Data from 500M LinkedIn Users Posted for Sale Online

Personal data from more than 500 million LinkedIn users has been posted for sale online in yet another incident of threat actors scraping data from public profiles and slinging it online for potential cybercriminal misuse. Hackers posted an archive containing data they said includes LinkedIn IDs,...

Facebook: Stolen Data Scraped from Platform in 2019

The leak of personal data from more than 533 million Facebook users was scraped from their profiles by malicious actors because of a security flaw in the company’s platform prior to September 2019, the social media giant said Tuesday. Threat actors posted that data to a public hacker forum over t...

WP GDPR Compliance < 1.5.6 - Unauthenticated Stored Cross-Site Scripting (XSS)

The GDPR Compliance action=wpgdprcprocessaction=cccf5a60ec="type":"accessrequest","email":"[email protected]","consent":true...

Complaint Blasts TikTok’s 'Misleading' Privacy Policies

An umbrella group comprising 44 consumer-privacy watchdog organizations have filed a complaint against TikTok, saying the wildly-popular video-sharing platform has “misleading” data-collection policies. ByteDance-owned TikTok has skyrocketed in popularity, with more than 2 billion downloads on th...

WordPress WP GDPR Compliance plugin <= 1.5.5 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability discovered by Kamil Vavra in WordPress WP GDPR Compliance plugin versions = 1.5.5. Solution Update the WordPress WP GDPR Compliance plugin to the latest available version at least 1.5.6...

WordPress Ultimate GDPR & CCPA Compliance Toolkit premium plugin <= 2.4 - Unauthenticated Settings Import & Export vulnerability

Unauthenticated Settings Import & Export vulnerability found by Jerome Bruandet in WordPress Ultimate GDPR & CCPA Compliance Toolkit premium plugin versions = 2.4. Solution Update the WordPress Ultimate GDPR & CCPA Compliance Toolkit premium plugin to the latest available version at least 2.5...

Ultimate GDPR & CCPA Compliance Toolkit < 2.5 - Unauthenticated Plugin Settings Export and Import

The plugin used the isadmin method as an authorisation check, which does not check if the user is a an administrator. This could allow unauthenticated attackers to import arbitrary plugin’s settings and redirect all traffic to an external malicious website for example. Even though proper capabili...

Automating and operationalizing data protection with Dataguise and Microsoft Information Protection

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. In technical literature, the terms data discovery, classification, and tagging are sometimes used interchangeably, but there are real differences in what they actually mean—and each...

A week in security (January 25 – January 31)

January 28 was Data Privacy Day, but for Malwarebytes Labs, it was Data Privacy Week. As such, were packed with more privacy coverage than you can shake a stick at, starting with some practical steps on how to make your online life private and secure, and why privacy is core to a safer internet. ...

$12m Grindr fine shows GDPR’s got teeth

As thoughts turn to Data Privacy this week in a big way, GDPR illustrates it isnt an afterthought. Grindr, the popular social network and dating platform, will likely suffer a $12 million USD fine due to privacy related complaints. What happened here, and what are the implications for future case...

Why Data Security and Privacy in the digital age are crucial

Privacy is considered a basic human right but, with so much of our personal data now ‘out there’ in cyberspace, how private can it really be? Data is everywhere, and with rising internet usage, an increase in cloud technologies, and our growing reliance on IoT devices, it continues to grow...

VMware Carbon Black Champions Data Privacy Day 2021

Today is Data Privacy Day, an annual effort hosted by the National Cybersecurity Alliance NCSA to raise awareness about the importance of privacy and protection of personal information. VMware Carbon Black is proud to be an official Champion, supporting the principle that all organizations share...

Privacy breaches: Using Microsoft 365 Advanced Audit and Advanced eDiscovery to minimize impact

GDPR, HIPAA, GLBA, all 50 U.S. States, and many countries have privacy breach reporting requirements. If an organization experiences a breach of customer or employee personal information, they must report it within the required time frame. The size and scope of this reporting effort can be massiv...

Privacy breaches: Using Microsoft 365 Advanced Audit and Advanced eDiscovery to minimize impact

GDPR, HIPAA, GLBA, all 50 U.S. States, and many countries have privacy breach reporting requirements. If an organization experiences a breach of customer or employee personal information, they must report it within the required time frame. The size and scope of this reporting effort can be massiv...

Data Privacy – Now’s the Time for the US to Catch Up

The recent Netflix documentary, The Social Dilemma, may have highlighted to many Americans just what happens to the wealth of personal information they regularly - and willingly - share online. It may be especially concerning, then, to know that companies in the United States aren’t required by...

A week in security (December 14 – December 20)

Last week on Malwarebytes Labs we kept you updated on the SolarWinds attack, we warned about the special dangers that come with the Christmas season, published a threat profile for the Egregor ransomware, warned how a lead generation scam was targeting potential Malwarebytes MSP partners, and...

Ticketmaster Scores Hefty Fine Over 2018 Data Breach

Ticketmaster’s UK division has been slapped with a $1.65 million fine by the Information Commissioner’s Office ICO in the UK, over its 2018 data breach that impacted 9.4 million customers. The fine £1.25million has been levied after the ICO found that the company “failed to put appropriate securi...

Millions of Hotel Guests Worldwide Caught Up in Mass Data Leak

A widely used hotel reservation platform has exposed 10 million files related to guests at various hotels around the world, thanks to a misconfigured Amazon Web Services S3 bucket. The records include sensitive data, including credit-card details. Prestige Software’s “Cloud Hospitality” is used b...

dvogtimoveis.com.br Cross Site Scripting vulnerability OBB-1492680

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

tCell by Rapid7 Now Available for the European Region

Today, we are excited to announce tCell by Rapid7, our next-gen WAF and RASP solution, is now available in the Rapid7 Insight cloud’s European region. Multi-national or European organizations with data sovereignty requirements can now leverage tCell to reduce the risk of a breach via hacking of...