(In)secure digest: lawsuit for leaks, insidious phishing and record leak of personal data
29.07.2022
Back to blog listBeseech to reimburse
Situation:
Gaming equipment manufacturer Razer filled in a claim against IT-solutions provider Capgemini due to clients’ data leak.
Case study:
Two years ago confidential - data concerning more than 100,000 Razer clients - was exposed. Company officials stated that sensitive data on credit card numbers and passwords didn’t leak. However, order details, customer and shipping information was freely available. Razer top-managers blamed Capgemini employees to be culprits of the incident, as their actions had led to a security misconfiguration. The security problem remained unsolved for three months, from June to September 2020. Razer estimated losses and expenditures as of at least US$7 million.
Phishing is so insidious
Situation:
Roblox Corporation internal documents leaked due to employee’s actions.
Case study:
Cyber criminals gained access to a trove, containing 4 GB of Roblox internal documents and lately attempted to blackmail the corporation. Roblox Corporation management decided not to pay ransom, so hackers published stolen documents.
The revealed data contained information about some biggest games and their creators, including email addresses, accounts and various spreadsheets. After an external investigation was conducted, it turned out, that one employee fell victim to phishing. According to the official statement by the company, the data was published by extortionists. However, can we really be convinced, that an insider wasn’t involved?
This isn’t the first case of Roblox data leak. In 2020 a hacker bribed an employee. Due to insider’s actions the intruder gained access to personal data of more than 100 million users of a popular online videogame, he could also reset passwords and ran amok in accounts.
Hello, hi!
Situation:
Cybercriminals attempted to attack European Central Bank President Christine Lagarde, however no information was compromised.
Case study:
The Bank President received a text message from a phone number, which was used by the former German Chancellor Angela Merkel. An unknown person stated in the message, that the former Chancellor would like to communicate via messenger. The Bank President suspected that something was wrong and decided to phone Merkel in order to specify, if she really wanted to communicate via messenger. The news portal Business Insider claims, that intruders attempted to hack the mobile device. The European Central Bank officials hasn’t provided any comment on the incident.
Leaks – the everlasting issue?
Situation:
Marriott International experienced a data leak again. This time, an employee was the culprit of the incident. Starting from 2010 it’s already the seventh time when hotel giant faces data compromise incident.
Case study:
Marriott representatives stated that a hacker implemented social engineering method. The intruder forced an employee of one hotel to share access to the employee’s PC.
After the hack was completed, the intruder tried to shakedown, however, Marriott managers declined to pay the ransom. According to the official statement, the biggest part of the stolen data primarily contained non-confidential internal business files. Nevertheless, Marriott informed approximately 400 people, whose personal data was compromised. According to DataBreaches, the hacker managed to access a trove of 20 GB of data, containing some credit card data and confidential information.
During the period from 2010 on Marriott has experienced at least seven data leaks, one of them concerned 383 million guests’ data and has led to a $100 million class-action lawsuit and £18 million penalty.
“Holey” server
Situation:
Shanghai authorities arranged a meeting with Alibaba Cloud executives to discuss the details of a data leak, due to which 23 TB. of data were uploaded in darknet for sale.
Case study:
Last month a hacker gained access to Shanghai police archive, containing confidential data of approximately one billion of Chinese citizens. The cybercriminal tried to sell the database, the price was set at $200.000.
Due to the leak, the hacker gained access to the data: names, home addresses, ID numbers, phone numbers. Later experts confirmed that the compromised data was stored on Alibaba cloud servers.
Currently, it’s believed, that the data breach originated from the misconfigured cloud server.
What's the big deal, it's just a leak
Situation:
Due to the hack of sites for travel bookings, intruders gained access to data on 300.000 of Israeli residents.
Case study:
Hackers attacked Gol Tours LTD tour operator, owning more than 20 travel booking sites. Due to the incident, such data as phone numbers, addresses, dates and places of booked vacations, as well as confidential medical information was exposed.
Israel’s Privacy Protection Authority claimed to get in touch with the CEO of the company in order to eliminate security-related problems. However, the Head of the company declined to cooperate. The authorities also claimed that Gol Tours LTD owner declined to eliminate the “security hole”, because it would cost a fortune. Later, Israel’s Privacy Protection Authority confiscated the servers of the travel company and blocked their websites. Gol Tours LTD owner didn’t consider himself guilty and said that the hackers managed to access “only” names and phone numbers, but not the financial information.
It’s worth noticing that the data leak happened soon after Israeli companies received a direction by government to strengthen information security protection, due to increased amount of hacker attacks.
