Hackers leak images to taunt Western Digital’s cyberattack response
The ALPHV ransomware operation, aka BlackCat, has published screenshots of internal emails and video conferences stolen from Western Digital, indicating they likely had continued access to the company’s systems even as the company responded to the breach. The leak comes after the threat actor warned Western Digital on April 17th that they would hurt them until they “cannot stand anymore” if a ransom was not paid.
CISA Launches New Ransomware Vulnerability Warning Pilot For Critical Infrastructure Entities
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) unveiled the Ransomware Vulnerability Warning Pilot (RVWP) program to help ensure critical infrastructure organizations can protect their systems from ransomware attacks. The RVWP pilot aims to keep agencies up to date on possible attack targets so their security teams can act accordingly. This is timely news, as ransomware attacks are escalating at a rapid pace and critical infrastructure has long been a key target of threat actors. Not only are these attacks incredibly disruptive (think attacks like the Colonial Pipeline attack of a few years ago), but they are also expensive.
New York City’s new tool to stop car thefts: Apple AirTags
New York City is adding a new weapon to its crime-fighting arsenal: Apple AirTags. At least some people are eligible to receive the free bluetooth-powered tracking devices to combat a spike in car thefts in the five boroughs, Mayor Eric Adams announced on Sunday. The city will distribute 500 of the devices, donated by the Association for a Better New York, to residents, including in the Bronx where car thefts rose 19.4% from this time last year, NYPD data shows. Citywide, the number of stolen vehicles has climbed from 3,756 to 4,184, up 11.4%, over that same time span.
Apple uses iOS and macOS Rapid Security Response feature for the first time
When it announced iOS 16, iPadOS 16, and macOS Ventura at its Worldwide Developers Conference last summer, one of the features Apple introduced was something called “Rapid Security Response.” The feature is meant to enable quicker and more frequent security patches for Apple’s newest operating systems, especially for WebKit-related flaws that affect Safari and other apps that use Apple’s built-in browser engine. Nearly a year after that WWDC and more than seven months after releasing iOS 16 in September, Apple has finally issued a Rapid Security Response update. Available for iOS and iPadOS devices running version 16.4.1 or Macs running version 13.3.1, the update adds an (a) to your OS version to denote that it’s been installed.
T-Mobile discloses second data breach since the start of 2023
T-Mobile disclosed the second data breach of 2023 after discovering that attackers had access to the personal information of hundreds of customers for more than a month, starting late February 2023. Compared to previous data breaches reported by T-Mobile, the latest of which impacted 37 million people, this incident affected only 836 customers. Still, the amount of exposed information is highly extensive and exposes affected individuals to identity theft and phishing attacks. “In March 2023, the measures we have in place to alert us to unauthorized activity worked as designed and we were able to determine that a bad actor gained access to limited information from a small number of T-Mobile accounts between late February and March 2023,” the company said in data breach notification letters sent to affected individuals just before the weekend, on Friday, April 28, 2023.
Coinbase faces suit over alleged privacy violations in biometrics collection
Coinbase violated biometric privacy laws in Illinois through its collection and storage of customer fingerprints and facial templates, a proposed class-action lawsuit alleges. A May 1 filing in a California District Court by a Coinbase user claimed the exchange’s requirement that a customer uploads pictures of a valid ID and a self-portrait in order for the firm to conduct Know Your Customer (KYC) checks is violating certain provisions of Illinois’ Biometric Information Privacy Act (BIPA). The lawsuit argues BIPA required Coinbase to gain permission from users when collecting their biometrics. Coinbase needed to also provide the purpose for collecting such data, how long it would be stored, how it would be used and how Coinbase would permanently destroy it.
