Search This Blog

Powered by Blogger.

Blog Archive

Labels

About Me

Showing posts with label Identity Theft. Show all posts

Frankenstein Scam: Here's How to Safeguard Yourself Against Synthetic Identity Fraud

 

Identity theft is not always as straightforward as acquiring one person's information; stolen identities can be put together from several sources. This rising crime, known as synthetic identity fraud or "Frankenstein fraud," involves combining someone's Social Security number with information from other people to establish a new, fake identity.

To safeguard yourself from this and other types of identity theft, look into the finest identity theft protection services. Criminals frequently target the most vulnerable people, including children, the homeless, and the elderly. The offender can then use his new name to borrow money. If a fraudster succeeds, the real owner of the SSN may be held liable.

Modus operandi

Synthetic identity fraud requires patience on the part of the criminal, especially if they use a child's Social Security number. The identity is created by combining a valid Social Security number with an unrelated name, address, date of birth, phone number, or other piece of identifying information to make a new "whole" identity. Criminals can buy Social Security numbers on the dark web, acquire them from data breaches, or defraud people using phishing attacks and other frauds. 

Synthetic identity theft thrives because of a basic vulnerability in the American financial and credit systems. When a criminal creates a synthetic identity to request for a loan, the lender often denies credit because there is no record of that identity in their system. The thieves anticipate this because youngsters and teenagers may have little credit or a limited history, and the elderly may have poor credit scores. 

When an identity applies for an account and is reported to a credit bureau, it is shared with other credit agencies. That conduct is sufficient to allow credit bureaus to identify the synthetic identity as a real person, even if there is minimal activity or evidence to corroborate its authenticity. Once the identity has been established, the fraudsters can begin borrowing credit from lenders.

Prevention tips

Synthetic identity fraud may seem frightening, but there are actions you can take to limit how thieves can utilise your identifying data. 

Freeze your credit report: No one can open new credit lines in your name since a credit freeze stops creditors from viewing your credit reports. Unless your credit is first unfrozen with each of the major credit agencies, this also applies to you. 

Although the procedure for freezing a child's credit is a little more complicated, freezing their credit is also one of the greatest ways to cut off the source of synthetic identity fraud, which mostly depends on obtaining the Social Security numbers of children and the elderly. In a similar vein, you may help stop someone from using your Social Security number without your knowledge by freezing it.

Check credit reports regularly: If you do not freeze your credit reports, make sure to check them on a regular basis for any questionable activity. Be especially aware of any other names, residences, or employers associated with your credit file. You can also join up for free credit monitoring, such as Capital One's CreditWise, which searches the dark web for your personally identifiable information. 

Additionally, you can utilise an identity theft protection service to automate reviewing your credit reports or to alert you if your information is compromised in a breach. AnnualCreditReport.com also offers a free weekly credit report.

FBI Warns Against Free Online File Converters as Potential Cybersecurity Threats

 

Free online file converters have become a popular choice for users looking to convert files into different formats. Whether transforming a PDF into a Word document or switching between media formats, these tools offer convenience with just a few clicks. However, the FBI has issued a warning about the hidden dangers associated with such services.

Despite their ease of use, free file conversion tools may serve as a gateway for malware, potentially compromising users’ sensitive data. According to TechRadar, the FBI has identified certain converters that embed malicious software into the converted files. This malware can infect the user's system, allowing hackers to steal personal and financial information undetected.

Once installed, malware can extract crucial data, including:
  • Full names and home addresses
  • Social Security numbers
  • Banking and financial details
  • Cryptocurrency wallets and access keys
The stolen information is often exploited for identity theft, financial fraud, and other cybercrimes. In some cases, hackers deploy ransomware, which locks victims out of their own systems and demands a hefty ransom for data recovery.

Ransomware attacks have surged, affecting both businesses and individuals. When malware encrypts files, victims face a difficult choice—either pay the ransom or lose access to critical data. The FBI emphasizes that these threats are not limited to corporations; everyday internet users relying on free online tools are also at risk. A report from Cisco Talos highlights ransomware as one of the most significant security threats in recent years.

Mark Michalek, FBI Denver Special Agent in Charge, advises that awareness and education are the best defenses against malware attacks. To minimize risks, users should follow these cybersecurity best practices:
  • Use trusted sources – Only download or use file conversion tools from reputable websites and developers.
  • Keep security software updated – Install and regularly update antivirus and anti-malware programs to detect potential threats.
  • Avoid suspicious links and attachments – Do not open files or click on links from unknown sources.
  • Maintain data backups – Regularly back up important files to prevent data loss in case of an attack.

If you suspect that malware has been installed through a file converter, take immediate action:
  • Disconnect from the internet to prevent further data compromise.
  • Run a full system scan using reputable antivirus software to detect and remove malicious files.
  • Report the incident to law enforcement to document the attack and seek assistance.
While free online file converters provide convenience, they also pose significant cybersecurity risks. Users must remain vigilant and prioritize safety when handling digital files. By adopting precautionary measures and staying informed, individuals can protect their sensitive data from cyber threats.

Western Alliance Bank Data Breach Exposes Nearly 22,000 Customers’ Personal Information

 

Western Alliance Bank has alerted nearly 22,000 customers that their personal information was compromised following a cyberattack in October. The breach stemmed from a vulnerability in a third-party vendor’s secure file transfer software, which allowed attackers to gain unauthorized access to the bank’s systems and extract sensitive customer data. 

Western Alliance, a subsidiary of Western Alliance Bancorporation with over $80 billion in assets, first disclosed the incident in a February SEC filing. The bank revealed that hackers exploited a zero-day vulnerability in the software, which was officially disclosed on October 27, 2024. However, unauthorized access to the bank’s systems had already occurred between October 12 and October 24. The breach was only confirmed after the attackers leaked stolen files online. 

According to breach notification letters sent to 21,899 affected customers and filed with the Office of Maine’s Attorney General, the stolen data includes names, Social Security numbers, birth dates, financial account details, driver’s license numbers, tax identification numbers, and passport information if previously provided to the bank. Despite the exposure, Western Alliance stated there is no evidence of fraud or identity theft resulting from the breach. 

To support affected customers, the bank is offering one year of free identity protection services through Experian IdentityWorks Credit 3B. Although Western Alliance did not disclose the name of the compromised software in its SEC filing or customer notifications, the Clop ransomware gang has claimed responsibility for the attack. In January, Clop listed the bank among 58 companies targeted in a campaign that exploited a critical zero-day vulnerability (CVE-2024-50623) in Cleo LexiCom, VLTransfer, and Harmony software. 

The ransomware group had previously leveraged similar security flaws in MOVEit Transfer, GoAnywhere MFT, and Accellion FTA to conduct large-scale data theft operations. Further investigations revealed that Clop exploited an additional zero-day vulnerability (CVE-2024-55956) in Cleo software in December. This allowed them to deploy a Java-based backdoor, dubbed “Malichus,” enabling deeper infiltration into victims’ networks. Cleo, which serves over 4,000 organizations worldwide, confirmed the vulnerability had been used to install malicious backdoor code in affected instances of its Harmony, VLTrader, and LexiCom software. 

The full extent of the breach remains unclear, but it highlights the growing risks posed by vulnerabilities in third-party software. Organizations relying on such solutions must remain vigilant, promptly apply security patches, and implement robust defenses to prevent similar incidents.

American Addiction Centers Cyberattack Exposes Sensitive Data of 422,424 Individuals

 


In September 2024, American Addiction Centers (AAC) experienced a significant cyberattack that exposed the personal and health-related information of 422,424 individuals. The breach involved sensitive data such as Social Security numbers and health insurance details, prompting AAC to take immediate action to address the situation and support those impacted.

The cyberattack occurred over three days, from September 23 to September 26, 2024. AAC identified the breach on September 26 and quickly launched an investigation. The organization engaged third-party cybersecurity experts and notified law enforcement to assess the extent of the attack. By October 3, investigators confirmed that unauthorized individuals had accessed and stolen data during the breach.

Data Compromised

The stolen information included:

  • Names, addresses, and phone numbers
  • Dates of birth
  • Social Security numbers
  • Health insurance details

AAC assured clients that no treatment information or payment card data was compromised during the incident. While the exposed data could be exploited for identity theft, the company emphasized that there is no evidence linking the breach to fraudulent activity at this time.

Response and Notifications

In December 2024, AAC began notifying affected individuals, with official letters sent out just before the holiday season. These notifications outlined the breach details, the steps AAC had taken to address the incident, and the measures implemented to prevent future occurrences.

To mitigate risks, AAC offered affected individuals complimentary credit monitoring services for 12 months. The organization partnered with Cyberscout, a TransUnion company, to provide identity protection services, including:

  • Alerts for credit report changes
  • Monitoring for suspicious activity
  • Fraud Assistance

Affected individuals are encouraged to enroll in these services by March 31, 2025, to ensure their data remains protected.

Beyond immediate support, AAC implemented enhanced security protocols to strengthen its cybersecurity defenses. The organization collaborated with leading cybersecurity experts to fortify its systems and continues to review and update its measures regularly. Additionally, AAC established a dedicated hotline to assist individuals with inquiries and provide guidance on protective measures.

Proactive Recommendations

Although AAC has found no evidence of identity theft linked to the breach, it urged affected individuals to take the following proactive measures:

  • Monitor financial accounts and credit reports
  • Place fraud alerts on credit files
  • Consider security freezes on credit accounts

AAC’s notification letters include detailed instructions on these steps to help individuals safeguard their personal information against potential threats.

AAC emphasized its dedication to protecting personal information and maintaining transparency with its clients. “We regret that this incident occurred and the concern it may have caused,” the company stated. “We take the confidentiality and security of personal information very seriously and will continue to take steps to prevent a similar incident from occurring in the future.

As investigations into the incident continue, AAC remains focused on strengthening its cybersecurity measures and rebuilding client trust. For further information, individuals can contact AAC’s dedicated hotline at 1-833-833-2770, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern Time.

This incident highlights the importance of robust cybersecurity measures and proactive data protection strategies to safeguard sensitive information in the digital age.

Cybercriminals Exploit Identity Verification Systems

 


Cybercriminals on the dark web have developed new ways to exploit identity verification systems. Rather than hacking or stealing personal information, they are purchasing it directly from individuals, as revealed by security researchers at iProov. This approach allows them to bypass Know Your Customer (KYC) processes used by businesses to verify customer identities. Researchers found that a criminal group in Latin America is gathering identity documents, such as passports and driver's licenses, along with corresponding facial images. 

In some cases, these criminals pay individuals for their personal data. While the exact amount paid remains unclear, this practice raises serious concerns. This group’s activities extend beyond Latin America, with similar tactics reported in Eastern Europe. Law enforcement agencies in these regions have been alerted to the threat. 
 
Why Is This Dangerous? 
 
Selling personal data equips fraudsters with real identity "kits," which combine authentic documents with matching biometrics. This makes it challenging to identify the kits as counterfeit. According to iProov Chief Scientific Officer Andrew Newell, these kits enable criminals to execute sophisticated impersonation scams, putting victims’ financial security and personal identities at risk. 
  
What Can Be Done? 
 
Classic verification methods have proven inadequate against such advanced attacks. iProov recommends implementing multi-layered security measures to combat these threats. Key steps include:
  • Real-Time Authentication: Verifying that the user is a human being in real-time.
  • Identity Verification: Ensuring the user matches the rightful owner of the presented identity.
These layered methods significantly hinder cybercriminals, even when they possess convincing identity data. iProov notes that even sophisticated attackers struggle to bypass such systems while maintaining realistic interactions.
  • Never sell or share your personal information, regardless of incentives.
  • Be cautious of schemes offering money for personal data, as they can fuel large-scale fraud.
  • Stay vigilant and report any suspicious activity to relevant authorities.
As cybercriminals continue to innovate, businesses must invest in robust security systems, and individuals must take proactive steps to safeguard their sensitive information.

Builder.ai Data Breach Exposes Sensitive Information of Over 3 Million Users

 

A huge data security breach has come to light, with the data platform Builder.ai. It's a service that lets organizations build their own proprietary, custom software applications, which don't need heavy programming. According to a blog post by a security researcher, sensitive information from more than three million users' accounts was inadvertently leaked to the internet, leaving an open question of what now?

Jeremiah Fowler, a cybersecurity expert known for discovering unsecured online databases, found a Builder.ai archive with over 3 million records. This archive reportedly contained 1.29 terabytes of data, including very sensitive materials such as invoices, NDAs, email screenshots, and tax documents.

Worryingly, files contained access keys and configurations of two cloud storage systems. These keys, in the wrong hands, could grant hackers access to even more sensitive data.  


What Was Exposed

The exposed database included the following:  

337,434 invoices: The documents comprised transactions between Builder.ai and its clients.

32,810 master service agreements: Most agreements included user names, e-mail addresses, IP details and project estimations of the cost associated with a particular project giving a holistic overview of their sensitive information.  


Such data left unprotected poses grave risks. This information could be used for phishing scams, identity theft, or even financial fraud by criminals. Phishing is the art of making people give up their personal information by claiming to be a trusted person. The presence of cloud storage keys in the database further increases the worry, as this may also open access to more sensitive files elsewhere.

Fowler quickly notified the company, Builder.ai. However, the company, in its defense, showed that it could not tighten the database security due to "complexities with dependent systems." It is already a month, and nobody knows if the problem persists.  

Misconfigured databases are one of the constant problems of the digital era. Companies don't realize they have a shared responsibility to secure the data when it comes to cloud services, leaving large repositories of information exposed unintentionally. 

For businesses, this is an important wake-up call regarding comprehensive cybersecurity practices- periodic checks and ensuring the databases are properly secured for users' data protection.

For users, vigilance is key. Anyone who's interacted with Builder.ai should keep an eye out on their accounts for anything weird and be on their toes for phishing scams.

And in this hyperconnected world, security breaches such as this remind us that vigilance is key, too, for companies as much as it is for their users.



Protect Yourself from AI Scams and Deepfake Fraud

 

In today’s tech-driven world, scams have become increasingly sophisticated, fueled by advancements in artificial intelligence (AI) and deepfake technology. Falling victim to these scams can result in severe financial, social, and emotional consequences. Over the past year alone, cybercrime victims have reported average losses of $30,700 per incident. 

As the holiday season approaches, millennials and Gen Z shoppers are particularly vulnerable to scams, including deepfake celebrity endorsements. Research shows that one in five Americans has unknowingly purchased a product promoted through deepfake content, with the number rising to one in three among individuals aged 18-34. 

Sharif Abuadbba, a deepfake expert at CSIRO’s Data61 team, explains how scammers leverage AI to create realistic imitations of influencers. “Deepfakes can manipulate voices, expressions, and even gestures, making it incredibly convincing. Social media platforms amplify the impact as viewers share fake content widely,” Abuadbba states. 

Cybercriminals often target individuals as entry points to larger networks, exploiting relationships with family, friends, or employers. Identity theft can also harm professional reputations and financial credibility. To counter these threats, experts suggest practical steps to protect yourself and your loved ones. Scammers are increasingly impersonating loved ones through texts, calls, or video to request money. 

With AI voice cloning making such impersonations more believable, a pre-agreed safe word can serve as a verification tool. Jamie Rossato, CSIRO’s Chief Information Security Officer, advises, “Never transfer funds unless the person uses your special safe word.” If you receive suspicious calls, particularly from someone claiming to be a bank or official institution, verify their identity. 

Lauren Ferro, a cybersecurity expert, recommends calling the organization directly using its official number. “It’s better to be cautious upfront than to deal with stolen money or reputational damage later,” Ferro adds. Identity theft is the most reported cybercrime, making MFA essential. This adds an extra layer of protection by requiring both a password and a one-time verification code. Experts suggest using app-based authenticators like Microsoft Authenticator for enhanced security. 

Real-time alerts from your banking app can help detect unauthorized transactions. While banks monitor unusual activities, personal notifications allow you to respond immediately to potential scams. The personal information and media you share online can be exploited to create deepfakes. Liming Zhu, a research director at CSIRO, emphasizes the need for caution, particularly with content involving children. 

Awareness remains the most effective defense against scams. Staying informed about emerging threats and adopting proactive security measures can significantly reduce your risk of falling victim to cybercrime. As technology continues to evolve, safeguarding your digital presence is more important than ever. By adopting these expert tips, you can navigate the online world with greater confidence and security.

Ransomware Gangs Target Weekends and Holidays for Maximum Impact

 


A new report by cybersecurity firm Semperis reveals that ransomware gangs are increasingly launching attacks during weekends and holidays when organisations are less equipped to respond. The study found that 86 percent of ransomware incidents occurred during off-peak times as companies often scale back their security operations centre (SOC) staffing. While most organisations claim to run 24/7 SOCs, 85% admit to reducing staff by up to half on weekends and holidays, leaving critical systems more exposed. According to Dan Lattimer, an area vice president at Semperis, many organisations cannot afford the high cost of maintaining full SOC coverage each day. He noted, for example, that some organisations assume they are less exposed to risk during weekends because fewer employees are online to fall prey to phishing attacks. Others perceive their exposure being low because they have never had a threat in the past, further reducing the monitoring effort.


Why Cybercriminals Prefer Off-Peak Hours

Attackers leverage these openings to elevate the chances of their success. Performing attacks during weekends or holidays gives them a relatively longer timeframe to conduct an operation secretly so they can encrypt files and steal sensitive information with little hope of interfering soon. According to Lattimer, this tactic increases the chances of receiving ransom money because the organisations are willing to regain control at any critical downtime.

The report also showed that finance and manufacturing were among the most often targeted sectors, with 78 percent and 75 percent of organisations in the respective sectors reporting attacks on weekends or holidays. Furthermore, 63 percent of respondents said the ransomware related to major corporate events such as mergers or layoffs, which often cause additional diversion for IT teams. 


Identity Security Lapses Continue

Another concerning result of the report is that too many companies feel too confident about their identity security. While 81% said to have sufficient defences against identity-related attacks, 83% experienced successful ransomware incidents in the past year. This discrepancy is largely due to lack of budget and resources to properly protect identity systems like AD, a part of core infrastructure.

Semperis noted that without proper funding for identity threat detection and response (ITDR), many organisations are leaving themselves open to attacks. Around 40% of companies either lacked the resources or were unsure about their ability to secure these systems. 


Takeaway

SEMPERIS 2024 RANSOMWARE HOLIDAY RISK REPORT states that businesses must immediately address the vulnerability of weekends. Strengthening cybersecurity measures over holidays, investing in such robust identity protection, and maintaining consistent monitoring can help mitigate such growing risks for organisations. Cybercrime has become so dynamic, and hence organisations must adapt constantly to stay one step ahead.



How Incogni Helps Protect Your Digital Privacy and Reduces Spam

 

Managing unwanted spam messages, calls, and emails has become a necessary part of online life today. Beyond annoyance, these can lead to identity theft, financial fraud, and other issues. Much of this activity is driven by advertisers and marketing companies, which rely on data brokers who collect, store, and sell personal data for profit. In response, data removal services like Incogni have emerged to protect online privacy. Developed by Surfshark, Incogni uses automation to simplify and expedite the process of deleting personal data from these brokers’ databases. 

Incogni is designed for ease of use and requires minimal user intervention. Users authorize Incogni to handle the data removal requests with just a few initial steps. Once signed up, Incogni handles the technical legwork of filing removal requests with data brokers on the user’s behalf. It also regularly re-checks databases to ensure that data brokers don’t re-acquire the user’s information, providing ongoing protection. Incogni then tracks and organizes each request through a clean, user-friendly dashboard that categorizes requests by status, such as “sent,” “in progress,” or “completed.” The demand for Incogni reflects growing concerns over the security of personal information. When sensitive data is leaked or accessed by malicious actors, the consequences can be severe, ranging from identity theft to financial fraud.

For many, manually contacting data brokers is too complex and time-consuming. Incogni’s automation offers an efficient alternative, saving users considerable effort while giving them peace of mind about their digital privacy. Incogni is available as a standalone service, but it can also be bundled with Surfshark’s other cybersecurity tools, such as real-time data breach alerts, antivirus software, and an ad blocker, under the Surfshark One+ plan. Incogni’s appeal is in its accessibility and price. Competing data removal services like DeleteMe, Optery, Kanary, and Privacy Bee offer similar features but are often more expensive or complex. DeleteMe, for example, tracks a larger list of brokers but is more costly. Incogni balances affordability with essential functionality, making it a practical choice for users who want effective, no-frills data removal. 

This service is ideal for people who receive excessive spam or have concerns about personal information being exposed in a data breach. Additionally, for anyone who has already faced cybercrime, Incogni helps reduce ongoing risks by limiting the spread of their personal data online. While Incogni lacks some detailed tracking features offered by its competitors, it remains highly effective at what it does, making it a convenient option for most users. With an emphasis on simplicity, Incogni lets users reclaim privacy without extensive technical knowledge, automating much of the process. By reducing users’ digital footprint and preventing misuse of their information, Incogni offers an efficient layer of security in a landscape where personal data is frequently at risk.

Comcast Data Breach Impacts Thousands, Sensitive Information Compromised

 



Comcast Cable Communications LLC reports that it is a victim of a data breach compromising personal information of more than 237,000 individuals, including 22 residents of Maine. According to an investigation, the breach is traced back to Financial Business and Consumer Solutions, Inc., a third-party with which Comcast has associated in the past.

The data breach began on February 14, 2024, when an unauthorised third party gained access to FBCS's computer network. Access to this unauthorised party had led to a ransomware attack where cybercriminals downloaded and encrypted sensitive data. Initially, on March 13, 2024, FBCS had communicated to Comcast that customer information did not appear to have been compromised. However, months later, on July 17, 2024, it came to be known that sensitive customer data had indeed been affected.


New Comcast Hacking Findings

As soon as the breach was discovered, FBCS reached out to the FBI and hired some private cybersecurity firms to comprehend the full dimension of the breach. The investigation revealed names, addresses, Social Security numbers, birth dates, and Comcast account numbers accessed. The acquired information is of a very sensitive nature that encompasses substantial risk factors for identity theft and even financial frauds.

Still, FBCS has maintained that, to date, there is nothing known to be ill-gotten from the stolen data. Only the records starting 2021 are affected, as in 2020, FBCS terminated its contract with Comcast.


Support for Victims

Comcast began notifying the victims on 16 August 2024 and is providing them with free identity theft protection for 12 months. Comcast is partnering with CyEx Identity Defense Complete for credit monitoring and additional support services.

The notification stated that the breach had occurred only in FBCS systems and was unrelated to Comcast's networks themselves. To reach out to the affected customers, the company, Comcast, geared efforts towards helping them manage the fallout of the breach. It provided direct communication and access to a support service. Outside legal counsel for Comcast, Michael Borgia noted, "We are committed to helping our customers navigate the aftermath of this incident and ensuring they have the resources necessary to protect themselves."

Watching Your Back: Protection of Consumer Data End

The Comcast breach highlights the kinds of current risks facing consumers whose data is managed by third-party vendors. In response to this, Comcast is counselling its consumers to be on their guard. Protecting measures include: reviewing account statements for suspicious transactions, reviewing credit reports, and registering for the identity protection services Comcast is offering. Moreover, Comcast is suggesting the enabling of two-step verification for Xfinity accounts in order to increase security to its fullest potential.

This incident underlines the critical need to protect information while ensuring greater caution with regard to personal information in light of more prudent cyber attacks.



BSNL Reportedly Suffers Major Data Breach: Sensitive User Information at Risk

 

Bharat Sanchar Nigam Limited (BSNL) has reportedly experienced a significant data breach, with the responsible threat actor claiming to have acquired sensitive user and operational data. The government-owned telecom provider's servers were attacked, resulting in the hackers obtaining SIM card details, home location register data, and critical security keys. This stolen data could potentially be used for criminal activities such as SIM card cloning, identity theft, and extortion.

According to a report by digital risk management firm Athenian Tech, cited by News18, the cyberattack was carried out by a threat actor using the dark web forum username “kiberphant0m”. It remains unclear if the attack was executed by an individual or a group of hackers.

The report states that approximately 278GB of data from BSNL's telecom operations was compromised. This data includes not only user information but also server snapshots that could be exploited for further attacks, posing severe security risks. The threat actor claims to have obtained critical details such as International Mobile Subscriber Identity (IMSI) numbers, SIM card details, PIN codes, authentication keys, and snapshots of BSNL's SOLARIS servers.

The hacker has reportedly offered the stolen data for sale at $5,000 (roughly Rs. 4.18 lakh). Discussions on the dark web forum suggest potential misuse of the data for activities like SIM cloning, identity theft, and extortion.

Kanishk Gaur, CEO of Athenian Tech, explained that while the specific vulnerabilities exploited by “kiberphant0m” are not publicly disclosed, access to critical systems such as the Home Location Register (HLR) and SOLARIS server snapshots indicates a deep penetration. This likely involved exploiting software vulnerabilities or sophisticated social engineering techniques. The server snapshots suggest possible exploitation of known vulnerabilities within BSNL's server infrastructure, highlighting the need for rigorous patch management and security updates.

The alleged data breach poses a serious threat to millions of BSNL users whose sensitive information may have been compromised. Notably, BSNL experienced a similar data breach in December 2023. Gadgets 360 has reached out to BSNL for a comment and will update the story once a response is received.

Safeguarding Your Employee Data From Identity Theft

 

In today's digital age, where data breaches and cyberattacks are increasingly common, safeguarding against identity-based attacks has become paramount for organizations worldwide. Identity-based attacks, which involve the unauthorized access to sensitive information through compromised user credentials, pose significant risks to businesses of all sizes and industries. 

As CrowdStrike reported, 80% of attacks involve identity and compromised credentials, highlighting the widespread nature of this threat. Additionally, an IBM report found that identity-related attacks are now the top vector impacting global cybercrime, with a staggering 71% yearly increase. 

Cybercriminals employ various tactics to carry out identity-based attacks, targeting organizations through phishing campaigns, credential stuffing, password spraying, pass-the-hash techniques, man-in-the-middle (MitM) attacks, and more. Phishing campaigns, for example, involve the mass distribution of deceptive emails designed to trick recipients into divulging their login credentials or other sensitive information. Spear-phishing campaigns, on the other hand, are highly targeted attacks that leverage personal information to tailor phishing messages to specific individuals, increasing their likelihood of success.  

Credential stuffing attacks exploit the widespread practice of password reuse, where individuals use the same passwords across multiple accounts. Cybercriminals obtain credentials from previous data breaches or password dump sites and use automated tools to test these credentials across various websites, exploiting the vulnerabilities of users who reuse passwords. Password spraying attacks capitalize on human behavior by targeting commonly used passwords that match the complexity policies of targeted domains. 

Instead of trying multiple passwords for one user, attackers use the same common password across many different accounts, making it more difficult for organizations to detect and mitigate these attacks. Pass-the-hash techniques involve obtaining hashed versions of user passwords from compromised systems and using them to authenticate into other systems without needing to crack the actual password. This method allows attackers to move laterally within a network, accessing sensitive data and executing further attacks. MitM attacks occur when attackers intercept network connections, often by setting up malicious Wi-Fi access points. 

By doing so, attackers can monitor users' inputs, including login credentials, and steal sensitive information to gain unauthorized access to accounts and networks. To mitigate the risk of identity-based attacks, organizations must adopt a multi-layered approach to security. This includes implementing strong password policies to prevent the use of weak or easily guessable passwords and regularly auditing user accounts for vulnerabilities. 

Multi-factor authentication (MFA) should be implemented across all applications to add an extra layer of security by requiring users to provide a second form of authentication, such as a one-time password or biometric data, in addition to their passwords. Furthermore, organizations should protect against social engineering attacks, which often target service desk staff to gain unauthorized access to sensitive information. Automated solutions can help verify user identification and reduce the risk of social engineering vulnerabilities. 

 Identity-based attacks pose significant risks to organizations, but by implementing robust security measures and remaining vigilant against evolving threats, businesses can effectively mitigate these risks and safeguard their sensitive information from cybercriminals.

Teachers' Taxes Fraudulently Filed in Glendale Ransomware Attack

 

The Glendale Unified School District recently found itself at the center of a distressing situation when teachers, nurses, counsellors, and other faculty members received an unexpected notification from the IRS: their taxes had already been filed. What unfolded was a troubling revelation — the district had fallen victim to a ransomware attack, compromising sensitive data and leaving employees grappling with the aftermath. 

The attack, which occurred in December, targeted the school district's system, locking employees out and demanding a ransom for the safe return of their data. The stolen information included employee and student details such as names, addresses, dates of birth, Social Security numbers, and financial account information. As if that wasn't alarming enough, the breach's full extent became apparent when employees attempted to file their taxes, only to discover that fraudulent filings had already been made using their information. 

In the wake of the breach, at least 231 union members found themselves impacted, facing the arduous task of verifying their identities with the IRS to rectify the situation. The district took swift action, partnering with law enforcement agencies and cybersecurity experts to investigate the incident's scope and potential risks to employees and students. Despite the district's efforts to address the breach, some employees expressed dissatisfaction with the handling of the situation. 

Criticism centered around the perceived lack of transparency and timely communication regarding the breach. While the district maintained that it promptly informed the community about the incident and provided regular updates, employees felt otherwise, describing the information release as a "slow drip of updates." 

Amidst the fallout, concerns lingered about the compromised data's implications and the district's ability to safeguard against future attacks. School districts, while not prime targets for ransomware attacks, are vulnerable due to their extensive networks and numerous vulnerabilities. The complexity of securing these systems underscores the challenges faced by educational institutions in safeguarding sensitive information. 

Looking ahead, affected employees face an uphill battle in reclaiming their financial security, with the process of rectifying fraudulent filings expected to be prolonged and cumbersome. Despite assurances from the district and ongoing efforts to mitigate the breach's impact, the incident serves as a stark reminder of the ever-present threat posed by cybercriminals and the critical need for robust cybersecurity measures in educational institutions.

Wells Fargo Data Breach: Safeguarding Customer Information in a Digital Age

 

In a digital age where data breaches have become all too common, the recent disclosure of a data breach at Wells Fargo, a prominent multinational financial services corporation, has once again brought cybersecurity concerns to the forefront. The breach, impacting the personal information of two clients, underscores the challenges faced by financial institutions in safeguarding sensitive data and maintaining customer trust. 

The breach exposed clients' names and mortgage account numbers, raising significant concerns about the security of personal information within the financial services sector. According to Wells Fargo, the breach was not the result of a cyberattack but rather an employee breaching company policy by transferring information to a personal account. While the exact timeline and duration of unauthorized access remain unclear, Wells Fargo has taken swift action to address the situation and mitigate risks to affected individuals. 

In response to the breach, Wells Fargo has prioritized the welfare of its customers and has taken proactive steps to assist those impacted. The company has offered complimentary two-year subscriptions to Experian IdentityWorks5M, a comprehensive identity theft detection service. This includes daily monitoring of credit reports, internet surveillance to monitor identity-related activity, and full-service identity restoration in the event of theft. Affected individuals are encouraged to activate their subscriptions within 60 days from the date printed on the notification letter, either online or by phone. The team is available via phone during specified hours and offers language assistance services for non-English speakers, as well as support for individuals with hearing or speech difficulties. 

While the specifics of the data breach are still under investigation, Wells Fargo remains committed to enhancing security measures and preventing similar incidents in the future. The breach serves as a stark reminder of the evolving nature of cyber threats and the importance of remaining vigilant in protecting sensitive information. This incident also highlights a recurring issue within the banking industry, as Wells Fargo is not the only financial institution to experience a data breach in recent months. 

In February 2024, Bank of America, another one of the Big Four Banks in North America, announced a data breach affecting its customers. The Bank of America data breach was attributed to a cyberattack targeting one of its service providers, Infosys McCamish Systems. 

As investigations into the breach continue, Wells Fargo reassures its customers of its unwavering commitment to security and vows to implement additional measures to safeguard customer information. Despite the challenges posed by cyber threats, Wells Fargo remains dedicated to maintaining customer trust and protecting sensitive data in an increasingly interconnected world.

AT&T User Discusses Safety Measures Following Data Breach

 

AT&T has periodically tried to downplay the gravity of its recent data breach, but the US telecoms company has now sought to reassure worried consumers with a slew of new security features. 

In the most recent development in the ongoing story of the AT&T data hack, the firm has announced that all of its users—affected or not—can now take advantage of a number of complimentary security and identity protection offerings. 

These include a free identity theft insurance policy that offers up to $1 million in coverage, which seems to indicate that the company is now beginning to take the data leak seriously. 

AT&T new announcements

AT&T has announced numerous additional security measures in response to the March disclosure that data belonging to up to 73 million of its customers had been exposed on an online hacker forum.

In addition to the previously mentioned $1 million identity protection insurance, these also come with access to an identity restoration team and "one year of complimentary credit monitoring, identity theft detection, and resolution services.” 

According to KPRC-TV, AT&T appears to have hired the assistance of Experian's IdentityWorks protection arm to help reassure the more than seven million current AT&T customers who have been affected by the hack. 

How many AT&T customers were affected by the data breach?

Most estimates suggest that as a result of the historic data breach, the personal information of around 71 million AT&T customers was exposed online. 

However, AT&T has attempted to dispute this number on several occasions, having first denied culpability for the breach completely. It has instead stated that it believes approximately 51 million consumers were affected, the majority of whom are former customers.

That is perhaps predictable, given that many individuals would leave a provider who had disclosed their information. As previously stated, the number of current AT&T users believed to be affected is approximately 7 million. 

To make it easier to secure your online accounts with hard, unique passphrases, experts advise setting up a password manager.

Look Out For SIM Swap Scams: Tips for Bitcoin Security

 




In today's digitised world, safeguarding personal information and digital assets is of great importance. One emerging threat is the SIM swap scam, a sophisticated form of identity theft where fraudsters manipulate mobile carriers to transfer a victim's phone number to a SIM card under their control. This can lead to unauthorised access to accounts, especially those reliant on SMS-based two-factor authentication (2FA).


Bitcoin Security at Risk

For Bitcoin users, SIM swap scams pose an even greater risk, particularly on centralised exchanges using SMS-based 2FA. Unauthorised access to these accounts could result in substantial financial loss. However, utilising self-custodial wallets, where users control their private keys, significantly reduces this risk by eliminating reliance on telecom-based authentication methods.


Protective Measures and Best Practices

1. Switch to Authenticator Apps: Transitioning from SMS-based 2FA to authenticator apps like Google Authenticator or Authy enhances security by eliminating the vulnerability to SIM swap attacks.

2. Implement Additional Security Measures: Make use of platform-provided security features such as withdrawal address whitelisting and multi-factor authentication whenever possible to add layers of protection to your assets.

3. Stay Careful Against Phishing: Be cautious of unsolicited communications and verify the authenticity of requests for personal information or urgent actions related to your accounts.

4. Inform Your Mobile Carrier: Make your mobile carrier aware of the risks associated with SIM swap scams and inquire about additional security measures to safeguard your account.

5. Prioritise Non-Custodial Wallets: Opt for storing Bitcoin in hardware or reputable software wallets where you control your private keys, ensuring maximum security.


Striving for Practical Security

While achieving perfect security may seem daunting, taking practical steps such as enabling authenticator apps and transitioning to non-custodial wallets significantly reduces vulnerability to SIM swap scams. Rather than pursuing perfection, adopting proactive security measures is key to mitigating risks and protecting valuable assets.


In the face of multiplying threats like SIM swap scams, prioritising security measures is essential, especially for Bitcoin holders. By following best practices and embracing non-custodial solutions, individuals can shield their digital assets and minimise the risk of falling victim to cyberattacks. Stay informed, stay vigilant, and take proactive steps to protect yourself in the digital realm.


How Can You Safeguard Against the Dangers of AI Tax Fraud?

 




The digital sphere has witnessed a surge in AI-fueled tax fraud, presenting a grave threat to individuals and organisations alike. Over the past year and a half, the capabilities of artificial intelligence tools have advanced rapidly, outpacing government efforts to curb their malicious applications.

LexisNexis' Government group CEO, Haywood Talcove, recently exposed a new wave of AI tax fraud, where personally identifiable information (PII) like birthdates and social security numbers are exploited to file deceitful tax returns. People behind such crimes utilise the dark web to obtain convincing driver's licences, featuring their own image but containing the victim's details.

The process commences with the theft of PII through methods such as phishing, impersonation scams, malware attacks, and data breaches — all of which have been exacerbated by AI. With the abundance of personal information available online, scammers can effortlessly construct a false identity, making impersonation a disturbingly simple task.

Equipped with these forged licences, scammers leverage facial recognition technology or live video calls with trusted referees to circumvent security measures on platforms like IRS.gov. Talcove emphasises that this impersonation scam extends beyond taxes, putting any agency using trusted referees at risk.

The scammers then employ AI tools to meticulously craft flawless tax returns, minimising the chances of an audit. After inputting their banking details, they receive a fraudulent return, exploiting not just the Internal Revenue Service but potentially all 43 states in the U.S. that impose income taxes.

The implications of this AI-powered fraud extend beyond taxes, as any agency relying on trusted referees for identity verification is susceptible to similar impersonation scams. Talcove's insights underscore the urgency of addressing this issue and implementing robust controls to counter the accelerating pace of AI-driven cybercrime.

Sumsub's report on the tenfold increase in global deepfake incidents further accentuates the urgency of addressing the broader implications of AI in fraud. Deepfake technology, manipulating text, images, and audio, provides criminals with unprecedented speed, specificity, personalization, scale, and accuracy, leading to a surge in identity hijacking incidents.

As individuals and government entities grapple with this new era of fraud, it becomes imperative to adopt proactive safety measures to secure personal data. Firstly, exercise caution when sharing sensitive details online, steering clear of potential phishing attempts, impersonation scams, and other cyber threats that could compromise your personally identifiable information (PII). Stay vigilant and promptly address any suspicious activities or transactions by regularly monitoring your financial accounts.

As an additional layer of defence, consider incorporating multi-factor authentication wherever possible. This security approach requires not only a password but also an extra form of identification, significantly enhancing the protection of your accounts. 

The Latest Prudential Financial Data Breach Exposes Vulnerabilities

 

Prudential Financial, a global financial giant managing trillions in assets, recently revealed a cybersecurity breach, putting employee and contractor data at risk. The incident, identified on February 5, highlighted the vulnerabilities in even the most robust financial institutions' cybersecurity defenses. 

Prudential Financial, a Fortune 500 company providing a spectrum of financial services to over 50 million customers globally, reported that a threat actor gained unauthorized access to some of its systems. The breach, detailed in a Form 8-K filing, exposed the severity of the incident, as the attackers managed to steal administrative and user data stored on compromised systems, including user accounts linked to employees and contractors. 

The company, managing assets worth approximately $1.4 trillion, activated its cybersecurity incident response process promptly. External cybersecurity experts were enlisted to investigate, contain, and remediate the breach. Despite these efforts, Prudential Financial did not disclose the number of employees affected among its 40,000-strong global workforce. The nature of the attack suggests a cybercrime group's involvement, potentially indicating a ransomware attack. Prudential Financial assured stakeholders that it is actively investigating the extent of the incident, aiming to determine if the threat actor accessed additional information or systems. 

The company is committed to understanding the full impact of the breach on its operations. Prudential Financial emphasized that, as of now, there is no evidence of customer or client data theft. This assertion is a relief for the millions of customers who rely on the company for insurance, retirement planning, and wealth management services. The incident has been reported to law enforcement and regulatory authorities, showcasing the company's commitment to transparency and cooperation in addressing the cyber threat. 

However, this is not the first time Prudential Financial faced a data breach. In May 2023, a further complication arose when personal information for over 320,000 Prudential customers, managed by third-party vendor Pension Benefit Information (PBI), became vulnerable. The breach was attributed to the Clop cybercrime group infiltrating PBI's MOVEit Transfer file-sharing platform. PBI, in their communication about the incident, specified that compromised data on their server included sensitive information such as names, addresses, dates of birth, phone numbers, and Social Security numbers. 

This prior breach adds a layer of complexity to the recent cybersecurity incident, prompting concerns about the overall resilience of Prudential Financial's data security infrastructure. The dual incidents underscore the evolving and persistent threats financial institutions face in the digital age. The intricacies of these breaches pose challenges not only in immediate response but also in understanding the long-term consequences on customer trust, regulatory compliance, and the overall stability of the financial services provider. 

As Prudential Financial navigates the aftermath of the recent breach, the focus on cybersecurity resilience becomes paramount. The company must reassess and fortify its security protocols to withstand evolving cyber threats. Beyond addressing the immediate vulnerabilities, Prudential Financial needs to instil confidence in its customers, employees, and stakeholders by showcasing a renewed commitment to data protection and proactive cybersecurity measures. 

The Prudential Financial Data Breach serves as a cautionary tale for financial institutions worldwide. The incident highlights the ongoing challenges in safeguarding sensitive data and underscores the critical need for continuous improvement in cybersecurity strategies. As the financial industry grapples with evolving cyber threats, institutions like Prudential Financial must not only respond effectively to breaches but also proactively invest in robust cybersecurity measures to protect their assets, reputation, and the trust of millions of customers.

Identity Hijack: The Next Generation of Identity Theft

 

Synthetic representations of people's likenesses, or "deepfake" technology, are not new. Picture Mark Hamill's 2019 "The Mandalorian" episode where he played a youthful Luke Skywalker, de-aged. Similarly, artificial intelligence is not a novel concept. 

However, ChatGPT's launch at the end of 2022 made AI technology widely available at a low cost, which in turn sparked a competition to develop more potent models among almost all of the mega-cap tech companies (as well as a number of startups). 

Several experts have been speaking concerning the risks and active threats posed by the current expansion of AI for months, including rising socio economic imbalance, economic upheaval, algorithmic discrimination, misinformation, political instability, and a new era of fraud. 

Over the last year, there have been numerous reports of AI-generated deepfake fraud in a variety of formats, including attempts to extort money from innocent consumers, ridiculing artists, and embarrassing celebrities on a large scale. 

According to Australian Federal Police (AFP), scammers using AI-generated deepfake technology stole nearly $25 million from a multinational firm in Hong Kong last week.

A finance employee at the company moved $25 million into specific bank accounts after speaking with several senior managers, including the company's chief financial officer, via video conference call. Apart from the worker, no one on the call was genuine. 

Despite his initial suspicions, the people on the line appeared and sounded like coworkers he recognised.

"Scammers found publicly available video and audio of the impersonation targets on YouTube, then used deepfake technology to emulate their voices... to lure the victim into following their instructions," acting Senior Superintendent Baron Chan told reporters. 

Lou Steinberg, a deepfake AI expert and the founder of cyber research firm CTM Insights, believes that as AI grows stronger, the situation will worsen. 

"In 2024, AI will run for President, the Senate, the House and the Governor of several states. Not as a named candidate, but by pretending to be a real candidate," Steinberg stated. "We've gone from worrying about politicians lying to us to scammers lying about what politicians said .... and backing up their lies with AI-generated fake 'proof.'" 

"It's 'identity hijacking,' the next generation of identity theft, in which your digital likeness is recreated and fraudulently misused," he added. 

The best defence against static deepfake images, he said, is to embed micro-fingerprint technology into camera apps, which would allow social media platforms to recognise when an image is genuine and when it has been tampered with. 

When it comes to interactive deepfakes (phone calls and videos), Steinberg believes the simple solution is to create a code word that can be employed between family members and friends. 

Companies, such as the Hong Kong corporation, should develop rules to handle nonstandard payment requests that require codewords or confirmations via a different channel, according to Steinberg. A video call cannot be trusted on its own; the officers involved should be called separately and immediately.

Binance Data Breach Sparks Concerns: Dark Web Sale Rumors Surface

 

In a surprising development, cryptocurrency giant Binance finds itself facing the looming threat of a potential data breach, as claims circulate on the dark web suggesting the sale of sensitive user information. This occurrence has sent shockwaves throughout the cryptocurrency community, prompting apprehension about the security of one of the world's leading digital currency exchanges. 

Renowned for its extensive selection of digital assets and user-friendly interface, Binance has not been impervious to the escalating menace of cyberattacks targeting the cryptocurrency sector. Reports indicate that an individual or a group of hackers is asserting possession of a significant amount of user data from Binance, purportedly offering it for sale on the dark web. 

The alleged data breach has cast a spotlight on Binance's security infrastructure, compelling the company to initiate a comprehensive investigation to verify the authenticity of the claims. Users anxiously await official statements from the exchange detailing the extent of the breach, identifying potential vulnerabilities, and outlining measures taken to mitigate the repercussions. 

Should the dark web sale prove to be true, it could expose sensitive information, including user account credentials, email addresses, and other personally identifiable details. This not only raises concerns about individual privacy but also the potential exploitation of this data for illicit activities, such as phishing attempts and identity theft. 

Despite Binance's proactive approach to security, incorporating measures such as two-factor authentication and cold wallet storage, the dynamic nature of cyber threats poses an ongoing challenge for even the most robust security protocols. 

Users are strongly advised to exercise vigilance and adopt precautionary measures, including password updates, enabling two-factor authentication, and regular monitoring of their accounts for any signs of suspicious activity. Binance has reassured users that it is treating the situation seriously and is diligently working to validate the extent of the alleged data breach. 

This potential breach at Binance also prompts broader inquiries into the overall security stance of cryptocurrency exchanges. As the digital asset landscape continues to expand, the imperative to secure user data and assets becomes increasingly paramount. Regulatory bodies and industry stakeholders are expected to scrutinize such incidents, emphasizing the necessity for stringent cybersecurity measures across the cryptocurrency ecosystem. 

In summary, the potential data breach at Binance and the accompanying dark web sale claims underscore the persistent challenges confronting cryptocurrency exchanges in safeguarding user information. This incident serves as a poignant reminder for users to prioritize security best practices, while exchanges must continually reassess and fortify their cybersecurity measures to counter evolving cyber threats. The cryptocurrency community awaits further updates from Binance regarding the investigation and any actions taken to address this disconcerting situation.