Global Cyber News Digest

Equifax agrees to settlement of up to $700 million over 2017 data breach

Source: The Verge
By: Jon Porter
Published: July 22, 2019

* Equifax has agreed to a settlement over its 2017 data breach that saw as many as 147 million people's personal information, including names, birth dates, addresses, and social security numbers, exposed by the company.
* The company has agreed to provide free credit monitoring services to anyone affected for up to 10 years, as well as cash payments of up to $20,000 per person to refund any costs incurred as a result of the breach.

Hackers broke into a contractor for Russia's spy agency

Source: Engadget
By: Jon Fingas
Published: July 21, 2019

* The Russian government has been linked to a number of high-profile hacks, but it just became a target -- and the data that was stolen says a lot about its apparent goals.
* The intruders revealed a number of projects that SyTech had been working on for the FSB (and fellow contractor Quantum) since 2009, some of which were pure research while others came to fruition.

Browser Extensions Siphon Private Data From 4M Users, Then Leak It

Source: PC Mag
By: Michael Kan
Published: July 19, 2019

* Be careful around shady browser extensions. They might be collecting and leaking your most private data.
* Eight browser extensions for Chrome and Firefox were recently shut down after a security researcher uncovered how they were secretly sending users' private data to a marketing intelligence firm.

Kazakhstan government is now intercepting all HTTPS traffic

Source: ZD Net
By: Catalin Cimpanu
Published: July 18, 2019

* Starting Wednesday, July 17, 2019, the Kazakhstan government has started intercepting all HTTPS internet traffic inside its borders.
* The certificate, once installed, will allow local government agencies to decrypt users' HTTPS traffic, look at its content, encrypt it again with their certificate, and send it to its destination.

Phishing Scheme Targets Amex Cardholders

Source: Bank Info Security
By: Akshaya Asokan
Published: July 18, 2019

* Researchers have uncovered a new type of phishing campaign that is targeting American Express card users.
* What makes this phishing attack different is that instead of using a hyperlink to send victims to a malicious landing page, this scheme deploys an embedded "base href" URL to help hide the true intent from anti-virus and other security tools.

Hackers Execute Ransomware Attack on Asian Art Museum

Source: SFist
By: Joe Kukura
Published: July 18, 2019

* The Asian Art Museum silently endured a ransomware attack in May, but they swear they didn't pay up.
* It's unclear how much the hackers demanded, how long the system was disabled, or whether any information or data was compromised. Museum officials reportedly contacted police, and the city's IT security personnel apparently found a workaround to restore the system.

Data Breaches and Educational Institutions

Source: The National Law Review
By: FNU LNU
Published: July 18, 2019

* Educational institutions hold valuable and sensitive data (paper files and electronic ones), such as personal, financial and medical data on prospective students, enrolled students and alumni, employment information about their faculty and staff, and research data.
* Schools share information with their service providers for a variety of purposes, including to process applications, to provide financial aid, to accept payments, and to host their websites and student portals.

Syracuse Schools, Libraries Disabled by Ransomware Attack

Source: Center for Digital Education
By: Tim Knauss
Published: July 17, 2019

* The Onondaga County library computer system was disabled last week by the same ransomware as the Syracuse school district, but thus far the county has not received a ransom demand, officials said today.
* The library system's computer network was disabled July 12 by Ryuk ransomware, the same malware that crippled the school district system three days before, according to Justin Sayles of the county executive's office.

Customers' personal data stolen in breach of major wireless carrier

Source: Komando.com
By: James Gelinos
Published: July 17, 2019

* Using a vulnerability found on the official Samsung website, hackers were able to infiltrate a customer database for a major American mobile brand.
* The breach was so bad, in fact, that hackers obtained a vast amount of personal data from the attack -- including account settings, phone numbers, and even home addresses.

Bulgaria's 'biggest leak': Suspect arrested after cyber attack

Source: Euro News
By: Alice Tidey
Published: July 17, 2019

- Bulgarian police said on Wednesday they have arrested a suspect for a cyber attack on the country's National Revenue Agency (NRA), which led to the leak of personal and financial data of millions of people.