Content by Mathew J. Schwartz

Superdrug Rebuffs Super Ransom After Supposed Super Heist

Mathew J. Schwartz  •  August 22, 2018

U.K. health and beauty retailer Superdrug Stores is warning customers that attackers may have compromised some of their personal information, apparently because they'd reused their credentials on other sites that were hacked. While Superdrug quickly notified victims, it stumbled in three notable ways.

Facebook, Twitter and Google Suspend 'Inauthentic' Accounts

Mathew J. Schwartz  •  August 22, 2018

Facebook, Twitter and Google have suspended or removed hundreds of pages and accounts tied to two separate alleged influence operations being run by Iran and Russia. Cybersecurity firm FireEye says the campaigns target the U.S., U.K., Latin America and Middle East.

Google Hit With Lawsuit Over Location Tracking

Mathew J. Schwartz  •  August 21, 2018

A lawsuit accuses Google of "the surreptitious location tracking of millions of mobile phone users." The legal action was sparked by a report demonstrating that some Google apps tracked and time-stamped users' locations even if a user deactivated the "location history" setting.

Microsoft Uncovers Fresh Russian Attack Infrastructure

Mathew J. Schwartz  •  August 21, 2018

With the U.S. midterm elections approaching fast, Microsoft says it's seized six domain names tied to "Fancy Bear," a hacking team widely believed to be part of Russia's military intelligence agency, amplifying concerns that Moscow's election interference efforts continue.

Crypto Wars Continue, as Feds Seek Messenger Backdoor

Mathew J. Schwartz  •  August 20, 2018

It's déjà vu "FBI vs. Apple" all over again, as Reuters reports that the Justice Department is seeking to compel Facebook to build a backdoor into its Messenger app to help the FBI monitor an MS-13 suspect's voice communications.

Australian Teenager Pleads Guilty to Hacking Apple

Mathew J. Schwartz  •  August 17, 2018

An Australian teenager was such a fan of Apple that he hacked into the technology giant's mainframe, according to media reports. The teen has pleaded guilty to stealing 90 GB of sensitive information. But Apple says no customers' personally identifiable information was exposed.

Bitfi Gets Pwnies Award for 'Lamest Vendor Response'

Mathew J. Schwartz  •  August 9, 2018

Hubris has a new name: Bitfi. The cryptocurrency wallet-building company, backed by technology eccentric John McAfee, earned this year's not-so-coveted Pwnies Award for "Lamest Vendor Response" for how it mishandled security researchers' vulnerability disclosures. Bitfi has promised to do better.

Political Play: Indicting Other Nations' Hackers

Mathew J. Schwartz  •  August 8, 2018

Espionage: Every nation does it. But for nation-state hacking that targets intellectual property or interference in political affairs, the U.S. has been using criminal indictments against individuals as a diplomatic way of saying: "We see what you're doing, now knock it off." But does it work?

The Art of the Steal: FIN7's Highly Effective Phishing

Mathew J. Schwartz  •  August 7, 2018

The FIN7 cybercrime gang regularly phoned victims, posing as buyers, to trick victims into opening phishing emails and attachments with malware, federal prosecutors allege. The group's success - 15 million stolen payment cards and counting - is one measure of how difficult these types of attacks are to block.

Atlanta's Reported Ransomware Bill: Up to $17 Million

Mathew J. Schwartz  •  August 6, 2018

The cost of the city of Atlanta's mitigation and subsequent IT overhaul following a massive SamSam ransomware infection in March could reach $17 million, of which $6 million has already been budgeted for new devices, security enhancements as well as upgrades, according to news reports.

Salesforce Security Alert: API Error Exposed Marketing Data

Mathew J. Schwartz  •  August 3, 2018

Cloud-based CRM giant Salesforce.com is warning some of its Marketing Cloud users that any data they stored may have been accessed by third parties or inadvertently corrupted because of an API error that persisted for six weeks.

Reddit Says Attackers Bypassed SMS-Based Authentication

Mathew J. Schwartz  •  August 2, 2018

Reddit suffered a data breach in June after attackers managed to bypass its SMS-based two-factor authentication system. User data from 2007 and before was compromised. Security experts say the breach should serve as a reminder that using any two-factor authentication is better than none.

Russian Carder Tied to $4 Million in Fraud Sentenced

Mathew J. Schwartz  •  August 1, 2018

Russian national Mikhail Malykhin, who was illegally residing in the U.S., has received a 70-month prison sentence after admitting to hack attacks and conspiring to use fraudulent debit cards issued via a hacked healthcare benefits administrator.

Facebook Reveals Ongoing Political Influence Campaigns

Mathew J. Schwartz  •  August 1, 2018

Facebook has suspended eight pages and 24 accounts for "coordinated inauthentic behavior" tied to apparent political influence campaigns ahead of an event in Washington. While Facebook declined to attribute the activities to specific individuals or groups, U.S. lawmakers are blaming the Kremlin.

Dixons Carphone: 10 Million Records Exposed in 2017 Breach

Mathew J. Schwartz  •  July 31, 2018

Struggling European electronics giant Dixons Carphone says its investigation into a 2017 data breach has found that 10 million customers' personal details - up from its previous estimate of 1.2 million - were compromised. It previously reported that 5.9 million payment cards were also compromised.