Welcome to GearBrain's Weekly Data Breach Report, a collection of known breaches into company databases where someone you don't know got access to your personal information. The frequency at which these break-ins happen appears to be growing, so every week we'll update our report with fresh news on the latest hacks and links on where you can go if there's action to be taken — whether you're concerned about your privacy or not.
This week news on data breaches involved a number of groups from popular Japanese retailer Uniqlo to a school district in Connecticut, plus if you have a WhatsApp account, you need to update your app pronto.
- More than 15 percent of used drives sold on eBay still have personal data
- 5 ways to stay secure online
- Two-thirds of hotel websites found to leak personal guest data
Week of May 20th - 49 million Instagram users have contact details exposed
Almost 50 million high-profile users were affected
This week, it emerged that the location and contact details — including phone numbers and email addresses — of 49 million Instagram users were exposed online. The data belonged to so-called influencers, who have a large following on Instagram and earn a living from the Facebook-owned image sharing site.
The database was traced to Chtrbox, a Mumbai-based marketing company which had stored the information on an Amazon server but failed to protect it with a password.
Chtrbox says the database was only exposed publicly for 72 hours, and has since been taken offline. It appears the contact details were gathered by 'scraping' them from the affected users' Instagram accounts, a practice which violates the social media site's policies.
Instagram says it is speaking with Chtrbox to understand how the data was obtained. The marketing company says it had not purchased any data that had been obtained by "unethical means."
Georgia Tech offers ID theft protection and credit monitoring to data breach victimsiStock
In the wake of a data breach which saw a database containing the personal details of 1.3 million people unlawfully accessed, Georgia Tech has offered credit monitoring and identification theft protection to everyone affected.
Georgia Tech disclosed in April that someone illegally accessed a database that may have included the names, addresses, birth dates and Social Security numbers of almost 1.3 million people, including past and present students, staff, and other people associated with the university.
Jim Fortner, Georgia Tech's interim executive vice president for administration and finance, said: "We regret that this incident occurred and apologized for any inconvenience."
Offering such services is standard procedure for when a database like this has been accessed, even if the target company or institution is unsure if any data was actually stolen.
Seattle blood bank announces loss of patient data
Bloodworks says documents went missing from an employee's desk
Bloodworks, a Seattle-based blood bank, announced this week that the private details of patients may have fallen into the wrong hands. But instead of being the victim of a cyberattack, or carelessly leaving sensitive data on an unencrypted server, Bloodworks says a document has gone missing from an employee's desk.
A statement admitted: "The document contained certain patient information, including name, date of birth, and medical diagnosis." Bloodworks describes the incident as a "data privacy event" on its website.
Thankfully, it said that no Social Security numbers or financial account information was held in the lost document. Bloodworks said it is now in the process of informing patients whose details appeared in the document, providing them with information on how to place a credit freeze against their name, or add a fraud alert to their credit file.
A phone line has been setup for anyone who thinks they may have been affected by this incident. The toll-free number is 1-800-363-3903 and is open Monday through Friday, between 8:00am and 5:00pm PST.
Shubert Organization admits February data breach, credit card details stolen
The New York-based organization owns 17 Broadway theaters
The Shubert Organization, owner of 17 Broadway theaters, admitted this week that it was the victim of a data breach which began on February 8 and lasted for three days.
Contacting affected customers by letter this week, Shubert said data potentially taken during the breach included customer names, email addresses, credit card numbers and card expiry dates. Affected customers are being offered 24 months of free credit monitoring through TransUnion Interactive to help protect them from further personal damage.
Shubert told its customers it become aware of "unusual activity related to an employee's email account" on February 11 this year, and a subsequent investigation revealed "unauthorized access to some employees' email accounts" during the previous three days.
The company told customers: "While the investigation was unable to confirm the scope of the information that was accessed within the affected email accounts, Shubert is notifying you in an abundance of caution because we have confirmed that your information was present in the affected email accounts."
Week of May 13th — Uniqlo's online site has been breachedUniqlo store in New York City, USA
Uniqlo, the Japanese clothing store known for their T-shirts and well-priced basics is involved in a data breach that hit its parent company, Fast Retailing. The breach involves more than 461,000 customers that shopped on the Uniqlo online site between April 23 and May 10. Hackers gained access to personal data, with Fast Retailing stating that names, addressees, gender, date of birth and other contact information — including credit card expiration dates — "may have been browsed," on its web site.
Customers should change their passwords if they've shopped with the firm — and Fast Retailing itself suggests that people should not use the same password from other sites, nor one that people can easily guess.
West Hartford Schools has a test registration problem
A company that handles registration for AP tests and other exams for West Hartford schools has been breached
A company that registers students for tests such as those for advanced placement courses, may have been breached according to a story in the Hartford Courant. Parents received a note from the West Hartford school district telling them that names, grade level, emails, date of birth and other personal details about their children may have been breached by the company. Social Security numbers and credit card details were not involved.
If you use WhatsApp, you need to read this now
WhatsApp is asking its 1.5 billion users to update their app to avoid being affected by a malware called Pegasus
While data may not have been exposed from the security breach impacting messaging platform WhatsApp, that doesn't mean the danger isn't present. Hence the call from the company — to everyone of its 1.5 billion users — to update the app to ensure they have a patch for spyware called Pegasus.
The malware, while not thought to have affected the general user base of WhatsApp, attacks mobile devices like smartphones. How easy it is for the spyware to get on to the app? An attacker makes a WhatsApp call to someone — and even if the person doesn't pick up, the malware can harvest emails, messages, get into their camera and microphone and much more.
The attacker can also erase traces of the call, wiping logs clean so that the victim never knew the malware had infected their device, or been used against them. Use WhatsApp? Update the app people.
Week of May 6th - Data breeches are a ticking time bomb
Data breaches are a time bomb, expert warns
Before we delve into this week's data breaches, we would like to draw your attention to a report published by Verizon. The report, built with data from over 41,000 security incidents and 2,013 data breaches provided by 74 public and private data sources spanning 86 countries, found that 69 percent of breaches are perpetrated by outsiders.
It was also revealed that 39 percent were the work of organized criminal groups, and in 23 percent of cases, data breaches involved actors identified as nation-state or state-affiliated. 53 percent of breaches featured hacking, 33 percent exploited social media, 28 percent involved malware, 21 percent were blamed on errors, and four percent were the result of physical actions.
The vast majority of victims — 43 percent - were small businesses, followed by public sector entities (16 percent), healthcare organizations (15 percent), and financial entities (10 percent).
Commenting on the report, Bryan Sartin, Verizon's head of global security services, told the BBC described data breaches as a "time bomb", adding: Compromises happen in minutes and then extend out to hours, days, weeks and sometimes months. Yet we are still looking at months for them to be discovered...When it comes to account takeover, senior executives are getting hit hard right now. Humans are the weakest link in the chain especially when they are on their mobile devices."
Freedom Mobile user data gets a little too much freedom
The network claims 15,000 customers had their data leaked by an unencrypted server
Freedom Mobile, Canada's fourth-largest cell network, has become victim to a data breach which saw a server leaking five million logs containing customer data. According to security researchers Noam Rotem and Ran Locar, the server wasn't protected with a password, so anyone could access it.
Speaking to TechCrunch, the pair said it took Freedom Mobile a week to secure the leaking database after first being informed about it. Unencrypted data presented by the security researchers showed customer names, email addresses, phone numbers, postal addresses, dates of birth, customer types and their Freedom mobile account numbers. Answers to credit check questions asked by Equifax were also included, along with whether an applicant was accepted or rejected, and the reason why.
A spokesperson for the cell network said around 15,000 of its 1.5 million customers were affected by the leaky server. Specifically, customers who opened or made changes to their accounts between March 25 and April 15 at 17 Freedom Mobile retail locations had their data set free, along with any customer who made changes or opened an account on April 16, regardless of retail location.
Indiana is suing Equifax over massive 2017 cyberattack
Over 140 million people were affected by the 2017 data breach
Indiana is suing Equifax over the 2017 data breach which affected over 140 million people, of which almost four million were from the US state. The lawsuit accuses Equifax, a major credit bureau, of failing to protect the personal information of the Indiana residents who were exposed by the breach.
Attorney general Curtis Hill said: "Hoosiers trust us to work hard every day to ensure their safety and security. This action against Equifax results from an extensive investigation, and we will continue our diligent efforts to protect consumers from illegal or irresponsible business."
Data stolen during the breach, which spanned from May 13 to July 30, 2017, included names, Social Security numbers, birth dates, addresses and, in some cases, driver's license numbers.
Week of April 29th — Unknown data base is unprotected with 80 million accounts
Here, we have a security breach that is no one's fault — well, no one anyone can pin it on. The breach is online, and in the form of a database, and was discovered by VPNMentor — with 80 million households affected, the security firm said. There are names, addresses, birth dates and even if these people own home or not — oh, and the address of those homes as well. Everyone on there is over 40 (yes, that means if you're a Millennial you're safe.) VPNMentor can't even find out who owns the database, which means it can't be locked down. Fun.
Inmediata Health Group
If this is your health provider, your name, address, gender, date of birth and your medical claim information may have been compromised in a recent data security breach of Inmediata Health Corp. The health care provider is reaching out to patients — quite exhaustively as it turns out, reports Health IT Security, with people reporting they're getting letters, but for other people as well as themselves. Confusing.
After a hack in March 2017 of the clothing company Eddie Bauer, Veridian Credit Union filed a class-action lawsuit for its own customers. That suit ended in a settlement of a whopping $9.8 million. Don't start shopping for cars yet — or even a new Eddie Bauer jacket. Each customer, represented by the suit, is walking away with (wait for it) — $2. That's a large cup of java from your local deli, or a banana (and not the cappuccino) from Starbucks.
Week of April 22 - Bodybuilding.com urges password reset
Bodybuilding.com, the internet's largest online store and forum for fitness and bodybuilding admitted this week it was the victim of a security breach sometime in February 2019. The website, which has over seven million registered users on its forums, and receives over 30 million visitors per month, said it isn't sure if customer data has been stolen.
The site reassured users that full credit card numbers are not stored - only the last four digits, if a user has requested this be saved - but cannot be certain that other personal information wasn't stolen. But information that might have been accessed unlawfully includes user names, email addresses, billing and shipping addresses, phone numbers, order history, any communications with the website, birthdates, and any information added by users to their BodySpace profile.
Bodybuilding.com says it has found a remedy for the incident, and has coordinated with law enforcement authorities. Users are urged to change their password immediately, otherwise Bodybuilding.com will reset them on June 12. The cause of the breach appears to have been a phishing email sent to the site in July 2018.
EmCare, a provider of physician practice management services, this week announced it was addressing a "data security incident" that involved the personal information of some patients, employees and contractors. The hackers gained access to employee email accounts that contained the personal information of as many as 60,000 individuals, half of whom are patients.
The breach was discovered back on February 19, and EmCare has now admitted the unlawfully accessed data may include names and dates of birth, plus clinical information for some patients. In some instances, the company said, social security and driver's license numbers were affected. EmCare says it has arranged for identity protection and credit monitoring service for patients and employees affected by the breach.
Facebook (yet again)
Canadian regulators said tis week that Facebook has broken the country's privacy laws, and they will be taking the social network to court. Canadian officials say Facebook "committed serious contraventions of Canadian privacy laws" when the personal data belonging to over 87 million Facebook users worldwide was leaked as part of the Cambridge Analytica scandal on 2018. The data included that belonging to 622,000 Canadians.
A report by the Privacy Commissioner of Canada and the Information and Privacy Commissioner from British Columbia concluded Facebook has not done enough to prevent the mishandling of user data collected through a Facebook app called This is Your Digital Life. Commissioners said Facebook used "superficial and ineffective safeguards and consent mechanisms."
Later in the week, the New York attorney general's office announced it has opened an investigation into Facebook. This comes after a discovery earlier in April that Facebook had the email contacts belonging to over 1.5 million people without their consent.
Attorney General Letitia James said: "It is time Facebook is held accountable for how it handles consumers' personal information. Facebook has repeatedly demonstrated a lack of respect for consumers' information while at the same time profiting from mining that data."
Week of April 15 — The FBI gets hacked
Hackers hit the servers belonging to a group connected to the FBI — and not only walked away with names, jobs, email addresses and in some situations, the physical addresses, publishing them online. More than 23,000 people were affected in total, hundreds of them law enforcement people, after the hackers broke into the online database of three local chapters of the FBI National Academy Associates.
If you use Microsoft Outlook, this may not sit well. Hackers gained access to Outlook, allowing them to read user's emails for months. In this case, the data breach came after hackers stole the login details from a Microsoft customer service agent. Microsoft has cut off the hackers — but between January 1 and March 28, about 6 percent of customer accounts were basically open to them. Next steps? You know what we're going to tell you: Change your password.
IT firm Wipro is not a name that most of us would know as companies outsource their IT needs to this firm. But KrebsonSecurity reported this week that its own systems were used to attack clients, based on phishing attacks on Wipro's own people. (Hint: Do not click on emails from people you don't know.)
Week of Monday, April 8: Don't panic, but a hotel has probably mishandled your passport
This week, cybersecurity research firm Symantec revealed how the websites of over 1,500 hotels in more than 50 countries accidentally leak private customer information. The problem is to do with how the websites send customers an email, with a link which takes them directly to their booking details - no need for a username, password, or even an account with the site.
That would normally be fine, but the webpage contains adverts, which means advertisers and other companies could have direct access to customer details, including their name, postal address, email address, and passport number.
The report comes soon after Marriott International disclosed in November how it had exposed 500 million guest records, in one of the largest-ever data breaches. However, Symantec said Marriott was not included in its study of hotel websites.
Makers of an indoor gardening system AeroGarden, sought to nip bad news in the bud this week, contacting customers about a data breach which it discovered in early March. Customers were told how their credit card information had been lifted from AreoGrow's website by a piece of malware which was active between October 29, 2018 and March 4.
Planted in AeroGarden's payment processing page, the malware potentially scooped up payment card numbers, expiry dates, security codes and other customer data. The company was at pains to say customer's security PINs and social security numbers were not stolen.
In a bid to turn over a new leaf, AeroGarden says it has informed law enforcement and will give victims a year of free identity protection services from Experian.
Yahoo — now owned by Verizon — is this week trying to settle the breach of three billion of its user accounts with a $117.5 million payout. This comes after a judge rejected the company's first offer of just $50 million.
The breach, which took place between 2013 and 2016, affected all three billion Yahoo user accounts worldwide, making it the largest data breach in history. The compensation package is made up of $55 million for compensating victims who took yahoo to court via a class action lawsuit, plus $24 million for credit monitoring.
Information which may have been stolen during the breach, which wasn't disclosed by Yahoo until 2017, may have included users' names, email addresses, phone numbers, and dates of birth, as well as a trove of encrypted and unencrypted passwords.
British Home Office
Meanwhile, the UK Home Office apologized to hundreds of European Union nationals this week, seeking settled status in the UK, after it accidentally shared their email addresses — by forgetting to use the 'blind CC' option.
Blamed on a "administrative error," the data gaffe revealed 240 personal email addresses to all 240 people the email was sent to; it is likely that this was a breach of the UK's Data Protection Act, and the Home Office may be forced to apologize in Parliament.
Week of April 1, 2019: Planet Hollywood, hit Facebook (yeah, again)
It hardly seems news anymore when we hear about Facebook getting breached. But here we are — a year after the Cambridge Analytica scandal — finding that more than 540 million of its users profile information apparently landed on publicly — yes, publicly — on Amazon cloud servers, according to cybersecurity company UpGuard. Two different developers, Cultura Colectiva and the "At the Pool" app makers apparently hadn't followed the rules on how to store the data they had from Facebook on users who played with its apps. This one wasn't great (of course no breach is great) as it included passwords, names, comments and even what people liked. Again, it's likely time to change your Facebook password.
Georgia Institute of Technology, commonly known as Georgia Tech, also managed to lose possession of the data around 1.3 million students and faculty at the leafy university. The breach wasn't anywhere as big as Facebook's, but the details exposed were problematic: not just names, but addresses, birth dates and social security numbers. Basically, this is everything you need to open a credit line or create a new identity. The school, actually known for its cybersecurity program, found out in late March and says it has locked everything down.
UPDATE: On April 10, the university said it has hired two firms to review the lapse in cyber security. Virginia-based Mandiant will investigate how the breach took place and the method hackers used to gain access. Meanwhile, Atlanta-based Ankura will analyze the data which was taken.
Toyota discovered that up to 3.1 million pieces of information may have been nabbed by hackers who broke into its network. These details were tied to eight different subsidiaries – including the Corolla line and also its luxury line, Lexus. Credit card details weren't part of this hack, but that's often the least concern as those companies can't force consumers to be responsible for chargers made in situations like these. Toyota isn't completely sure that the information was leaked and the company says it's monitoring the situation. As you should too.
Planet Hollywood, Buca di Beppo and.....
Finally, if you ate at a Planet Hollywood, Buca di Beppo, Chicken Guy, Mixology, Tequila Taqueria or the Earl of Sandwich, part of Earl Enterprises, between May 23, 2018 and March 18, 2019, you may want to take a gander at your credit and debit card statements. Software installed on the point of sale machines may have grabbed your credit card number, expiration date and even our name. Brian Krebs, always on it, reported that two million credit and debit card numbers from customers who ate at Earl Enterprises were floating around for sale. The breach apparently may have hit three locations in Disney Springs — Planet Hollywood, Earl of Sandwich and Chicken Guy — and all of the Buca de Beppo spots. Get online, check your bank and credit card statements, and perhaps think of cooking in tonight at home.