Fraud Prevention Month advice, the latest data breach reports and more.
Welcome to Cyber Security Today. It’s Monday, March 6th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.
 |
 |
 |
March is Fraud Prevention Month. Businesses are reminded that protecting the personal information of customers and employees, including credit and debit card data, is vital to lowering the odds of being victimized by credit card fraud, fraudulent cheques, false invoices, or identity fraud.
Crooks want to make money first by selling stolen credit and debit card information to other crooks. But sometimes they get generous. Last week, for example, an underground website called BidenCash that sells stolen credit and debit cards celebrated its first anniversary by giving away a database of personal information. According to researchers at Cyble, the data covers about 811,000 debit cards and 740,000 credit cards. Included are card numbers, expiration dates and CVV codes along with names, home addresses, email addresses and phone numbers of card holders. American cardholders account for just under half the total. Crooks could use the information for identity theft and sending phishing messages. Think about the damage that could be done to your firm by crooks pretending to be your customers. Does your firm have an anti-fraud program in addition to a data theft prevention strategy?
A recent KPMG survey of more than 500 small and medium-sized companies across Canada found three-quarters of respondents experienced either internal fraud (by an employee) or external fraud.
Your firm’s employees can inadvertently help fraud in a number of ways. One is by misconfiguring a website, like the one at hotel reservation provider Booking.com discovered by researchers at Salt Security. Last week the researchers explained the misconfiguration was of the implementation of Open Authentication. OAuth allows customers to log into websites using their credentials for Facebook or Google and other services. Had this hole been discovered by a hacker they could have taken over the accounts of users and stolen their personal information. The mistake was corrected in December.
Two American universities are still dealing with the effects of cyber attacks. According to the cyber news site The Record, Tennessee State University notified more than 8,000 students last week its IT systems were hit by ransomware. In addition, Southeastern Louisiana University acknowledged it was hit by a cyber attack.
An update on Friday’s report that fast food outlet Chick-fil-A has begun notifying customers about a data breach. The number of people being notified is just over 71,000.
The Play ransomware gang has started to disclose information recently stolen from the city of Oakland, California. According to Bleeping Computer, the gang says some personal information on residents and employees is being made publicly available.
Attention telephony administrators: Cisco Systems released updates to fix two critical vulnerabilities in the web-based user interface of several models of its IP phones. If your firm uses the Cisco IP Phone 6800, 7800, 7900 and 8800 series phones see the Cisco Security Advisory and take action.
American authorities have issued another in a series of background reports on ransomware gangs. The latest is on the strain called Royal. The alert includes indicators of compromise that IT and security teams should watch for.
Finally, so far this year a number of U.S. hospitals and clinics have reported data breaches. Often experts complain healthcare institutions in many countries don’t put enough money and people into cybersecurity. It’s not due to a lack of know-how. A commentator at the SANS Institute last week noted there are lots of free resources hospitals and clinics can take advantage of to prevent attacks. There is, for example, a Health Information Sharing and Analysis Centre (Health-ISAC), in addition to information offered by the U.S. Cybersecurity and Infrastructure Security Agency. More to the point, a SANS commentator said, clinical systems with personal information shouldn’t be exposed to the public internet.
Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon