Cyberattacks are unavoidable till cyber adversaries continue to exist. Hence ensuring phishing attack prevention is a strenuous task. However, awareness about the recent cyber threats can help organizations handle their security concerns better. With this interest, we bring you the top security news updates from the previous week:
MyCastingFile Leaves Database With 1GB Data Unprotected Online
US website MyCastingFile that has provided extras for productions like True Detective, Pitch Perfect, and Terminator Genisys was recently found to have left a database unprotected online. The database contained the details of over 260,000 of its users and employees, some of whom were also minors.
The compromised details include the names, physical addresses, email addresses, phone numbers, work histories, dates of birth, height and weight, ethnicity, and physical features (hair color and length, etc.) of its subscribers and aspiring actors. Also, the database included the vehicle ownership information (model, color, year of manufacture, etc.) of users.
However, MyCastingFile has adopted the phishing prevention best practices and secured and brought down the database as soon as security researchers notified them of the same.
Customized Zoom URLs: A Threat Factor
The Zoom feature that enables organizations to set customized vanity URLs with their company name in it could be a possible gateway for adversaries to launch phishing attacks.
Since users seldom visit these vanity URLs, attackers exploit these and pretend to be real employees of a company. They then send meeting invitations to prospective victims using the company’s vanity URL. Any unsuspecting user would fall into the trap and end up giving away his details to the attackers.
Hence, users are advised to be very cautious and take necessary phishing protection measures while accessing Zoom URLs.
E-Learning Portals Compromise Student Data
Five e-learning portals, namely, Escola Digital, MyTopDog, Okoo, Square Panda, and Playground Sessions from Brazil, South Africa, Kazakhstan, and the US, respectively, have collectively exposed over one million student records.
The details include their full names, home, and email addresses, ID numbers, phone numbers, dates of birth, and course/school information. Researchers have warned that although some of these users aren’t presently active on these e-learning platforms, they still are vulnerable to phishing and other cybercrimes.
All users of these learning platforms should take adequate anti-phishing measures to avoid any cyber mishap.
Yet Again, Cyberattack Hits Israel’s Water Department
In yet another attack, Israel has succumbed to cyber attackers. It’s the Israeli Water Authority infrastructure that was targeted in the recent breach. Two of their facilities were recently attacked, but luckily, their measures for protection against phishing came handy, and no damage was caused.
The attack targeted the agricultural water pumps in the Upper Galilee and failed in its pursuit because services were brought back up by local authorities immediately. Although there are no suspects this time, the attack serves as a cue to Israel to work on strengthening its anti-phishing protection measures.
Tesco TV Fraud Gets Consumers Drooling
Tesco customers in the UK fell into a big giveaway scam that promised free TVs to 500 lucky winners. Over 100 unsuspecting users shared their details with the fraudsters who created a fake Facebook page resembling Tesco’s own and even sent them confirmation emails and SMS.
The scammers convinced that 500 TVs with minor glitches were about to be thrown from Tesco’s warehouse. Still, they have decided to have a giveaway instead wherein 500 lucky winners who share the Facebook post shall win free TVs that are in working condition.
People need to be careful before believing every offer they find online. To protect oneself from phishing, one must refrain from clicking on links that come embedded in spooky emails.
Bitcoin Scam Now Targets Bill & Melinda Gates Foundation
After the massive Bitcoin scam that happened on Twitter last week, the adversaries have now targeted the Bill & Melinda Gates Foundation. They have launched an email phishing campaign that impersonates the real Bill & Melinda Gates Foundation and demands Bitcoin from people.
The only difference in the domain name is the use of a capital ‘I’ in gatesfoundatlon[.]com. Although the scammer’s Bitcoin address hasn’t been able to fool any people so far, this typosquatting attack reemphasizes the significance of taking phishing prevention tips seriously.
Blackbaud Succumbs Before Adversaries And Pays Ransom
The Cloud software provider Blackbaud recently underwent a ransomware attack in which the attackers compromised and deleted a copy of a subset of its data from their self-hosted environment. Fearing that its impact would disturb their clients, Blackbaud chose to go in for a settlement with the threat actors. They paid the demanded ransom to the adversaries and asked them to remove and destroy the copy of data stolen.
Blackbaud is taking necessary phishing prevention measures and has also notified all affected customers to stay vigilant.
Data Breach At US Family Tree Software
In a recent data breach, details of over 60,000 users of US-based family tree maker software were compromised. The breach happened because of a misconfigured cloud server that leaked over 25GB of their data.
The compromised user details include the email addresses, geolocation data, IP addresses, system user IDs, support messages, etc. which can be used to launch phishing or identity theft attacks. Therefore users are advised to take necessary measures to prevent phishing attacks.
South Korea’s COVID App Contains Security Risks
It has come to light recently that South Korea’s mobile application use to track details of COVID patients has dangerous security loopholes, which if exploited can expose the personal information of users like their name, date of birth, sex, nationality, address, phone number, real-time location, and medical symptoms.
In their haste to get the app functional among people, the government overlooked the security factors as a result of which protection from phishing is now at risk for their citizens. Their blunder includes using encryption keys as primary and guessable as “1234567890123456,” which only made it easy for hackers to get in.
Netwalker Attacks Lorien Health Services
Lorien Health Services – a family-owned nursing home for the elders in Maryland underwent a ransomware attack recently. The details of around 47,754 of its patients were compromised in this Netwalker attack.
After Lorien refused to pay the ransom, attackers leaked their data online. They labeled it as “Part 1”, which implies that they might also have access to other Lorien information.