An American mortgage lender has shelled out $1.5m to resolve allegations that it violated the New York Department of Financial Services (NYDFS) Cybersecurity Regulation.  Residential Mortgage Services, Inc. (RMS), which is headquartered in South Portland, Maine, was accused of failing to report a data breach that occurred in 2019.  The breach was uncovered during an investigation of

by Paul Ducklin If you’ve ever used the Python programming language, or installed software written in Python, you’ve probably used PyPI, even if you didn’t realise it at the time. PyPI is short for the Python Package Index, and it currently contains just under 300,000 open source add-on modules (290,614 of them when we checked

The United States Justice Department has warned that cyber-criminals are impersonating state workforce agencies (SWAs) to steal Americans’ personal data. In a press release issued March 5, the department said it had received reports that bad actors are creating fake websites that mimic sites genuinely belonging to SWAs.  “The fake websites are designed to trick consumers into

by Paul Ducklin Remember the last big jailbreak news? It was nearly a year ago, back in May 2020, when well-known Apple jailbreaking crew unc0ver released version 5 of their jailbreak toolkit, just a week after Apple came out with iOS 13.5. The word jailbreak, at least in the IT world, is a generic term

Elite cybercrime forum Maza aka MFclub has been taken over by hackers, according to new research by risk intelligence company Flashpoint. The Russian-language forum, which was originally known as Mazafaka, has served thousands of cyber-criminals since its launch in 2003.  “Little is known at this time about the attackers who successfully compromised Maza,” wrote Flashpoint researchers. But

by Harriet Stone TikTok is a video-sharing social media platform, owned by Chinese company ByteDance, where users make and share short-form videos that range from three seconds to one minute long. It’s the latest app to take its turn on the social media throne, following MySpace in 2005, Facebook in 2008, and most recently Instagram

A Swedish businessman has admitted conning thousands of victims out of millions of dollars with a reversed pension cryptocurrency investment scam.  Roger Nils-Jonas Karlsson pleaded guilty today to securities fraud, wire fraud, and money laundering charges that he defrauded 3,575 victims of more than $16m. Karlsson and his now defunct company, Eastern Metal Securities (EMS), were charged in

by Paul Ducklin How to stop security-conscious apps from allowing unencrypted data to escape, and how scammers put social network users under pressure in order to steal their passwords. With Doug Aamoth and Paul Ducklin. Intro and outro music by Edith Mudge. LISTEN NOW Click-and-drag on the soundwaves below to skip to any point in

Two teenage girls who went missing from the same North Carolina county used school-issued laptops to communicate with their alleged abductors.  Savannah Grace Childress vanished on February 11 from her home on Canaan Church Road in Denton. The 14-year-old was found alive ten days later in Arkansas.  Law enforcement officers investigating Childress’ disappearance discovered that the teen had

by Paul Ducklin Almost exactly a month ago, or a couple of days under an average month given that February was the short one, we warned of a zero-day bug in Google’s Chromium browser code. Patch now, we said. And we’re saying it again, following Google’s otherwise cheery release of version 89.0.4389.72: The Chrome team

A federal judge in Washington state has dismissed a cyber-squatting claim brought by the Washington Chapter of The Satanic Temple. The United Federation of Churches LLC, doing business as The Satanic Temple, filed a lawsuit against a group of former Temple members who it claimed erased the contents of the Temple’s social media accounts and replaced it

by Paul Ducklin Ransomware gets the big headlines, because of the enormous blackmail demands that typically arrive at the end of ransomware attacks. Indeed, the word “ransom” only expresses half the drama these days, because modern ransomware attacks usually involve the crooks making copies of all your data first before scrambling it. The crooks then

United Airlines Inc. has agreed to pay $49m to resolve criminal charges and civil claims that it was defrauding the United States Postal Service. The world’s third largest airline entered into International Commercial Air (ICAIR) contracts to transport mail internationally on behalf of the postal service. Under the contracts, United was entitled to full payment only if accurate

by Paul Ducklin If you’re active on social media, you probably know that copyright infringement is a big deal online, and that even accidentally including or referring to somebody else’s material can leave you facing a copyright complaint notice sent by the social media platform involved. If you don’t sort out the complaint, you could

The Federal Bureau of Investigation and Michigan State Police are investigating a cyber-attack on a Michigan school district. District administrators at Saginaw Township Community Schools began experiencing IT issues on Sunday following what is believed to have been a ransomware attack on the district’s computer network.  Investigators are in contact with the cyber-criminals behind the attack. It

French multinational information technology services and consulting company Atos has completed the acquisition of two cybersecurity companies.  On February 24, the self-styled decarbonization services and products pioneer announced the successful acquisition of Motiv ICT Security. Founded in 1998, Motiv is the largest independent Managed Security Services (MSS) provider in the Netherlands. In a statement released Wednesday, Atos said

New research by cybersecurity company Kaspersky has found that Russia, Brazil, and the United States of America were the countries most affected by stalkerware last year.  A new report, “The State of Stalkerware 2020,” that was released today found that 53,870 Kaspersky users were affected globally by malicious surveillance software in 2020. Russia had the most affected users

Six school officials in Alabama have been indicted over a scheme to fraudulently obtain millions of dollars in state education funding by pretending to enroll private students into virtual schools. Federal prosecutors say educators in Athens City Schools and Limestone County Schools stole the identities of hundreds of private students and falsified enrollment records to

by Paul Ducklin The graphics card that wants you to stick to playing games, the man that didn’t weigh 100 tons after all, and the marketing gang that used a browser bug to bombard iPhone users with scammy online surveys. With Kimberly Truong, Doug Aamoth and Paul Ducklin. Intro and outro music by Edith Mudge.

The United States Senate’s select committee on intelligence met yesterday to hear evidence from tech executives regarding the historic hack on Texas-based company SolarWinds.  Government agencies issued emergency directives in December after cybersecurity company FireEye detected a supply-chain attack trojanizing SolarWinds’ Orion business software updates to distribute malware. Using SolarWinds and Microsoft programs, hackers believed to have been working for Russia attacked

by Paul Ducklin Last week, a UK journalist reported an incident that he subtitled with the words, “Hilarious mix-up may have highlighted a potential issue with the vaccine roll-out.” As you probably know, medical mix-ups have a habit of ending badly, especially when they involve automated calculations that determine drug doses. In this case, happily,

The former comptroller of a Louisiana community college has been sent to prison for wire fraud after abusing her network access to issue fraudulent refunds. Carol Bates admitted committing wire fraud from 2013 to 2016 while working at Bossier Parish Community College (BPCC). The 50-year-old Shreveport resident conspired with her sister Audrey Williams and nine

by Paul Ducklin Keybase, owned by online meeting and teleconferencing behemoth Zoom, is a secure messaging and file sharing service that describes itself as providing “end-to-end encryption for things that matter.” End-to-end encryption is pretty much what it says: encryption that starts on your computer, typically inside an individual app such as when browser submits

A vengeful former staff member of a San Jose sports stadium concessionaire has admitted carrying out a costly cyber-attack against his ex-employer after losing his job.  Salvatore A. La Rosa worked for Spectra Food Services and Hospitality from Valentine’s Day 2015 until his termination on January 6, 2020. Spectra was the concessions contractor for California’s Earthquakes Stadium, home of

by Paul Ducklin Nvidia, the graphics chip company that wants to buy ARM, made a unusual announcement last week. The company is about to launch its latest GeForce GPU (graphics processing unit) chip, the RTX 3060, and wants its users know that the chip is “tailored to meet the needs of gamers and those who

The number of month-on-month healthcare data breaches of 500 or more records reported in the United States was halved in January, according to new research by the HIPAA Journal. While December 2020 saw 62 such incidents recorded, only 32 were recorded in January 2021. The 32 breaches occurred across 18 states. Florida, where six of the

by Paul Ducklin We know what you’re thinking: “I bet you this is what they call a supply chain attack.” And you’d be right. The “one man” in the headline is cybersecurity researcher Alex Birsan, and his paper Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies, which came out last

The United States has arrested six alleged members of an international fraud and money-laundering ring that deployed spoofing, catfishing, and COVID-19 relief scams to con victims out of $55m. The defendants are accused of creating fake identities to trick companies, the Small Business Administration (SBA), and old folks searching for romance online into wiring funds to bank

by Naked Security writer The US Department of Justice (DOJ) has just unsealed a lengthy list of cybercrime charges against three North Koreans. The DOJ explicitly named the three accused men as Jon Chang Hyok (31 years old), Kim Il (27), and Park Jin Hyok (36), alleging them to be part of a North Korean

Kia Motors America has said a recent computer network outage problem was not caused by a ransomware attack. IT outages began on Saturday, impacting both Kia and affiliated automaker Hyundai Motor America, both of which are owned by the South Korea–based Hyundai Motor Group. The issues experienced by Hyundai were not as severe as those