Industry News: ESG5

The target: Orbitz, a subsidiary of online travel agency Expedia Inc.

The take: Payment card information and personal data such as billing addresses, phone numbers, and emails.

The attack vector: About 880,000 payment cards had been hit by a security breach. The attacker may have accessed personal information that was submitted for certain purchases made during an entire year.

Read more...

2019-04-15

Fortune: It’s no secret that private equity has been on a cybersecurity kick as of late—and for good reason. With online attacks and digital fraud only becoming more prevalent, global spending on technology to protect sensitive data and information is expected to reach an unprecedented $124 billion this year, according to research firm Gartner...

2019-04-16

Forbes: The arrest of Wikileaks founder Julian Assange marks the first step toward bringing to court one of the most prominent cyber crimes in American history. With cyber-threat actors making a living off of hacked information, it should come as no surprise that U.S. government intelligence agencies are shifting focus and resources to address the issue, which includes $15 billion set aside from the President’s budget for cybersecurity-related activities...

2019-04-16

Reuters: Russia’s lower house of parliament approved on Tuesday the third reading of a draft law that aims to increase Moscow’s sovereignty over its Internet segment and defend against foreign meddling, Interfax agency reported. The bill must now be approved by parliament’s upper house and the presidency before passing into law. The bill’s authors said earlier that the measures are needed to defend the country after the United States adopted what they described as aggressive new cyber security policies last year...

2019-04-15

ZDNet:  Pregnancy club Bounty UK Limited has been fined £400,000 for illegally sharing and selling information belonging to 14 million individuals without their explicit consent. The fine was imposed by the UK's data protection watchdog, the Information Commissioner's Office (ICO). Personal data relating to pregnancy, new mothers, mothers-to-be, and the birth dates & sex of children were shared. The ICO said the data was collected from those who were "potentially vulnerable."...

2019-04-11

Nypost:  City Hall’s bumbling tech czar previously held a similar job in Atlanta — which was crippled by a cyberattack shortly after he left for the Big Apple. Samir Saini, who’s enmeshed in a scandal over an entirely preventable crash of the city’s in-house wireless network, was Atlanta’s chief information officer when Mayor Bill de Blasio named him head of the Department of Information Technology and Telecommunications in January 2018...

2019-04-15

ZDNet:  A hacker who spoke with ZDNet in February about wanting to put up for sale the data of over one billion users is getting dangerously close to his goal after releasing another 65.5 million records last week and reaching a grand total of 932 million records overall. The hacker's name is Gnosticplayers, and he's responsible for the hacks of 44 companies, including last week's revelations...

2019-04-16

eWeek:  BlackBerry is a very different company today than it was a decade ago, as the one-time mobile giant is now firmly positioning itself to be a global player in the cyber-security market. Among the new assets in the BlackBerry security portfolio is Cylance, which BlackBerry acquired in a $1.4 billion deal announced in November 2018. Cylance is, however, only one of many cyber-security technologies within BlackBerry. In a video interview with eWEEK, BlackBerry CTO Charles Eagan explains what his company is now doing in cyber-security as it transitions away from its mobile device past...

The target: Timehop, an application which aggregates old posts and photos from user’s social media feeds.

The take: Personal information including some combinations of name, e-mail address and phone number, to a total of 21 million records.

The attack vector: An account with administrative access to Timehop’s cloud computing environment was not protected with two-factor authentication – the attacker accessed the account, created a separate administrator credential for their own use in December of 2017. The attacker maintained access and performed reconnaissance for eight months until they proceeded to exfiltrate user data in July of 2018.

Read more...

2019-04-08

Security Week:  JPMorgan Chase spends Roughly $600 Million Annually on its Security Efforts, and Employs Around 3,000 People Involved With Cybersecurity. In his annual letter to shareholders, Jamie Dimon, chairman and CEO of JPMorgan Chase discusses the position and role of the bank in America and the American economy. Against a background of strong performance ($32.5 billion in net income on revenue of $111.5 billion in the last year...