T-Mobile's New Data Breach Shows Its $150 Million Security Investment Isn't Cutting It

The mobile operator just suffered at least its fifth data breach since 2018, despite promising to spend a fortune shoring up its systems...

T-Mobile Hacked Again: 37 Million Accounts Compromised

By Deeba Ahmed According to T-Mobile, the data breach occurred in November of 2022, but the company only discovered the incident in January of 2023. This is a post from HackRead.com Read the original post: T-Mobile Hacked Again: 37 Million Accounts Compromised...

New T-Mobile Breach Affects 37 Million Accounts

T-Mobile today disclosed a data breach affecting tens of millions of customer accounts, its second major data exposure in as many years. In a filing with federal regulators, T-Mobile said an investigation determined that someone abused its systems to harvest subscriber data tied to approximately ...

PayPal Notifies 35,000 Users of Data Breach

By Habiba Rashid According to PayPal, hackers managed to access the personal information of 34,942 users; however, no transactions were performed from the breached accounts. This is a post from HackRead.com Read the original post: PayPal Notifies 35,000 Users of Data Breach...

Third-Party Firm Exposes Personal Info for Nissan Customers

By Habiba Rashid In total, 18,000 customers of Nissan North America, Inc. had their personal information exposed to the public by a third-party developer. This is a post from HackRead.com Read the original post: Third-Party Firm Exposes Personal Info for Nissan Customers...

CVE-2023-21891

...

CVE-2023-21889

CVE-2023-21889 affects Oracle VM VirtualBox (Core). Affected: VirtualBox versions prior to 6.1.42 and prior to 7.0.6. Exploitation requires local access (logon) to the infrastructure where VirtualBox runs. Impact: unauthorized read access to a subset of VirtualBox data. No details on root cause b...

CVE-2023-21859

The CVE-2023-21859 entry concerns Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware. Affected version: 12.2.1.4.0. Root cause described as insufficient input validation in the Authentication Engine, enabling a high-privilege attacker with logon on the infrastructure to com...

CVE-2023-21839

CVE-2023-21839 affects Oracle WebLogic Server (core) versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. It is exploitable via unauthenticated network access over T3/IIOP and relates to post-deserialization of a ForeignOpaqueReference object, enabling remote code execution as the oracle user. Multip...

"Untraceable" surveillance firm sued for scraping Facebook and Instagram data

Days after Meta achieved victory after suing the NSO Group for Computer Fraud and Abuse Act charges, Meta filed a lawsuit against surveillance company Voyager Labs for violations of its Terms and Policies and California law. According to court documents, Voyager Labs created 38,000 fake accounts ...

Is the FSI innovation rush leaving your data and application security controls behind?

Fuelled by rising consumer expectations for innovative services and easy real-time access to financial products and information, financial services industries FSI and fintech organizations are racing to out-innovate each other and capture market share. The sizeable growth of investments into the...

Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident

DevOps platform CircleCI on Friday disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data last month. The CI/CD service CircleCI said the "sophisticated...

Threat Source newsletter (Jan. 12, 2023): Did ChatGPT write our newsletter?

Welcome to this weeks edition of the Threat Source newsletter. We tried to get ChatGPT to write this weeks newsletter but it was at capacity, so youll have to stick with us for another week. Or maybe thats just what the robots want you to think, you be the judge. The one big thing This week Talos...

Twitter Denies Hacking Claims, Assures Leaked User Data Not from its System

Twitter on Wednesday said that its investigation found "no evidence" that users' data sold online was obtained by exploiting any security vulnerabilities in its systems. "Based on information and intel analyzed to investigate the issue, there is no evidence that the data being sold online was...

Twitter Scraping Breach: 209 Million Accounts Leaked on Hacker Forum

By Waqas The data was collected through web scraping techniques however some sites are reporting it as a "Twitter data breach," or " Twitter being hacked." This is a post from HackRead.com Read the original post: Twitter Scraping Breach: 209 Million Accounts Leaked on Hacker Forum...

BitRAT Now Sharing Sensitive Bank Data as a Lure

Introduction In June of 2022 Qualys Threat Research Unit TRU wrote an in-depth report on Redline, a commercial off the shelf infostealer that spreads via fake cracked software hosted on Discord’s content delivery network. Since then, we have continued to track similar threats to identify their...

LastPass Data Breach: It’s Time to Ditch This Password Manager

The password manager’s most recent data breach is so concerning, users need to take immediate steps to protect themselves...

Online Casinos DraftKings and BetMGM Hacked; Data of Millions at Risk

By Waqas In BetMGM's case, hackers are selling data of 1.57 million customers, while data of 68,000 DraftKings customers is also up for grabs. This is a post from HackRead.com Read the original post: Online Casinos DraftKings and BetMGM Hacked; Data of Millions at Risk...

LastPass Admits to Severe Data Breach, Encrypted Password Vaults Stolen

The August 2022 security breach of LastPass may have been more severe than previously disclosed by the company. The popular password management service on Thursday revealed that malicious actors obtained a trove of personal information belonging to its customers that include their encrypted...

Millions of Gemini cryptocurrency exchange user details leaked

If youre a user of the Gemini cryptocurrency exchange, its time to be on your guard against phishing attacks. Gemini says its own systems have not been compromised, but an unnamed third party has become the focal point for a breach. On December 13 or some point before, rogues gained access to jus...