We’re very pleased to announce that the Retail & Hospitality ISAC Podcast has joined the CyberWire Podcast Network. Join host Luke Vander Linden for chats with members of the InfoSec community to discuss the latest challenges, opportunities, and best practices unique to cybersecurity in the retail and hospitality industry. Tune in and subscribe.
The cybersecurity team at the SafetyDetectives reports they found a database containing 1.2GB of unencrypted Peruvian government data shared on a clear web forum for free. The database appears to belong to SUNAT (Superintendencia Nacional de Aduanas y de Administración Tributaria), Peru’s national tax administration agency, and contains information on an estimated 15 million Peruvian citizens, available for download to anyone with access to the forum post. What’s more, this was not the first time the database was posted, as the discovered post was an update from a December 2022 message. The sample shared, which was analyzed to confirm it is authentic Peruvian citizen data, contained tax identification numbers, individual or business names, taxpayer status, and tax domicile condition. The researchers contacted Peruvian authorities on February 13 to notify them of the data leak, but so far no response has been received.
As we noted previously, popular US cloud computing company Rackspace suffered a cyberattack at the hands of the Play ransomware group in December. The company confirmed at the time that the attackers used an MS Exchange exploit chain to breach Rackspace’s Hosted Exchange email environment, disrupting email services and compromising customer data. Heimdal reports that as Rackspace works to recover from the attack, most impacted customers have regained access to some or all of their email data, but more than 5% have downloaded malware into their mailboxes. It appears that Rackspace delayed applying a patch that would have resolved the exploited vulnerability due to reports that it caused “authentication errors,” which Rackspace was concerned could shut down its Exchange Servers. However, the company had already implemented Microsoft’s recommended mitigations, which Microsoft claimed should have been enough to prevent attacks. It’s unclear whether Rackspace met Play’s ransom demands, but the stolen data are not currently listed on Play’s leak site. The company decided not to rebuild the compromised Hosted Exchange email environment, opting instead to migrate to Microsoft 365, as it had planned to do before the attack. More than half of the email data from the compromised servers has been recovered, but unfortunately for Rackspace, the company has been hit with several class-action lawsuits as a result of the incident.
Biometric-Privacy Rulings in Illinois Expand Potential Liability for Companies (Wall Street Journal) Decisions from the state’s highest court could boost claims by workers and consumers.
Blind Eagle Deploys Fake UUE Files and Fsociety to Target Colombia's Judiciary, Financial, Public, and Law Enforcement Entities (BlackBerry) The threat group APT-C-36, also known as Blind Eagle, has been actively targeting organizations in Colombia and Ecuador, including health, financial, law enforcement, immigration, and an agency in charge of peace negotiation in the country.
Beware rogue 2FA apps in App Store and Google Play – don’t get hacked! (Naked Security) Even in Apple’s and Google’s “walled gardens”, there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)
U.S. Marshals Service suffers 'major' security breach that compromises sensitive information, senior law enforcement officials say (NBC News) The incident did not involve the database involving the Witness Security Program, commonly known as the witness protection program, a source told NBC News.
'Major' data breach reported by U.S. Marshals Service; sensitive information potentially compromised (USA Today) Sensitive law enforcement information put at potential risk
U.S. Marshals Service investigating ransomware attack, data theft (BleepingComputer) The U.S. Marshals Service (USMS) is investigating the theft of sensitive law enforcement information following a ransomware attack that has impacted what it describes as "a stand-alone USMS system."
US Marshals says prisoners’ personal information taken in data breach (TechCrunch) Current and former prisoners were notified of the breach on May 1.
As MedusaLocker ransomware targets RDP, HHS urges brute force defense (SC Media) A new HHS alert warns the Russian-backed MedusaLocker ransomware group has ramped up its tactics, adding brute-force attacks to its phishing and spam email arsenal.
LastPass: DevOps engineer hacked to steal password vault data in 2022 breach (BleepingComputer) LastPass revealed more information on a "coordinated second attack," where a threat actor accessed and stole data from the Amazon AWS cloud storage servers for over two months.
Hacker leaks alleged Activision employee data on cybercrime forum (BleepingComputer) A threat actor has posted data the alleged data stolen from American game publisher Activision in December 2022 on a hacking forum, highlighting the data's value for phishing operations.
