Tag Archive for: millions

I’m a tech expert – millions risk losing everything by breaking ‘number one security rule’ on iPhone and Android

/in


CYBER experts have revealed why you must never use the same password more than once.

Gadget users risk a dangerous wave of cyber-attacks if they make a simple (and very common) mistake.

It might seem like a handy option, but re-using passwords is extremely dangerousCredit: Unsplash

Often people choose one strong password – and then use it over and over again.

That’s because it’s easy to remember just one password, giving you quick access to all of your accounts and apps.

But it’s extremely dangerous, according to Brad Freeman, director of technology at SenseOn.

“The number one security rule is don’t reuse passwords,” Brad exclusively told The U.S. Sun.

“Many websites will get compromised and reusing the same password could cause a cascading failure as attackers can access multiple services which you have signed up for.

“This could allow an identity thief to build up a rich picture about you to commit fraud against you or your employer.”

If one account is hacked or leaked, crooks can use your password to break into all of your accounts that share the same login.

This means that a small breach somewhere can suddenly cascade into an enormous cyber-attack.

It puts you at serious risk of financial loss and being defrauded.

Hackers could even use a major cyberattack like this to spy on you, or even extort or blackmail you.

Thankfully staying safe is easy: Don’t re-use passwords.

If that seems difficult, it’s best to start using a password manager.

You may already have one: Apple devices like the iPhone offer you iCloud Keychain.

This will automatically generate strong passwords for accounts and then save them for you – refilling the login field when it’s needed.

Google offers a similar password-management feature through its Chrome browser.

And both Apple and Google are trying to push users away from passwords altogether to a new system called Passkeys.

Password-less logins are only just becoming available, and mean you don’t have to risk having a password for an account at all.

Source…

Millions of students impacted by ransomware attacks – Fox News

/in



Millions of students impacted by ransomware attacks  Fox News

Source…

Clop Hacking Rampage Hits US Agencies and Exposes Data of Millions

/in


United States cybersecurity officials said yesterday that a “small number” of government agencies have suffered data breaches as part of a broad hacking campaign that is likely being carried out by the Russia-based ransomware gang Clop. The cybercriminal group has been on a tear in exploiting a vulnerability in the file transfer service MOVEit to grab valuable data from victims including Shell, British Airways, and the BBC. But hitting US government targets will only increase global law enforcement’s scrutiny of the cybercriminals in the already high-profile hacking spree.

Progress Software, which owns MOVEit, patched the vulnerability at the end of May, and the US Cybersecurity and Infrastructure Security Agency released an advisory with the Federal Bureau of Investigation on June 7 warning about Clop’s exploitation and the urgent need for all organizations, both public and private, to patch the flaw. A senior CISA official told reporters yesterday that all US government MOVEit instances have now been updated. 

CISA officials declined to say which US agencies are victims of the spree, but they confirmed that the Department of Energy notified CISA that it is among them. CNN, which first reported the attacks on US government agencies, further reported today that the hacking spree impacted Louisiana and Oregon state driver’s license and identification data for millions of residents. Clop has previously also claimed credit for attacks on the state governments of Minnesota and Illinois.

“We are currently providing support to several federal agencies that have experienced intrusions affecting their MOVEit applications,” CISA director Jen Easterly told reporters on Thursday. “Based on discussions we have had with industry partners in the Joint Cyber Defense Collaborative, these intrusions are not being leveraged to gain broader access, to gain persistence into targeted systems, or to steal specific high-value information—in sum, as we understand it, this attack is largely an opportunistic one.”

Easterly added that CISA has not seen Clop threaten to release any data stolen from the US government. And the senior CISA official, who spoke to reporters on the condition that they…

Source…

Over 130 Organizations, Millions of Individuals Believed to Be Impacted by MOVEit Hack

/in


More victims of the MOVEit hack have come to light, with a total of over 130 organizations and millions of individuals believed to be impacted. 

Brett Callow, threat analyst at cybersecurity firm Emsisoft, has been monitoring the campaign, which exploited a zero-day vulnerability in Progress Software’s MOVEit Transfer managed file transfer (MFT) product to gain access to data belonging to organizations that had been using the solution.

Callow is aware of 138 organizations known to have been impacted by the campaign, with the data breaches resulting in the personal information of more than 15 million people being compromised. 

The Russia-linked cybercrime group known for operating the Cl0p ransomware has taken credit for the attack, claiming that it had been the only threat actor to know about the MOVEit zero-day exploit before it was patched.

The hackers claim to have hit many organizations and they have started naming those that have refused to pay up or enter negotiations. They have recently named over 60 entities that appear to have been targeted through the MOVEit vulnerability, which the group may have been testing since 2021. 

The list includes major organizations such as Shell (they have already leaked data allegedly stolen from the energy giant), Siemens Energy, Schneider Electric, UCLA, Sony, EY, PwC, Cognizant, and AbbVie. Law firms Kirkland & Ellis and K&L Gates have also been added to Cl0p’s leak website.

Siemens Energy and Schneider Electric have confirmed for SecurityWeek that they have been targeted. 

Advertisement. Scroll to continue reading.

EY has also confirmed being targeted and told SecurityWeek that it’s investigating the incident.

“We have verified that the vast majority of systems which use this transfer service across our global organization were not compromised. We are manually and thoroughly investigating systems where data may have been accessed,” the financial services giant said in an emailed statement. “Our priority is to communicate to those impacted, as well as the relevant authorities and our investigation is ongoing.”

UCLA also admitted that the vulnerability was exploited to gain access to its MOVEit platform and said it…

Source…