Tis' the Season for Online Holiday Shopping; and Phishing

While online holiday shopping is nothing new, more of us will be avoiding the malls and brick-and-mortar stores this year — which opens up big opportunities for cybercriminals. This, along with COVID-19, is expected to anchor most of the scam and phishing lures in circulation this season. Since...

Exposed Database Reveals 100K+ Compromised Facebook Accounts

Researchers have uncovered a wide-ranging global scam targeting Facebook users, after finding an unsecured database used by fraudsters to store the usernames and passwords of at least 100,000 victims. Researchers said that the cybercriminals behind the scam were tricking Facebook victims into...

Credential-Stuffing Attack Hits The North Face

The North Face has reset its customers’ passwords after attackers launched a credential-stuffing attack against the popular outdoor outfitter’s website. In a recent data-breach notification, the company told customers that it was alerted to “unusual activity involving its website,”...

openGauss: Configuring the Level of Error-Deriving SQL Statements to Be Logged

The logminerrorstatement parameter specifies which level of SQL statements that cause an error will be recorded into server logs. SQL statements whose levels are higher than or equal to the configured level will be recorded into server logs. The valid values include DEBUG5, DEBUG4, DEBUG3, DEBUG2...

Carnival Corp. Ransomware Attack Affects Three Cruise Lines

Hackers accessed personal information of guests, employees and crew for three cruise line brands and the casino operations of Carnival Corp. in a ransomware attack the company suffered on Aug. 15, officials have confirmed. Carnival Cruise Line, Holland America Line and Seabourn were the brands...

U.S. Dept Of Defense: PII Leak of USCG Designated Examiner List at https://www.███

Hello Dod Team, Summary: PII Leakage of approx 750 personal is being disclosed through the pdf at https://www.██████ which had been uploaded at the 7th of October, this includes Personal phone number and email address. Description: The list presented at the "dereport.pdf" contains personal info...

Marketing firm Friendemic exposed 2.7 million customer records

By Deeba Ahmed Exposed data belonged to Friendemic and included full names, email addresses, and contact numbers of its customers. This is a post from HackRead.com Read the original post: Marketing firm Friendemic exposed 2.7 million customer records...

Facebook Small Business Grants Spark Identity-Theft Scam

Cybercriminals are exploiting a $100 million Facebook grant program designed for small businesses impacted by the pandemic, to phish personal information and take over Facebook accounts. The perpetrators are trying to dupe people into thinking that the social network is handing out free money to...

Personal data of 600,000 customers of U.S. fitness chain exposed Online

By Waqas An unprotected database containing private data of Town Sports’ employees and members was leaked on the internet. This is a post from HackRead.com Read the original post: Personal data of 600,000 customers of U.S. fitness chain exposed Online...

CISA: LokiBot Stealer Storms Into a Resurgence

The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning that the LokiBot info-stealing trojan is seeing a surge across the enterprise landscape. The uptick started in July, according to the agency, and activity has remained “persistent” ever since. LokiBot targets Windows and...

Data Breaches Expose Vets, COVID-19 Patients

A pair of healthcare-related data breaches at high-profile government agencies has impacted tens of thousands of people. First, a cyberattack at the U.S. Department of Veterans Affairs VA has impacted about 46,000 veterans, exposing their financial information. And another incident, at the U.K.’s...

Cloud Leak Exposes 320M Dating-Site Records

Users of 70 different adult dating and e-commerce websites have had their personal information exposed, thanks to a misconfigured, publicly accessible Elasticsearch cloud server. In all, 320 million individual records were leaked online, researchers said. All of the impacted websites have one thi...

Ransomware And Zoom-Bombing: Cyberattacks Disrupt Back-to-School Plans

UPDATE A slew of ransomware attacks and other cyberthreats have plagued back-to-school plans — as if dealing with the pandemic weren’t stressful enough for administrators. Just this week, attacks in Hartford, Conn. and Clark County, Nev. forced public schools to postpone the first day of school, ...

Former Uber Security Chief Charged Over Covering Up 2016 Data Breach

The federal prosecutors in the United States have charged Uber's former chief security officer, Joe Sullivan, for covering up a massive data breach that the ride-hailing company suffered in 2016. According to the press release published by the U.S. Department of Justice, Sullivan "took deliberate...

Experian South Africa Suffers Data Breach Affecting Millions; Attacker Identified

The South African arm of one of the world's largest credit check companies Experian yesterday announced a data breach incident that exposed personal information of millions of its customers. While Experian itself didn't mention the number of affect customers, in a report, the South African Bankin...

Medical software firm leakes personal data of 3.1 million patients

By Zara Khan Somehow, the misconfigured Elasticsearch cluster did not contain medical data of patients. This is a post from HackRead.com Read the original post: Medical software firm leakes personal data of 3.1 million patients...

Brave Software: Cross-origin resource sharing misconfiguration (CORS)

Hi! In this report I want to describe High level bug which can seriously compromise a user account. If I am authorize on this site, I can steal user's sessions, some personal information or do some action. In my tests, I found the relevant vulnerability using different methods. I detected the COR...

Mail.ru: Disclosure of personal support email addresses on 'support-fleet.city-mobil.ru'

IDOR vulnerability in support-fleet.city-mobil.ru allowed to disclose the support staff e-mail addresses...

Vermont Taxpayers Warned of Data Leak Over the Past Three Years

The Vermont Department of Taxes may have been exposing taxpayer data that could be used in credential scams for more than three years due to a vulnerability in its online tax filing system. A notice PDF posted on the department’s website warned taxpayers who filed a Property Transfer Tax return...

CVE-2020-2078

Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain...