Content by Mathew J. Schwartz

Tesco Bank Hit With £16 Million Fine Over Debit Card Fraud

Mathew J. Schwartz  •  October 2, 2018

Tesco Bank has been hit with a £16.4 million ($21.3 million) fine by the U.K.'s Financial Conduct Authority for failing to prevent and more rapidly block thousands of fraudulent transactions that drained £2.3 million ($3 million) directly from customers' bank accounts.

Facebook Breach: Single Sign-On of Doom

Mathew J. Schwartz  •  October 2, 2018

While Facebook has invalidated 90 million users' single sign-on access tokens following a mega-breach, researchers warn that most access token hijacking victims still lack any reliable "single sign-off" capabilities that will revoke attackers' access to hyper-connected web services and mobile apps.

Facebook Breach: Attackers Exploited Privacy Feature

Mathew J. Schwartz  •  October 1, 2018

Facebook says that whoever hacked 50 million user accounts, putting the privacy of those users' personal data at risk, did so by abusing its "View As" privacy feature. Facebook says the attack successfully targeted three separate bugs in its video-uploading functionality.

Facebook Submits GDPR Breach Notification to Irish Watchdog

Mathew J. Schwartz  •  October 1, 2018

To comply with GDPR, Facebook has notified Ireland's data privacy watchdog about the massive breach it has suffered, resulting in 50 million accounts being exposed. But Irish authorities have signaled that Facebook has failed to share all of the information they would have expected to see.

Ransomware Crypto-Locks Port of San Diego IT Systems

Mathew J. Schwartz  •  September 28, 2018

Several days after the Port of San Diego was hit by a crypto-locking ransomware attack, incident response efforts remain underway and many port systems remain offline. Port officials say the attacker has demanded a ransom, payable in bitcoin, for the promise of a decryption key.

Uber Reaches $148 Million Breach Settlement With States

Mathew J. Schwartz  •  September 27, 2018

Ride-hailing platform Uber Technologies has reached a $148 million settlement agreement with the attorneys general of all 50 states and the District of Columbia over its failure to report a massive 2016 data breach in a timely manner, as well as its inadequate information security practices.

GDPR: Data Breach Class Action Lawsuits Come to Europe

Mathew J. Schwartz  •  September 26, 2018

Breached businesses in Europe: Brace for more class action lawsuits seeking material and non-material damages filed by victims following mandatory data breach notifications under GDPR, says attorney Jonathan Armstrong. He predicts more breach-related suits will succeed in Europe than in the United States.

Scan4You Operator Gets 14-Year Prison Sentence

Mathew J. Schwartz  •  September 25, 2018

Scan4You, a notorious cornerstone of the cybercrime-as-a-service economy that allowed malware developers to more easily create code to bypass anti-virus defenses, has been dismantled, and its Latvian technical administrator has been slammed with a 14-year U.S. prison sentence.

Why Was Equifax So Stupid About Passwords?

Mathew J. Schwartz  •  September 24, 2018

Massive, well-resourced companies are still using live customer data - including their plaintext passwords - in testing environments, violating not just good development practices but also privacy laws. That's yet another security failure takeaway from last year's massive Equifax breach.

Cybercrime Markets Sell Access to Hacked Sites, Databases

Mathew J. Schwartz  •  September 21, 2018

One mystery with the recently discovered payment card sniffing attacks against such organizations as British Airways and Newegg has been how attackers might have first gained access to the victims' networks. But a number of cybercrime markets sell such access, in some cases for as little as 50 cents.

Scotland's Arran Brewery Slammed by Dharma Bip Ransomware

Mathew J. Schwartz  •  September 21, 2018

Scotland's Arran Brewery fell victim to a Dharma Bip ransomware attack that infected its Windows domain controller and crypto-locked files and local backups, leading to the loss of three months' worth of sales data. The brewery refused to pay the attackers' two bitcoin ransom demand.

Equifax Hit With Maximum UK Privacy Fine After Mega-Breach

Mathew J. Schwartz  •  September 20, 2018

Credit bureau Equifax has been hit with the maximum possible fine under U.K. law for "multiple failures" that contributed to its massive 2017 data breach, including its failure to act on a critical vulnerability alert issued by the U.S. Department of Homeland Security.

Cybercrime: 15 Top Threats and Trends

Mathew J. Schwartz  •  September 19, 2018

Criminals operating online continue to target cryptocurrencies, leverage phishing and other social engineering attacks, as well as tweak age-old scams - including Nigerian prince emails - for the modern age. So warns Europol in its latest Internet Organized Crime Threat Assessment.

Yahoo's Mega-Breaches: Altaba Moves to Settle Lawsuits

Mathew J. Schwartz  •  September 18, 2018

Lawsuits sparked by massive data breaches at Yahoo - and the company's failure to report those breaches to investors in a timely manner - could soon be resolved. Plaintiffs and defendants say they have committed to a $47 million deal that they expect to submit for court approval within 45 days.

Why Cybercrime Remains Impossible to Eradicate

Mathew J. Schwartz  •  September 18, 2018

More evidence that running cybercrime schemes remains inexpensive and accessible to anyone with criminal intent: To send spam emails, admitted botnet herder Peter Levashov quoted customers $500 for 1 million emails. And that was just his 2016 pricing.