Connect with us

Malware

Breaking News: Johnson & Johnson Reveals Alarming IBM Data Breach Endangering Patient Security

Johnson & Johnson recently revealed a concerning IBM data breach that has compromised vital patient information. The breach could potentially lead to severe consequences, putting patients’ privacy and safety at risk. This alarming incident highlights the urgent need for robust cybersecurity measures in the healthcare industry to safeguard sensitive data from cybercriminals.

Published

on

Keywords: IBM, data breach

IBM Data Breach Exposes Sensitive Information of Johnson & Johnson CarePath Customers

Johnson & Johnson Health Care Systems, also known as Janssen, has recently notified its CarePath customers about a data breach involving IBM, a technology service provider for Janssen. This breach has resulted in the compromise of sensitive customer information.

The CarePath application and database, which are managed by IBM, offer various services to patients, including access to Janssen medications, discounts on eligible prescriptions, insurance coverage guidance, and drug refiling and administering alerts.

According to a notice on Janssen’s website, the pharmaceutical firm discovered an undocumented method that could potentially grant unauthorized users access to the CarePath database. Janssen promptly reported this security gap to IBM, who took immediate action to fix the issue and initiated an internal investigation to determine if the vulnerability had been exploited.

Unfortunately, the investigation concluded on August 2nd, 2023, revealed that unauthorized users had gained access to the following CarePath user details:

  • Full name
  • Contact information
  • Date of birth
  • Health insurance information
  • Medication information
  • Medical condition information

The data exposure affects CarePath users who enrolled in Janssen’s online services prior to July 2nd, 2023. This suggests that the breach may have occurred on that date or that the breached database was a backup.

Fortunately, social security numbers and financial account data were not stored in the breached database, so these critical details have not been compromised.

It is important to note that Janssen has clarified that this security incident does not impact its Pulmonary Hypertension patients.

The compromised data has the potential to facilitate highly effective phishing, scamming, and social engineering attacks. Given the value of medical data, it is highly likely that the stolen information will be sold for a premium on darknet markets.

In a separate announcement, IBM has stated that there are currently no indications of the stolen data being misused. However, the company advises Janssen CarePath users to remain vigilant and closely monitor their account statements for any suspicious activity. As an additional precautionary measure, IBM is offering one year of free credit monitoring to all affected individuals.

Both Janssen and IBM have provided toll-free numbers for providers and users to call if they have any questions or require assistance with enrolling in credit monitoring services.

It is worth mentioning that earlier this year, IBM was one of the many entities targeted by the Clop ransomware. This cyber attack exploited a zero-day vulnerability in the MOVEit Transfer software, which is widely used by organizations worldwide. However, it is currently unclear whether the Janssen breach is connected to this incident or if it was orchestrated by different threat actors.

We have reached out to IBM for further information regarding the Janssen breach and the number of individuals affected. We will update this post as soon as we receive a response.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Malware

Massive Roblox Vendor Data Breach: Dev Conference Attendee Info Shockingly Exposed

A Roblox vendor data breach has exposed personal information of Roblox Developers Conference attendees. The breach, discovered on November 8, exposed names, billing addresses, and order details of customers, but no financial data. Roblox has since terminated the vendor’s contract and is taking steps to prevent future breaches.

Published

on

Imagine you’re a dedicated developer, excited to attend a prestigious conference to connect with peers and learn about innovative tools in your field. You register, book your flight, and eagerly await the event. Now imagine the disappointment and concern you’d feel if you discovered your personal information had been exposed due to a data breach. Unfortunately, this scenario recently became reality for attendees of the Roblox Developer Conference.

Roblox, a wildly popular online gaming and game creation platform, boasts over 200 million active users, many of whom are young developers eager to design, create, and share games with their community. Each year, the company holds a Roblox Developer Conference (RDC) to provide networking opportunities and learning experiences for these talented individuals.

However, a notice published recently revealed that FNTech, the vendor responsible for handling registration for the conference, suffered a data breach. Unauthorized access to its systems led to the exposure of personal information belonging to attendees of the 2022, 2023, and 2024 RDC events.

What was exposed, and who is affected?

The data breach resulted in the theft of attendees’ full names, email addresses, and IP addresses. According to the data breach notification service Have I Been Pwned (HIBP), 10,386 unique email addresses were exposed. Of these, 63% (6,500) had not been exposed in previous breaches.

Worryingly, this isn’t the first time Roblox developers have been targeted. In July 2023, HIBP added information about nearly 4,000 Roblox developer accounts to its database. These individuals, also RDC attendees, had their data leaked on a hacker forum following a 2021 breach that impacted attendees from 2017 to 2020.

Understanding the risks and taking action

While the recent breach doesn’t directly put Roblox developers in immediate danger, it does increase the likelihood of targeted phishing attacks. Armed with their personal information, cybercriminals could easily craft convincing messages designed to trick developers into revealing even more sensitive data.

In response to the breach, Roblox has taken steps to prevent similar incidents in the future. However, this isn’t the first time the platform and its users have faced security threats. In November 2022, over 200,000 users installed a malicious Chrome extension called SearchBlox, which contained code designed to steal Roblox account credentials.

Don’t let this happen to you!

As an IT Services company specializing in cybersecurity, we understand how devastating data breaches can be, not only to businesses but also to individuals like the RDC attendees. Don’t leave your security to chance—reach out to us for expert advice and support to keep your data safe and secure.

Together, we can help prevent cyberattacks and protect your personal information from falling into the wrong hands. And remember, always stay vigilant and be cautious of any suspicious emails or messages, no matter how convincing they may seem.

Contact us today to learn more about our cybersecurity services, and keep coming back for the latest news and insights in the world of online safety.

Continue Reading

Malware

Shopify Debunks Hacking Claims, Exposes Stolen Data Connection to Third-Party App

Shopify has denied being hacked after suspicious emails were sent to customers, blaming a third-party app for the data breach. The firm’s investigation revealed that the app had accessed and stolen data from Shopify’s API, but the incident was not a security breach of the platform itself.

Published

on

Shopify, the popular e-commerce platform, has recently denied experiencing a data breach after a threat actor started selling customer data that they claimed to have stolen from Shopify’s network. But, don’t worry, it’s not as bad as it seems.

What Shopify had to say

According to Shopify, the company’s systems have not suffered a security incident. They told us, “The data loss reported was caused by a third-party app. The app developer intends to notify affected customers.

This statement comes after a threat actor, known as ‘888’, began selling data they claimed was stolen from Shopify back in 2024.

Selling alleged Shopify data on a hacking forum
Selling alleged Shopify data on a hacking forum
Source: IT Services

What’s in the data?

The threat actor shared data samples that include a person’s Shopify ID, first name, last name, email, mobile number, order count, total spent, email subscription, email subscription date, SMS subscription, and SMS subscription date. While this information is significant, it’s important to remember that Shopify itself wasn’t directly breached.

Unfortunately, Shopify did not provide any further information about the app from which this customer’s data was stolen.

A history of data leaks

The threat actor, 888, has been linked to previous data sales or leaks allegedly involving companies like Credit Suisse, Shell, Heineken, Accenture India, and Unicef.

It’s also worth noting that in 2020, Shopify disclosed that two “rogue members” of its support team accessed customer transactional records of about 200 merchants. While this is concerning, it’s essential to recognize the proactive steps the company has taken to address security issues.


Stay informed and protect your data

While this particular incident doesn’t seem to be a direct breach of Shopify’s systems, it’s still a reminder to stay vigilant when it comes to our data. Make sure to stay informed about potential threats and take the necessary steps to protect your personal information.

If you’re interested in learning more about cybersecurity and how to keep your data safe, don’t hesitate to contact us and keep coming back for more valuable information.

Continue Reading

Malware

Hackers Expose Supposed Taylor Swift Tickets, Intensify Ticketmaster Blackmail with Power Word

Hackers have leaked alleged Taylor Swift concert tickets and intensified their extortion efforts against Ticketmaster. The group, known as REvil, is demanding a $10 million ransom for the stolen data and threatening to reveal more.

Published

on

Imagine being a die-hard Taylor Swift fan, eagerly awaiting her next concert, and then finding out that your ticket information has been compromised. Well, that’s precisely what happened to a large number of fans recently when hackers leaked the barcode data of 166,000 Taylor Swift Eras Tour tickets. The hackers have warned that more events will be leaked if a $2 million extortion demand isn’t met.

Back in May, a notorious threat actor named ShinyHunters started selling data on 560 million Ticketmaster customers for $500,000. Ticketmaster later confirmed the data breach, stating it was from their account on Snowflake, a cloud-based data warehousing company they use to store databases, process data, and perform analytics.

By April, threat actors had begun downloading Snowflake databases of at least 165 organizations using credentials stolen by information-stealing malware. They then blackmailed these companies, demanding payment to prevent the data from being leaked or sold to other threat actors. Companies known to have had data stolen from their Snowflake accounts include Neiman Marcus, Los Angeles Unified School District, Advance Auto Parts, Pure Storage, and Satander.

When Concert Dreams Turn into Nightmares

Today, a threat actor known as Sp1d3rHunters has leaked what they claim is the ticket data for 166,000 Taylor Swift Eras Tour barcodes used to gain entry on various concert dates.

Sp1d3rHunters, previously named Sp1d3r, is the threat actor behind the sale of data stolen from Snowflake accounts, publicly extorting the various companies for payments. The extortion demand, shared by threat intel service HackManac, reads, “Pay us $2million USD or we leak all 680M of your users’ information and 30 million more event barcodes, including more Taylor Swift events, P!nk, Sting, Sporting events F1 Formula Racing, MLB, NFL, and thousands more events.”

The post claims the barcode data is for upcoming Taylor Swift concerts in Miami, New Orleans, and Indianapolis. It includes a small sample of the alleged barcode data, containing the value used to create a scannable barcode, seat information, the face value of tickets, and other information. The threat actor even shared details on how to turn this data into a scannable barcode.

While the barcode data wasn’t part of the initial leak of stolen Ticketmaster data samples released by the threat actors in May, some of the newly leaked data can be found in the older leaks, including the hashed credit card and sales order information for the tickets.

The group behind these attacks is ShinyHunters, which has been responsible for many data breaches over the years. These include leaking the data for 386 million user records from 18 companies in 2020, an AT&T breach impacting 70 million customers, and most recently, the leaking of 33 million phone numbers used with the Authy multi-factor authentication app.

Update: Ticketmaster has informed us that unique barcodes are updated every few seconds, so the stolen tickets cannot be used. “Ticketmaster’s SafeTix technology protects tickets by automatically refreshing a new and unique barcode every few seconds so it cannot be stolen or copied,” Ticketmaster told us. “This is just one of many fraud protections we implement to keep tickets safe and secure.” They also confirmed that they did not engage in any ransom negotiations with the threat actors, disputing ShinyHunter’s claims that they were offered $1 million to delete the data.

Protect Yourself and Stay Informed

This incident is just one example of how vulnerable our personal data can be in the digital age. To stay informed about cybersecurity threats and how to protect yourself, make sure to keep coming back to our IT Services page. Our team of experts is dedicated to helping you stay one step ahead of cybercriminals. Don’t let hackers ruin your concert experience or compromise your personal information. Stay informed and stay safe.

Continue Reading

Trending

Copyright © 2023 IT Services Network.