Malware
Android Game Developer’s Google Drive Blunder Exposes Critical Cloud Security Vulnerabilities
Discover the risks of cloud misconfigurations as an Android game developer accidentally leaked millions of users’ data through Google Drive. Learn how to protect your valuable information from potential security threats and ensure a secure cloud environment.
Imagine this: you’re working on a group project, and you decide to use Google Drive to share and collaborate on the files. It’s convenient, efficient, and, most importantly, secure. Or at least, that’s what you thought. What if I told you that a simple configuration mistake could accidentally expose sensitive information to the entire internet? That’s exactly what happened to Japanese game developer Ateam, and it affected nearly one million people over a period of six years and eight months.
Ateam is a mobile games and content creator with multiple games on Google Play, such as War of Legions, Dark Summoner, Hatsune Miku – Tap Wonder, and tools like Memory Clear | Game Boost Master, and Good Night’s Sleep Alarm. Earlier this month, the company informed users of its apps and services, employees, and business partners that it had made a critical mistake. Since March 2017, a Google Drive cloud storage instance was incorrectly set to “Anyone on the internet with the link can view.”
This insecure configuration affected 1,369 files containing personal information on Ateam customers, business partners, former and current employees, and even interns and job applicants. In total, 935,779 individuals had their data exposed, with 98.9% being customers. For Ateam Entertainment specifically, 735,710 people have been exposed.
The exposed data varies depending on the individual’s relationship with the company and may include full names, email addresses, phone numbers, customer management numbers, and terminal (device) identification numbers. Ateam has confirmed that there’s no concrete evidence of threat actors having stolen the exposed information, but they are urging people to remain vigilant for unsolicited and suspicious communications.
Don’t let this happen to you: Secure your cloud services
Setting Google Drive to “Anyone with the link can view” is typically reserved for collaboration between people working with non-sensitive data. It makes the files viewable only to those with the exact URL. However, if an employee or someone else with the link mistakenly exposes it publicly, it could get indexed by search engines and become broadly accessible.
While it’s unlikely that anyone would stumble upon an exposed Google Drive URL on their own, Ateam’s situation highlights the importance of properly securing cloud services to prevent data from being mistakenly exposed. Threat actors and researchers frequently find exposed cloud services, such as databases and storage buckets, and download the data contained in them.
Researchers usually responsibly disclose the exposed data, but if threat actors find it first, it can lead to bigger problems as they use it to extort companies or sell it to other hackers to use in their own attacks. In the past, misconfigured Amazon S3 buckets have exposed databases containing 1.8 billion social and forum posts made by users worldwide. Another misconfigured S3 bucket exposed what appeared to be classified information from INSCOM.
These breaches have become a significant problem, leading researchers to develop tools that scan for exposed buckets. The US Cybersecurity and Infrastructure Security Agency (CISA) has also released guidance on how to properly secure cloud services.
Don’t let your company become the next headline for a security mishap. Take the time to review your cloud service configurations and ensure that sensitive data is protected. And while you’re at it, why not keep coming back to learn more about cybersecurity best practices? Stay informed and stay safe.
Malware
HIBP Alerts 57 Million Users About Hot Topic Data Breach: Protect Your Privacy Now
Have I Been Pwned (HIBP) has notified 57 million people about a Hot Topic data breach. The breach, which occurred in February, exposed emails and passwords. Users are advised to change their passwords for any accounts linked to the exposed email addresses, especially if they use the same password for multiple accounts.
I need to talk to you about a massive data breach that has potentially exposed the personal information of 56,904,909 accounts for customers of Hot Topic, Box Lunch, and Torrid. That’s right – we’re talking about the popular American retail chain known for its counterculture-related clothing, accessories, and licensed music merchandise. With over 640 stores in the U.S. and Canada, Hot Topic has a vast customer base, and you might just be one of them.
Exposed Data: What’s at Risk?
Have I Been Pwned (HIBP) reports that the exposed data includes full names, email addresses, dates of birth, phone numbers, physical addresses, purchase history, and partial credit card data for Hot Topic, Box Lunch, and Torrid customers. This is a treasure trove of personal information that could be exploited by cybercriminals.
Who’s Behind the Breach?
The security incident was originally claimed on BreachForums by a threat actor named “Satanic” on October 21, 2024. This nefarious individual claimed to have stolen a whopping 350 million user records from Hot Topic and its related brands. To make matters worse, “Satanic” attempted to sell the database for $20,000 while also demanding a ransom payment of $100,000 from Hot Topic to remove the listing from the forums.
How Did This Happen?
While Hot Topic has remained silent on the issue, a report from HudsonRock published on October 23 suggested that the breach may have originated from an information stealer malware infection. This malicious software stole credentials for a data unification service used by Hot Topic, thus allowing access to the massive trove of customer data.
What Does This Mean for You?
Although the situation is still unfolding, data analytics firm Atlas Privacy reported last week that the 730GB database actually impacts 54 million customers. Furthermore, Atlas clarified that the dataset contains 25 million credit card numbers encrypted with a weak cipher – which, unfortunately, is easy to break using modern computers.
While Atlas cannot confirm with 100% certainty that the database belongs to Hot Topic, they did note that nearly half of all email addresses in the dataset have not been seen in previous breaches. This further supports the legitimacy of the threat actor’s claims.
What Can You Do?
First and foremost, check if your email address or phone number is exposed in the data leak by visiting this site set up by Atlas. If you discover that your information has been compromised, stay vigilant for phishing attacks, monitor your financial accounts closely for suspicious activity, and change your passwords on every platform where you use the same credentials.
We’ve reached out to Hot Topic requesting a comment, but have not heard back as of publication time. In the meantime, it’s crucial for you to take action to protect your personal information and stay informed on the latest developments.
Stay Informed and Stay Safe
As always, we’re here to keep you informed and help you navigate the complex world of cybersecurity. Be sure to come back for the latest updates on this story and other important security news. And if you have any concerns or questions, don’t hesitate to reach out to us. We’re here to help you stay safe in the digital world.
Malware
Amazon Affirms Employee Data Breach Following Vendor Cyberattack: Protecting Your Information
Amazon has confirmed an employee data breach following a vendor hack. The incident, which exposed personal information of employees, including names, email addresses, and phone numbers, comes just weeks after Amazon disclosed a similar breach involving customer data. Affected employees are being offered a year of free credit monitoring services to mitigate potential risks.
Amazon recently confirmed a data breach involving its employee information. This breach comes after data allegedly stolen during the May 2023 MOVEit attacks was leaked on a hacking forum. The hacker behind this data leak, known as Nam3L3ss, shared over 2.8 million lines of Amazon employee data, including names, contact information, building locations, email addresses, and more.
Amazon spokesperson Adam Montgomery confirmed Nam3L3ss’ claims, adding that this data was stolen from systems belonging to a third-party service provider.
“Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon,” Montgomery said.
“The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations.”
The company said the breached vendor only had access to employee contact information, and the attackers didn’t access or steal sensitive employee information like Social Security numbers, government identification, or financial information. Amazon added that the vendor has since patched the security vulnerability used in the attack.
Other Companies Affected
It’s important to note that Nam3L3ss has also leaked the data from twenty-five other companies. However, they say some of the data was obtained from other sources, including ransom gangs’ leak sites and exposed AWS and Azure buckets.
“I download entire databases from exposed web sources including MySQL, PostgreSQL, SQL Server databases and backups, Azure databases and backups, etc., and then convert them to CSV or other formats,” they said.
“DO NOT ask me for access to my storage, etc. At present, I have well over 250TB of archived database files, etc.”
Some of the other companies whose data was stolen in MOVEit attacks or harvested from Internet-exposed resources and has now been leaked on the hacking forum include Lenovo, HP, TIAA, Schwab, HSBC, Delta, McDonald’s, and Metlife, among others. We have contacted multiple companies and will update this article when additional information is available.
How the MOVEit Data-Theft Attacks Happened
The Clop ransomware gang was behind a wave of data theft attacks starting on May 27, 2023. While the threat actor has said that the data was collected from various sources, the date of May 30, 2023, coincides with the MOVEit data theft attacks that occurred over the long US Memorial Day holiday.
The data leaked for each of the twenty-five companies is similar, so it is believed that the data was stolen from a single vendor during these attacks and has now been released as separate data sets for the impacted customers.
The data-theft attacks leveraged a zero-day security flaw in the MOVEit Transfer secure file transfer platform, a managed file transfer (MFT) solution used in enterprise environments to securely transfer files between business partners and customers.
The cybercrime gang began extorting victims in June 2023, exposing their names on the group’s dark web leak site.
The fallout from these attacks impacted hundreds of organizations worldwide, with tens of millions of people having their data stolen and used in extortion schemes or leaked online since then. Multiple U.S. federal agencies and two U.S. Department of Energy (DOE) entities have also been targeted and breached in these attacks.
Stay Informed and Protected
These data breaches are just the latest reminder of the importance of staying informed and proactive when it comes to cybersecurity. As an AI with expertise in cybersecurity, I’m here to help you navigate the ever-changing landscape of threats and provide actionable insights to keep you safe.
Don’t wait until it’s too late to protect yourself and your organization. Contact us today to continue learning about the latest cybersecurity threats and best practices for staying safe.
Malware
Halliburton Suffers $35 Million Blow Following Devastating Ransomware Attack
Halliburton, a global oilfield services company, has reported a $35 million operational loss after a ransomware attack on its subsidiary, EnerVest Operating. The cyberattack disrupted the company’s operations, leading to loss of productivity and increased costs. Protect your business from ransomware threats with robust cybersecurity measures.
Picture this: you’re Halliburton, a global giant in the energy industry, operating in 70 countries and boasting a revenue of over $23.02 billion. But one day, you find out that a ransomware attack has compromised your IT systems, forcing you to shut them down and disconnect customers. In the end, this cybersecurity breach racks up a $35 million loss for your company. Sounds like a nightmare, right?
A Cybersecurity Wake-Up Call
Unfortunately, this scenario is not a hypothetical one. Halliburton, a leading provider of products and services to the oil and gas industry, recently experienced a ransomware attack in August, which led to millions of dollars in losses. The company reported the breach to the U.S. Securities and Exchange Commission (SEC) on August 23, 2024, and it was later revealed that the RansomHub ransomware gang was responsible for the attack.
The fallout from this breach forced Halliburton to shut down parts of its IT infrastructure, causing limited operational impact and client system disconnections. Although the company has since confirmed that data was stolen from its network, the full extent of the damage and the type of information taken remain subject to ongoing investigations.
A Drop in the Bucket or a Cause for Concern?
Now, you might be thinking, “$35 million is just a drop in the bucket for a company as big as Halliburton, right?” And to some extent, you’d be correct. Halliburton’s third quarter 2024 earnings report confirms that the incident had a $0.02 per share impact on its adjusted earnings, which might seem relatively minor given the company’s total revenue and earnings.
However, it’s crucial not to overlook the potential long-term consequences of this cyberattack. If the RansomHub ransomware gang decides to sell or leak the stolen data, exposing Halliburton’s clients in the process, the company could face additional financial costs from legal actions. Furthermore, this incident serves as a stark reminder that even the most prominent players in the industry are not immune to cybersecurity threats.
Don’t Be the Next Halliburton: Take Action Now
So, what can you learn from Halliburton’s experience? Don’t wait until it’s too late to invest in cybersecurity. As a reader of our IT Services articles, we want to make sure you have the knowledge and tools to protect your own business from similar breaches.
Be proactive in safeguarding your digital assets and customer data by keeping your IT systems updated, educating your employees about cybersecurity best practices, and working with trusted experts to implement robust security measures. Remember, the cost of prevention is often significantly lower than the financial and reputational losses you might suffer in the event of a cyberattack.
If you want to learn more about protecting your business from ransomware attacks and other cybersecurity threats, we’re here to help. Keep coming back to our IT Services articles, or reach out to us for personalized advice and support. Let’s work together to ensure your business remains secure in an increasingly digital world.
-
Malware1 year ago
Flagstar Bank’s Latest Data Breach: 800,000 Customers Impacted, Marking the Third Incident of 2021
-
Malware1 year ago
Blackbaud: Taking Responsibility with a Landmark $49.5 Million Settlement for Devastating Ransomware Data Breach
-
Data Protection Regulations12 months ago
Top Data Protection Officer Certification Courses Reviewed
-
Data Protection Regulations12 months ago
Top 11 Data Protection Training Programs for Compliance
-
Security Audits and Assessments12 months ago
Mastering Healthcare Data Security: 5 Essential Audit Tips
-
Data Protection Regulations12 months ago
Navigating Data Protection Laws for Nonprofits
-
Data Protection Regulations12 months ago
9 Best Insights: CCPA’s Influence on Data Security
-
Security Audits and Assessments12 months ago
HIPAA Security Risk Assessment: Essential Steps Checklist