China Temu App caused data privacy concerns in United Kingdom

During the shopping season, a significant portion of the United Kingdom’s population was eagerly turning to the Temu online shopping application, enticed by its promise of unbelievable prices. The application, adorned with an eye-catching orange logo, had generated high expectations for excellent profits during the Christmas 2023 shopping frenzy.

However, law enforcement authorities have issued a stark warning about this online marketplace. They have uncovered evidence of the app harvesting customer data and expressed concerns that this data may find its way into Chinese hands.

These growing concerns about data privacy have dominated headlines on Google, casting a shadow of doubt over the app’s trustworthiness. Many potential users are now hesitant to explore Temu for their shopping needs, especially considering that it’s marketing Chinese products under the guise of a Singaporean cover. Adding to these apprehensions is a recent alert circulating on the Telegram app, suggesting that the electronic devices supplied by Temu may harbor malware capable of espionage in the future.

Operating under the name Tee-Moo in Beijing, this app prides itself on delivering products directly from factories, boasting of cost-effective prices that not only delight customers but also keep the business thriving.

Currently, these ultra-low prices are exclusively available to customers in the United Kingdom. However, the company has ambitions to expand its services across Europe, contingent on compliance with the General Data Protection Regulation (GDPR) and privacy regulations in the UK.

The owner of the Temu app, E-commerce giant PDD Holdings Inc, has maintained a stance of silence on this issue. They’ve clarified that their products and services do not contain any hidden malware or malicious software. They assert that the data they collect is solely for the purpose of improving their services.

So, what’s the best course of action?

It is advisable to exercise caution. Avoid sharing sensitive banking details such as credit and debit card numbers or CVVs unless absolutely necessary. If possible, opt for the Cash on Delivery (COD) payment method when shopping through the Temu app to minimize potential risks.

The post China Temu App caused data privacy concerns in United Kingdom appeared first on Cybersecurity Insiders.

October 04, 2023 at 08:22PM

Read More

The Importance of Data Protection in the Financial Sector

The financial sector is among the most data-intensive industries in the world. Financial institutions deal with vast amounts of sensitive information, including personal and financial data of customers, transaction records, and market-sensitive information. As such, data protection is of paramount importance in the financial sector for several critical reasons:

1. Customer Trust and Reputation: Data breaches can irreparably damage a financial institution’s reputation and erode customer trust. When customers entrust their financial information to banks, insurance companies, or investment firms, they expect it to be safeguarded diligently. Any breach of this trust can lead to customer churn and a loss of business.

2. Regulatory Compliance: The financial sector is subject to a multitude of stringent regulations and compliance standards. Failing to protect customer data can result in severe legal and financial consequences, including hefty fines and legal actions. Compliance with regulations like the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA) is essential to avoid penalties.

3. Identity Theft and Fraud Prevention: Financial institutions are prime targets for cybercriminals seeking to steal personal information for identity theft and financial fraud. Effective data protection measures, such as encryption and multi-factor authentication, are critical in preventing unauthorized access to sensitive data.

4. Financial Stability: The stability of financial markets relies on the integrity of financial data. Accurate and secure data is essential for making informed investment decisions and ensuring the smooth functioning of financial systems. Any manipulation or tampering of data can have far-reaching economic consequences.

5. Insider Threat Mitigation: The financial sector faces threats not only from external hackers but also from insider threats. Employees or contractors with access to sensitive data can misuse their privileges or inadvertently cause data breaches. Robust data protection policies can help mitigate these risks.

6. Intellectual Property Protection: Financial institutions often develop proprietary algorithms, trading strategies, and financial models that are considered valuable intellectual property. Protecting this intellectual property is crucial for maintaining a competitive edge in the industry.

7. Operational Efficiency: Effective data protection measures can enhance operational efficiency. When data is well-organized, protected, and accessible only to authorized personnel, financial institutions can streamline their operations and reduce the risk of errors or data loss.

8. Cybersecurity Threat Mitigation: The financial sector is a prime target for cyberattacks due to the potential for substantial financial gain for attackers. Data breaches can lead to significant financial losses, not only in terms of stolen funds but also in costs related to investigating and mitigating the breach.

9. Trust in Digital Transformation: The financial sector is undergoing a digital transformation, with online banking, mobile apps, and fintech innovations becoming the norm. Trust in digital financial services depends on the ability of financial institutions to protect customer data. Without robust data protection measures, customers may be reluctant to embrace these digital services.

In conclusion, data protection is a cornerstone of the financial sector’s operations. It not only safeguards the interests of customers and shareholders but also upholds the integrity and stability of financial markets. Financial institutions must continually invest in data protection technologies and practices to adapt to evolving cybersecurity threats and regulatory requirements while maintaining trust in an increasingly digital world.

The post The Importance of Data Protection in the Financial Sector appeared first on Cybersecurity Insiders.

October 04, 2023 at 10:57AM

Read More

Cyber Attack on NATO and Ransomware Attack on Motel One

A hacking collective that goes by the name “Hacktivist,” also known as SiegedSec, has recently claimed to be in possession of classified NATO documents. Their assertion comes after successfully infiltrating the North Atlantic Alliance’s servers earlier this year.

In response to this alarming development, the North Atlantic Treaty Organization (NATO) has promptly initiated an investigation into the incident. NATO authorities are diligently examining whether these cybercriminals have accessed sensitive strategic planning and research documents from their IT infrastructure. Details of the investigation’s findings will be disclosed soon, according to NATO officials.

To substantiate their claims, the hacktivist group, a subgroup of Alphv,  published a portion of the pilfered data on their Telegram channel. They emphasized that this information was obtained approximately three months ago from the organization’s website servers.

In a separate cybersecurity incident, Motel One, a budget hotel chain based in Germany, revealed that it had fallen victim to a ransomware attack. The attackers utilized encryption tools to compromise the hotel chain’s digital infrastructure, resulting in downtime. Motel One, one of Europe’s largest hotel chains with over 90 properties, disclosed that the perpetrators had accessed data linked to 169 customer credit cards and their corresponding addresses.

Although the scale of the impact was relatively small, the hotel chain is actively seeking expert guidance to bolster its defenses against future cyberattacks. Initial suspicions point to the ALPHV ransomware gang as the culprits. Preliminary assessments suggest that the gang managed to exfiltrate a substantial amount of data, exceeding 2 terabytes, including information related to both employees and customers.

It’s worth noting that both of these European-based victims find themselves in a region that supports Ukraine in its ongoing conflict with Russia. Additionally, both incidents were attributed to ALPHV, a notorious double-extortion gang that also targeted MGM Resorts and Caesars Entertainment Casinos back in August of this year. Notably, both MGM and Caesars, operating in the entertainment and hospitality sectors, made substantial financial contributions to secure the release of their encrypted databases.

The post Cyber Attack on NATO and Ransomware Attack on Motel One appeared first on Cybersecurity Insiders.

October 04, 2023 at 10:44AM

Read More

Cybersecurity related news headlines trending on Google

1.) The Federal Bureau of Investigation (FBI) has issued a nationwide alert regarding a hacking group known as “Phantom Hackers,” which is specifically targeting senior citizens. According to the FBI’s statement, these criminals impersonate bank representatives, convincing their victims to disclose sensitive information. This stolen information is subsequently exploited to drain bank accounts, deplete savings, and access retirement benefits stored in bank accounts. In some instances, the hackers gain the trust of their victims by falsely promising lottery winnings or fiat currency acquired through cryptocurrency trading.

2.) Security researchers at Zscalar recently uncovered a new malware variant called ‘BunnyLoader.’ This malware, associated with a burgeoning malware-as-a-service industry, possesses the capability to pilfer and replace data stored in the clipboard. Moreover, BunnyLoader can abscond with cryptocurrency from the targeted device and transmit data from remote keystrokes to command-and-control centers dispersed globally.

3.) A survey conducted by email security provider Egress highlights the growing challenge of identifying AI-generated phishing emails. The Phishing Threat Trends report suggests that most software and AI chatbots struggle to detect phishing emails crafted using artificial intelligence. Jack Chapman, Vice President of Threat Intelligence at Egress, believes that additional time may be required to develop defenses capable of recognizing such technologically sophisticated phishing attempts.

4.) Indian Logistics history witnessed a significant breach as the National Logistics Portal Marine exposed sensitive data due to misconfigured Amazon S3 buckets. Security researcher Bob Diachenko discovered that these storage resources contained a wealth of sensitive information, including crew members’ dates of birth, genders, passport numbers, expiration dates, nationalities, full names, travel expenses, and logistic details pertaining to ships, such as parcel invoices and shipping addresses. The Indian Transport Ministry, which launched the website in January, has acknowledged the issue and declared that it has since rectified the configuration.

5.) A report from ESET reveals that the Lazarus Hacking group, linked to North Korea, has initiated espionage campaigns targeting aerospace company networks using social engineering tactics. Typically, the hackers contact high-level executives on platforms like LinkedIn and send them links that ultimately lead to the download of espionage-related payloads. Recently, Lazarus posed as a recruiter from Meta to target an employee at a Spanish aerospace firm successfully. Although the hackers managed to infiltrate the network to a certain extent, the aerospace agency’s IT team thwarted their efforts, thanks to a timely tip-off from a forensic expert.

6.) Minnesota-based Metro Transit, a public transportation service provider, reported a cyberattack on October 2, 2023, prompting the freezing of its IT infrastructure. The company clarified that the cyber incident was unrelated to a Metro Transit bus accident involving a pickup truck, emphasizing that the accident occurred without any digital interference.

7.) Estes Express, a freight transit manager based in Virginia, found itself in the news due to a digital disruption. The company assured that it would provide more details regarding the incident once its IT team has thoroughly investigated the issue. However, a source from Estes Express’s Richmond headquarters hinted at the sophistication of the attack, suggesting it might be a variant of a Distributed Denial of Service (DDoS) attack.

8.) Predator Spyware, developed by Egyptian company Cytrox, has come under scrutiny for its alleged use in monitoring the mobile activities of Egyptian MP Ahmed Eltantawy, who is running for the 2024 Presidential elections. This situation appears to be a significant development, potentially surpassing the controversy surrounding the Pegasus Spyware, which targeted Amazon CEO Jeff Bezos and exposed his involvement with his current girlfriend, Lauren Sanchez. Further details are expected to emerge following a comprehensive investigation.

The post Cybersecurity related news headlines trending on Google appeared first on Cybersecurity Insiders.

October 03, 2023 at 08:23PM

Read More

Top 5 cybersecurity risks involved during layoffs

Major technology companies like Meta, Amazon, and Microsoft have recently made headlines with their announcements of employee layoffs. However, these workforce reductions can potentially expose organizations to cybersecurity risks, several of which will be discussed in this article.

1. Employee Training: Downsizing can disrupt or delay critical IT services, as new staff members must familiarize themselves with the company’s infrastructure and adapt to its work culture. This transition can introduce security vulnerabilities, leading to misconfiguration errors, network congestion, and disruptions in the regular flow of data.

2. Insider Threats: Disgruntled former employees may become insider threats by leaking sensitive information to competitors or erasing mission-critical data. Such actions can result in downtime, decreased productivity, and severe damage to a company’s reputation by undermining critical infrastructure. According to a 2021 report by Cybersecurity Insiders, 66% of businesses perceive themselves as highly susceptible to insider threats, which can lead to significant reputational harm.

3. Unused Accounts: Layoffs often result in the creation of forgotten digital accounts, which can be exploited if their credentials fall into the wrong hands. These accounts may be misused by former employees or by hackers who gain unauthorized access to login information. To mitigate this risk, it is advisable to promptly deactivate these dormant accounts when employees depart, requiring effective coordination between the HR and IT departments.

4. Remote Worker Layoffs: Special attention must be given when terminating remote workers. Their access to the company’s digital infrastructure should be immediately revoked upon their departure, and their login credentials should be rendered inactive. Failing to do so could leave the organization vulnerable to potential threats from former remote employees.

5. Retrieving Employee Devices: Many companies provide employees with devices to maximize productivity, especially in sectors like software and IT. However, when an employee leaves the organization, it is common for companies to neglect retrieving these devices. This oversight can pose a cybersecurity threat, as departing employees may misuse or sell the information and applications stored on these devices to unauthorized parties. To mitigate this risk, it is advisable for HR departments to collect these devices on the employee’s last day of work.

In conclusion, as companies navigate the challenges of workforce reductions, they must remain vigilant in addressing the cybersecurity risks associated with employee layoffs. Implementing comprehensive procedures for employee off-boarding, account deactivation, and device retrieval can help safeguard sensitive information and protect against potential threats to an organization’s digital infrastructure.

The post Top 5 cybersecurity risks involved during layoffs appeared first on Cybersecurity Insiders.

October 03, 2023 at 10:30AM

Read More

Dual Ransomware Attacks are different and explained

In August of this year, the Federal Bureau of Investigation (FBI) issued a warning regarding a concerning trend affecting numerous companies across North America since July 2023. This emerging threat, known as “Dual Ransomware” attacks, entails digital assaults targeting the same victim within a time-frame spanning from 48 hours to 7 days.

To put it plainly, a dual ransomware attack occurs when a company falls victim to a file-encrypting attack, regardless of whether it involves double extortion. The consequences are consistent: financial losses, the illicit extraction of sensitive information, and the complete lockdown of data access.

While concrete evidence pinpointing the exact motivations behind these attacks remains elusive, security analysts suggest that various factors may be contributing to their prevalence. These factors include inadequate technical support within targeted organizations to rectify vulnerabilities susceptible to dual ransomware, mis-configurations in applications or cloud environments, and the absence of a pre-established business continuity plan to address such situations, among other potential catalysts.

According to a survey conducted by a dark web-affiliated hacking group, nearly 19 companies have fallen victim to these attacks since July 2023. Notably, two of these targeted entities were Fortune 500 companies, boasting annual revenues in the millions.

Interestingly, none of these attacks have been officially documented; they only came to light when company representatives sought assistance from freelance forensic experts to negotiate with the hackers.

The culprits behind these sophisticated digital assaults remain shrouded in mystery. However, the FBI’s private industry notification has raised concerns about the involvement of various Ransomware-as-a-Service (RaaS) groups, such as Royal, Quantum, 3AM Ransomware, LockBit, Karakurt, Hive, Diamond, and Avoslocker, either directly orchestrating these attacks or having connections to the encryption code employed on the compromised computer networks.

In a noteworthy revelation, Emsisoft researchers have traced the origins of dual encryption as a criminal tactic introduced in 2020-21, coinciding with the widespread lockdowns and the surge in remote work culture during the COVID-19 pandemic.

The primary defense against such attacks lies in implementing robust identity and access management measures. These include enforcing strong passwords, deploying multi-factor authentication (MFA) systems that are resistant to phishing attempts, and implementing time-based access controls for accounts holding administrative privileges. Additionally, conventional security practices such as keeping operating systems up to date, regularly updating antivirus solutions, securing network protocols, patching firmware vulnerabilities, disabling unused ports, and monitoring the activities on Bring Your Own Device (BYOD) devices continue to be essential safeguards against these evolving cyber threats.

The post Dual Ransomware Attacks are different and explained appeared first on Cybersecurity Insiders.

October 02, 2023 at 08:33PM

Read More

Cyber Attack on Louisiana Vehicle Owners data and Royal Family Website crash by Russia

Louisiana vehicle owners’ data was leaked in a massive cyber-attack

A massive cyber-attack has exposed the personal data of Louisiana vehicle owners, marking what appears to be the largest breach in the history of the U.S. automotive industry. According to a report in The Guardian, Clop Ransomware hackers gained access to the data of over 6 million Louisiana residents in August of this year. Now, they threaten to leak this stolen information unless their demands are met promptly.

The attack is said to have originated in Russia, where the hackers infiltrated and pilfered a wide range of personal information, including names, addresses, social security numbers, vehicle registration dates, driver’s license details, dates of birth, height, eye color, gender information, and even car ownership details.

The Clop ransomware group, hailing from Russia, has publicly stated their intent to release more of the data they obtained from the Louisiana Department of Transportation and Development’s database if their demands are not addressed swiftly.

Royal Family Website taken down by Killnet

In a separate incident, the Royal Family Website came under attack, reportedly orchestrated by pro-Kremlin hackers in Moscow. This assault was carried out through a distributed denial of service (DDoS) attack, seemingly in response to Britain’s condemnation of Russia’s actions in Ukraine.

While the Palace administration did acknowledge the disruption of their website, they refrained from officially categorizing it as a state-funded cyber attack in the form of a DDoS attack. According to our sources in Cybersecurity, the website was inaccessible for approximately 3 hours before being restored to normalcy, a process that took over 45 minutes.

A subsequent report in The Telegraph shed light on the incident, linking it to state-funded hackers. They published a screenshot from a Telegram resource named ‘Killmilk,’ purportedly the owner of Killnet, who claimed responsibility for the attack on behalf of the Soviet Intelligence Agency.

It is noteworthy that this digital assault occurred just two weeks after King Charles publicly voiced his support for Ukraine, stating, “Ukraine must prevail.”

The post Cyber Attack on Louisiana Vehicle Owners data and Royal Family Website crash by Russia appeared first on Cybersecurity Insiders.

October 02, 2023 at 10:44AM

Read More