Malware
T-Mobile Confirms No Data Breach Amidst Rumors, Sheds Light on Authorized Retailer Network
T-Mobile has refuted rumors of a new data breach, instead pointing to an authorized retailer as the source of the compromised customer data. The telecom giant assures its customers that no sensitive information was accessed, but recommends changing passwords as a precaution. T-Mobile continues to collaborate with law enforcement agencies to investigate the incident thoroughly.
T-Mobile Denies Data Breach, Leaked Database Belongs to Authorized Retailer
T-Mobile has denied suffering another data breach following reports on Thursday night that a threat actor leaked a large database allegedly containing T-Mobile employees’ data.
The mobile carrier informed us that the leaked data is believed to belong to an authorized retailer who experienced a breach earlier this year.
“There has not been a T-Mobile data breach. The data being referred to online is believed to be related to an independently owned authorized retailer from their incident earlier this year. T-Mobile employee data was not exposed,” T-Mobile told us.
Last night, an individual using the alias ’emo’ shared an 89 GB ZIP archive on the BreachForums hacking forum, claiming that it contains T-Mobile data and is related to Connectivity Source, a third-party authorized retailer for T-Mobile. However, the post suggests that the data was stolen from T-Mobile itself.
In April 2023, T-Mobile suffered a data breach exposing sales data/analytics, T-Mobile support calls with customers, employee credentials, partial SSNs, email addresses, and customer data,” reads the forum post.
The archive posted on the hacking forum contains a significant amount of data, including employee IDs, employment status, hire dates, termination dates, rehire dates, job titles, department, names, the last four digits of social security numbers, and email addresses.
The data also appears to include information about customer orders and their plans.
The malware repository VX-Underground was the first to share information about the data leak in tweets [1, 2], describing it as a result of a T-Mobile breach.
“T-Mobile has been breached (again). Data has been exfiltrated and it is being shared online (again). This is T-Mobile’s 8th breach since 2018,” reads tweets from VX-Underground.
As T-Mobile has a history of repeated data breaches, experiencing nine breaches since 2018, with two already in 2023, it is easy to assume that it suffered another breach.
Likely Linked to Connectivity Source Breach
However, this data breach is believed to be related to Amtel, LLC, an authorized T-Mobile retailer operating under the Connectivity Source brand, which previously disclosed a breach earlier this year.
In May 2023, Amtel warned that they suffered a data breach on April 19th, which allowed attackers to steal data belonging to current or former employees of the company.
“On April 19, 2023, Amtel was notified of suspicious activity in its network environment. Upon discovering this incident, Amtel promptly engaged a specialized cybersecurity firm to secure its environment and determine the nature and scope of the incident,” reads the Amtel/Connectivity Source data breach notification.
“While the investigation is ongoing, Amtel determined that the incident involved limited personally identifiable information (PII) on the same day.”
Although it has not been confirmed if the data released on BreachForums is the same as the data breach disclosed by Amtel, the dates align, making it highly likely.
We contacted Connectivity Source regarding the publication of its stolen data last night but did not receive a response to our email.
The good news is that this data does not contain customer data, and Amtel claims that only 17,835 current and former employees were affected by the breach.
However, this data is still valuable for threat actors, who could use it to send targeted phishing emails to Connectivity Source employees, gaining access to support systems or carrying out SIM swapping attacks.
Therefore, all Connectivity Source employees should remain vigilant and verify the legitimacy of any suspicious emails before taking any action.
Malware
Dell Sounds Alarm on Massive Data Breach: 49 Million Customers Potentially Impacted
Dell has warned 49 million customers of a potential data breach as unauthorized individuals attempted to extract customer data from its network. The company has reset all affected users’ passwords and is urging them to stay vigilant for any suspicious activity.
Did you know that Dell recently experienced a data breach? A threat actor claimed to have stolen information for approximately 49 million customers. As a result, Dell started sending out data breach notifications to customers, informing them that a Dell portal containing customer information related to purchases was breached.
Now, you might be wondering, what kind of information was accessed during this breach? Well, according to Dell, the following information was compromised:
- Name
- Physical address
- Dell hardware and order information, including service tag, item description, date of order, and related warranty information
Fortunately, the stolen information does not include financial or payment information, email addresses, or telephone numbers. Dell is currently working with law enforcement and a third-party forensics firm to investigate the incident.
How did this happen?
As reported by Daily Dark Web, a threat actor named Menelik tried to sell a Dell database on the Breach Forums hacking forum on April 28th. The threat actor claimed to have stolen data from Dell for “49 million customers and other information systems purchased from Dell between 2017-2024.” While we haven’t been able to confirm if this is the same data that Dell disclosed, it matches the information listed in the data breach notification.
The post on Breach Forums has since been deleted, which could indicate that another threat actor purchased the database.
What does this mean for Dell customers?
Although Dell doesn’t believe there is significant risk to its customers given the type of information involved, the stolen information could potentially be used in targeted attacks against Dell customers. Without email addresses, threat actors might resort to targeting specific people with physical mailings containing phishing links or media (DVDs/thumb drives) to install malware on targets’ devices.
Think this sounds far-fetched? Well, similar attacks have happened in the past. For instance, tampered Ledger hardware wallets were physically mailed, which then stole cryptocurrency, or gifts with USB drives were sent that installed malware.
Since the database is no longer being sold, there’s a good chance a threat actor is trying to monetize it in some way through attacks. So, what can you do to protect yourself?
Stay vigilant and be cautious
Be wary of any physical mailings or emails you receive that claim to be from Dell, asking you to install software, change passwords, or perform some other potentially risky action. If you receive any suspicious communication, contact Dell directly to confirm its legitimacy.
Remember, knowledge is power, and staying informed about cybersecurity threats is essential to protecting yourself and your information. Don’t hesitate to contact us for more information and resources on cybersecurity, and keep coming back to learn more.
Malware
800K Users Compromised: The Alarming 2023 MOVEit Cyberattack Unleashed
Learn how the University System of Georgia suffered a massive data breach in 2023, exposing the personal information of over 800,000 individuals. Discover the role of the Moveit attack and its impact on cybersecurity in the education sector. Stay informed on the latest data protection measures to keep your information safe.
Imagine waking up one day to find out your personal information, including your Social Security number and bank account details, has been stolen by cybercriminals. This is what happened to 800,000 individuals when the University System of Georgia (USG) fell victim to the notorious Clop ransomware gang in 2023.
USG, a state government agency responsible for operating 26 public colleges and universities in Georgia, was among the first to be compromised in a massive worldwide data theft campaign conducted by the Clop gang. They exploited a zero-day vulnerability in the Progress Software MOVEit Secure File Transfer solution, impacting thousands of organizations around the globe.
How the breach unfolded
With the help of the FBI and CISA, USG eventually determined that sensitive files had been stolen from its systems. Almost a year later, they began notifying the impacted individuals, revealing that the cybercriminals accessed the following information:
- Full or partial (last four digits) of Social Security Number
- Date of Birth
- Bank account number(s)
- Federal income tax documents with Tax ID number
Considering the type of information exposed and the fact that the number of impacted individuals is larger than the number of students under USG, it’s likely that prior students, academic staff, contractors, and other personnel were also affected.
USG submitted a sample of the data breach notice to the Office of the Maine Attorney General, stating that the data breach impacts 800,000 people. Interestingly, the entry on Maine’s portal also lists driver’s license numbers or identification card numbers as exposed data types, although these are not mentioned in the notice.
What’s being done to help the victims?
To help those affected, USG is now offering 12 months of identity protection and fraud detection services through Experian. Impacted individuals have until July 31, 2024, to enroll in these services.
Unfortunately, the MOVEit attacks by Clop were one of the most successful and prolific extortion operations in recent history. Over a year after the attacks took place, organizations are still discovering, confirming, and disclosing breaches, extending the aftermath of the cyber-attacks.
Emsisoft’s dedicated counter of MOVEit victims lists 2,771 impacted organizations and nearly 95 million individuals whose personal data now resides in Clop’s servers. Some of that data was published on Clop’s extortion portal on the dark web, some were sold to other cybercrime groups, and some remain to be monetized in the future.
What can you do to protect yourself?
This data breach serves as a stark reminder of the importance of cybersecurity and vigilance in our increasingly digital world. Organizations and individuals must prioritize cybersecurity measures, such as using strong, unique passwords, enabling multi-factor authentication, and regularly updating software and systems.
For more information on how to protect yourself and your organization from cyber threats, don’t hesitate to contact us. Our team at IT Services is dedicated to helping you stay safe in this ever-evolving digital landscape. Keep checking back for more insights and advice on cybersecurity!
Malware
DocGo Reveals Devastating Cyberattack: Hackers Breach and Steal Crucial Patient Health Data
Medical transportation company DocGo disclosed a cyberattack that led to unauthorized access of patients’ health data. The company has taken steps to enhance security measures and is working with cybersecurity experts to investigate the incident, emphasizing the importance of safeguarding sensitive information and preventing future breaches.
Imagine this: you’re at home, recovering from a recent surgery, when suddenly you receive a letter from your healthcare provider. They inform you that your personal health information has been compromised due to a cyberattack. This nightmare scenario recently became a reality for some patients of mobile medical care firm, DocGo.
DocGo’s Cybersecurity Breach: What Happened?
DocGo is a healthcare provider offering mobile health services, ambulance services, and remote monitoring for patients in 30 US states and across the United Kingdom. In a recent filing with the SEC, DocGo confirmed that it had suffered a cyberattack when threat actors breached its systems and stole patient health data.
Upon detecting unauthorized activity, DocGo promptly took steps to contain and respond to the incident. They launched an investigation with the assistance of leading third-party cybersecurity experts and notified relevant law enforcement.
The Aftermath: How DocGo Responded
Although DocGo did not share specifics about how they responded to the incident, organizations typically shut down their IT systems after detecting a breach to prevent the attack from spreading. As part of DocGo’s investigation, it was determined that the hackers stole protected health information from a “limited number of healthcare records” for the company’s US-based ambulance transportation business.
DocGo is now actively reaching out to individuals whose data was compromised in the attack. They stress that no other business units have been affected, and they have found no evidence of continued unauthorized access. Additionally, DocGo does not believe that the attack will have a material impact on the company’s operations and finances.
Who’s Responsible and What’s Next?
No threat actors have claimed responsibility for the breach. However, if it was a ransomware attack and a ransom is not paid, it’s likely that the stolen data will be used as leverage in the future to extort DocGo. We contacted DocGo to learn how many people were affected by the breach, but a reply was not immediately available.
Stay Informed, Stay Protected
This recent cyberattack on DocGo is a stark reminder of the importance of cybersecurity – not just for businesses, but for individuals as well. As personal information becomes more interconnected and accessible through technology, it’s crucial to stay informed about potential threats and take necessary precautions to safeguard your data.
If you want to learn more about cybersecurity and how to protect yourself and your information, don’t hesitate to contact our IT Services team for expert advice and assistance. And remember – knowledge is power. Keep coming back to stay informed and stay protected.
-
Malware7 months ago
Flagstar Bank’s Latest Data Breach: 800,000 Customers Impacted, Marking the Third Incident of 2021
-
Malware7 months ago
Blackbaud: Taking Responsibility with a Landmark $49.5 Million Settlement for Devastating Ransomware Data Breach
-
Data Protection Regulations6 months ago
Top Data Protection Officer Certification Courses Reviewed
-
Security Audits and Assessments6 months ago
Mastering Healthcare Data Security: 5 Essential Audit Tips
-
Data Protection Regulations6 months ago
Top 11 Data Protection Training Programs for Compliance
-
Security Audits and Assessments6 months ago
HIPAA Security Risk Assessment: Essential Steps Checklist
-
Data Protection Regulations6 months ago
9 Best Insights: CCPA’s Influence on Data Security
-
Data Protection Regulations6 months ago
Navigating Data Protection Laws for Nonprofits