Scammers Impersonate Authorities to Swipe OTPs with Remote Access Apps
Cybersecurity researchers at Group-IB have discovered a sophisticated refund scam where scammers are using remote access tools and software to steal personal and financial information from victims in the Middle East. The modus operandi of the scam involves these scammers posing as government officials, gaining the trust of their targets by offering to help them claim refunds for unsatisfactory purchases. In return, scammers end up collecting personal details from victims including personal information, card data, and the one-time passwords (OTPs) necessary for online transactions.
Location Data Giant Gravy Analytics Breach
Hackers claim to have breached Gravy Analytics, a major location data broker that sells smartphone tracking data to U.S. government agencies. This could be the first major breach of a location data aggregator, potentially exposing millions of people’s precise movements and creating unprecedented privacy risks. The breach highlights the dangerous concentration of sensitive location data in private companies’ hands. Gravy Analytics, through its subsidiary Venntel, has been selling bulk location data to military, DHS, IRS, and FBI – making it an attractive target for cybercriminals.
FDA Warns of Cyber Risks in Guidance for AI-Enabled Devices
Manufacturers are eager to incorporate artificial intelligence and machine learning technologies into a wide range of medical devices, from cardiac monitors that can spot developing heart problems to medical imaging systems that can find malignancies a radiologist might miss. Manufacturers are eager to incorporate artificial intelligence and machine learning technologies into a wide range of medical devices, from cardiac monitors that can spot developing heart problems to medical imaging systems that can find malignancies a radiologist might miss.
T-Mobile is once again being sued over its 2021 data breach
Washington state is suing T-Mobile for allegedly failing to address cybersecurity vulnerabilities that enabled a hacker to expose the personal data of 79 million people nationwide. The consumer protection lawsuit filed by Washington Attorney General Bob Ferguson on Monday stems from a cyberattack that began in March 2021 and went unnoticed until T-Mobile disclosed the breach in August. The filing asserts that T-Mobile failed to address certain security vulnerabilities that the company was aware of “for years,” and did not properly notify more than two million Washington residents who were impacted by the breach. The lawsuit accuses T-Mobile of downplaying the severity of the breach, which exposed the personal information of current, former, and prospective customers — including their names, phone numbers, physical addresses, dates of birth, Social Security numbers, and driver’s license / ID numbers.
UN aviation agency confirms recruitment database security breach
The United Nations’ International Civil Aviation Organization (ICAO) has confirmed that a threat actor has stolen approximately 42,000 records after hacking into its recruitment database. This follows ICAO’s announcement on Monday that it was investigating what it described as a “potential information security incident.” While the UN agency didn’t provide additional details, this came two days after a threat actor using the “Natohub” handle leaked an archive of 42,000 documents reportedly stolen from ICAO on the BreachForums hacking forum.
US Cyber Trust Mark logo for smart devices is coming
The White House announced the launch of the US Cyber Trust Mark which aims to help buyers make an informed choice about the purchase of wireless internet-connected devices, such as baby monitors, doorbells, thermostats, and more. The cybersecurity labeling program for wireless consumer Internet of Things (IoT) products is voluntary but the participants include several major manufacturers, retailers, and trade associations for popular electronics, appliances, and consumer products. The companies and groups said they are committed to increase cybersecurity for the products they sell. Justin Brookman, director of technology policy at the consumer watchdog organization Consumer Reports, lauded the government effort and the companies that have already pledged their participation.
