Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Financial Data. Show all posts
private
Agent Tesla Email Financial Data malware private

Tesla Users Targeted by Dangerous New Malware: What You Should Know

 



Tesla has often made headlines lately, but this new problem is not connected to Elon Musk or his cars. Instead, it involves cybercriminals who are trying to steal people’s private information using a dangerous software called Agent Tesla.

Here’s a clear explanation of how the attack works and what you need to stay safe.


Attackers Use Clever Tricks to Spread Malware

Researchers from Unit 42, the security team at Palo Alto Networks, have reported a new online threat. This time, hackers are sending fake emails to people, pretending that important documents like invoices or payment receipts are attached.

When someone opens the file, it quietly triggers a hidden script. This script then downloads a second program called PowerShell, which runs silently from the computer’s temporary folder, making it much harder for antivirus software to detect.

Once the script is active, the attack can follow one of two different paths: it either launches a .NET file or an AutoIt dropper. Depending on which one is used, different types of harmful programs are installed on the victim’s device. Although each step of the attack is simple, when combined, they make the entire process harder to spot and stop.


What is Agent Tesla?

One of the main threats delivered by this campaign is Agent Tesla. Agent Tesla is a type of malware known as a Remote Access Trojan (RAT). It allows hackers to secretly access and steal important information from an infected device. Once inside, it can gather:

1. Usernames and passwords

2. Email contacts and communication details

3. Financial data

4. Saved information from web browsers

5. Screenshots from the user’s computer

6. Information from email apps

7. Records of everything typed (keystrokes)

It can even read private email and chat messages, making it very dangerous for both individuals and businesses.

The same attack campaign was also seen using other malware like Remcos RAT and XLoader, but Agent Tesla was a major part of the operation because of its strong data theft abilities.


Be Careful With Unknown Emails

Since the attack begins with a simple email, it’s important to stay cautious. Avoid opening attachments you weren't expecting, especially if the email asks you to check a payment or invoice you do not recognize.

Read more »
Sensitive Information
Data Breach Financial Data Landmark Sensitive Information

Landmark Admin Hack: Massive Data Leak Hits 1.6 Million Americans

 



Landmark Admin, a company based in Texas that works with insurance firms across the country, has shared new details about a cyberattack it suffered last year. According to the latest update, the number of people whose personal data may have been accessed has now reached more than 1.6 million.


How It Started

In May 2024, Landmark noticed something suspicious on its computer network. After looking into the issue, it found out that hackers had broken in and accessed files containing sensitive details of many individuals.

At first, the company believed the attack had affected around 806,000 people. However, in a recent filing with the Maine Attorney General’s Office, Landmark revealed that the total number of impacted people is now estimated at 1,613,773. They also said that this number might change again as the investigation continues.


What Information Was Stolen?

The hackers were able to get their hands on private data. This could include a person’s name, home address, Social Security number, or details from their passport or driver’s license. Some people’s financial information, health records, and insurance policy numbers may also have been exposed.

Not everyone had the same information stolen. The company has promised to send each affected person a letter that clearly mentions which of their details were accessed in the attack.


What Is Being Done to Help?

Landmark is still reviewing the situation with cybersecurity experts. They are in the process of informing everyone who may have been affected. People who get a notice from Landmark will also receive 12 months of free credit monitoring and identity theft protection to reduce the chances of further harm.

Those affected are encouraged to keep an eye on their credit activity. They may also consider placing a fraud alert or even freezing their credit to stay protected from possible misuse.

The full extent of the breach is still being investigated, which means the number of victims may grow. In the meantime, people are advised to stay alert, review their financial statements, and take steps to protect their identities.


Read more »
OCC
Banks bloomberg Cyber Attacks Data Sharing digital data email security financial attack Financial Data Hacker attack OCC

Top U.S. Banks Cut Off Digital Data Sharing With OCC After Major Cyberattack

 

Several of the largest banks in the United States have curtailed or reassessed how they share sensitive data with the Office of the Comptroller of the Currency (OCC), after a significant cyberattack compromised the regulator’s email system. 

According to Bloomberg, JPMorgan Chase and Bank of New York Mellon have paused all electronic communications with the OCC. Bank of America is continuing to share data, but through what it considers more secure digital channels. The decision follows the discovery that hackers had accessed over 100 email accounts at the OCC for more than a year—a breach labeled a “major incident” by both the OCC and the U.S. Treasury Department. 

The hackers reportedly obtained highly sensitive information related to financial institutions, although their identities remain unknown. The OCC, a bureau under the Treasury, oversees over 1,000 national banks and savings associations, including the U.S. branches of foreign institutions. Among the materials potentially exposed are reports on cybersecurity protocols, internal vulnerability assessments, and National Security Letters—documents that may contain classified intelligence regarding terrorism or espionage. 

Banks have raised concerns about the extent of the breach and the OCC’s communication about the incident. Some financial institutions reportedly did not learn of the scope of the compromise until media coverage surfaced. As a result, there is growing distrust among regulated institutions regarding how the OCC has handled disclosure and mitigation. The OCC said it is actively working with independent cybersecurity experts, including Mandiant and Microsoft, to investigate the breach and determine whether stolen data has surfaced on the dark web. 

A contractor is also reviewing two internal communication systems—BankNet and another used for transferring large files—to assess whether they were affected. While JPMorgan and BNY Mellon have suspended digital transmissions, Citigroup has continued data sharing due to its existing consent order with the OCC. It remains unclear whether other major banks like Wells Fargo or Goldman Sachs have taken similar steps. Experts warn that the breach could enable targeted cyberattacks or extortion attempts, as the stolen material may offer insight into institutional vulnerabilities. 

According to former Treasury CIO Eric Olson, the exposed data is “as sensitive as it gets.” The incident has drawn attention from Congress, with both the House Financial Services Committee and the Senate Banking Committee seeking more information. Experts view the banks’ decision to reduce data sharing as a sign of eroding trust in the OCC’s ability to safeguard critical regulatory communications.
Read more »
US Regulator
Data Breach Data Leak Financial Data OCC US Regulator

US regulator OCC Claims Email Hack Exposed Sensitive Bank Details

 

The US Office of the Comptroller of the Currency (OCC), a key banking regulator, officially classified a significant breach of its email system as a "major information security incident" after learning that malicious actors accessed highly sensitive bank supervisory data for eight to nine months before being detected. 

On February 11, 2025, the OCC became aware of "unusual interactions" between a system administrative account and user mailboxes in its office automation environment. By February 12, the agency had determined that the activity was unauthorised, engaged its incident response mechanisms, reported the problem to CISA (Cybersecurity Infrastructure and Security Agency), and blocked the compromised administrative accounts, effectively terminating the unauthorised access.

However, subsequent investigations, including internal evaluations and those conducted by independent third parties, revealed that the infiltration was much larger than previously thought. According to Bloomberg News, citing sources familiar with the investigation, the unauthorised access began in May or June 2024 and was discovered in February 2025. During this prolonged period, the attackers gained access to around 150,000 emails from 100 to 103 accounts, including those of senior OCC executives and workers.

On April 8, 2025, the OCC formally informed the United States Congress that the breach satisfied the threshold for a "major incident" under the Federal Information Security Modernisation Act (FISMA). This classification is based on the fact that the stolen emails and attachments contained "highly sensitive information relating to the financial condition of federally regulated financial institutions used in its examinations and supervisory oversight processes.”

Acting Comptroller of the Currency Rodney E. Hood stated unequivocally that "long-held organisational and structural deficiencies" led to the incident and promised "full accountability for the vulnerabilities identified and any missed internal findings." The OCC is conducting a thorough audit of its IT security rules and procedures, and it has engaged third-party cybersecurity experts for review. Additional experts may be brought in to analyse internal cyber incident processes. 

The prolonged, undetected access to highly sensitive regulatory information about the health and oversight of US national banks constitutes a severe security flaw within a critical financial regulatory body. Exposure to such data increases the risk of its misuse for market manipulation, espionage, or enabling targeted assaults on financial institutions. While the OCC claimed in February that there was "no indication of any impact to the financial sector," the sensitivity of the exposed data may potentially cause "demonstrable harm to public confidence.”
Read more »
Financial Data
Athenian Tech Classified Information Data Breach Defence Ministry Financial Data

Cyberattack Exposes Confidential Defence Data, Raising Security Concerns

 



A massive collection of classified defence documents has reportedly been stolen by hackers and put up for sale. The stolen information includes blueprints for a weapon, details about an upcoming Air Force facility, procurement strategies, and India's defence partnerships with other countries.  

Cybersecurity firm Athenian Tech, which analyzed the data, believes it was taken from the personal device of a former Defence Ministry official. Among the leaked files are emergency evacuation procedures for high-ranking government officials, including the President and Prime Minister, in the event of an aerial attack. This has raised serious concerns about national security.  


Defence Agency denies data breach

The Defence Research and Development Organisation (DRDO), which is responsible for developing military technology, is known for its strict security rules. Employees are not even allowed to carry personal mobile phones in certain areas. However, the stolen data has been linked to DRDO, raising concerns about how such critical information was accessed.  

Despite these claims, DRDO officials have denied that their systems were breached. They stated that the stolen files do not belong to their organization but have not provided further details to clarify the situation.  


Hackers Claim Responsibility 

A ransomware group called Babuk Locker 2.0 announced on March 10, 2025, that it was behind the attack. The hackers claim to have stolen 20 terabytes of sensitive defence data from DRDO’s servers, including classified military documents and login credentials. They released a small portion of this data, approximately 753 MB, as proof of their claims.  

The sample files include technical details about upgrades to the T9 Bhishma Tank, along with records of India’s defence collaborations with countries such as Finland, Brazil, and the United States.  

Athenian Tech examined conversations between the hackers and found that they were communicating in Indonesian, suggesting they may be based in Indonesia. However, after further analysis, the firm believes the hackers might have exaggerated the scale of the breach.  

The report indicates that much of the leaked data is linked to Puneet Agarwal, who served as a Joint Secretary in the Defence Ministry between 2019 and 2021. His personal information, including Aadhaar details, financial records, and travel documents, were found in the files. This suggests that the breach might have come from his personal device rather than DRDO’s secured internal network.  


Major Security Risks 

The exposure of such sensitive information highlights major cybersecurity vulnerabilities. It raises concerns about insider threats and whether India’s defence infrastructure is adequately protected from sophisticated cyberattacks.  

Athenian Tech has stressed the need for stronger security measures, tighter access controls, and constant monitoring to prevent such incidents from happening again.  

One of the biggest concerns is that classified documents were stored on a personal device, which indicates serious gaps in data security policies. If the hackers also obtained login credentials, they could use them to infiltrate more secure systems and gain access to additional classified information.  

Read more »
Security Incident
Data Breach Data Leak Financial Data Fintech Security Incident

Fintech Giant Finastra Breach Exposed Private Data, Company Notifies Victims

 

The financial technology behemoth Finastra is alerting victims of a data breach after unidentified hackers initially gained access to its networks in October 2024 and took their personal data. More than 8,100 financial institutions in 130 countries, including 45 of the top 50 banks in the world, rely on London-based Finastra to supply financial services software applications.

The security incident was discovered on November 7 after Finastra detected malicious activity on some of its systems, as the business warned in breach notification letters given to those impacted by the breach. 

"Our investigation revealed that an unauthorized third party accessed a Secure File Transfer Platform (SFTP) at various times between October 31, 2024 and November 8, 2024. Findings from the investigation indicate that on October 31, 2024, the unauthorized third party obtained certain files from the SFTP," the fintech giant noted. 

"Finastra has no indication the unauthorized third party further copied, retained, or shared any of the data. We have no reason to suspect your information has or will be misused. As a result, we believe the risk to individuals whose personal data was involved is low.” 

At least 65 people in the state whose financial account information was stolen received breach notification letters from Finastra last week, although the company has not yet disclosed the number of victims or the type of data that was compromised (apart from the names of the victims), according to filings with the Massachusetts Attorney General's office. 

Additionally, the financial services organisation offers those whose information was compromised or stolen in the incident two years of free credit monitoring and identity restoration services through Experian.

The hack is believed to be connected to a (now-deleted) post on the BreachForums online cybercrime community by a threat actor called "abyss0" who claimed to sell 400GB of data allegedly stolen from Finastra's network, despite the fact that Finastra only revealed a very small amount of information in filings with Attorney General offices.

Last year in November, when a local media outlet enquired about the forum post, a Finastra spokesperson declined to confirm or deny ownership of the data, stating that the company experienced a limited-scope security incident and is assessing its impact.

"On November 7, 2024 Finastra's Security Operations Center (SOC) detected suspicious activity related to an internally hosted Secure File Transfer Platform (SFTP) we use to send files to certain customers," Finastra added. 

Finastra was also forced to shut down parts of its systems in March 2020 to combat what Tom Kilroy, the company's Chief Operating Officer at the time, described as a ransomware attack. While the company did not disclose how the attackers got access to its systems, cyber threat intelligence firm Bad Packets discovered that Finastra had many unpatched Pulse Secure VPN and Citrix ADC (NetScaler) servers prior to the attack.
Read more »
Personal Data
data attacks Data Breach Data Leak data security Financial Data healthcare data breach HIPAA Medical Data Medical Data breach Personal Data

Medusind Data Breach Exposes Health and Personal Information of 360,000+ Individuals

 

Medusind, a major provider of billing and revenue management services for healthcare organizations, recently disclosed a data breach that compromised sensitive information of over 360,000 individuals. The breach, which occurred in December 2023, was detected more than a year ago but is only now being reported publicly. 

The Miami-based company supports over 6,000 healthcare providers across 12 locations in the U.S. and India, helping them streamline billing processes and enhance revenue generation. According to a notification submitted to the Maine Attorney General’s Office, the breach was identified when Medusind noticed suspicious activity within its systems. 

This led the company to immediately shut down affected systems and enlist the help of a cybersecurity firm to investigate the incident. The investigation revealed that cybercriminals may have gained access to and copied files containing personal and medical details of affected individuals. Information compromised during the breach includes health insurance details, billing records, and medical data such as prescription histories and medical record numbers. Financial data, including bank account and credit card information, as well as government-issued identification, were also exposed. 

Additionally, contact details like addresses, phone numbers, and email addresses were part of the stolen data. In response, Medusind is providing affected individuals with two years of free identity protection services through Kroll. These services include credit monitoring, identity theft recovery, and fraud consultation. The company has advised individuals to stay vigilant by reviewing financial statements and monitoring credit reports for unusual activity that could indicate identity theft. 

This breach highlights the increasing cybersecurity challenges facing the healthcare industry, where sensitive personal information is often targeted. To address these risks, the U.S. Department of Health and Human Services has proposed updates to the Health Insurance Portability and Accountability Act (HIPAA). These proposed changes include stricter requirements for encryption, multifactor authentication, and network segmentation to protect patient data from cyberattacks. The Medusind incident follows a series of high-profile breaches in the healthcare sector.

In May 2024, Ascension reported that a ransomware attack had exposed data for 5.6 million individuals. Later in October, UnitedHealth disclosed a breach stemming from a ransomware incident affecting over 100 million people. As healthcare providers continue to face cyber threats, the urgency to implement robust data security measures grows. Medusind’s experience serves as a reminder of the significant risks posed by such breaches and the importance of safeguarding sensitive information.
Read more »
Healthcare
Ascension Cyber Attacks Financial Data Healthcare

New Finds from The June Ascension Hack




Healthcare industry giant Ascension has broken the silence and revealed more sensitive information concerning the recent hack in June. Through a worker opening a suspicious file without even knowing the malware was actually very harmful to download, it gave room for hackers into their network exposing patient information, among others.


During the past months, the healthcare system has worked with experts in cybersecurity to analyze how the breach affected them and the amount of patient and employee data that was taken. Since the investigation has been concluded, Ascension has informed the public regarding the data stolen and measures undertaken to safeguard the victims.

The investigation established that several kinds of personal information were accessed during the breach. Though the specifics vary for each individual, the leaked information may include:  

  • Medical Records: Medical record numbers, service dates, types of lab tests, and procedure codes.  
  • Financial Data: Credit card numbers, bank account information, and insurance details such as Medicaid and Medicare IDs.
  • Government Identifications: Social Security numbers and other governmental IDs. 

Ascension has come out to clarify that their main Electronic Health Records, which hold extensive patient's medical histories, were unaffected. This means that those operations that are considered most core in healthcare, such as viewing patient records and prescribing drug therapies, remain safe and unimpeded.


How Ascension is Reacting

To make amends for the breach, Ascension is offering free credit monitoring and identity protection services to anyone affected. Those affected will be sent formal notification letters within the next two to three weeks, which will detail step-by-step instructions to enroll in protection services so those affected may protect themselves from potential misuse of their data.

The credit monitoring service will be offered for two years and can be used to track suspicious activity regarding an individual's personal information. Ascension also informed those who had already enrolled in protection services after the initial breach that they could continue coverage without any interruption.


If you receive a notification, enrolling in the complimentary identity protection services is crucial. For assistance, you can visit Ascension’s website or contact their support line at (866) 724-3233 during business hours.  

Additionally, Ascension advises practicing general security measures, such as monitoring bank statements and staying alert for unusual activity. These steps can help minimize potential risks.

Ascension acknowledged the hurdle caused by the cyberattack and gave thanks to its patients, employees, and clinicians for their continued support. The organization highlighted its ability to persevere with such a team, and it assured the community that utmost care will be taken in protecting the information of its patients in the future.




Read more »
Subscribe to: Posts (Atom)