Dissent Doe :cupofcoffee:

Blogger/journalist at databreaches.net and pogowasright.org. As a retired healthcare professional, breaches in the healthcare sector are my priority.

The header pic is Indy, a Siberian husky we rescued in 2016 after I read how nobody wanted her because she was so difficult. She is now living her best life and is a mushball with me. My avatar is her co-conspirator, Senna. We rescued him from the town shelter in 2018. He is named for the #F1 #GOAT.

Public Key

npub1rh9ks6jqam8nj4kccfk505f70erhhq0g0kcr6w32c5ywyqgltdpsmklmka

NIP-05 Address

PogoWasRight@infosec-exchange.mostr.pub

Profile Code

nprofile1qqspmjmgdfqwanee2mvvym286yl8u3mms858mvpa8g4v2z8zqy04ksc249ugf

Author Public Key

npub1rh9ks6jqam8nj4kccfk505f70erhhq0g0kcr6w32c5ywyqgltdpsmklmka

Show more details

Last Notes

2025-06-03 17:00:54

- reply

@nprofile…5k2y OK, is this where you write a post with a headline that has "wake up call for..." in it?
J/K... wishing you a speedy and full recovery.

2025-05-28 23:22:07

Nova Scotia Power has repeatedly said that data from the ransomware attack it suffered has been published on the dark web. Yet not one media outlet or anyone I know has reported finding any data from this anywhere, and no ransomware group that I track has claimed responsibility for this incident.
Does anyone know where these data have allegedly been published? If so, please contact me privately.
#ransomware #databreach

2025-05-25 12:19:03

You may know this already, but in case you didn't: Threat actors have leaked some data from 2 more K-12 public school districts this week:
Some personal info on students at Coweta County School System was leaked by Nitrogen as proof of claims. I googled the parent information and found an exact match for name, address, and phone number.
Data from Kalamazoo Public School District was leaked by InterLock. InterLock claimed to have acquired 1,420 GB of data consisting of 724,477 Files and 82,820 Folders. It looks like they leaked it all but I didn't attempt to validate any data.
@nprofile…wz7x @nprofile…c4cm
#EduSec #cybersecurity #ransomware #databreach

2025-05-20 21:31:31

Massachusetts hacker to plead guilty to PowerSchool data breach:
https://www.investing.com/news/stock-market-news/massachusetts-hacker-to-plead-guilty-to-powerschool-data-breach-4055643
Related:
DOJ Press release: https://www.justice.gov/usao-ma/pr/worcester-college-student-plead-guilty-cyber-extortions
USA v. Matthew D. Lane - Information: https://www.justice.gov/usao-ma/media/1400921/dl
USA v. Matthew D. Lane - Plea Agreement:
https://www.justice.gov/usao-ma/media/1400926/dl
#databreach #PowerSchool #EduSec #cybersecurity
@nprofile…wz7x @nprofile…c4cm @nprofile…7nut @nprofile…l8lp

2025-04-25 15:01:57

Holy sh*t...
FBI arrests judge in escalation of Trump immigration enforcement effort:
https://www.cnbc.com/2025/04/25/fbi-arrest-judge-hannah-dugan-milwaukee.html
#obstruction

2025-04-17 12:12:05

Former Trump Official Targeted With Government Probe Vows to Fight: https://www.wsj.com/politics/policy/chris-krebs-trump-cybersecurity-executive-action-31cb99cb
Good for Chris Krebs and all those who do not buckle to this administration's bullshit investigations and abuse of power.
And shame on the DOJ for allowing itself to be weaponized. They should be reminded hourly that their oath was to the Constitution, not to a malignant narcissist or anyone trying to use them for political revenge.

2025-04-12 14:46:27

Google Hit With Lawsuit Over Data Collection on School Kids
https://news.bloomberglaw.com/litigation/google-hit-with-privacy-suit-over-data-collection-on-school-kids
Nor for nothing, but this is the same issue some parents in Toronto and I tried to raise against Google years ago -- and Google told me that their relationship was with their clients -- the schools -- and the schools consented. It was up to the schools, they claimed, to seek parental consent.
@nprofile…wz7x @nprofile…c4cm @nprofile…l8lp
#Google #WorkspaceForEducation #EdTech #consent #privacy #dataprotection #k12

2025-04-06 14:57:54

In the middle of the night, there were numerous attempts to get Facebook accounts created for randomly generated usernames for my domain. The emails all provided different confirmation code numbers and different fake Chinese-sounding names.
It didn't work. And I am not happy that Facebook didn't catch that it was rapid-fire emailing me numerous requests to confirm accounts.
#phishing #Facebook
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/291/589/702/545/459/original/cf5cfced80e283a0.jpg

2025-04-05 23:46:22

And here's another reminder of the insider threat if you don't investigate your employees' or consultants' backgrounds and claimed credentials carefully enough. @nprofile…5k2y has the story and how a number of criminal cases may now be appealed or overturned:
Cyber Forensic Expert in 2,000+ Cases Faces FBI Probe:
https://krebsonsecurity.com/2025/04/cyber-forensic-expert-in-2000-cases-faces-fbi-probe/
#insiderthreat #fraud

2025-04-05 22:56:44

Today's reminder of the insider threat involves a pharmacist in Maryland who over a period of 8 years or more, used keyloggers and installed spyware on about 400 computers at the University of Maryland Medical System so he could spy on female co-workers in private moments at work (such as changing clothes, breastfeeding their babies), and in their homes. He was reportedly fired in October 2024, and was able to get another job in another healthcare facility in Maryland because there has been no criminal charges filed against him yet and UMMC apparently didn't alert his new employer.
If Maryland law is like my state's laws, the hospital may be barred legally from revealing what happened if asked for a recommendation by the new employer,. And it seems the Maryland state pharmacy board can't just suspend a license unless there's been a conviction, so the failure to have criminal charges filed already seems to have put more potential victims at risk.
Unsurprisingly, a potential class action lawsuit has already been filed against UMMS with six plaintiffs so far. There are estimates that there are more than 80 victims of the now-former employee.
Some of the media coverage on the case: https://thedailyrecord.com/2025/04/04/six-women-sue-umms-claiming-staffer-spied-on-them-after-security-breach/
#InsiderThreat #keylogger #workplace #privacy #infosec

2025-03-30 11:21:35

A little ray of sunshine:
The Journal Times, part of Lee Enterprises, had been seriously impacted by the #ransomware attack by Qilin in February. Today, they announced that they are back to full strength: https://journaltimes.com/opinion/column/article_856d2fed-473b-4683-bbf4-61e8fd157830.html
Sincere congrats to them after what was almost two months of intensive and dedicated efforts to fully recover.
#journalism #freepress

2025-03-19 14:31:47

Somewhat OT, but may be of interest/relevance to a number of folks:
" In a landmark opinion over the copyrightability of works created by artificial intelligence, a D.C. Circuit panel ruled on Tuesday that human authorship is required for copyright protection.
As AI technology quickly advances and intertwines with human creations, the unanimous opinion lays down the first precedential marker over who or what is the author of work created solely by artificial intelligence under copyright law."
https://www.courthousenews.com/dc-circuit-rules-ai-generated-work-ineligible-for-copyright/
Direct link to opinion:
https://www.courthousenews.com/wp-content/uploads/2025/03/thaler-v-perlmutter-dc-circuit-opinion.pdf
#copyright #AI #ArtificialIntelligence

2025-03-16 11:09:31

Trump's attack on the media continues.
"In an executive order signed on Friday, President Donald Trump outlined seven federal agencies to be reduced in size, including the United States Agency for Global Media, which oversees Voice of America. The reduction was made to agencies Trump saw as "unnecessary," the order states.
"President Trump is delivering on his promise to make our government more efficient," White House Press Secretary Karoline Leavitt told USA TODAY on Saturday. "American taxpayers should not be funding anti-American propaganda in the name of journalism."
https://www.usatoday.com/story/news/politics/2025/03/15/trump-executive-order-voice-of-america/82443203007/
#press #media #journalism #VOA

2025-03-13 23:28:22

- reply

@nprofile…r0kn That is a great photo!

2025-03-13 20:12:53

Breach notifications needed to be made faster in 2024. Instead, they were made more slowly.
Some findings from #Bluesight 2025 Breach Barometer report plus additional observations and my frustration with #HHSOCR for not enforcing the notification requirements in #HIPAA and #HITECH.
https://databreaches.net/2025/03/13/breach-notifications-needed-to-be-made-faster-in-2024-instead-they-were-made-more-slowly/
#databreach

2025-03-06 21:19:06

Thanks to everyone in the fediverse who has favorited, boosted, and reached out to me supportively over the injunction and takedown order that I wouldn't comply with (overview: https://infosec.exchange/@PogoWasRight/114110520940142405)
Special thanks to @nprofile…5xd5 for reporting about it all on #TechCrunch:
https://techcrunch.com/2025/03/06/hacked-health-firm-hcrg-demanded-journalist-take-down-data-breach-reporting-citing-uk-court-order/
#databreach #HCRG #ransomware #incident_response #injunction

2025-03-04 20:32:09

Last Friday I received a letter from a U.K. law firm with an attached injunction. The law firm claimed I must remove two posts about their client.
That is not going to happen. I am not under the jurisdiction of the U.K. or the High Court of Justice. My lawyer informed them of that yesterday.
But DataBreaches.net might disappear tomorrow because the U.K. law firm sent the injunction to my domain registrar who, innocently believing them, informed me they will suspend my site if I don't remove the posts within 24 hours. I have replied to them but have not heard back.
So...
If my site is gone tomorrow, I will let you know where you can read a lot more about the injunction and how the injunction poses a serious risk of censorship in the U.K.
If my site is still online tomorrow, I will still let you know here where you can read about the over-reaching injunction obtained in a private hearing where no one represented journalists whose reporting was being censored.
#censorship #injunction #pressfreedom
#AssociatedPress #RCFP #databreach #ransomware #journalism
@nprofile…x3tn @nprofile…c8kq @nprofile…5xd5 @nprofile…zqsg @nprofile…405a @nprofile…8rys @nprofile…2m4m @nprofile…et2y

2025-02-25 13:05:27

I don't know if this is a first or not, but it sure struck me as unusual:
RansomHub sends a letter to the editor. Really.
https://databreaches.net/2025/02/25/ransomhub-sends-a-letter-to-the-editor-really/
#ransomware #databreach
@nprofile…zgwf @nprofile…c8kq @nprofile…ptue

2025-01-10 03:18:01

- reply

@nprofile…f9kf Terrific reporting, Joe!
Did "Nightly" or someone give you all the data? It sounds like you either had it all or had a lot.

2025-01-09 14:42:38

Some folks may get confused by PowerSchool saying that if they have medical records on students, they may have to notify under HIPAA.
Most student medical/health records are not covered under HIPAA. They are covered under FERPA.
If the district is billing the student's health insurance for services like speech therapy, physical therapy, or occupational therapy, then there's a HIPAA issue. Or if the school has arrangements with an actual clinic that is providing medical/health services to students. But most things like doctor's absence notes or even allergy action plans or school medication orders are not under HIPAA.
If the district has a health plan for employees that it administers, there's also a HIPAA issue there.
#PowerSchool #databreach #incidentresponse #HIPAA #FERPA
@nprofile…wz7x @nprofile…c4cm

2025-01-07 14:22:48

Two ransomware groups claimed they attacked Rutherford County Schools. in Tennessee. One leaked sensitive records.
I skimmed the data tranche and found tens of thousands of files with sensitive student information and personnel files. Read more about it here:
https://databreaches.net/2025/01/07/two-ransomware-groups-claimed-they-attacked-rutherford-county-schools-one-leaked-sensitive-records/
#databreach #ransom #EduSec #cybersecurity
@nprofile…wz7x @nprofile…7nut @nprofile…c4cm

2024-12-27 19:26:19

- reply

@nprofile…a0g8 One way to know that someone is a husky owner is that all they really want for Christmas is more blankets for the sofa. 😂
God bless our derpy huskies. 😍😍

2024-12-27 18:40:51

- reply

@nprofile…a0g8 Wait a minute. You have a husky on a gray sofa and I do not see a ton of dog hair or chewed up sofa. This is very sus. 😂
Happy holidays to you and the pupper.

2024-12-23 23:01:11

Yikes.
Wood County Commissioners pay $1.5M in ransomware:
https://www.sent-trib.com/2024/12/23/wood-county-commissioners-pay-1-5m-in-ransomware/
This was the situation two weeks ago: https://www.toledoblade.com/local/suburbs/2024/12/10/ransomware-attack-cripples-wood-county-computer-systems/stories/20241210087
This incident had not been publicly claimed. Anyone know who did it?
#databreach #ransomware #govsec #infosec #cybersecurity

2024-12-17 21:52:36

OK, a huge thumbs up to Byte Federal for their breach notification letter. They frankly admit where they screwed up and what happened. I wish more notifications were as clear and straightforward as this one.
https://databreaches.net/2024/12/17/a-positive-example-of-forthright-breach-disclosure/
#databreach #transparency #disclosure #IncidentManagement #IncidentReporting #infosec

2024-12-16 18:23:58

Unbelievable. Or maybe too believable...
I previously posted about Bolton Walk-in Clinic in Ontario not locking down their patient data despite multiple responsible disclosure alerts (https://infosec.exchange/@PogoWasRight/113589181607493357). Then I reported that Canada's cybersecurity agency contacted me and offered to help (https://infosec.exchange/@PogoWasRight/113589757905504474).
Well, they tried... but got no results either. Bolton Walk-In Clinic is still exposing patient data and didn't even do anything when contacted by Canadian federal police.
If any Canadian news outlet would like to report on this, get in touch. @nprofile…5au4 and I will share the information with you (yes, I just volunteered him too). 😂
Or if anyone is in the vicinity of their clinic, maybe stand outside with a sign that says, "Bolton Walk-In Clinic is leaking patient data and ignoring alerts!" That might get some attention...
Bonus points if you get someone in a Santa outfit to stand outside their clinic with a sign that says "Bolton Walk-In Clinic is naughty -- they are leaking patient data."
#dataleak #negligence #healthsec #PHIPA #HIPA #cybersecurity #databreach #accountability

2024-12-06 20:22:06

How is it that no one has set up the dark web equivalent of archive.org to archive onion sites?
(Translation: a link is dead and I really want to know what data it linked to) :blobnotlike:

2024-12-05 17:47:21

Scattered Spider Hacking Gang Arrests Mount With Teen:
Remington Ogletree (aka "Remi") arrested and charged with wire fraud and aggravated identity theft.
This teen had jaw-droppingly bad opsec, and to add to it, he used a crypto laundering service on TG that was actually an undercover FBI operation.
https://databreaches.net/2024/12/05/scattered-spider-hacking-gang-arrests-mount-with-teen/
#ScatteredSpider #FinSec #Telecoms #Hack #phishing #infosec #databreach

2024-12-05 00:16:03

#dogsofmastodon #doghair
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/597/321/696/809/704/original/f2c24a8b9c9bddeb.jpg

2024-12-04 15:17:50

- reply

@nprofile…skc4 My first thought was that someone really pissed about the Change Healthcare #databreach might be involved. BUt maybe I've read too many conspiracy news stories these days.
@nprofile…tq5v

2024-12-03 13:42:41

Bolton Walk-In Clinic in Ontario: lock down your backup already!
DataBreaches hates reporting on an incident when the entity has not yet secured misconfigured storage, but after four months of futile efforts to get a Canadian clinic to respond to responsible disclosures, maybe publication will help get them off the dime.
Do any personal injury lawyers in Ontario, Canada, or folks in the Information and Privacy Commissioner of Ontario follow me? Maybe they can get something done.
Read more at:
https://databreaches.net/2024/12/03/bolton-walk-in-clinic-in-ontario-lock-down-your-backup-already/
#misconfiguration #error #healthsec #dataleak #databreach #exposure #incidentresponse
#DontCallMeHoney
@nprofile…7nut

2024-11-20 23:41:47

OT, but holy heck...
Dallas Anesthesiologist Convicted of Tampering with IV Bags Sentenced to 190 Years in Prison:
https://www.justice.gov/opa/pr/dallas-anesthesiologist-convicted-tampering-iv-bags-sentenced-190-years-prison
The press release doesn't really explain the doctor's motivation or if he offered any defense. Just.... wow.

2024-11-20 18:40:29

- reply

@nprofile…5k2y Yeah... I kinda hate LinkedIn and am only on it minimally. I am more likely to read you here than there so count me as one of the "Do it!" replies.

2024-11-14 00:49:05

Idaho man who hacked medical entities and made vile threats sentenced to 10 years in prison:
https://databreaches.net/2024/11/13/idaho-man-who-hacked-medical-entities-and-made-vile-threats-sentenced-to-10-years-in-prison/
This is a case that started because the threat actor, "Lifelock," contacted DataBreaches to try to get DataBreaches.net to report on victims who hadn't paid his ransom demands.
Some of his court filings tried to blame me for the FBI raiding him and seizing his devices. The FBI did their own investigation but yes, it was my reporting that initially made the FBI aware of Robert Purbeck.
#databreach #healthsec #cybersecurity #infosec #extortion
@npub1lkk…sgcw @npub1zj4…fyjh @npub16kz…fslh @npub14fa…99fr

2024-10-30 19:17:16

In every generation, there have been people who stood up for inclusion while others spewed divisiveness.
Franklin debuted on Peanuts in a decade that saw civil rights protests, children hit with firehose for protesting, MLK assassinated, and so much more.... Remembering Charles Schulz:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/397/940/478/842/723/original/1ea16f4f1f42680f.jpg

2024-10-16 19:44:37

Breaking News: The threat actor known as "USDoD" (aka "EquationCorp" and other monikers") has been arrested by Brazilian Federal Police. USDoD is probably best known for his attacks on #InfraGard, Airbus, and his role in the recent National Public Data breach.
Media coverage indicates he was arrested this morning: https://g1.globo.com/politica/noticia/2024/10/16/pf-prende-hacker-de-33-anos-suspeito-de-invadir-sistemas-e-vazar-dados-de-policiais.ghtml
#databreach #hacker #USDoD #EquationCorp
@npub1jah…0scu @npub1zj4…fyjh

2024-10-16 18:30:57

The #SEC doesn't take kindly to be lied to, it seems.
Data Center Company CEO Indicted for Major Fraud and Making False Statements to the U.S. Securities and Exchange Commission:
https://www.justice.gov/opa/pr/data-center-company-ceo-indicted-major-fraud-and-making-false-statements-us-securities-and
They don't name the company but a little googling suggests that Deepak Jain's data center was AiNET in Beltsville, MD.
#fraud #datasecurity

2024-09-30 11:21:07

Heads up! New developments -- and arrests -- in law enforcement pursuit of LockBit.
Law enforcement reactivated a previously seized LockBit URL to announce what will be revealed tomorrow. Announcements will include the arrest of what they describe as a major LockBit actor, other LockBit-linked UK arrests, and a member of EvilCorp identified as a LockBit affiliate.
Stay tuned, it seems.
#LockBit30 #NCA #disruption #EvilCorp #ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/226/219/950/939/560/original/80518d4235696017.png

2024-08-25 17:54:34

If you're lonely or there's a hole in your heart that needs filling, have you thought of adopting or fostering a shelter dog?
Meet "Brooklyn." She's a 4-year old terrier mix and has been at the Town of Hempstead Animal Shelter since June 18 hoping for a furever home.
For more info or to arrange to meet her, call the shelter at (516) 785-5220.
#adoptdontshop #dogsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/023/926/240/302/861/original/dce58d95b5896b91.jpg

2024-07-31 11:26:25

Analysts had understandably described DISPOSSESSOR as a data broker rather than a ransomware group, but it seems that they have recently teamed up with RADAR and have shifted to a R-a-a-S model while still doing some sales for others.
https://databreaches.net/2024/07/30/radar-and-dispossesor-shift-to-r-a-a-s-model/
#ransomware #RaaS #dispossessor #radar

2024-07-30 12:24:15

Turning the tables: two gangs’ opsec fails exposed data; good guys deleted it:
https://databreaches.net/2024/07/30/turning-the-tables-two-gangs-opsec-fails-exposed-data-good-guys-deleted-it/
h/t, @npub1zj4…fyjh
#dataleak #ransomware #karma

2024-05-28 18:49:53

Hacked? Ticketmaster's terrible, horrible, no good, very bad week just got worse:
https://databreaches.net/2024/05/28/hacked-ticketmasters-terrible-horrible-no-good-very-bad-week-just-got-worse/
#databreach #infosec #Ticketmaster
@npub1zj4…fyjh

2024-05-28 15:51:07

Japan Man Arrested for Creating Virus Using Generative AI Systems; ‘I Thought I Could Do Anything if I Asked AI’:
https://japannews.yomiuri.co.jp/society/crime-courts/20240528-188598/
#AI #generative #artificialintelligence #ransomware #malware

2024-04-28 18:34:16

- reply

@npub1urn…c83k
Ouch. I'm sorry. Did they at least give you any reason?

2024-04-02 12:56:00

This may be the worst #IDTheft story I've read in ages:
https://www.justice.gov/usao-ndia/pr/former-hospital-administrator-pleads-guilty-identity-theft-scheme-spanned-three
#identitytheft

2024-03-29 10:25:53

Does anyone have a contact at WHO.int for infosec? A researcher is trying to contact them but got no response to info@

2024-03-20 02:41:35

For those wondering why I am torturing site visitors with captcha: my site is still under massive DDoS attack about every other hour... The site is online, but someone is very determined and is still trying.
And no, I have no idea who I ticked off enough that they would pay money to get such heavy-duty DDoSing...
But please be tolerant of the captcha and the time I need to get things running as I would prefer.

2024-03-09 00:05:50

I'm happy to report that DataBreaches.net is back online. PogoWasRight.org will be back up soon, too. The site is up, but the content is first being reuploaded.
The powerful #DDoS attacks didn't stop after yesterday morning. They continued, even today, but I hear the DDoSer is having a very very very bad day at the office today.
Thanks again to all those who reached out and offered help and support.
#DDoS

2024-03-07 22:55:28

- reply

@npub17lg…9uux @npub1hyp…aehm
This is extremely concerning if China is being accused of something that they didn't do. Has anyone in the govt actually spoken with Menlo's source to determine if the info really is on any level to support all these public suggestions?

2024-03-06 19:05:29

Speaking of exit scams, Ransomed.vc has left the room....
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/050/300/671/157/836/original/cbe9cdd4b9e3f633.png

2024-03-05 00:12:08

Developing: AlphV allegedly scammed Change Healthcare and its own affiliate:
https://www.databreaches.net/developing-alphv-allegedly-scammed-change-healthcare-and-its-own-affiliate/
#databreach #ransomware #changehealthcare
#AlphV #BlackCat #scam #exit
@npub1jah…0scu @npub1wnv…899h @ajvicens @npub1lkk…sgcw @npub1wf4…94wn @npub1zj4…fyjh

2024-02-11 15:25:12

My annual PSA for anyone else who doesn't care about football:
PuppyBowl XX is today! And there is now a PuppyBowl Hall of Fame and four former players will be inducted.
Kickoff for Puppy Bowl XX is at 2 p.m. ET. The pre-game show begins at 1 p.m. ET.
The Puppy Bowl will be aired on Animal Planet, Discovery, Discovery+, MAX, TBS and truTV.
I'm pretty sure Taylor Swift won't be showing up for this one because she's got her priorities a bit off.
#MustLoveDogs #PuppyBowl2024
You're welcome. :) 🐶 ❤️ 🐕❤️ 🐕‍🦺 ❤️

2024-02-07 14:28:46

I did not have a botnet of smart toothbrushes on this morning's Cyberattack Bingo card. Did you?
https://www.independent.co.uk/tech/toothbrush-hack-cyber-attack-botnet-b2492018.html
#botnet #DDoS #smart

2024-02-02 16:13:40

Was BrightStar Care attacked by two different groups — or was there only one breach?
It would help if BrightStar Care responded to inquiries. They didn't, but I'm confident they would like us all to know that they take privacy and security very seriously, right?
https://www.databreaches.net/was-brightstar-care-attacked-by-two-different-groups-or-was-there-only-one-breach/
#databreach #HealthSec #HIPAA #cybersecurity #transparency
@npub1jah…0scu @npub1lkk…sgcw @npub1wnv…899h

2024-02-01 23:14:40

The #FTC went after #Blackbaud for its poort security, #databreach in 2020, and incident response. A ton of provisions in the proposed order, but no monetary penalty.
Press release: https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-require-blackbaud-delete-unnecessary-data-boost-safeguards-settle-charges-its-lax
Direct link to proposed order: https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-require-blackbaud-delete-unnecessary-data-boost-safeguards-settle-charges-its-lax
I like how they included that after paying $250k to the threat actors to get them to delete the data, "The company never verified, however, that the hacker actually deleted the stolen data, according to the complaint."
#EduSec #databreach
@npub10k7…lp63 @npub107p…fkuv

2024-01-24 14:13:22

"Based on 481 ransomware attacks from the Dutch police and a Dutch incident response party, we arrive at a number of key insights: Insurance led to a 2.8x higher ransom amount paid, without affecting the frequency of payments. Data exfiltration led to a 5.5 times higher ransom amount paid, without affecting the frequency of payments. Organizations with recoverable backups were 27.4 times less likely to pay the ransom compared to victims without recoverable backups.
Press release: https://www.utwente.nl/nieuws/2024/1/1318314/ut-brengt-besluitvormingsproces-slachtoffers-ransomware-in-kaart#belangrijke-inzichten
Full article by Tom Meurs and colleagues: https://ris.utwente.nl/ws/portalfiles/portal/324702475/Ecrime2023vPREPRINT.pdf
h/t, #politieNL
@npub1a3j…zlqf @npub1jah…0scu @npub10a4…nt27 @npub1dla…k6ph @npub17lg…9uux
#databreach #ransomware #cyberinsurance #backup #incidentresponse #risk #dataprotection #analyses

2024-01-13 14:05:18

NYS DFS is really rocking it in enforcement.
NYS announces $8 Million Penalty Against Genesis Global Trading, Inc. After DFS Investigation Finds Significant Failings in Anti-Money Laundering and Cybersecurity Programs
Press release:
https://www.databreaches.net/nys-announces-8-million-penalty-against-genesis-global-trading-inc-after-dfs-investigation-finds-significant-failings-in-anti-money-laundering-and-cybersecurity-programs/
Consent order:
https://www.dfs.ny.gov/system/files/documents/2024/01/ea20240104_genesis_global_trading_inc.pdf
Entities doing business in New York should really keep an eye on these enforcement actions by DFS and the AG's office on cybersecurity.
#cybersecurity #infosec #AML #FinSec #databreach #dataprotection
@npub1fma…d2wy @npub1lkk…sgcw

2024-01-13 13:22:21

For those who may not know, the U.S. Census Bureau requires us all to complete the American Community Survey (ACS). If you don't answer, you'll get reminders, and could be fined as much as $5,000 in extreme cases.
Of course, our govt absolutely sucks at protecting personal info, and now the Census Bureau is seeking to collect even MORE very sensitive and personal info.
The Rutherford Institute explains:
"the Census Bureau issued a notice of proposed information collection seeking to add questions about each household member’s level of certain disabilities, including mental disabilities, and whether they have psychosocial, cognitive, or speech disabilities. The Bureau also seeks to ask about possession of electric vehicles, use of solar panels, type of sewage disposal, and other matters."
To read more about this proposal and how you can oppose it or comment on it, see:
https://www.rutherford.org/publications_resources/on_the_front_lines/rutherford_institute_opposes_census_bureaus_plans_to_question_citizens_about_mental_health_psychosocial_disabilities_in_mandatory_survey
#census #privacy #dataprotection #datasecurity

2024-01-11 13:27:38

Emsisoft's recent report advocating for a ban on #ransom payments has been generating discussion and debate -- and that's a good thing.
I came across some stats from the UK this morning which are also food for thought on this issue.
[ If you missed Emsisoft's report it's at https://www.emsisoft.com/en/blog/44987/the-state-of-ransomware-in-the-u-s-report-and-statistics-2023/ ]
#ITPro provides a summary from a Trellix report:
"One-third of UK-based #CISOs have confessed to paying #ransomware groups millions of dollars in recent years in a bid to alleviate the impact of an attack, according to new research.
Analysis from security firm Trellix found four-in-ten UK CISOs have managed a ransomware attack in the last five years – and in every single case, their organization opted to pay.
#Trellix found that one-third of CISOs paid between $5 million and $15 million for a ransom demand while 13% paid between $10 and $15 million.
The minimum ransom paid by all UK businesses across a five year period stood at around $250,000, the study found."
ITpro: https://www.itpro.com/security/ransomware/uk-cisos-are-cowing-to-ransomware-demands-more-than-you-think-heres-why-they-shouldnt-pay-up
@npub1jah…0scu

2024-01-10 02:28:03

Sébastien Raoult, aka "Sezyo," sentenced in federal court today; could be out in less than 11 months:
https://www.databreaches.net/sebastien-raoult-sentenced-in-federal-court-could-be-out-in-less-than-11-months/
#databreach #phishing #Sawfish #ShinyHunters
@npub1wnv…899h @npub1pa8…7mjg

2023-12-06 14:01:09

Now: The registrar for BreachForums.is has suspended the domain after reportedly getting several requests from law enforcement. It was suspended "for legal reasons."
I don't have more specific info on the nature of those requests yet (whether it was for user info or to remove content, etc.), but either the registrar just doesn't want any headaches or BreachForums.is might be in the process of being seized.
Right now, the domain name reg shows as being parked, but it's not on any FBI/DOJ server.
@npub1wnv…899h @npub1wf4…94wn @npub1fma…d2wy

2023-12-05 12:49:38

Disciplinary judge approves lawyer's suspension for using ChatGPT-generated fake case citations and then lying about it:
https://www.coloradopolitics.com/courts/disciplinary-judge-approves-lawyer-suspension-for-using-chatgpt-for-fake-cases/article_d14762ce-9099-11ee-a531-bf7b339f713d.html
The lawyer realized after submitting the filing that chatGPT had generated fake cases, but didn't withdraw the filing and lied to the judge in a panic when questioned about it.
#AI #ArtificialIntelligence

2023-12-03 13:04:56

So AlphV (aka BlackCat) is trying something different again. This time, it seems they are claiming a victim before they have even attempted to contact the victim or extort them. They post no proof of claims. They state that they are taking this approach because the victim's cyberinsurance policy does not cover extortion, and their research into the victim (Tipalti) and one of the victim's clients (Roblox) suggests that their usual approach will not work. They intend to try to extort those firms and Twitch, all individually.
They even cite an academic reference on the potential benefit of paying ransom.
This listing is not the nasty approach that we've seen in some other listings on that leak site. But we'll see what happens if or when the victims don't respond.
I've sent an inquiry to Tipalti who is probably already swamped and running around trying to figure out what happened. AlphV claims to have been in multiple systems of theirs since September 8. Whether that's true or not remains to be seen.
#databreach #infosec #cybersecurity #ransom
#extortion #AlphV #BlackCat
@npub1jah…0scu @npub1wf4…94wn @npub1zj4…fyjh @npub17lg…9uux @npub1wnv…899h

2023-11-24 13:06:11

@npub1zj4…fyjh had this interesting news item on his #RiskyBiz newsletter:
"Killnet leader dox: In a surprising turn of events, a regime-controlled news outlet has doxed and revealed the real-world identity of Killmilk, the leader of the infamous pro-Kremlin hacktivist group Killnet. According to Russian news outlet Gazeta, Killmilk is a 30-year-old named Nikolai Nikolaevich Serafimov. The news outlet says it learned of Killmilk's identity from two Russian hacktivist groups, and they later confirmed the dox with a source in Russian law enforcement."
Read more at Gazeta.ru: https://www.gazeta.ru/tech/2023/11/21/17878753.shtml
And if you're not already subscribing to #RiskyBiz newsletter, you're missing out on a great resource: https://riskybiznews.substack.com/subscribe
#Killnet #Killmilk #dox

2023-11-15 20:48:03

In what may be a first: AlphV filed an SEC complaint against one of its victims for not disclosing the breach to the SEC:
https://www.databreaches.net/alphv-files-an-sec-complaint-against-meridianlink-for-not-disclosing-a-breach-to-the-sec/
#databreach #SEC #compliance #infosec #cybersecurity #hacking
@npub1jah…0scu @npub1zj4…fyjh @npub1wf4…94wn @npub1lkk…sgcw @npub1wnv…899h

2023-11-05 18:20:32

PSA concerning daylight savings time.
#dogsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/359/317/400/188/644/original/8402699cda6c8845.jpg

2023-11-05 18:20:32

PSA concerning daylight savings time.
#dogsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/359/317/400/188/644/original/8402699cda6c8845.jpg

2023-11-01 19:28:01

Exclusive: Advarra hacked, threat actors threatening to leak data:
https://www.databreaches.net/exclusive-advarra-hacked-threat-actors-threatening-to-leak-data/
#databreach #cybersecurity #infosec #PHI #incidentresponse #transparency
This is an ugly incident also involving harassment... please consider not just reproducing any claims about named individuals without redacting names.
@npub1jah…0scu @npub1wnv…899h @npub1wf4…94wn @npub1zj4…fyjh @npub1pa8…7mjg @npub1ly2…z8hn

2023-10-31 12:50:40

- reply

@npub1urn…c83k
Oh my. Feel better soon!

2023-10-30 12:44:50

Seriously: who decides what "best practice(s)" is/are for incident response? And how is that determination made?
A law professor reportedly informed a student news outlet it was “best practice” to limit information about a breach claimed by threat actors until there was information on the full scope of the breach and the network was secure.
“Institutions do not want to get into a drip situation where they notify people of a breach, then later learn the breach was worse than understood, and then have to give more and more notices,” he wrote.
So "best practice" is defined as what is most convenient or in the entity's best interests instead of in the best interests of those whose data were stolen? I can understand the wanting to secure the network part, but it is not acceptable in the World According to Dissent to delay disclosure of a breach until you know the full scope if data are already being leaked on the internet or appear to be at plausible risk of imminent misuse.
Calling delays like this "best practices" seems to confer some legitimacy on delays that I don't think are all legitimate reasons.
(Wanders off in search of coffee..)
@npub1jah…0scu @npub10k7…lp63 @npub107p…fkuv @npub1zj4…fyjh @npub182a…mc3v
#databreach #incidentresponse #disclosure #bestpractices #excuses

2023-10-20 16:38:36

So an arrest was made in conjunction with the seizure of RagnarLocker's infrastructure and Tor leak site:
The "key target," who was arrested in Paris, is believed to be a developer of the malware:
https://www.europol.europa.eu/media-press/newsroom/news/ragnar-locker-ransomware-gang-taken-down-international-police-swoop
To all the agencies who cooperated on this: bravo!
#ransomware #RagnarLocker #europol #malware

2023-10-08 12:00:27

- reply

@npub17lg…9uux
BreachForums has already issued its own announcement making it clear that there is no partnership with ransomedvc:
https://breachforums.is/Thread-Clarification-about-partnerships-with-our-forum
h/t, @npub182a…mc3v

2023-10-03 12:57:31

- reply

@npub17lg…9uux
Yes to Defender. But even if I allow Tor browser through the firewall, it doesn't seem to be working. Even if I turn off Defender Firewall altogether, it's not connecting, and I don't get any logs. It continues to tell me it can't locate me. And attempts to use a bridge fail.
So many years of using Tor and then this....

2023-10-03 12:26:18

- reply

@npub17lg…9uux I've tried to view logs but it doesn't return any logs at all.
I'm in the US and checking whatismyip confirms the US IP addy... so keeping that in mind. here's most recent attempt results. I've tried unblocking button, I've tried getting bridges... nothing is working right.
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/111/171/068/807/120/544/original/1fc1dd87eb7bae38.jpg

2023-10-03 12:03:58

Totally baffled that I cannot connect to Tor. Tried uninstalling it and fresh install even. Not using proxy or anything.... just attempt a simple connection and no joy... attempts to use bridge also fail. Have tried two different networks here even, and still no connection... wtf....

2023-09-21 11:53:59

It's a serious #databreach, but hats off to TissuPath Australia for its security notice that provides more info than we usually see about how a breach occurred. It doesn't come back and tell people that the data were dumped, but it had revealed the threat and possibility of it.
https://www.databreaches.net/tissupaths-data-breach-notice-provides-details-about-how-they-were-attacked-and-their-incident-response/
@npub1jah…0scu @npub1lkk…sgcw
#HealthSec #cybersecurity #vendor #extortion #dataleak #databreach #AlphV #transparency

2023-09-20 16:34:10

Schools Are the Most Targeted Industry by Ransomware Gangs -- according to a report by Sophos and AtlastVPN
https://www.hackread.com/schools-most-targeted-industry-ransomware-gangs/
Related:
https://atlasvpn.com/blog/80-of-education-providers-hit-with-ransomware-last-year-biden-administration-responds
Related:
https://assets.sophos.com/X24WTUEQ/at/j74v496cfwh4qsvgqhs4pmw/sophos-state-of-ransomware-education-2023-wp.pdf
@npub10k7…lp63 @npub1jah…0scu @npub107p…fkuv
#EduSec #EdTech #ransomware #infosec #cybersecurity #dataBreach

2023-09-19 14:06:38

- reply

@npub17lg…9uux
I checked Clop yesterday, and it looks like they have already leaked some of Nuance's data in a 50-part leak. They do not say how much more data they have from Nuance to come.
I am dedicated to my blog, but I refuse to spend what's rest of my life downloading Clop's stuff. Someone else will have to do that. :)

2023-09-13 21:50:40

#DogsofMastodon #AdoptDontShop
Teacher says: The test isn't very hard.
Here's the test:
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/111/060/033/144/006/749/original/a1c10d8c14e8760a.jpg

2023-08-18 17:35:50

Who among us has not driven off after leaving something on the roof of their car?
Police officer loses laptop and notebook as he drives along motorway after leaving them on roof of his car in fourth data breach by single police force
https://www.dailymail.co.uk/news/article-12421601/Police-officer-loses-laptop-notebook-drives-motorway-leaving-roof-car-fourth-data-breach-single-force.html
#databreach #HumanError #BrainFade #infosecurity

2023-08-18 17:27:22

Airline scammers: family trying to change flight home to get out of Maui sooner because fires were raging lost $3,400 after hackers changed airline contact info:
https://www.aerotime.aero/articles/airline-scammers-family-loses-3400-after-hackers-changed-airline-contact-info
#scammers

2023-08-16 17:49:04

RIP Anonfiles.com
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/900/551/183/118/502/original/bab477e063c09b57.jpg

2023-08-15 19:59:51

When Centers for Medicare & Medicaid announced the #MOVEit #databreach reported to them by #Maximus last month, they estimated 645,000 were affected. The breach was eventually reported to HHS as affecting 1,362,470 -- about double what they had initially reported.
#healthsec #HIPAA #HITECH #incidentresponse
@npub1jah…0scu

2023-08-14 14:05:07

One of the #MOVEit victims was the Colorado Department of Health Care Policy & Financing, who was notified by #IBM of the #databreach.
Info types included full name, Social Security number, Medicaid ID number, Medicare ID number, date of birth, home address and other contact information, demographic or income information, clinical and medical information (such as diagnosis/condition, lab results, medication, or other treatment information), and health insurance information.
https://hcpf.colorado.gov/news-release-contractor-data-security-incident
They have now reported the incident to Maine's AG as affecting 4,091,794 .
That makes it the biggest or one of the biggest single reports on the MOVEit incident, I think.
@npub1jah…0scu

2023-08-03 19:22:26

- reply

@npub17lg…9uux
I find those multiple-site #ransomware listings confusing. Are they just sharing data, just boosting each other's ads, was there more than one attacker, or what? It could be any of the above or something else.
When I rule the world, they will not be allowed to confuse me.

2023-08-01 12:36:35

Cyber attack on Montclair Township led to $450K ransom payment:
https://montclairlocal.news/cyber-attack-on-montclair-township-led-to-450k-settlement/
So if they had had 2FA, they wouldn't have needed to pay $450k? Is that what we get from this one?
#databreach #ransomware #infosec #cybersecurity
@npub1jah…0scu @npub1a3j…zlqf @npub1fma…d2wy

2023-07-04 19:58:51

EU’s top court rules against #Meta in key data #privacy case:
https://siliconangle.com/2023/07/04/eus-top-court-rules-meta-key-data-privacy-case/
Press release by CJEU:
https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-07/cp230113en.pdf

2023-07-01 14:28:53

ICYMI: Yesterday, I reported on the arrest of a hacker who was described by Dutch law enforcement as being the prime suspect in a group of hackers responsible for a significant number of big hacks in the Netherlands and elsewhere. Most recently, he was known as "Umbreon" on the original BreachForums.
In future posts, we will hopefully address why the govt's diversion program that he had been through a few years ago didn't really help him get out of blackhat activities. And maybe after his trial and sentencing in October, I will be able to reveal more about some of his better known hacks and why some intel firms or analysts referred to him as an APT.
He's a complex young man -- super-talented as a blackhat, it seems, but also super-talented as a whitehat gainfully employed in cybersecurity and also a volunteer who donated tons of time to helping nonprofits and other entities secure themselves from vulnerabilities.
Read the first part of what will be a series of posts at:
"I had been chatting with a blackhat. They had been working with a whitehat. We were both dealing with the same person:"
https://www.databreaches.net/i-had-been-chatting-with-a-blackhat-they-had-been-working-with-a-whitehat-we-were-both-dealing-with-the-same-person/
@npub1wf4…94wn @npub1zj4…fyjh @npub1fy0…nr5l

2023-06-29 12:55:45

There's an update to the saga of the breaches.net domain that was gifted to me by Conor Fitzpatrick (aka "Pompompurin" of Breached.vc) but then seized by the government when they seized all of his domains.
When I reached out to the FBI to ask for their help getting the domain unseized and restored to me, they responded quickly, and on Monday, asked me to provide various proofs of registration, etc. I sent them screencaps to address all their inquiries.
Yesterday, they asked for a quick meeting by phone. When we met, they told me I would be getting the domain unseized, but to expect it to take time as they have to go through a whole court procedure because there had been a warrant and an order involved.
So it will not be quick, but I will eventually have Breaches.net back as my domain that I can develop, thanks to the kindness of Conor Fitzpatrick ("Pom") who donated it to me to use for good purposes and thanks to the FBI agents who responded so quickly and courteously to my request.
@npub1wf4…94wn @npub1zj4…fyjh
@npub1a3j…zlqf @npub1fy0…nr5l @npub1s4n…73vw
#Seized #FBI #HappyEnding

2023-06-22 23:08:21

The govt has seized a slew of domains owned by Conor Fitzpatrick aka "Pompompurin" of the now-defunct Breached.vc
They even seized one of MY domains that had previously been owned by Pom but was now lawfully owned by me. Wow.
@npub1zj4…fyjh @npub1wf4…94wn
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/590/378/579/289/683/original/a3d417c597fe135a.jpg

2023-06-13 12:12:10

Cyberattack is a factor in Illinois hospital’s closure:
https://edition.cnn.com/2023/06/12/politics/cyberattack-hospital-closure/index.html
So they're saying that a 2021 incident that affected them for months is a factor in their closing now?
Oddly, although I had noted this incident in my recording sheets for February 2021, I never saw it reported on HHS's public breach tool, and still don't find it on that tool or archived reports. And I never saw data up for sale or any group claiming responsibility for this one. Anyone have more details or follow-up on it?
#databreach #ransomware #healthsec #infosec #cybersecurity
@npub1jah…0scu @npub1sx4…pzpa @npub1a3j…zlqf @npub1zj4…fyjh

2023-05-25 21:46:51

In an article about Richmond University Medical Center's progress in recovering from a ransomware attack three weeks ago, we read:
"Asked about whether patient information had been compromised in the attack, the hospital said, '[w]e are continuing our investigation into this incident alongside third-party cybersecurity experts.' "
Have I mentioned #transparency recently?
C'mon, #RMUC -- just tell people what you know already. Your lack of transparency is disappointing, to say the best.
@npub1jah…0scu @npub10k7…lp63 @npub107p…fkuv
#databreach #ransomware #disclosure #incidentresponse #HealthSec #infosec #HIPAA #PHI #cybersecurity #malware #transparency

2023-05-22 23:56:09

It's like FTC suddenly woke up from a long slumber and got active.... here's more from today's news:
FTC Files Brief in Jones v. Google in Support of Appeals Court Ruling that COPPA Does Not Preempt Plaintiffs’ State Privacy Claims:
https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-files-brief-jones-v-google-support-appeals-court-ruling-coppa-does-not-preempt-plaintiffs-state
#FTC #COPPA #Google #breach #children #online #Preemption #privacy
@npub10k7…lp63 @npub107p…fkuv @npub137m…wymk

2023-05-16 16:26:18

DOJ is having a busy day disclosing actions. Here's something of note, too:
Justice Department Announces Five Cases as Part of Recently Launched Disruptive Technology Strike Force:
https://www.justice.gov/opa/pr/justice-department-announces-five-cases-part-recently-launched-disruptive-technology-strike
#disruptive #disruption #disruptivetechnology

2023-05-13 17:29:24

This is the biggest single breach reported so far this year for the U.S. healthcare sector:
Ransomware attack on PharMerica affected 5.8 million patients
https://www.databreaches.net/ransomware-attack-on-pharmerica-affected-5-8-million-patients/
@npub1jah…0scu @npub1e2e…krxe
@npub1a3j…zlqf
#HIPAA #databreach #ransomware #IT #infosec #cybersecurity

2023-05-09 23:21:22

A U.K. citizen, Joseph James O’Connor, aka PlugwalkJoe, 23, pleaded guilty today in New York to his role in cyberstalking and multiple schemes that involve computer hacking, including the July 2020 hack of Twitter.
https://www.justice.gov/opa/pr/uk-citizen-extradited-and-pleads-guilty-cyber-crime-offenses
#hacking #Twitter #cyberstalking #SIMswap

2023-05-01 13:16:47

29 years ago today, the world went dark for #F1 when we lost the greatest driver of all time, Ayrton Senna.
#SennaSempre
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/293/607/167/194/813/original/10aa43c1f8f99bd3.jpg

2023-04-24 12:15:08

Whoever has taken over writing BlackCat's posts seems to have abandoned any attempt at a professional or "just business" tone. They are going to wear out their exclamation point key very quickly at this rate.

2023-04-18 15:31:12

Dutch hacking suspects to be in court April 20; Dutch police try to warn others to "stop cybercrime":
Includes the identity of two of the suspects and preliminary charges.....
https://www.databreaches.net/dutch-hacking-suspects-to-be-in-court-april-20-dutch-police-try-to-warn-others-to-stop-cybercrime/
#[0] #[1] #[2] #[3] #[4] #[5] #[6] #[7] #[8]
#[9] #[10] #[11] #[12] #[13] #[14]

2023-03-28 17:32:52

Anyone else getting a 502 on #[0] leak site? I've been getting that error for a while now.
Something afoot?
#[1] #[2] #[3]
#[4] #[5] #[6] #[7]

2023-03-21 14:10:49

And for those reporting on the #[0] breach:
It was not a ransomware attack. There was no malware or locker involved. Other details here:
Ferrari hacked; doesn’t pay $1 million ransom demand:
https://www.databreaches.net/ferrari-hacked-doesnt-pay-1-million-ransom-demand/
#[1] #[2] #[3] #[4] #[5] #[6]
#[7] #[8] #[9] #[10] #[11]