Quest Diagnostics data breach affects 12 million customers

By Uzair Amir Clinical laboratory firm Quest Diagnostics Inc. has admitted exposure of personal information of nearly 11.9 million customers after its web payment page was accessed by an unauthorized individual. In a press release, the company revealed that its billing system, which is managed by...

Haidian Driving School App Has Unauthorized Access Vulnerability

Haidian Driving School APP is a mobile driving test software launched by the official website of Haidian Driving School. Haidian Driving School APP has an unauthorized access vulnerability that can be exploited by attackers to view personal information...

Know Your Limitations

At the end of the 1973 Clint Eastwood movie Magnum Force, after Dirty Harry watches his corrupt police captain explode in a car, he says "a man's got to know his limitations." I thought of this quote today as the debate rages about compromising municipalities and other information...

SQL Injection Vulnerability in Personal Information Modification on Tpshop Us***.php Page

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the personal information modification section of the Tpshop Us.php page. An attacker can exploit the vulnerability to obtain sensitive information from the...

Online graphic-design tool Canva hacked; 139 million accounts stolen

By Uzair Amir Canva has contacted the FBI to investigate the data breach. Canva, an online graphic-design tool website operated from Australia has suffered a massive data breach in which personal data of over 139 million registered users has been stolen - The breach took place on Friday, May 24...

200k Personal Records Exposed by Events Planning Firm

A database belonging to Australian event planning startup, Amazingco, was found leaking more than 200,000 records with personal details tied to children’s entertainment, wine tour events and more. Amazingco, which is based in Austrailia but offers services in New Zealand and the U.S., connects...

Snapchat Privacy Blunder Piques Concerns About Insider Threats

Snap, the company behind the popular Snapchat social media app, has found itself in hot water after a recent report revealed that Snap employees were abusing their access to private user data – which includes location data, saved Snaps and phone numbers. According to a Thursday Motherboard report...

U.S. Dept Of Defense: ██████ Authenticated User Data Disclosure

Background The Air Force’s ███ application is exposing members’ personal information to other users with access to the applocaton. We’ve identified two specific issues, but there may be other similar problems in the same vein as the ones described here. The underlying problem appears to be that...

Uber: API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers.

There was an API endpoint on the Uber site campus-vtc.com that allows an attacker to view the full names, personal email addresses and phone numbers of 83 Uber France members. These were people who uploaded entries to a contest on campus-vtc.com. Endpoint leaked some PII for the 83 Uber France...

CVE-2019-7690

In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH server. This affects Passwordless Authentication that has a Password Protected SSH...

U.S. Charges Chinese Hacker For 2015 Anthem Data Breach

The United States Justice Department today announced charges against a Chinese hacker and his hacking team member for their alleged role in the 2015 massive data breach at health insurance giant Anthem and three other unnamed American companies. Fujie Wang 王 福 杰 and another hacker named John Doe...

Stay Safe: 5 Tips to Keep Fraudsters at Bay

By Patrick Vernon Both in business and personally, fraud is, unfortunately, an everyday hazard and a byproduct of advances in tech mean fraud is more prevalent than ever before. There are steps you can take to keep safe from fraudsters and these are becoming an essential part of life for business...

The top six takeaways for user privacy

Last week, Malwarebytes Labs began closing out our data privacy and cybersecurity law blog series, a two-month long exploration spanning five continents, 50 states, just as many data breach notification laws, three non-universal definitions of personal information and personal data, five pending ...

Executive hacked competitor’s website to steal students meal preferences

By Ryan De Souza Top Executive at Bay Area School Lunch Provider Arrested for Hacking into Competitor’s Website to Access Students Meal Preferences. Personal rivalry and competitiveness can compel people to get involved in all sorts of bizarre activities and the latest incident is clear proof of...

Freedom Mobile leaked millions of card data with CVV codes in plain text

By Uzair Amir The company claims it does not share user data with others but looks like it does. Another day, another data breach; this time an unprotected database has been discovered leaking personal and financial data of millions of Canadians. Identified by researchers at vpnMentor along with...

Code Execution Vulnerability in Yongzhong Office Personal Edition for Windows

Yongzhong Software Co., Ltd. is a basic office software developer and service provider. With Yongzhong Office as the core, the company provides a wide range of products and solutions such as desktop office, mobile office, cloud office and document conversion services. A code execution vulnerabili...

Popular Online Tutoring Marketplace 'Wyzant' Suffers Data Breach

Wyzant—an online marketplace that makes it easy for parents and students to connect with private tutors, in-person and online, in over 250 different subjects—has suffered a data breach exposing "certain personal identification information" for its customers. The Hacker News received a copy of an...

Lenovo Watch app has multiple vulnerabilities

Shenzhen Personal Data Management Service Co., Ltd. is for analyzing and mining the value behind personal habits, preferences, and health, and becoming a scene service and content operator based on personal data. The Lenovo Watch app has multiple vulnerabilities that can be exploited by attackers...

Mysterious database exposed personal information of 80 million US households

Word has broken of yet another massive data trove exposed for anyone to see. A research team from vpnMentor discovered an exposed 24GB database hosted on a Microsoft cloud server containing the addresses, income levels, and marital statuses of users within 80 million US households. As we’ve seen...

Unprotected Database Exposes Personal Info of 80 Million American Households

A team of security researchers has claims to have found a publicly-accessible database that exposes information on more than 80 million U.S. households—nearly 65 percent of the total number of American households. Discovered by VPNMentor's research team lead by hacktivists Noam Rotem and Ran Loca...