Search the Community

I have signed up to some service via a Credit score monitoring provider here in the UK (ClearScore). They offer a service where they apparently scan the Dark Web and it highlights all leaked passwords, addresses, emails and accounts that have been posted. At first, I got it as a prevention thing as it was only £5 a month, but after 1 search, it came back with like 8+ different groups of leaked information. I was sceptical, but it literally shows you the EXACT password that has been leaked (so in other words, information that ClearScore couldn't have known). I was mind blown. Of course, my passwords being leaked are from websites/apps that appear to have had some sort of data breach in the past and a couple of unknown sources. This is not the part I am concerned or amazed at though. What is shocking me is that this leaked information can be scanned and instantly found on the Dark Web. 1.) This means that my information is PUBLICLY available somewhere on a random Dark Web site. - Why? What purpose would someone have to PUBLICLY release information to others unless they are a HVT? I understand blackhat and alike buy and sell information, like "CC FOR SALE" etc, but they have no motive to distribute the info for free unless it's to sabotage a company (which I highly doubt). I don't understand how ClearScore would have been able to obtain this information unless it was public. 2.) Even if it was public, it is probably contained on a spreadsheet or similar document with probably thousands of other leaked users. If ClearScore can identify leaked information this easily, surely they would report back to where the leak came from and the source would invest some resources into getting the data removed. Data Protection and GDPR is really big these days and the fines can be in the millions. I'm no web dev, but surely you could pay a top-tier security team £100K or something to find the storage location of the information and get it removed. Would love to hear comments from a data security expert or similar.

Summary RansomHouse, a newly established group aimed at monetizing stolen data, claims to own more than 450 Gb of data coming from AMD. It is claimed that the leaked AMD data contains network files, system information, and AMD passwords. At this time it’s not clear if the data was taken directly from AMD or one of its partners. The actual hack happened back in January of this year, but we’re just now learning about it. Quotes My thoughts This is an interesting breach because AMD got back to Tom's Hardware and claimed that the group is a "bad actor", implying that they aren't in possession of any data and the claim is rubbish implying that the organization is responsible for harmful/illegal actions, and AMD will investigate the claims made by them. I think it's also amusing that they are claiming AMD had poor security practices like using "password" as their passwords. RansomHouse has had a history of other victims, including: Gaming Authority (SLGA), Saskatchewan Liquor, and ShopRite. RansomHouse only materialized in December of 2021 and started establishing an extortion market in May of 2022. Tom's Hardware and TechRadar says they will continue to update the story as it develops; so if any new information comes along I'll update the OP and thread. Sources https://www.tomshardware.com/news/amd-purportedly-targeted-by-ransomhouse-extortion-group-450gb-of-data-stolen https://www.techpowerup.com/296573/amd-is-investigating-a-potential-450-gb-data-breach https://www.techradar.com/news/amd-is-investigating-a-serious-potential-data-breach https://www.extremetech.com/computing/337537-amd-looking-into-alleged-data-theft https://techcrunch.com/2022/06/28/amd-extortion-ransomhouse/

UPDATE: Other three data breach, Indihome (20th August GMT+7) and police data (Yesterday, GMT+7) Summary Another data breach coming from Indonesia, this time it's state owned electricity company (Perusahaan Listrik Negara). Reportedly PLN have over 17M consumer data breached, that includes SSN, consumer ID and address, power meter number, and even KW/h number. In other breachforum post, Indonesian branch of big companies also have 347GB of their data leaked, separated into standard (companies with revenue under $50M) and big (revenue >$50M). Examples include Microsoft Indonesia branch, AT&T Indonesia branch, China State Construction Engineering Corporation, China Railway Group Ltd, McKinsey Indonesia branch, Huawei Tech Investment and Prudential Life Assurance. Leaked data includes numerous ID, license and certificates, transaction records, and more. Quotes My thoughts I have zero hopes and expectations to be honest. If you saw the news about the entire PSE registration thingy you know cybersecurity in here is already that bad, that even state owned websites can be breached in just a few hours. No doubts it also going to even affects companies in Indonesia, and now here we are, again with data breach from not only state owned company but also Indonesian branch of big companies, and it even includes big tech names like Microsoft and AT&T. At this point not even Data Privacy law (that somehow even to this very second never gets passed) can save us I guess, it's just way too late Sources https://www.cnbcindonesia.com/tech/20220819121855-37-365025/data-pelanggan-pln-diduga-bocor-ini-kata-kominfo https://www.jagatreview.com/2022/08/data-perusahaan-indonesia-bocor-di-situs-gelap/ Nuice Media:

Hello, I will start this with some backstory of the event that happened. In the morning I powered on my PC and discord has automatically logged me out (I'm usually logged in automatically) and for my 5-6 years of using discord it has never logged me out. At first I thought nothing of it, later on I received an email from google that someone knows my password and I should change it, they said my password appeared in a non google data breach. This concerned me and also answered my question about my discord however although my email and discord emails are the same they do not share the same passwords. Overall I still didn't think too much of it, just a data breach, happens all the time now so i just changed my password and didn't think about it again. Later on in the day I discovered with conversations with my family that my mother, father and sister's email all had the same email from google that someone knows their password and should change it, also the email was sent near around the same time as each other. What worries me here is that this seems targeted, I mean obviously all our passwords are different, and the thing is that my email that was hacked is kind of a email I don't use, like I think I only signed up to discord and one other thing with it and that's it so I don't know where the data breach with my details are. Because even if it came from discord or the other website I used to register my email with, my other families members 100% haven't signed their emails to that service. This is all assuming that our details were involved in a non google data breach, since google told us this. Anyways, I just wrote this looking for answers, what happened, how could of this happened, is this a targeted attack against me and my family? I don't know why it would be, were not important or anything. Some extra details, when i was trying to find a common link to come up with an explanation, the thing that connects our emails together is that my mothers email that got hacked has emailed my email that got hacked and she has also emailed all my other family members who's emails got hacked. But my email (the one that got hacked) the last time she emailed me was a very long time ago and she has since been emailing my main email(the one that hasn't been hacked) Although this theory has holes in it since it doesn't explain how they knew all our passwords since they are all different. (this is also assuming that this is in fact how they found our emails) If you need any other details please ask, i want to get to the bottom of this. Thanks.

A group of internet researchers possibly have discovered a large list of emails used to spam people with messages, possibly originating from data breaches such as the LinkedIn breach in 2012/ SOURCE: Canadian Broadcasting Corp. (http://www.cbc.ca/news/technology/record-spam-list-1.4268167) The researchers believe that the list is used to deliver spam and/or possibly malware to the affected emails. The list was discovered by a spambot server in the Netherlands, that possibly contained a list of up to 711 million emails and passwords. Although there's a high amount of recorded emails, an internet security blogger, Tory Hunt, notes that some or most of those emails are just fake or inactive emails. The spambot was used to transmit malware to the victim's PCs and collect personal and possibly bank info to the perpetrator. If you want to check if you are a victim of this, please check https://haveibeenpwned.com/. And maybe, we should advise you to change your passwords... or take a Google security audit, but I'm not the boss of you.

Hot off the press. This is rather disappointing. Source: CNET Looks like the hacker is quite impatient and wanted to know what will happen next. But 1.5TB of company data? That could be anything other than scripts like unedited footages or even company data. So at the moment, if you'll ever stumble upon leaked episodes, don't watch it just yet and wait for the rest of us. To be honest, I'm not really a big fan of the show until last year after excessive persuasion from a friend. I'm wondering now what are the rules set within HBO's firewall that a data breach happened. ¯\_(ツ)_/¯

So I have two email accounts; one is a personal yahoo and the other is a work gmail. I want to make a whole new gmail that's just for personal like my yahoo but don't know how to get all my emails to the new account. I know I can just set up email forwarding but that wont help if I delete the yahoo account. I am going to transfer all the old emails to the gmail later today. My question is, is there some way to get all the sites that email me to send it to a new email address without going to each site and giving them my new account info? I found this link https://support.google.com/mail/answer/56283?hl=en that tells me how to get all the old emails to my new account but i don't know if any new ones will come if I delete the yahoo once the transfer is complete. Does anyone have an words of advice?

https://www.forbes.com/sites/daveywinder/2019/08/05/cafepress-hacked-23m-accounts-compromised-is-yours-one-of-them/#68e12789407e Thanks to https://haveibeenpwned.com/ for bringing this to the attention of previous CafePress.com customers. CafePress has not released an official statement about the supposed data leak but HIBP has an excellent track record of reporting legitimate breaches. Personally, I haven't used CafeExpress since 2008 and I'm shocked that any data I generated there would still be available today (if the breach was recent and not years ago). What's the point of harvesting data for that long?

Some real bad juju here. Someone is going to be loosing their job and ODS is going to be in a world of hurt. From some other news articles on this. It also looks like this leak basically allowed anyone to download government files. Source ZDNet Original article from Upguard

500px, a photo sharing website has had a data breach It seems that there was a flaw and then they realised that there was a breach It seems like that there will be law enforcement teams on this issue, Something I, personally, haven't seen this happen with any other data breaches They say that they've already fix this flaw Personally... Its normal, its normal for data breaches to happen... I have no words really other than Sources from: 500px Support PetaPixel The Verge of failing to build a PC

SOURCES: https://www.cnet.com/news/words-with-friends-hack-reportedly-exposes-data-of-more-than-200m-players/ https://haveibeenpwned.com/ https://www.pcworld.com/article/3173791/stop-using-sha1-it-s-now-completely-unsafe.html Another day, another large organisation suffers a massive data breach. This time it's our friends at Zynga. A hacker name Gnosticplayers has taken responsibility saying they stole data from 218 million Words with Friends player accounts in September 2019. Per CNET: Per HaveIBeenPwned: HIBP also ranks the Zynga data breach in the top 10 largest data breaches it's come across. I'd recommend anyone who isn't using HaveIBeenPwned to start, it's a great way to learn about what data breaches are occuring across the world and if you are personally affected. My Thoughts: I don't know what to say really. These types of breaches are becoming all too common place. SHA-1 is an older standard of encryption and shouldn't be used nowadays. At least Zynga recommended 'some users...to change their passwords'. It seems like things are bound to get worse before they get better.

In a disappointing decision on December 27, 2018 BC court ruled to dismiss the Class Action lawsuit filed against the NCIX, its landlord and the company responsible for auctioning off the old equipment. The original lawsuit was stayed because NCIX was bankrupt. The Judge in the case refused to grant leave for the plaintiff to sue the trustee, Bowra Group, citing 'unreliable' proof of data breach. The Judge in the case had cited a significant number of deficiencies in the evidence presented amounting most of it to hearsay and belief (as not fact). At the same time, an RCMP case opened to investigate the breach was closed without charges being recommended. The plaintiff's lawyer had intended to proceed with a modified version of the proposed class action against the auctioneer and NCIX's landlord. However, due to the ruling by the judge, it would not be possible to submit a modified case, saying he "has not acknowledged any deficiencies" in his evidence. https://www.cbc.ca/news/canada/british-columbia/court-blocks-class-action-against-bankrupt-computer-firm-citing-unreliable-proof-of-data-breach-1.4964076

A popular MMORPG Guild Wars 2's developer decided decided to include a spyware in one of its build to list and hash all running process on your PC and send back ALL the information silently and if any of the hashes matched a potential cheating software, you would get banned. Even if the program wasn't interacting with the game in question. The initial reddit post about this (with a huge deal of information of how exactly they do it) can be found here. My thoughts; This is a huge concern but not so much about data leakage, rather than the fact that they are repeatedly hashing and collecting information client side and then sending all of the data to server side, which puts a huge strain on network and resources specially if you aren't using SSDs. furthermore, sending so much data that is pretty much irrelevant to your own program can be considered as a breach of privacy. Plus the fact that, if a person is using for example CheatEngine for a different game, and its running in the background, and the spyware sees it, its just going to assume you were cheating in the primary game and ban you, which is BS considering you paid for a game and got banned for having a potential cheat software even installed on your device. A better way to do this would be to collect information and compare it with a list of hashes client side and send over only anomalies. this method is used by almost every other game anti-cheat system. Sending over process lists and memory dumps to some server online without even notifying the user is BAD PRACTICE. WoW's anti-cheat does this as far as I know. What are your thoughts on this? do you guys think such an aggressive and intrusive tactic should be okay if it means just catching cheaters?

source: https://oag.ca.gov/system/files/Customer Notice Letter - California_0.pdf? via: http://www.channelregister.co.uk/2016/06/17/what_a_pain_in_the_acer/ if you bought anything from ACER's online shop between May 2015 and April 2016, you might wanna check your bank account for suspicious activity these fucking retards failed to protect people's data and someone got customer names, credit card number and the fucking three digit security code ACER hasn't revealed how many customers had their details stolen

All of these data breaches are getting really tiresome, something in the world of network security is going to have to drastically change before we can have nice things like self-driving cars and etc. http://www.wbir.com/story/news/local/2014/08/18/community-health-systems-data-breach-affects-45m/14230939/ "Franklin-based hospital company Community Health Systems Inc. had a data breach that affected an estimated 4.5 million patients." "CHS, which worked with cybersecurity company Mandiant to help address the threat, said that the data affected in the breach is non-medical, but does include sensitive information such as patient names, addresses, birthdates, telephone numbers and Social Security numbers." -Don't worry guys, they didn't get medical data, just SSN, DOBs, names, addresses and etc

Summary Intel suffered a massive data breach earlier this year and as of today the first associated data has begun being released. Some users are reporting finding hardcoded backdoors in the intel code. Some of the contents of this first release (There will be further releases) - Intel ME Bringup guides + (flash) tooling + samples for various platforms - Kabylake (Purley Platform) BIOS Reference Code and Sample Code + Initialization code (some of it as exported git repos with full history) - Intel CEFDK (Consumer Electronics Firmware Development Kit (Bootloader stuff)) SOURCES - Silicon / FSP source code packages for various platforms - Various Intel Development and Debugging Tools - Simics Simulation for Rocket Lake S and potentially other platforms - Various roadmaps and other documents - Binaries for Camera drivers Intel made for SpaceX - Schematics, Docs, Tools + Firmware for the unreleased Tiger Lake platform - (very horrible) Kabylake FDK training videos - Intel Trace Hub + decoder files for various Intel ME versions - Elkhart Lake Silicon Reference and Platform Sample Code - Some Verilog stuff for various Xeon Platforms, unsure what it is exactly. - Debug BIOS/TXE builds for various Platforms - Bootguard SDK (encrypted zip) - Intel Snowridge / Snowfish Process Simulator ADK - Various schematics - Intel Marketing Material Templates (InDesign) - Lots of other things Quotes My thoughts I hope this leads to more understanding about the internals of the Intel ME. Last few years have shown that it’s a tremendous security liability, and the best way to mitigate this is if we all get a better understanding of how it works. Update: They used the password Intel123. They probably deserved it. Sources (Original tweet and TH link) https://twitter.com/deletescape/status/1291405688204402689 https://www.tomshardware.com/news/massive-20gb-intel-data-breach-floods-the-internet-mentions-backdoors

A data breach of 1,500 sites that did not implement HTTPS has surfaced. The leaked information includes emails and passwords in plain text. More than 2 GB of .txt files containing user credidentials were freely available on http://www.pxahb.xyz . The breach has probably occured in December 2017, judging by the files' date of creation. I can't provide you with the full list of affected websites, but there are no "big ones" amongst them(e.g. Google, Yahoo, Amazon, etc.) as they all implement HTTPS correctly. The website has been taken down, but I found some url reports that contain screenshots: Report 1 Report 2 There is no information about the breach in mainstream media, the only coverage that I could find is a YouTube video from the (fairly) popular Linux youtuber Quidsup. He is a reliable source when it comes to computer security/privacy and related topics(btw he works as a malware analyst). I will try to update the topic if any new information appears. However, the leaked data still shows that people are not very creative when it comes to passwords, phrases like "123456" and "password" are common. But the ones to blame are the people who maintain those websites. Having a login page on your website in 2018 and not having HTTPS enabled is a complete suicide - sniffing HTTP traffic can be done by anyone skilful enough to power on a computer. SSL certificates are not expensive to obtain, and certificate authorities such as Let's Encrypt give them out for free. There is literally no excuse for not having HTTPS on your website. Update: Thanks to Google's cache we have part of the list of affected websites: https://webcache.googleusercontent.com/search?q=cache:lITAZhUWlk4J:pxahb.xyz/emailpass/+&cd=2&hl=en&ct=clnk&gl=en