California Man Hacked iCloud Accounts to Steal Nude Photos

A California man impersonated an Apple customer support technician in a socially engineered email campaign that stole people’s iCloud passwords to break into accounts and collected upwards of 620,000 private photos and videos. Hao Kuo Chi, 40, of La Puente, has agreed to plead guilty to four...

Researchers Warn of 4 Emerging Ransomware Groups That Can Cause Havoc

Cybersecurity researchers on Tuesday took the wraps off four up-and-coming ransomware groups that could pose a serious threat to enterprises and critical infrastructure, as the ripple effect of a recent spurt in ransomware incidents show that attackers are growing more sophisticated and more...

Microsoft Spills 38 Million Sensitive Data Records Via Careless Power App Configs

For months, Microsoft’s Power Apps portals exposed personal data tied to 38 million records ranging from COVID-19 vaccination status, Social Security numbers and email addresses. Consumers most affected by what is being called a “platform issue” are those doing business with American Airlines,...

Researchers Detail Modus Operandi of ShinyHunters Cyber Crime Group

ShinyHunters, a notorious cybercriminal underground group that's been on a data breach spree since last year, has been observed searching companies' GitHub repository source code for vulnerabilities that can be abused to stage larger scale attacks, an analysis of the hackers' modus operandi has...

38M Records Exposed Online—Including Contact-Tracing Info

Misconfigured Power Apps from Microsoft led to more than a thousand web apps accessible to anyone who found them...

What’s Next for T-Mobile and Its Customers? – Podcast

What’s the opposite of a resilient operation? It’s when your wireless carrier gets breached for the sixth time in a few years, you try to change your PIN online, and the site tells you “No can do.” As of Wednesday, T-Mobile had confirmed its sixth breach over the last three years. The purported...

COVID-19 Contact-Tracing Data Exposed, Fake Vax Cards Circulate

This week, the Indiana Department of Health issued a notice that the state’s COVID-19 contact-tracing system had been exposed via a cloud misconfiguration, revealing names, emails, gender, ethnicity, race and dates of birth of more than 750,000 people. The incident shows that COVID-19 data could ...

T-Mobile customers, change your PINs

At the end of last week, T-Mobile was investigating reports of a “massive” customer data breach. A hacker claimed to stolen 100 million people’s data from T-Mobile’s servers, which included everything from names and driver licences to addresses and social security numbers. Its now confirmed...

T-Mobile Data Breach

Its a big one: As first reported by Motherboard on Sunday, someone on the dark web claims to have obtained the data of 100 million from T-Mobiles servers and is selling a portion of it on an underground forum for 6 bitcoin, about $280,000. The trove includes not only names, phone numbers, and...

The T-Mobile Breach Is Much Worse Than It Had to Be

The vast majority of victims weren’t even T-Mobile customers. Now their information is for sale on the dark web...

T-Mobile: >40 Million Customers’ Data Stolen

T-Mobile has confirmed much of what a threat actor bragged about over the weekend: Personal details for tens of millions of current, former or prospective T-Mobile customers were stolen in a huge breach of its servers. On Tuesday, it disclosed further details on the data breach in a post on its...

T-Mobile: Breach Exposed SSN/DOB of 40M+ People

T-Mobile is warning that a data breach has exposed the names, date of birth, Social Security number and drivers license/ID information of more than 40 million current, former or prospective customers who applied for credit with the company. The acknowledgment came less than 48 hours after million...

Design/Logic Flaw

Viewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Address without the viewing privilege...

CVE-2021-20763

Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without the appropriate privilege...

CVE-2021-20756

Viewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Address without the viewing privilege...

PT-2021-5804 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs get attribute value. This issue may allow an attacker to access confidential data,...

Dell EMC PowerScale OneFS Information Disclosure Vulnerability

Dell EMC PowerScale OneFS, an API-driven file system, is vulnerable to an information disclosure in Dell EMC PowerScale OneFS version 8.2.2-9.1.0.. The vulnerability stems from the product's use of a get request method with a sensitive query string. An attacker could exploit the vulnerability to...

T-Mobile Investigating Claims of Massive Data Breach

Communications giant T-Mobile said today it is investigating the extent of a breach that hackers claim has exposed sensitive personal data on 100 million T-Mobile USA customers, in many cases including the name, Social Security number, address, date of birth, phone number, security PINs and detai...

The T-Mobile Data Breach Is One You Can’t Ignore

Hackers claim to have obtained the data of 100 million people—including sensitive personal information...

100m T-Mobile Customer Records Purportedly Up for Sale

A threat actor is selling what they claim to be 30 million T-Mobile customers’ Social Security and driver license numbers on an underground web forum. The collection is a subset of the purported 100 million records contained in stolen databases. The seller told Motherboard – which first reported...