyber attackers are trying to steal data from universities, pharmaceuticals and research institutes involved in the coronavirus response. Organisations trying to develop a COVID-19 vaccine are among those being targeted. A joint advisory published on Tuesday did not name any specific country involved in the "malicious cyber campaigns", but culprits are understood to include hacking groups from China, Russia and Iran, as well as others. Dominic Raab, the foreign secretary, called the attacks "particularly venal" given that they were targeting international and national organisations responding to the COVID-19 crisis
It found 50 profiles, pages and groups on Facebook, Twitter and Instagram offering stolen credit-card details, and Netflix and Uber Eats accounts. And much of the content had remained on the platforms after being reported. Facebook and Twitter said such activity was not tolerated and would be removed. The investigation, carried out before the coronavirus lockdown, found one Facebook post revealing a Yorkshire man's: full name, date of birth, address, mobile phone number, credit-card number, security code and expiry data plus bank name and sort code.
Organisations trying to develop a COVID-19 vaccine are among those being targeted. A joint advisory published on Tuesday did not name any specific country involved in the "malicious cyber campaigns", but culprits are understood to include hacking groups from China, Russia and Iran, as well as others. Dominic Raab, the foreign secretary, called the attacks "particularly venal" given that they were targeting international and national organisations responding to the COVID-19 crisis.
Filipino Onel de Guzman, now 44, says he unleashed the Love Bug computer worm to steal passwords so he could access the internet without paying. He claims he never intended it to spread globally. And he says he regrets the damage his code caused. "I didn't expect it would get to the US and Europe. I was surprised," he said in an interview for Crime Dot Com, a forthcoming book on cyber-crime. The Love Bug pandemic began on 4 May, 2000. Victims received an email attachment entitled LOVE-LETTER-FOR-YOU. It contained malicious code that would overwrite files, steal passwords, and automatically send copies of itself to all contacts in the victim's Microsoft Outlook address book.
Research published by ZecOps, a mobile security firm, said a bug in the Mail app made devices susceptible to sophisticated attacks. The firm said it had "high confidence" the bug has been used to exploited at least six high-profile victims. An Apple spokesperson told Reuters a fix would be included in upcoming software updates. In a statement, Apple said: "We have thoroughly investigated the researcher's report and, based on the information provided, have concluded these issues do not pose an immediate risk to our users. The researcher identified three issues in Mail, but alone they are insufficient to bypass iPhone and iPad security protections, and we have found no evidence they were used against customers." ZecOps reported the bug to Apple in March. The tech giant had not previously known about the issue.
They were initially posted to message group 4chan, according to a report from an organisation which monitors right-wing extremism. The BBC understands that some of the credentials are from old hack attacks. Site Intelligence Group did not say who posted them, or if they were authentic. Later, the list was also posted to Pastebin, which is often used to reveal hacked information, and Twitter. In a tweet, Site's director Rita Katz said the alleged list was being used by far-right extremists as part of a "harassment campaign."
The hacks involve a user logging into a person's Nintendo account - and often using a linked PayPal account to make expensive purchases. Several reports say the attacks have intensified in recent weeks, with staff at popular technology and gaming sites among those affected. Nintendo recommends using two-factor authentication to protect accounts. The attacks have been going on for months, but appear to have increased in the past few weeks. One staff member at gaming site Eurogamer had their account accessed, the website reported, as did another at Ars Technica. Administrators of the Nintendo forum on Reddit also said there had been a "notable" number of reports in the past few days.
NCSC said this included 471 fake online shops that were selling fraudulent virus-related items. It coincides with new online safety advice from the agency as part of a national awareness campaign. NCSC also launched an email reporting service, which the public can use to flag any suspicious activity. Numerous other malware and phishing sites have been removed, as well as almost 900 advance-fee fraud schemes, where a large sum of money is promised in return for a one-off payment. There is growing concern that criminals are hoping to capitalise on the increased usage of the internet during the pandemic.
The tech giant says the pandemic has led to an explosion of phishing attacks in which criminals try to trick users into revealing personal data. The company said it was blocking more than 100 million phishing emails a day. Over the past week, almost a fifth were scam emails related to coronavirus. The virus may now be the biggest phishing topic ever, tech firms say. Google's Gmail is used by 1.5 billion people. Individuals are being sent a huge variety of emails which impersonate authorities, such as the World Health Organization (WHO), in an effort to persuade victims to download software or donate to bogus causes. Cyber-criminals are also attempting to capitalise on government support packages by imitating public institutions. Google claims that its machine-learning tools are able to block more than 99.9% of emails from reaching its users.
Scammers have been targeting vulnerable people including those self-isolating at home, the NCA said. Graeme Biggar, director general of the agency's National Economic Crime Centre, said the virus was increasingly being used as "a hook to commit fraud". It comes as two people were arrested on suspicion of selling illegal tests. A 46-year-old pharmacist from Croydon, south London, was arrested on Saturday on suspicion of making false and misleading claims about the capability of coronavirus testing kits he had allegedly tried to sell, the NCA said. Officers seized £20,000 in cash and searched two properties and a car. The suspect was released on bail. Separately, on Sunday, investigators arrested a 39-year-old surveyor from Uxbridge, west London, who had allegedly planned to sell 250 testing kits to construction workers
This is a joint advisory from the United Kingdom?s National Cyber Security Centre (NCSC) and the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). This is a fast-moving situation and this advisory does not seek to catalogue all COVID-19 related malicious cyber activity. You should remain alert to increased activity relating to COVID-19 and take proactive steps to protect yourself and your organisation. This advisory provides information on exploitation by cyber criminal and advanced persistent threat (APT) groups of the current coronavirus disease 2019 (COVID-19) global pandemic. It includes a non-exhaustive list of indicators of compromise (IOCs) for detection as well as mitigation advice. The NCSC and CISA are working with law enforcement and industry partners to disrupt or prevent these malicious COVID-19 themed cyber activities.
SINGAPORE ? Hospitals and other institutions on the front lines of the fight against the coronavirus facing unprecedented physical dangers are now also facing another threat from cybercriminals. INTERPOL has issued a warning to organizations at the forefront of the global response to the COVID-19 outbreak that have also become targets of ransomware attacks, which are designed to lock them out of their critical systems in an attempt to extort payments. INTERPOL?s Cybercrime Threat Response team at its Cyber Fusion Centre has detected a significant increase in the number of attempted ransomware attacks against key organizations and infrastructure engaged in the virus response. Cybercriminals are using ransomware to hold hospitals and medical services digitally hostage; preventing them from accessing vital files and systems until a ransom is paid. To support global efforts against this critical danger, INTERPOL has issued a Purple Notice alerting police in all its 194 member countries to the heightened ransomware threat
In a blog, the chief executive of the video conferencing app apologised for "falling short" on security issues and promised to address concerns. He said that the use of Zoom had soared in ways he could never have foreseen prior to the coronavirus pandemic. One security expert said he hoped the company culture would change. Zoom is now being used by millions of people for work and leisure, as lockdowns are imposed in many countries. Eric Yuan spoke candidly about how "usage of Zoom ballooned overnight". "As of the end of December last year, the maximum number of daily meeting participants, both free and paid, was approximately 10 million. In March this year, we reached more than 200 million, he said. He admitted that despite "working around the clock" to support the influx of new users, the service had "fallen short of the community's - and our own - privacy and security expectations"
We have received 41 reports of a scam email purporting to be from HM Government asking for donations to the NHS during the COVID-19 outbreak. This is a fake email and your money will only end up in the hands of a criminal. The NHS will never ask you to send money directly to a bank account. If you would like to donate to the NHS you can do so via their official channels or your local NHS Trust. Don't click on the links or attachments in suspicious emails and never respond to messages that ask for your personal or financial details.
Like many rumours, the posts went viral across both public networks, like Twitter and Facebook, and closed forums on WhatsApp and Snapchat. They have become so widespread that Houseparty itself says it is a victim of a "paid commercial smear campaign". The US firm's owner Epic Games is now offering $1m (£803,000) bounty for evidence that a "malicious actor" is behind the claims.
Fraudsters are also selling counterfeit face masks and hand sanitisers, says the LGA, which speaks for councils in England and Wales.Hand sanitiser containing an ingredient banned for human use six years ago has been seized in Birmingham. The LGA is advising people not to accept help from cold-callers. This means being suspicious of anyone who offers help, either online or in person, the Local Government Association warned, after councils in Rochdale and south London received reports of attempted scams. In Lewisham, south London, Neighbourhood Watch reported cold-callers knocking at the doors of elderly people, saying they were from the health authority and were carrying out tests.
Cyber-criminals are targeting individuals as well as industries, including aerospace, transport, manufacturing, hospitality, healthcare and insurance. Phishing emails written in English, French, Italian, Japanese, and Turkish languages have been found. The BBC has tracked five of the campaigns.
Sky News has seen a copy of an email scam sent to a number of healthcare organisations that pretends to be from each firm's internal IT team. The email - which has the subject "ALL STAFF: CORONA VIRUS AWARENESS" - tells employees that "the institution is currently organising a seminar for all staff to talk about this deadly virus", asking them to click on a link to register.
The network call Necurs infected over nine million computers and one of the world's largest botnets. Necurs was responsible for multiple criminal scams including stealing personal information and sending fake pharmaceutical emails. Cyber-criminals use botnets to remotely take over internet-connected devices and install malicious software. The software can be used to send spam, collect information about what activity the computer is used for or delete information without notifying the owner. Tom Burt, Microsoft's vice-president for customer security and trust, said in a blog post that the takedown of Necurs was the result of eight years of planning and co-ordination with partners in 35 countries. He wrote that the steps taken will "ensure the criminals behind this network are no longer able to use key elements of its infrastructure to execute cyber-attacks."
A software vendor used by small retailers in the EU exposed a database of nearly 8 million sales records on the web without a password or any other authentication required to access it. The documents contained sales records including customer names, email addresses, shipping addresses, purchases, and the last four digits of credit card numbers, among other info. Anyone could find and access the data. The vendor?s app pulled sales records from marketplace and payment system APIs like that of Amazon UK, Shopify, PayPal, and Stripe to aggregate retailers? sales data and calculate value-added taxes for different EU countries. At this time, we do not know the exact number of retailers or customers affected.
Instead of threatening to distribute stolen private images, this new attempt claims to have already "sextorted" the recipient's friend, who refused to pay. It tells them it is now emailing nude photos to every contact of the supposed victim - and to check the attachment. Researchers said the "new take on sextortion is quite remarkable". Recipients who click on the attachment open a Word document with a blurred image that hints at possibly sexual content - and instructions on how to "enable content"
The Office of the Australian Information Commissioner said Facebook had seriously infringed the privacy of more than 300,000 Australians. The social media giant left personal data "exposed to be sold and used for... political profiling". The scandal involved harvested Facebook data of 87 million people being used for advertising during elections. "Facebook failed to take reasonable steps to protect those individuals' personal information from unauthorised disclosure," the Australian commissioner's office said. Australia's federal court can impose a fine of $1.7m (£860,000) for every serious or repeated interference with privacy, it added. A Facebook spokesperson said the company had "actively engaged" with the commissioner since it opened the investigation in 2018. They said Facebook had "made major changes... to help people protect and manage their data". "We're unable to comment further as this is now before the Federal Court," the spokesperson said.
The researchers who first discovered the database told the BBC that it contained more information than Virgin Media suggested. Such details could be used by cyber-criminals to extort victims. Virgin Media told the BBC only a small number of customers had these sensitive details in the database. The UK telecoms company revealed on Thursday that one of its "marketing databases" containing details of 900,000 people was open to the internet and had been accessed "on at least one occasion" by an unknown user. On Friday, it confirmed that the database contained details of about 1,100 customers who had used an online form to ask for a particular website to be blocked or unblocked.
Of the 21 reports, ten were made by victims that attempted to purchase protective face masks from fraudulent sellers. One victim reported losing over £15k when they purchased face masks that were never delivered. We have also received multiple reports about coronavirus-themed phishing emails attempting to trick people into opening malicious attachments or revealing sensitive personal and financial information. One common tactic used by fraudsters is to contact potential victims over email purporting to be from research organisation?s affiliated with the Centers for Disease Control and Prevention (CDC) and the World Health Organisation (WHO). They claim to be able to provide the recipient with a list of coronavirus infected people in their area. In order to access this information, the victim needs to click on a link, which leads to a malicious website, or is asked to make a payment in Bitcoin. porting numbers are expected to rise as the virus continues to spread across the world.
The information was accessed "on at least one occasion" by an unknown user. The database, which was for marketing purposes, contained phone numbers, home and email addresses. It did not include passwords or financial details. The breach was not due to a hack or a criminal attack, but because the database had been "incorrectly configured" by a member of staff not following the correct procedures, Virgin Media said. The firm was alerted to the problem on Friday after it was spotted by a security researcher at TurgenSec.
Between October 2014 and May 2018 Cathay Pacific?s computer systems lacked appropriate security measures which led to customers? personal details being exposed, 111,578 of whom were from the UK, and approximately 9.4 million more worldwide. The airline?s failure to secure its systems resulted in the unauthorised access to their passengers? personal details including: names, passport and identity details, dates of birth, postal and email addresses, phone numbers and historical travel information. Cathay Pacific became aware of suspicious activity in March 2018 when its database was subjected to a brute force attack, where numerous passwords or phrases are submitted with the hope of eventually guessing correctly. The incident led Cathay Pacific to employ a cybersecurity firm, and they subsequently reported the incident to the ICO. The ICO found Cathay Pacific?s systems were entered via a server connected to the internet and malware was installed to harvest data. A catalogue of errors were found during the ICO?s investigation including: back-up files that were not password protected; unpatched internet-facing servers; use of operating systems that were no longer supported by the developer and inadequate anti-virus protection.
The UK watchdog said the airline's computer systems had exposed details of 111,578 UK residents and a further 9.4 million people from other countries. These included names, passport details, dates of birth, phone numbers, addresses and travel history. "Appropriate security" was not in place between October 2014 and May 2018. The ICO said Cathay Pacific became aware of a problem in March 2018, when it suffered a "brute force" password-guessing attack.
Customers will not be able to use Boots Advantage Card points to pay for products while the issue is dealt with. Boots said none of its own systems were compromised, but attackers had tried to access accounts using reused passwords from other sites. It comes days after a similar issue hit 600,000 Tesco Clubcard holders. A spokeswoman for Boots told the BBC the issue affected less than 1% of the company's 14.4 million active Advantage Cards - fewer than 150,000 people. But it could not give an exact number as the company was still dealing with the problem
The National Cyber Security Centre (NCSC) is advising people to tweak the settings after buying them. Easy-to-guess default passwords might let a hacker secretly observe a home through connected devices, it said. The NCSC's technical director, Dr Ian Levy, warned while the devices were "fantastic innovations", they were vulnerable to cyber-attackers. There are many examples of devices being accessed without permission. In one, the attacker spoke to a young girl, pretending to be Father Christmas. In another, a couple from Leeds had been watched thousands of times online without their knowledge.
Network Rail and the service provider C3UK confirmed the incident three days after being contacted by BBC News about the matter. The database, found online by a security researcher, contained 146 million records, including personal contact details and dates of birth. It was not password protected.
The supermarket giant said it believed a database of stolen usernames and passwords from other platforms had been tried out on its websites, and may have worked in some cases. No financial data was accessed and its systems have not been hacked, it added. It said this was a precautionary measure and apologised for the inconvenience. "We are aware of some fraudulent activity around the redemption of a small proportion of our customers' Clubcard vouchers," a Tesco spokesperson said. "Our internal systems picked this up quickly and we immediately took steps to protect our customers and restrict access to their accounts." The supermarket said it had emailed everybody potentially affected, that nobody would lose their points and new vouchers would also be issued.
Systems at Redcar and Cleveland Council have been down for almost three weeks after the ransomware attack. It said it had been prioritising frontline services and has now built a new server and website, as well as mobilising a temporary call centre. However, there may be a short delay in letting children know which secondary school they have got places at. Since the attack on 8 February, the council has been working with the National Cyber Security Centre and the National Crime Agency.
In the course of investigating a malware infection of cloud infrastructure servers hosted in the Amazon Web Services (AWS) cloud, SophosLabs discovered a sophisticated attack that employed a unique combination of techniques to evade detection and that permits the malware to communicate freely with its command and control (C2) servers through a firewall that should, under normal circumstances, prevent precisely that kind of communication from reaching the infected server. We have published an in-depth report on the attack, which we have named Cloud Snooper.
ISS provides cleaning, catering, security and other services to companies in the UK and elsewhere. Its websites have been down since 17 February. And This Week in Facilities Management said 43,000 staff at London's Canary Wharf and its Weybridge HQ, in Surrey, still had no email. ISS said it was a "malware" attack, but declined to specify further. However, the BBC has learned it is a ransomware attack. Ransomware encrypts IT systems, locking users out and demanding money. The company says that many of its 500,000 global employees do not use its computers in their daily work - but the impact is affecting the whole company.
The US Department of Defence confirmed that computer systems controlled by the Defence Information Systems Agency (DISA) had been hacked, exposing the personal data of about 200,000 people. The agency oversees military communications including calls for US President Donald Trump. The data exposed included names and social security numbers. The agency is responsible for the military cyber-security and it sets up communications networks in combat zones. On its website, DISA says its vision is "to be the trusted provider to connect and protect the war fighter in cyber-space." There are 8,000 military and civilian employees at the DISA, but through its operations, it handles data for many other individuals. This is why the personal information for so many people was exposed.
The hack was first reported by ZDNet on Wednesday, which said the stolen information was posted to a hacking forum this week. MGM confirmed the attack took place to the BBC. The data exposed included names, address, and passport numbers for former guests. MGM said it was "confident" no financial information had been exposed. The resort chain said it was unable to say exactly how many people were impacted because information that was exposed might be duplicated. "Last summer, we discovered unauthorized access to a cloud server that contained a limited amount of information for certain previous guests of MGM Resorts. We are confident that no financial, payment card or password data was involved in this matter," a spokesperson for MGM Resorts said. Among the people who were impacted included celebrities like Justin Bieber and Twitter founder Jack Dorsey. ZDNet reported. MGM would not confirm this.
The gang targeted in excess of 2,000 people, predominantly in the Portsmouth area, between May 2014 and July 2016. They used the details to set up Paypal accounts to order expensive items which were then delivered to addresses in the city controlled by the group. Seven people were jailed for between 16 and 44 months for their part in the fraud. An eighth defendant was fined £1,000. Portsmouth Crown Court heard the gang spent the money on Rolex watches, high-value jewellery, TVs and designer clothes. Police carried out raids after being given information by BT, and group leader Festus Emosivwe, 36, put a USB data stick in his mouth and chewed on it when police arrested him, making it impossible to recover any data.
However, it did not name the facility or say when the attack happened. A malicious link sent to staff at the facility eventually caused the shutdown "of the entire pipeline asset". It was so severe in part because the organisation was not prepared for such an attack, the DHS statement said. The incident was detailed in a security alert., which revealed it to be a "spear-phishing" attack, in which individuals are sent fraudulent but believable scam messages. That let the attacker into the company's IT network.
More than 135,000 UK residents have been without online public services for nearly a week, as their council struggles with a cyber-attack. Redcar and Cleveland Borough Council's website and all computers at the authority were attacked on Saturday. One cyber-security expert told the BBC the incident had all the hallmarks of a ransomware attack, in which files are scrambled until a ransom is paid. But the council refused to confirm the nature of the hack. Online appointment bookings, planning documents, social care advice and council housing complaints systems are just some of the services knocked offline. The National Crime Agency said it was supporting the council.
Criminals netted $3.5bn (£2.7bn) from cyber-crimes reported to the FBI alone in 2019, according to the service's internet crime complaint centre (IC3). It received 467,361 complaints from individuals and businesses during the year and has had nearly five million since its inception in 2000. Phishing and extortion remain the most popular ways of scamming people. It says techniques are becoming more sophisticated, making it harder for people to tell "real from fake". This is especially true of web and email addresses that are fooling people because they look increasingly legitimate. Last year IC3 had 13,633 complaints from victims of so-called tech-support fraud, which involves a scammer phoning an individual and claiming there is a problem with their computer that needs immediate fixing.
The Labour Party could be fined up to £15m for failing to protect members' data after reporting Sir Keir Starmer's campaign to the information watchdog. This weekend Labour's general secretary Jennie Formby, a leading ally of Jeremy Corbyn, made a formal referral to the Information Commissioner's Office over an alleged breach of data protection rules by members of the frontrunner's campaign team. It was seen by allies of Sir Keir as an attempt to undermine his campaign.
Thomas and Tonia met on social media and started messaging regularly about their shared passion for travel and their pet dogs. Thirty-four-year-old Thomas, from the West Midlands, was besotted and was planning their future together, but Tonia was actually a fraudster. "Tonia and I had so much in common and spoke every day for seven months. She was beautiful, funny and kind," he said. "Looking back now I can't believe how easy it was for her to take advantage of me. I had no idea she was tricking me into giving out my personal details so she could get money."
Facebook has had several of its Instagram and Twitter accounts hijacked by a group who previously took credit for hacking the social media profiles of more than a dozen NFL teams. OurMine published the same message via @Facebook and @Messenger on Twitter, saying it had taken control of the accounts to prove how easily their security measures could be bypassed. "Well, even Facebook is hackable but at least their security is better than Twitter," the post said.
Twitter has warned that hackers acting on behalf of governments may have accessed the phone numbers of some users. A security researcher discovered a flaw in its contacts upload feature in December that allowed him to access the phone numbers of senior politicians. Around that time, Twitter said it saw a "high volume of requests" to use the feature from Iran, Israel and Malaysia. It declined to say how many users' phone numbers had been exposed. In a statement published on its blog Twitter said: " It is possible that some of these IP addresses may have ties to state-sponsored actors. We are disclosing this out of an abundance of caution and as a matter of principle. It did not provide much detail on why it thought it could have been a state-based attack but one clue may lie in the fact that users in Iran appeared to have had access to the platform, even though Twitter is banned in the country.
Speaker-maker Sonos has apologised after accidentally revealing the email addresses of hundreds of its customers to each other. The firm upset people last week by saying it will stop issuing software updates for its older devices from May. A staff member was emailing customers who had complained about the decision. But instead of using the blind copy field, they used the regular copy all one, which meant that recipients could see each other's email addresses. In a statement to the BBC, Sonos said: "Earlier today, an email was sent in response to a number of customer inquiries that included email addresses. No further information was included. "We have apologised to each customer affected by this error and have put in place processes to ensure this will not happen again." The blanket email was sent to more than 450 people. It apologised for a delayed response and noted that Sonos had received an "unprecedented number of emails" in recent days.
Facebook has launched a new tool that lets people see which apps, businesses and websites are sharing their information with the social network. Many companies track what people do online and share that information with Facebook, to target adverts at them. The new tool lets people "clear" this "off-Facebook activity" data from their account and opt out of the information being used for targeted advertising. However, the data will not be permanently deleted.
Ring doorbells are providing customer data to companies such as Facebook and Google, an investigation suggests. The Electronic Frontier Foundation found the Ring app was "packed" with third-party tracking, sending out customers' personally identifiable information. Five companies were receiving a range of information, including names, IP addresses and mobile networks, it said. Ring said it limited the amount of data it shared.
Fraudsters "operate with impunity" as a surge in cases has left police struggling to cope, a report has found. Staff feel they cannot identify criminals and bring them to justice, the report said, at a time when there has been a 15% rise in cases. The report, by ex-Met Police Deputy Commissioner Sir Craig Mackey, found fraud now accounts for one-in-three crimes - but just 2% are detected. The Home Office said it will study Sir Craig's findings. The report also revealed fewer than 1% of police officers directly investigate fraud. And despite nearly 2,000 fraud offences being committed daily in England and Wales, just one in 50 is prosecuted. Sir Craig warned that a lack of proper investment and inadequate technology was hampering efforts to tackle the crime.
Microsoft has today announced a data breach that affected one of its customer databases. The blog article, entitled Access Misconfiguration for Customer Support Databases, admits that between 05 December 2019 and 31 December 2019, a database used for ?support case analytics? was effectively visible from the cloud to the world. Microsoft didn?t give details of how big the database was. However, consumer website Comparitech, which says it discovered the unsecured data online, claims it was to the order of 250 million records.
Today, we concluded an investigation into a misconfiguration of an internal customer support database used for Microsoft support case analytics. While the investigation found?no malicious use, and although most customers did not have personally identifiable information exposed, we want to be transparent about this incident with all customers and reassure them that we are taking it very seriously and holding ourselves accountable.
Dating app Grindr and a Twitter-owned advertising-tech firm have been accused of unlawfully sharing users' data. It is part of a wider investigation by the Norwegian Consumer Council (NCC) into the "out of control" advertising industry and profiling of customers. Along with four other ad-tech companies, they face huge fines if found to be in breach of EU data laws. Grindr said it was changing its consent platform while Twitter has temporarily disabled the relevant account.
The US National Security Agency (NSA) has discovered a major flaw in Windows 10 that could have been used by hackers to create malicious software that looked legitimate. Microsoft has issued a patch and said it had seen no evidence of the bug being exploited by hackers. The issue was revealed during an NSA press conference. It was not clear how long it had known about it before revealing it to Microsoft. Brian Krebs, the security expert who first reported the revelation, said the software giant had sent the patch to branches of the US military and other high-level users ahead of its wider release. It was, he wrote, "extraordinarily scary".
Cyber-security experts are urging Windows 7 users to upgrade their operating system. icrosoft is going to stop supporting Windows 7 from Tuesday so that it can focus on "newer technologies". As a result, Windows 7 users will no longer receive the all-important security updates and patches that keep their machines safe. One in four Windows users is running Windows 7, according to statistics website StatCounter.
Amazon has fired a number of employees after they shared customer email address and phone numbers with a third-party ?in violation of our policies.? The email to customers sent Friday afternoon, seen by TechCrunch, said an employee was ?terminated? for sharing the data, and that the company is supporting law enforcement in their prosecution. Amazon confirmed the incident in an email to TechCrunch. A spokesperson said a number of employees were fired. But little else is known about the employees, when the information was shared and with whom, and how many customers are affected. ?No other information related to your account was shared. This is not a result of anything you have done, and there is no need for you to take any action,? the email read to customers.
Dixons Carphone, the owner of Currys PC World and Carphone Warehouse, has been fined ?500,000 over a hacking that targeted millions of customer accounts. The Information Commissioner's Office (ICO) said the data of 14 million customers was compromised over a period of nine months between July 2017 and April 2018 - when the cyber attack was detected. Its investigation found that malware was installed on 5,390 tills at the company's Currys PC World and Dixons Travel stores. It meant, the watchdog said, that the attacker/s got unauthorised access to 5.6 million payment card details used in customer transactions.
Britain's biggest high street banks have been left unable to process foreign currency orders following the cyber attack on Travelex, which provides services for them.Royal Bank of Scotland, Lloyds Banking Group, Barclays and HSBC are among more than a dozen major banks having problems after the New Year's Eve ransomware attack.
Amazon, Alphabet, Alibaba, Facebook, Tencent - five of the world's 10 most valuable companies, all less than 25 years old - and all got rich, in their own ways, on data. No wonder it's become common to call data the "new oil". As recently as 2011, five of the top 10 were oil companies. Now, only ExxonMobil clings on. The analogy isn't perfect. Data can be used many times, oil only once. But data is like oil in that the crude, unrefined stuff is not much use to anyone. You have to process it to get something valuable. You refine oil to make diesel, to put it in an engine.
Police say more than 3,000 people, most of them elderly, have been duped into withdrawing large sums of cash and handing it to someone posing as a courier or police officer. In October, a couple from Dorset lost almost ?1m, including their pensions and all their savings. "This is a despicable crime," said Cdr Karen Baxter of City of London Police. The Dorset couple were left with just ?187 after the fraudsters went back time and again. They are typical victims of courier fraud, according to Cdr Baxter.
Austria's foreign ministry has been targeted by a cyber-attack that is suspected to have been conducted by another country. The ministry said the seriousness of the attack suggested it might have been carried out by a "state actor". The hack started on Saturday night and experts warn it could continue for several days. The breach occurred on the same day Austria's Green party backed forming a coalition with conservatives . It was recognised very quickly and countermeasures taken immediately, the foreign ministry said in a statement. "Despite all intensive security measures, there is never 100% protection against cyber-attacks," the ministry said.
The government has apologised "to all those affected" after it accidentally published addresses of more than 1,000 New Year Honour recipients online. The file - which included details of senior police officers and politicians - was uploaded to an official website on Friday evening and removed Saturday. The Cabinet Office told the BBC it was "looking into how this happened". Among the addresses were those of Sir Elton John and former director of public prosecutions Alison Saunders. Also on the list of 1,097 honours recipients were high-profile names such as cricketer Ben Stokes, former Conservative Party leader Iain Duncan Smith, TV cook Nadiya Hussain, and former Ofcom boss Sharon White.
Facebook is to stop using members' phone numbers in its friends recommendation system in 2020 following concern about privacy implications. Users can choose to have a code sent to their mobile phones when logging in to make access harder for hackers. But Facebook admitted it also fed the numbers into targeted advertising and friend recommendation systems. The company says it will have completed the changes - part of a settlement with US regulators - during 2020.
This report provides technical details of some of the most common incident trends observed in the UK, across all sectors, by the NCSC?s Incident Management Team, in recent months. For each incident type, we also provide detailed technical guidance on how to defend against them, and recover from them. This report covers the period from October 2018 to April 2019.
A German internet service provider faces a €9.6m ($10.6m; £8m) fine after being accused of failing to carry out tough enough customer ID checks. Germany's data protection watchdog said anyone who called 1&1 Telecom could get extensive personal information about someone else solely by giving their name and date of birth. Fraudsters can easily collect such details from social networks and elsewhere on the net. But the firm is challenging the ruling. It said it did not accept the decision and intended to sue the authority. The sum represents one of the largest penalties imposed under the EU's GDPR (General Data Protection Regulation).
There is a data revolution transforming just about every aspect of our lives. And on Tech Tent this week we look at two areas - surveillance and health - where we have rather different attitudes to how our personal data is used. When it comes to the mass retrieval of facial recognition data and its use in security and surveillance, China certainly leads the way. It has been used everywhere from schools to shops to public parks, to verify identity.
A company which helps big businesses uncover security holes in their platforms has itself been hacked. HackerOne, which pays hackers who find bugs in products, services and websites for the likes of Uber and Goldman Sachs, was breached by one of its own community members. The vulnerability was exposed by a user with the handle haxta4ok00. Following the incident, HackerOne has paid $20,000 (?15,224) to haxta4ok00 for exposing the flaw. A HackerOne spokesperson said in a statement: "Last week, while reporting a vulnerability to HackerOne, a hacker had access for a short time to information relating to other programs running on the HackerOne platform.
US authorities have filed charges against two Russian nationals alleged to be running a global cyber crime organisation named Evil Corp. An indictment named Maksim Yakubets and Igor Turashev - who remain at large - as figures in a group which used malware to steal millions of dollars in more than 40 countries. Those affected by the hacks include schools and religious organisations. It is also alleged that Mr Yakubets worked for Russian intelligence. Speaking at a news conference, Assistant Attorney General Brian Benczkowski said the attacks were among "the worst computer hacking and bank fraud schemes of the past decade". Mr Yakubets is accused of leading Moscow-based Evil Corp, while Mr Turashev allegedly acted as an administrator. The pair are thought to be in Russia.
A German internet service provider faces a ???9.6m ($10.6m; ??8m) fine after being accused of failing to carry out tough enough customer ID checks. Germany's data protection watchdog said anyone who called could get extensive personal information about someone else solely by giving their name and date of birth. Fraudsters can easily collect such details from social networks and elsewhere on the net.
security weakness in Google's Android software has let cyber-thieves craft apps that can steal banking logins. The bug lets attackers create fake login screens that can be inserted into legitimate apps to harvest data. Called Strandhogg, the vulnerability can be used to trick users into thinking they are using a legitimate app but are actually clicking on an overlay created by the attackers.
The UK's National Crime Agency (NCA) said 14,500 people had bought spying tools from the Imminent Methods site. Imminent Methods sold a tool known as the Imminent Monitor Remote Access Trojan (Imrat) for about $25 (??19). It gave the attacker full access to an infected device, letting them steal data, monitor what the victim was doing and even access their webcam.
One customer cancelled her Netflix service in April 2019, but found her account had been charged £11.99 in Septmeber. She said 'I tried to login to my account, but it said my email and password had not been recongnised. It turns out that criminals had changed my login details completely and has signed me up for the most expensive service.'
This is another example of a Digital Footprint causing problems. The criminals will have obtained email addresses and possibly even 'old' passwords from data leaks and then used these to attempt to hijack well known accounts on online platforms.
If you thought only your bank accounts were a target for hackers, think again. London-based cybersecurity company?DynaRisk?published a list?of the top 20 sites where accounts are most often targeted and sold in hacker communities.?Some of the names on the top 20 were popular sites like Netflix, Spotify, Amazon and more.
A cyber-attack on a hospital in Rouen has caused 'very long delays in care'. Medical staff where forced to abandon PCs as ransomware made them unusable. France's national cyber-crime agency, helped limit the scale of the outbreak.
This article also has an interesting video explanation of ransomware.
Since Disney+ went live, attackers have stolen thousands of customers' accounts and put them up for sale on the dark web, according to a report. But the firm says it does not believe its systems have been compromised. The statement indicates that members' details have been stolen by other means. That could involve spyware on users' devices or the re-use of login details stolen from elsewhere.
What looks like a flaw in the Disney online platform turns out to be ID Fraud made possible my consumers' Digital Footprint putting them at danger. Data breaches have made hundreds of thousands of peoples email addresses and passwords available to criminals. Using this information it then becomes possible to hijack online accounts if customers continue to use the same passwords or ones that are easy to guess.
Check out the latest scam information as provided by Halifax bank. Halifax say, 'Scams come in all shapes and sizes, from dodgy emails to fake sites. And they keep changing to try and trick you. Stay one step ahead by learning about the latest scams.'
Google has gained access to a huge trove of US patient data - without the need to notify those patients - thanks to a deal with a major health firm. Google can access health records, names and addresses without telling patients, according to the Wall Street Journal, which first reported the news. Among the data the tech giant reportedly has access to under the deal are lab results, diagnoses, records of hospitalisation and dates of birth.
West Berkshire Council sent a leisure survey on Friday to 1,107 recipients who could all see each other's email addresses. The council said it has reported the incident to data protection watchdog the Information Commissioner's Office (ICO).
A university is investigating after mistakenly sharing the personal details of about 2,000 students in an email promoting a lecture. The email from the Creative Arts school at the University of Hertfordshire included an attachment with the recipients' names and email addresses. The university said it had contacted the data protection watchdog, the Information Commissioner's Office.
Degree-educated savers are more at risk of losing their pension to fraudsters than those without the qualification, a survey by regulators has suggested. Some 14% of people with a degree told regulators they would accept a review from a company they did not know. Pension scams start with an unexpected call, text, social media approach or email - offering a free pension review, or a way to make attractive returns on pension savings. But the money may be simply stolen or transferred into a high-risk scheme completely inappropriate for retirement savings.
Cyber-security company Trend Micro says the personal data of thousands of its customers has been exposed by a rogue member of staff. The company says an employee sold information from its customer-support database, including names and phone numbers, to a third party. It became suspicious after customers started receiving phone calls from scammers posing as Trend Micro staff. Trend Micro said it believed approximately 70,000 of its 12 million customers had been affected.
A massive data breach can cause chaos within a company and put IT staff under extreme stress. In September 2017 Equifax, one of the world's biggest credit score agencies, was hacked. Cyber-criminals had accessed customer data such as social security numbers, birth dates and credit card details. Ultimately the beach affected at least 147 million people in the US, 14 million UK citizens and 100,000 Canadians.
A recent study by the UK's National Cyber Security Centre found that millions of us are using the same passwords to protect our valuable data. Football teams, popular shows and characters, your name, or just the word 'password' are not great ways to secure your data.
Facebook has agreed to pay a ??500,000 fine imposed by the UK's data protection watchdog for its role in the Cambridge Analytica scandal. As part of the agreement, Facebook has made no admission of liability. The US firm said it 'wished it had done more to investigate Cambridge Analytica' earlier.
Fraudsters have stolen thousands of pounds from Currys PC World customers after hijacking the retailer's eBay account. Criminals were able to change payment details on a number of eBay listings. This enabled them to siphon money from unwitting customers who paid for goods via a PayPal account.
Identity theft is at an all-time high in the UK. The UK's fraud prevention service CIFAS recorded 190,000 cases in the past year, as our increasingly digitised lives make it easier than ever for fraudsters to get their hands on our personal information. So how should we keep our identities secure online? The first line of defence is, more often than not, a password.
Police forces and the National Crime Agency are generally effective at tackling cyber-dependent crime, according to a new report. However there are too many local variations in the response to a national threat.
Amazon Echo and Google Home speakers have been compromised by apps modified to spy on users, without them knowing, after being approved by the technology companies.
Britain's cyber-defence centre has thwarted more than one million cases of suspected payment card fraud in the last year, its annual review reveals. It said it had stopped more than 1,800 cyber-attacks aimed at UK citizens and businesses in its first three years.
When Doug Varey clicked on a pop-up ad offering computer security protection for 12 years for ??556, he signed up. That was a mistake. Mr Varey was a victim of a common online scam known as computer software service fraud, which ended up costing him some ??4,000. Indian police have shut two call centres and arrested seven people suspected of involvement in the scam.
A large-scale "sextortion" campaign is making use of a network of more than 450,000 hijacked computers to send aggressive emails, researchers have warned. The emails threaten to release compromising photographs of the recipient unless $800 (??628) is paid in Bitcoin.
Jack Monroe says she has lost about ??5,000 after her phone number was hijacked and re-activated on another Sim card. The criminals were then able to receive her two-factor authentication messages and access her bank and payment accounts.
A senior manager at Eurofins, the UK's biggest forensic services provider which was hit by a cyber-attack in June, has warned the country to 'ready itself' for further attacks.
'Action Fraud is the UK???s national reporting centre for fraud and cybercrime where you should report fraud if you have been scammed, defrauded or experienced cyber crime in England, Wales and Northern Ireland.
The Telephone Preference Service (TPS) is a free service. It is the official central opt out register on which you can record your preference not to receive unsolicited sales or marketing calls. It is a legal requirement that all organisations (including charities, voluntary organisations and political parties) do not make such calls to numbers registered on the TPS unless they have your consent to do so.
The Mailing Preference Service (MPS) is a free service set up and funded by the direct mail industry to enable consumers to have their names and home addresses in the UK removed from lists used by the industry. It is actively supported by the Royal Mail and all directly involved trade associations and fully supported by The Information Commissioners Office (ICO).
Three US hospitals have been forced to temporarily close their doors to 'all but the most critical new patients' following a ransomware outbreak.
A software engineer at Yahoo stole sexual videos and images from thousands of young women's accounts while working at the company. The 34-year-old from Tracy, California, accessed 6,000 Yahoo accounts including those of personal friends and work colleagues, US prosecutors said.
Microsoft has released an emergency update for its Internet Explorer browser to fix a bug that cyber-thieves are known to be exploiting. The bug could let attackers hijack a web browser and use their access to install malware, it warned.
Facebook has confirmed about 200 million phone numbers from members have been exposed in an online database. The company said it was investigating who had compiled the database and left it online unprotected.
The recorded telephone calls of 200,000 customers were left exposed on a cloud server for three years, an investigation by Verdict found.
The co-founder and chief executive of Twitter had his own account on the service briefly taken over by hackers.
Security researchers at Google have found evidence of a ???sustained effort??? to hack iPhones over a period of at least two years. The attack was said to be carried out using websites which would discreetly implant malicious software to gather contacts, images and other data.
It is a familiar experience - you are surfing the web, perhaps looking at an online shoe shop, and half-an-hour later when you are on Facebook an advert pops up for the very pair of shoes you have been looking at.
The number of data breaches reported and records exposed both increased by more than 50 percent during the first half of 2019 compared to the same period in 2018.
Twenty-three-year-old Bree Kotomah almost gave up on a burgeoning career in fashion design when hackers compromised her business's Instagram account in November 2018.
A software developer accused of stealing data from finance company Capital One took files from over 30 other organisations, prosecutors claim.
A new system designed to tackle fraud in online shopping has been delayed for 18 months. Banks and retailers had been expected to introduce a new layer of security from mid-September.
Wikipedia,'This is a list of data breaches, using data compiled from various sources, including press reports, government news releases, and mainstream news articles. The list includes those involving the theft or compromise of 30,000 or more records, although many smaller breaches occur continually.
The personal data of students and applicants has been stolen in a 'sophisticated and malicious' phishing attack at Lancaster University. Officials said the information had been used to send bogus invoices to undergraduate applicants.
The Federal Trade Commission had alleged the Atlanta-based firm failed to take reasonable steps to secure its network. The records of at least 147 million people were exposed in the incident.
More than ??190,000 a day is lost in the UK by victims of cyber-crime, police statistics show. More than a third of victims in that period fell prey to the hacking of social media and email accounts. Action Fraud said ??34.6m was reported to be stolen from victims between April and September 2018, a 24% increase on the previous six months.
The UK's independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
If you are worried about identity theft you could also opt for protective registration with anti-fraud organisation Cifas, which costs ??20 for two years. It will place a marker against your name so member firms ??? which include most banks, lenders and insurers ??? will action extra checks when you make applications to make sure it is really you.
Airport email scam thwarted by UK's cyber-defender NCSC
The National Cyber Security Centre, Helping to make the UK the safest place to live and work online
British Airways has revealed that hackers managed to breach its website and app, stealing data from many thousands of customers in the process.
British Airways faces record ??183m fine for data breach,British Airways is facing a record fine of ??183m for last year's breach of its security systems.