Giant health insurer struck by ransomware didn't have antivirus protection

The Philippine Health Insurance Corporation PhilHealth, has confirmed that it was unprotected by antivirus software when it was attacked by the Medusa ransomware group in September. Antivirus software--or more correctly, its modern descendents endpoint security and Endpoint Detection and Response...

GHSA-G9V2-WQCJ-J99G Uptime Kuma has Persistentent User Sessions

Summary Attackers with access to a users' device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods. Details uptime-kuma sets JWT tokens for users after successful authentication. These tokens have...

[updated] 23andMe user data stolen, offered for sale

Information belonging to as many as seven million 23andMe customers has been put up for sale on criminal forums following a credential stuffing attack against the genomics company. On Friday October 6, 2023, 23andMe confirmed via a somewhat opaque blog post that threat actors had "obtained...

23andMe User Data Stolen in Targeted Attack on Ashkenazi Jews

At least a million data points from 23andMe accounts appear to have been exposed on BreachForums. While the scale of the campaign is unknown, 23andMe says it's working to verify the data...

Hacker Claims to Have Data of 7 Million 23andMe Users from DNA Service

By Waqas 23andMe Investigating Potential Data Breach, Says Credentials May Have Been Gathered From Other Breaches. This is a post from HackRead.com Read the original post: Hacker Claims to Have Data of 7 Million 23andMe Users from DNA Service...

CVE-2023-4469

CVE-2023-4469 affects the WordPress plugin Profile Extra Fields by BestWebSoft . The vulnerability is due to a missing capability check in the prflxtrflds_export_file function, allowing unauthenticated attackers to expose potentially sensitive data entered into custom fields, reported for version...

Sony Data Breach via MOVEit Vulnerability Affects Thousands in US

By Waqas The data breach occurred from May 28th to May 30th, 2023, and the stolen data included "names and other personal identifiers combined with Social Security Numbers SSNs." This is a post from HackRead.com Read the original post: Sony Data Breach via MOVEit Vulnerability Affects Thousands i...

CVE-2023-2422 Keycloak: oauth client impersonation

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to...

Celebrate 20 years of Cybersecurity Awareness Month with Microsoft and let’s secure our world together

This year marks the twentieth anniversary of Cybersecurity Awareness Month, when we partner with the National Cybersecurity Alliance, the United States Cybersecurity and Infrastructure Security Agency CISA, and organizations around the world to amplify the importance of cybersecurity best practic...

Celebrate 20 years of Cybersecurity Awareness Month with Microsoft and let’s secure our world together

This year marks the twentieth anniversary of Cybersecurity Awareness Month, when we partner with the National Cybersecurity Alliance, the United States Cybersecurity and Infrastructure Security Agency CISA, and organizations around the world to amplify the importance of cybersecurity best practic...

A week in security (September 25 - October 1)

Last week on Malwarebytes Labs: Dependabot impersonators cause trouble on GitHub Update Chrome now! Google patches another actively exploited vulnerability Googles Bard conversations turn up in search results Malicious ad served inside Bing's AI chatbot Pegasus spyware and how it exploited a WebP...

Child health data stolen in registry breach

Canadian healthcare organization Better Outcomes Registry & Network BORN has disclosed a data breach affecting client data. BORN--an Ontario perinatal and child registry that collects, interprets, shares, and protects critical data about pregnancy, birth, and childhood--says it was attacked on Ma...

Ransomware group claims it's "compromised all of Sony systems"

Newcomer ransomware group RansomedVC claims to have successfully compromised the computer systems of entertainment giant Sony. As ransomware gangs do, it made the announcement on its dark web website, where it sells data that it's stolen from victims' computer networks. The announcement says Sony...

900 U.S. Schools Hit by MOVEit Hack, Exposing Student Data

By Deeba Ahmed Student Data Managing Platform National Student Clearinghouse Confirmed MOVEit Hack Affected 900 US Schools. This is a post from HackRead.com Read the original post: 900 U.S. Schools Hit by MOVEit Hack, Exposing Student Data...

CVE-2023-1636

OpenStack Barbican containers in an all‑in‑one configuration share CGROUP, USER, and NET namespaces with the host and other services, allowing a compromised service to access data transmitted to/from Barbican. The CVE-2023-1636 entry describes an information‑disclosure risk due to incomplete cont...

90GB of Data Posted on Hacker Forum Linked to T-Mobile Glitch

By Waqas Another day, another data security incident at T-Mobile - Because why not! A cybersecurity year without a T-Mobile… This is a post from HackRead.com Read the original post: 90GB of Data Posted on Hacker Forum Linked to T-Mobile Glitch...

T-Mobile spills billing information to other customers

Some T-Mobile customers logged into their accounts on Wednesday to find another customers billing and account information showing on their online dashboards. T-Mobile denied there was an attack, but confirmed there had been a data leak. It said a "temporary system glitch" had misplaced some...

MAL-2023-8189 Malicious code in @zettle-bo/account-settings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b17c84d8882d13329dffcb79f072da64a52b32b63fb3e8ba5a30daaec4e69a57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-39041

CVE-2023-39041 concerns the Line/KUKURUDELI platform. Multiple connected sources describe an information leak in KUKURUDELI Line v13.6.1 that enables attackers to obtain the channel access token and to send crafted messages. The core description across sources is consistent: an information disclo...

CVE-2023-39052

Summary: CVE-2023-39052 affects Earthgarden_waiting 13.6.1, describing an information disclosure that allows attackers to obtain the channel access token and send crafted messages. The NVD entry lists a MEDIUM severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N; base 6.5). Other connected sou...