GoDaddy hack causes data breach affecting 1.2 million customers
In a data breach notification published today, GoDaddy said that the data of up to 1.2 million of its customers was exposed after hackers gained access to the company’s Managed WordPress hosting environment. The incident was discovered by GoDaddy last Wednesday, on November 17, but the attackers had access to its network and the data contained on the breached systems since at least September 6, 2021. “We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement,” said Demetrius Comes, GoDaddy’s Chief Information Security Officer.
Exploit released for Microsoft Exchange RCE bug, patch now
Proof-of-concept exploit code has been released online over the weekend for an actively exploited high severity vulnerability impacting Microsoft Exchange servers. The security bug tracked as CVE-2021-42321 impacts on-premises Exchange Server 2016 and Exchange Server 2019 (including those used by customers in Exchange Hybrid mode) and was patched by Microsoft during this month’s Patch Tuesday. Successful exploitation allows authenticated attackers to execute code remotely on vulnerable Exchange servers. On Sunday, almost two weeks after the CVE-2021-42321 patch was issued, researcher Janggggg published a proof-of-concept exploit for the Exchange post-auth RCE bug.
More Ransomware Attacks Up to September Than Whole of 2020
Most UK business leaders expect cyber-threats to surge next year, with ransomware, business email compromise (BEC), cloud and supply chain attacks all predicted to increase, according to PwC. The findings come from the consulting giant’s 2022 Global Digital Trust Insights Survey and were distilled from interviews with 257 business and technology executives in the UK. Although most (63%) respondents said they expect security budgets to increase next year, even more (66%) predicted cyber-threats would rise. Ransomware (61%), BEC (61%), malware via software updates (63%), and cloud compromise (64%) were among the most notable. Bobbie Ramsden-Knowles, crisis and resilience partner at PwC UK, claimed the firm’s threat intelligence team has tracked more ransomware incidents globally up to September this year than for the whole of 2020.
Over half of millennials are responsible for executing their parents’ wills, but hardly any have access to their parents’ online passwords
As COVID-19 spread, many American millennials finally began their estate planning. Yet, many of them do not have the correct digital information if their parents pass on, according to new research from Toronto — Canada-based security and privacy company 1Password. In partnership with digital estate planning companies Trust & Will and Willful, it surveyed 1,000 American millennials aged 25-40 years old for its Great Wake up Call Report. It wanted to discover how this generation favours securing important documents and passwords and storing and transferring digital assets before and after death.
Apple sues NSO Group to curb the abuse of state-sponsored spyware
Apple today filed a lawsuit against NSO Group and its parent company to hold it accountable for the surveillance and targeting of Apple users. The complaint provides new information on how NSO Group infected victims’ devices with its Pegasus spyware. To prevent further abuse and harm to its users, Apple is also seeking a permanent injunction to ban NSO Group from using any Apple software, services, or devices. NSO Group creates sophisticated, state-sponsored surveillance technology that allows its highly targeted spyware to surveil its victims.
