New cybersecurity threats like phishing attacks, ransomware, and scams are always popping up. Stay up to date on the latest widespread threats and protection methods in our recurring series.
EVITE DATA BREACH
Evite, an online email invitation and event planning service, discovered a breach of client information dating up to 2013. The information accessed includes users’ names, usernames, email addresses, passwords, birth dates, addresses, and phone numbers. Evite stated that social security numbers and financial information were not taken.
The attacker who obtained the information has since put it up for sale on the dark web. Compromised users were alerted, and the company has since been working with computer experts to enhance their security and introduced additional security measures.
What to do: If you have used Evite in the past, ensure you change your password on their website immediately. If your Evite password and/or username is one you use on any other websites, we recommend changing your login information on those sites as well. Criminals will frequently test stolen credentials from one site on others as most people reuse their login information across services. Keep an eye out for suspicious activity on any online services you use and your financial records.
UNITED STATES CUSTOMS AND BORDER PROTECTION DATA BREACH
The photos of travelers and vehicles traveling in and out of the United States were breached via the US Customs and Border Patrol. A subcontractor for the organization was the cause: “CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network,” said an agency statement.
The subcontractor was the victim of a cyberattack, and “violated mandatory security and privacy protocols”, leading to the stolen data.
The incident is stated to affect less than 100,000 people through “a few specific lanes at a single land border” over a month and a half period.
What to do: Unfortunately there isn’t much we civilians can do regarding this breach. Customs has notified Congress of the breach and is monitoring the subcontractor’s work, along with any negative effects that may come from the incident. Many civil liberties groups are protesting the expansion of facial recognition that likely contributed to this breach. If this is something you’re interested in, look into getting involved with the American Civil Liberties Union.
AMERICAN MEDICAL COLLECTIONS AGENCY (AMCA) DATA BREACH
AMCA, which specializes in collecting overdue medical bill payments, revealed that approximately 20 million people may have been affected by a breach due to unauthorized activity on its web payment page. The data could include first and last names, birth dates, addresses, phone numbers, and credit card or bank account information. Clients of AMCA include LabCorp and Quest Diagnostics, whose customers were likely affected via the AMCA breach.
What to do: If you’ve had any medical procedures in the last couple of years, it’s likely AMCA or its customers handled some of the data. Whether you’ve been notified or not, it’s recommended to keep an eye on your financial accounts for suspicious activity and unauthorized charges.
Criminals are also likely to use information from breaches like this in other scams, such as phishing emails or fraudulent phone calls. If you receive a phone call or email claiming to be from your financial institution, the IRS, Social Security Administration, or similar organization, use caution. Always confirm with the company itself by contacting them through their official phone number or support channels and not the contact information given in the suspect email or phone call.
OUTLOOK UNDELIVERED EMAIL PHISHING SCAM
A new email phishing scam tries to trick you into giving up your login credentials. The email states that you have a list of undelivered emails being held in your Outlook WebMail Service. Clicking the included link will direct you to a fake Outlook login page, where your credentials, if entered, will be sent to the perpetrator.
What to do: Always check the sender’s address and email contents in emails you weren’t expecting. It’s very common for scam emails to direct you to a fake login page and attempt to steal your credentials. Never follow the links in emails like this and examine the URLs of webpages you’re directed to to make sure it’s the real deal.
If you need some extra help identifying or protecting against any of these or other cybersecurity threats, let us know!
