Data Breach

GE Data Breach – 3rd Party Vendor Canon Hacked – Employee, Retiree, and Beneficiary Data Stolen

Highly sensitive data was stolen from a General Electric (GE) third-party vendor. According to a letter sent by the company, the GE data breach impacts current and former employees of General Electric GE and occurred when a third-party vendor, Canon Business Process Services, was compromised. Canon processes employee documents on behalf of GE. Hackers gained access to an employee email account and accessed sensitive employee information between February 3 – 14, 2020. It is unknown at this time how many past and present employees or beneficiaries are affected by the GE data breach,

The hacked data comes from documents uploaded by employees, former employees, and beneficiaries who are entitled to benefits. GE sent a letter to those involved but did not disclose how many letters the company sent.

Although the GE data breach notice does not explicitly state it, is it likely that a Canon employee responded to a phishing email which somehow gave the hackers access to an IT network – possibly through a malware infection. Phishing emails are often launched with information collected from social engineering. For example, the names and contact information for human resource staff can often be taken from corporate websites or social media sites like LinkedIn. Hackers then target those employees with phishing emails trying to fool them into clicking on a malicious link or downloading an attachment that launches a malware attack. Once a computer is infected with malware, it can be used to steal usernames and passwords to highly private employee data or sensitive corporate secrets.

Hacked personal data presents a huge security risks for those affected by the GE data breach. GE and Canon did not state how many people are affected by the data beach and there is no estimate on how far back in time this data goes as it also involves former employees and their dependents.

Hackers steal this type of data to commit a variety of other cybercrimes. Anyone who has had personal information stolen is vulnerable to future identity theft, phishing emails, malware attacks, credit fraud. This is the type of information that can be used for medical identity theft and phishing email campaigns that steal money. It is also common for hackers to sell this information on the dark web. Just last week, Russia’s Federal Security Service arrested twenty-five Russian hackers, two of which who were the largest dealers of stolen personal data and credit card numbers. The carding ring preyed upon Western companies and made millions of dollars selling it on the dark web.

RELATED READ: Remote Work – Six Ways to Keep Your Data Safe When Working Remotely

It is important to change all passwords and set up identity theft monitoring. All online accounts that use the same email address are especially vulnerable to hackers.

Hacked documents include

• Direct deposit forms
• Driver’s licenses
• Passports
• Birth certificates
• Marriage certificates
• Death certificates
• Medical child support orders
• Tax withholding forms
• Beneficiary designation forms
• Applications for benefits such as retirement, severance, and death benefits

Breached data may have included

• Names
• Addresses
• Bank account numbers
• Social Security numbers
• Driver’s license numbers
• Bank account numbers
• Passport numbers
• Birthdates
• Other personal information contained in the relevant forms

Canon has secured its IT systems and is working with GE to identity which employees, former employees, and beneficiaries are impacted by the GE data breach

GE Data Breach – What Do I to Protect My Money?

All US citizens are entitled to a free credit report from each of the major credit reporting services or any time an application for credit is rejected. Canon is offering a complimentary two-year membership of Experian IdentityWorksSM Credit 3B.

• Order a credit report and review it carefully
• Look for accounts you did not open
• Monitor credit cards, loans, and other lines of credit for any increases in credit lines
• Check the information about you in each credit report. Make sure your contact address, phone number or other contact information has not changed

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

Another Marriott Data Breach Leaks the Personal Information of 5.2 Million Customers

Another Marriott data breach was disclosed today by the hotel and resort chain. This time the information from 5.2 million customers was hacked. The breach notification was posted on the company’s website. The post states that hackers used login credentials stolen from two franchise property employees to access the corporate database. The company discovered the breach at the end of February but did not give a specific date. Marriott International sent emails to all hotel guests impacted by the data breach today. The company is still investigating the incident.

This is the second major data breach for Marriott is less than sixteen months – both incidents involved millions of their customers private information. The last Marriott hack saw passport information and customer details of over 500 million Starwood brands guests stolen over a two-year cyber attack that went unnoticed.

It is believed that hackers gained access to the customer data in mid-January 2020 until it was discovered in February. The attack was stopped by disabling the login credentials for the two compromised employees accounts. The notice from Marriott states, “At this point, we believe that the following information may have been involved, although not all of this information was present for every guest involved:

• Contact Details (e.g., name, mailing address, email address, and phone number)
• Loyalty Account Information (e.g., account number and points balance, but not passwords)
• Additional Personal Details (e.g., company, gender, and birthday day and month)
• Partnerships and Affiliations (e.g., linked airline loyalty programs and numbers)
• Preferences (e.g., stay/room preferences and language preference)

It does not appear at this time that Marriott Bonvoy (the company’s loyalty program) account passwords or PINs were hacked. At this time, Marriott does not think that passport information, driver’s licenses, or other government IDs were stolen. However, it is common during investigations to find that the number of affected people and how much of their information was stolen is increased as investigators uncover details and attack vectors.

Marriott set up a website where customers can check to see if they are impacted by this data breach and what information may have been hacked.

Starwood Data Breach

This is the second major data breach for Marriott in less than two years. In November 2018, Marriott International reported that one of their brands, Starwood Hotels, had been compromised by hackers. Beginning in 2014 the guest reservations system for Starwood hotels was breached and the data of about 500 million hotel customers was stolen. The Starwood data breach carried on for years before it was discovered. Marriott acquired Starwood in 2016, after the data breach began. Stolen data included 327 million passports as well as customer names, mailing addresses, phone numbers, email addresses, guest rewards account information, birthdates, gender, and travel dates.

Who Was Behind the Marriott Data Breach?

Marriott Data Breach – What Do I Do Next?

Marriott International is offering free identity protection for those notified that they are impacted by the data breach. Customers must sign up by 30 June to take advantage of the service offered through However, IdentityWorks is only offered in Australia, Brazil, Canada, Germany, Hong Kong, India, Ireland, Italy, Mexico, New Zealand, Poland, Singapore, Spain, the United Kingdom, and the United States. Anyone else will need to protect themselves with an identity theft service that works everywhere. We recommend Identity Force – try a FREE TRIAL

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

Canada’s Rogers Communications Suffers Data Breach – Rogers Communications Customer Data Exposed in Online Data Breach

Customer data from Canadian ISP Rogers Communications was found exposed in an unsecured online database. Rogers posted information about the incident in their support section of their website. An unnamed vendor stored customer information online in a publicly accessible database. Customer addresses, account numbers, email addresses, and phone numbers were all exposed. Rogers Communications discovered the data breach on 26 February 2020. The information has already been removed.

It is believed that no credit card, banking, or password information was exposed. However, customers who have data exposed in a cyber security incident like this run a greater chance of identity theft. Affected customers are being notified by email or postal mail. Rogers Communications is offering free identity theft monitoring from TransUnion.

How Thieves Can Steal Your Identity

Thieves can steal your identity by hacking into databases, gaining access to email accounts, scraping personal data from social media or from corporate websites, or using a variety of other attack vectors. Often phishing email attacks begin with data taken from social engineering. Hackers cobble together bits of personal information to build a profile on a target. Although many people think they don’t have enough money to be a desirable target, a hacker is capable of building databases of information on thousands or millions of people. When phishing emails are sent in large volume, stealing just a few dollars from millions of people is very profitable.

RELATED READ: Will My VPN Work in Canada?

Protect your personal information like is cash.

People frequently use the same password across multiple online accounts. If a hacker can gain access to a low-level account, like your cable television account, the hacker can often use that email address or password to hack into something more valuable – like your credit card of bank account.

Read our guide on on the most common hacked passwords

What is Rogers Communications?

Rogers Communications is based in Toronto Canada and is one of Canada’s largest ISPs (internet service provider.). The company also sells phones, streaming services, home security monitoring, and phone services.

RELATED READ: How to Get a Canadian IP Address Outside of Canada

Data Breaches – How to Protect Yourself

It is important to monitor your other online accounts including social media and emails.

• Change your password – Although account passwords were not part of this data breach, email addresses were. That means hackers have half the information they need to break into any account using the same email address. Many people use the same passwords across multiple accounts which puts all accounts sharing the same password in jeopardy.
• Monitor your bank and payment card statements for fraudulent charges. Notify your bank if there are any erroneous charges.
• Email addresses were exposed. Be especially vigilant for phishing emails and spam from people you don’t know
• Phone numbers were exposed in this data breach too. Be vigilant for SMS phishing emails and scam text messages
• Always use a secure WiFi connection. Even logging into email and social media can give a hacker the information they need to break into your bank account and steal money.
• Never use public WiFi to make purchases or to log on to financial accounts

Previous Rogers Communications Data Breaches

Rogers Communications was hacked in 2015 after a hacking group that goes by the name TeamHans. In that incident hackers successfully phished a Rogers employee. TeamHans accessed one email account, an enterprise sales employee, who managed medium sized business accounts. The hackers dumped 465MB of data online after Rogers Communications refused to pay ransom to get the data back.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

Princess Cruises Data Breach – Hackers Steal Government IDs and Payment Information Stolen from Customers and Employees

Princess Cruises, a cruise line owned by Carnival Cruises, suffered a data breach. Hackers breached employee email accounts over a four-month period and stole personal information belonging to employees, crew, and guests. Princess Cruises is the same cruise line that had two ships on which passengers were infected with the Coronavirus. The first ship, the Diamond Princess eventually docked in Japan with over 700 ill passengers.

The Princess Cruises data breach was identified in late May 2019 and Princess Cruises quietly announced the data breach just this month. .

Hacked data includes passenger names, addresses, Social Security numbers and government IDs, payment information, and health data. The press release stated that, “This list is not specific to each guest, “ but it is not clear what that exactly means.

The data breach was reported to police, but Princess Cruises did not indicate in what jurisdiction or agency they had reported the breach in. Princess Cruises stated it is using cyber security investigators, but they did not say if it was a third-party company, as is customary in data breaches, or name anyone who is in charge of the investigation.

How Hackers Make Money

Hacked data can be used for a variety of cybercrimes including credit card fraud, stolen money, tax fraud, or identity theft. Hackers can use the stolen government ID information to open up lines of credit, produce false ID cards that are sold. They can even use them in medical fraud. Payment card numbers are used to clone physical payment cards to run up charges. They can be sold on the dark web to other hackers.

Recently a cache of thousands hacked payment card numbers was put up for sale on the dark web by a hacking group known as Jokers Stash. The stolen credit cards were part of the five-month long Wawa data breach in which hackers infected the point-of-sale terminals with malware to steal all payment information used by customers at all Wawa stores.

Princess Cruises has already ceased operating after two of its ships, Diamond Princess and Grand Princess, had outbreaks of the novel coronavirus, or COVID-19. The cyber attack on the company’s email accounts occurred between April and July 2019.

Princess Cruises Data Breach – What Do I Do?

• Remain alert for the signs of identity theft. Get identity theft monitoring app to protect your money
• Monitor your bank accounts and credit cards for signs of theft. This is another way that identity theft apps can protect your money. The apps will alert you is there are suspicious charges, an increase in an existing credit line, or any new credit accounts opened in your name
• Be alert for phishing emails. Phishing emails attempt to trick the recipient into divulging ever more information. Now that the hackers have your contact information and payment card numbers, they may be looking to log into your bank account or credit card to steal your money
• Malware protection can alert you to phishing emails. Malware apps quarantine suspicious emails and stop you from downloading malicious email attachments designed to infect your computer with malware or spy on you

If your money or identity is stolen, file a report with the police. You can also report the theft to your bank and any payment cards that were compromised.

Get a Free Copy of Your Credit Report

Each year, everyone is entitled to a free copy of their credit report form each of the three credit reporting bureaus: Equifax , TransUnion, and Experian. US service personnel are entitled to free credit monitoring services as long as they are on active duty. If you have been denied credit – mortgage, credit card, car loan – for any reason, you are always entitled to another free credit report.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

MGM Resorts Data Breach Hackers Dump 10.6 Million Guest Records Online – What Should You Do to Protect Yourself

The sensitive personal data of over 10.6 million hotel guests who stayed at MGM resorts was found online this week. Personal details of 10,683,188 MGM hotel customers including home address, full name, phone numbers, email address, and birthdate was exposed. For another 1300 guests, the personal data included driver’s licenses, passports, or military ID cards. It was reported the singer Justin Bieber was one of the millions of victims. The data was hacked in July 2019. Hacking groups GnosticPlayers is believed to be responsible for the cyberattack.

The data breach happened last year. A statement to ZDNet, MG Resorts stated, “Last summer, we discovered unauthorized access to a cloud server that contained a limited amount of information for certain previous guests of MGM Resorts.”

There are over ten million names on the list with some very high-profile people who also had their data hacked. According to ZDNet, Twitter CEO Jack Dorsey, singer Justin Bieber, Department of Homeland Security officials, Military, as well as Transportation Security Administration (TSA) officials are among those impacted by the data breach. Hundereds of thaousands of people come to Las vegas not only for the gambling but because it a major center for conferences and trade shows.

Previous Hotel Data Breaches

The MGM data breach is only a fraction of the size of the Marriot hotels data breach. In 2018 Marriot announced they had discovered a data breach that stole the information of over 500 million hotel guests. The data was stolen from the Starwood hotel chain that Marriot had recently acquired.

Hotel WiFi is Always Hackable

Although it is tempting to connect to free WiFi connections while you’re away from home can be tempting to use to save on data. Travelers often want to text their friends that they’re arrived or post photos on social media. Employees feel the need to reconnect with their office as soon as possible. Logging into any account while using public WiFi is always risky. Security when using any public network like that at hotels in Las Vegas is non-existent. But this holds true for any public WiFi connection. Even the WiFi in your hotel room is not secure from hackers and traffic sniffing. When you are checking emails, posting on social media, or logging into any online account your usernames, passwords, and anything else you typed in can be easily intercepted by hackers. This includes all of the photos, texts, and videos you send in private messages sent from the phone.

For most of the victims, the data posted online about them includes information that can be found in many places online already so it may seem like no big deal. No financial, payment card, or password data was stolen in the data breach but that doesn’t mean customers money is secure. But this is a treasure trove of information for further cyber attacks including spear phishing emails. Hackers often begin cyberattacks by going after less sensitive data to build a database of information about victims. That information can be used to send email scams, phishing emails, for tax fraud, or steal victim’s identity. When a hacker has specific information about a target, they can use that to craft personalized emails that sounds more convincing. When the victim feels they know the email sender or the content sounds familiar, they are more likely to follow the action that the hacker wants them to take – click on a link, download a file, visit a scam website.

Hackers send phishing emails, using information like job title, travel history, and names, scammed in data breaches. Phishing emails and targeted spear phishing emails are an especially common way for scammers and to gain access to high-value online accounts – like bank accounts and credit cards. If a hacker can gain access to an email account stolen in a data breach, they can use the email to reset passwords on any account that is attached to the email address. Since many people reuse the same password across multiple online accounts, a stolen email and password combination from a hotle loyalty account, may let the hacker into multiple other accounts.

Practice Good Cyber Security Habits

1. Change your passwords – Change passwords for online accounts on a regular basis. Create a unique and strong password for each online account.
2. Use a Password App – It is estimated that the average internet user has over 200 online accounts and apps. Using a password app can save you from having to create or remember for each one. Passwords apps can be synced across laptops and phones.
3. Use Two-Factor Authentication – Use two-factor authentication to protect your apps and the data they contain. Two-factor authentication uses a second form of authentication – email, SMS text, phone call, key FOB – to confirm the identity if the user.
4. Use Biometric Login Information – Use two-factor biometric login to protect phones, laptops, and tablets. If your phone so old that it does not have facial recognition or fingerprint scanning, the it may be best to upgrade to a new one.
5. Set up credit monitoring – The people impacted by the MGM data breach may want to consider financial account monitoring and identity theft monitoring to protect themselves. Credit monitoring will tell if a new line of credit is opened using your name or if the limits on any of your credit cards has been increased.
6. Set up Identity Theft Monitoring – Identity theft monitoring can alert you to fraudulent activity that occurs using your stolen credentials – this can include fraudulent tax returns filed in your name or medical fraud which can leave you responsible for large medical bills.
7. Use an Antivirus App – Use an Antivirus App to Protect Your Laptop, Tablet, and Phone. Install a quality antivirus app BEFORE you need it. Paid subscriptions have the latest updates on recent malware.

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

Chinese Military Personnel Charged with Equifax Data Breach – China Denies Involvement

On Monday, the US Department of Justice (DOJ) released an indictment that charges four Chinese Military personal for their part in the massive 2017 Equifax data breach. The hackers are part of the Chinese People’s Liberation Army (PLA) 54th Research Institute. The indictment accuses four members of the Chinese People’s Liberation Army Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可), and Liu Lei (刘磊) with nine different federal charges.

According to the nine-count indictment from the DOJ, the defendants exploited Equifax’s Apache Struts Web Framework to gain access to the company’s computer system. The indictment also stated that, “In total, the attackers ran approximately 9,000 queries on Equifax’s system, obtaining names, birth dates, and social security numbers for nearly half of all American citizens.”

The hackers are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud. They are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud.

China has denied any involvement in the Equifax hack.

The hackers downloaded the names, dates of birth, and Social Security numbers for nearly half of United States citizens from of May 2017 to July 2017. They routed their traffic through some 34 servers in 20 different countries. Routing traffic through servers and in a multitude of countries helps avoid detection by modern security algorithms and hardware. Log files were erased nightly so as not to expose the large volumes of data being transferred off Equifax servers.

Although it is disturbing that state-sponsored hackers from China, or any hackers at all, have stolen the data of millions of people, many feel that is better than alternatives. PLA’s 54th Research Institute is generally not in the hacking business to make money from stolen payment information or identity theft. The hacking group’s main focus is espionage and corporate secrets.

Recently WaWa convenience stores suffered a massive breach of their point of sale terminals at all 825 locations including their fuel pumps. The data breach also carried on over a period of many months – from 04 March 2019 to 12 December 2019. Just last month the first group of 30 million payment cards turned up for sale on dark web marketplace Joker’s Stash. Hackers buy card numbers or physical cloned cards to use them for purchases or to sell to other buyers. Any payment card used at WaWa last year should be replaced with a new card and new set of numbers. All bank and credit accounts should be monitored for suspicious activity.

Richard Smith, Chairman and CEO of Equifax stated, “This is clearly a disappointing event for our company and one that strikes at the heart of who we are and what we do.” He then apologized.

Regardless of weather or not the PLA or any other hackers breached Equifax’s IT system, the company itself shares responsibility for not securing their servers, network and highly personal data with best cyber security best practices. According the court documents from a class action lawsuit filed by shareholders, Equifax IT staff used the incredibly weak username admin and the password admin as credentials for a web portal used for credit disputes. Equifax also stored sensitive personal data on public-facing unencrypted servers.

In March 2018, Equifax filed a motion to dismiss the lawsuit, but ultimately settled with the FTC for $425 million in September 2019.

What is the PLA 54th Research Institute?

The People’s Liberation Army 54th Research Institute is ostensibly part of the General Staff Headquarters Department and is responsible for Signal and Electronic Intelligence (SIGINT and ELINT respectively) gathering. The 54th Research Institute is part of the Strategic Support Force whose task is to support PLA combat units through nontraditional means, such as hacking into enemy communications, stealing plans, and disrupting lines of communications.

This is not the first time the United States has accused PLA personnel of hacking into US companies. In 2014 another DOJ indictment accused 2014 five PLA officers of corporate espionage for hacking into private companies in Pennsylvania and Oregon – related to steel, solar, and nuclear power industries. In one instance, a nuclear power plant manufacturer negotiating to build power plants in China was hacked by the PLA. Stolen were corporate communications related to business strategy and vulnerabilities as well as design specifications.

What Happened in the Equifax Data Breach?

The Equifax data breach occurred over a period of months from mid-May 2017 until Equifax discovered the data breach on July 29. Hackers accessed Equifax servers and stole the sensitive information of millions of people. About 147.9 million Americans had their Social Security numbers stolen. Payment card information (credit cards and debit cards) for approximately 209,000 U.S. consumers were hacked. The data of 700,000 UK consumers as well as consumers in Canada was also hacked.

Former Equifax Manager, Sudhakar Reddy Bonthu plead guilty to insider trading and was convicted by The US DOJ. The former web portal manager was sentenced to eight months of house arrest and fined $50,000. Bonthu was ordered to forfeit $75,979 in profits gained as a result of the illegal trades.

Who Was Affected by the Equifax Data Breach?

About 147 million people were affected by the Equifax data breach. To see if you were affected:

1. Check to see if your information was hacked. Go to the webpage Equifax set up to check https://eligibility.equifaxbreachsettlement.com/en/Eligibility
2. Visit www.EquifaxBreachSettlement.com for information
3. Order a get free copy of your credit report from all three major credit bureaus, including Equifax, at www.annualcreditreport.com
4. If you see something suspicious freeze your credit, order new payment cards, and set up identity theft monitoring

All of the preparedness and restitution for victims of data breaches assumes that sensitive personal information is stolen for the purposes of identity theft. But there are other reasons for stealing the personal information of others. Corporate espionage is one of them.

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/