Some TurboTax Accounts Were Hacked Due To Poor Passwords

Hackers around the world have been busy this year, with Intuit being the latest company to fall victim to data breach.

The TurboTax company recently announced that their network was breached following a series of account takeover attacks, and that as a consequence, an undisclosed number of Turbo Tax customers had their personal data compromised.

The company stressed that this breach was not a consequence of failed network security on their part, but rather, bad password practices in use by some of their customers.

The way an ATO (Account Take Over) attack works is this: A customer is in the habit of using the same password on multiple sites. A hack occurs on another site that the customer uses, and his password there is exposed.

Knowing that many people reuse passwords, hackers attempt to use the passwords they glean from one cybersecurity breach on accounts for other sites, hoping to get lucky. In many cases, they do. That's what happened here.

 

Call Now

 

Although the number of impacted accounts seems disturbingly large, the reality is that Turbo Tax serves over 100 million customers a year. So the impacted accounts represent a tiny fraction of the total. Granted, that's small consolation for those who have had their data compromised, but understanding how it happened and the context of the scope and scale is still important.

Now for the bad news: If your account was compromised, the hackers likely made off with information like your tax returns for prior years, your current tax return, your social security number, date of birth, driver's license number, and a wide range of financial information. Put another way, the hackers now have in their possession, everything they need to steal your identity and/or make your life a living hell. Be careful and check your credit report regularly for the next few months.

 

Call SpartanTec, Inc. now if you need help in boosting your cybersecurity strategy to lower your risk of data breach.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Bose Is Latest Company To Have Employee Data Breached

Bose is the latest in an unending parade of major companies to disclose that they've been the victim of a ransomware attack. In the company's data breach notification letter, they indicated that they first detected the incursion on March 7th, 2021, with the attack itself having occurred on April 29th.

Additionally, as is quite common in these cases, the company indicated that they immediately began working with both law enforcement and a third-party cybersecurity agency to continue the investigation. According to the official notification, Bose did not pay the demanded ransom, and was able to restore their corporate network to full functionality with minimal disruption to the company's business operations.

In terms of scope and scale, the company identified a small number of individuals whose data was impacted and notified everyone who was affected by mail. Based on the forensic analysis, the company determined that the files accessed by the hackers contained personal information related to an unspecified number of current and former employees, including names, social security numbers, salary, and other HR-related information.

 

Call Now

 

In the aftermath of the attack, Bose took the following steps to further bolster their security:

• Enhanced malware/ransomware protection on endpoints and servers to further enhance our protection against future malware/ransomware attacks.
• Performed detailed forensics analysis on impacted server to analyze the impact of the malware/ransomware.
• Blocked the malicious files used during the attack on endpoints to prevent further spread of the malware or data exfiltration attempt.
• Enhanced monitoring and logging to identify any future actions by the threat actor or similar types of attacks.
• Blocked newly identified malicious sites and IPs linked to this threat actor on external firewalls to prevent potential exfiltration.
• Changed passwords for all end-users and privileged users.
• And changed access keys for all service accounts.

The bottom line is, although unfortunate, the company's handling of the incident has been commendable. We just hope that the day comes when there won't be quite so many stories like this one.

 

Call SpartanTec, Inc. now and let our IT support professionals to set up the most effective cybersecurity strategy to keep hackers at bay.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

SolarMarker Malware Stealing User Information Through PDFs

The hackers behind the malware called SolarMarker have begun using an innovative and unexpected means of distributing their poisoned code.

They've started publishing PDF documents filled with SEO (Search Engine Optimization) keywords in a bid to boost the visibility of malicious websites that pose as Google Drive, but in fact, are simply repositories for the malware itself.

A potential victim may get an email containing a PDF promising detailed information on attractive insurance rates or attractive credit card deals. Clicking on the links in the PDF will redirect the victim to a site designed to look like Google Drive, with instructions to download a different file on the drive. It is the act of clicking the file on the drive that dooms the user.

SEO is a tried and true marketing tactic used by legitimate business owners to drive traffic to their sites, co-opted, in this case, for a nefarious purpose. Unfortunately, it has proven to be a wildly effective thus far.

 

Call Now

 

 

As to the malware itself, SolarMarker is a backdoor malware that steals login credentials and other data from web browsers. So it's not harmful on its own, but it makes it easier for the hackers controlling it to introduce damaging malware down the road and/or steal a victim's identity and bypass computer security.

Crowdstrike was the first company to sound the alarm when researchers at the company first discovered the unusual marketing campaign for the malware. Note that thus far, at least, SolarMarker's makers seem to have focused the bulk of their attention on North America.

PDFs have been used for a very long time to deliver malicious payloads, but the unusual methodology used here makes this cyberattack noteworthy. Be on your guard against any PDFs you or your staff receive from unknown, un-trusted sources. Clicking links embedded in those files may net you much more than you bargained for, and not in a good way.

 

Call SpartanTec, Inc. now and let our team of IT support professionals help protect your company against malware and other online threats by developing an effective cybersecurity strategy.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

Over 3 Million Affected By Volkswagen Group Data Breach

The Volkswagen Group of America (VWGoA), a subsidiary of the German Volkswagen Group, recently disclosed a large scale data breach that exposed the personal data of more than three million VW customers.

The incident came about because between August of 2019 and May of 2021, one of VWGoA's vendors left unsecured data exposed on the internet.

The company was notified by the vendor that an unauthorized person or persons had accessed the unsecured data and may have obtained customer information for people who had purchased an Audi or Volkswagen during that time, in addition to exposing some details on the dealerships where the vehicles were purchased. A forensic analysis revealed that information belonging to 3.3 million customers was exposed, and that 97 percent of those records related to customers of Audi vehicles or interested buyers.

The information in the vulnerable database varies widely from one customer to the next, but generally includes full names, email addresses and phone numbers, and more than 95 percent of the compromised records also included driver's license numbers.

 

Call Now

 

A small number of exposed customer records, numbering approximately 90,000, also contained social security numbers. For those customers, VWGoA is offering one year of free credit protection and monitoring, and a $1 million insurance policy that protects against identity theft.

VWGoA has also begun the process of notifying all impacted customers. So if you purchased a BMW or Audi during the time frame mentioned above, or if you expressed an interest in doing so, you may be contacted by Vokswagen.

Unfortunately, the database was left exposed for an extended period of time, and there's no telling how many bad actors may have gained access to it. Right now, security professionals are monitoring the Dark Web in case the data begins appearing there. So far, it has not, but that could happen at any time. Companies, whether big or small, should pay close attention to their cybersecurity and data backup plans. Don't wait for a cyberattack to happen before you prioritize these things.

 

Call SpartanTec, Inc. now for more information about our managed IT solutions and data recovery services.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

Data Breach Hits McDonalds In US And Other Countries

McDonalds is the latest major corporation to fall victim to a data breach. The fast-food giant does business in more than 100 countries and has nearly 40,000 locations globally with more than 14,000 in the United States alone. Recently, they disclosed that hackers found a way into their network and stole information belonging to both employees and customers in the US, South Korea and Taiwan.

If there's a silver lining in the disclosure, it lies in the fact that McDonalds was able to confirm that no payment information was stolen. Nonetheless, the hackers were able to abscond with a raft of personal information including email addresses, phone numbers, physical addresses and the full names of an as yet undetermined number of customers and employees.

As part of their disclosure, the company said that they were working with law enforcement and a outside data security vendor to conclude the investigation. They included that they were in the process of contacting any customer whose information was compromised by the breach.

 

Call Now

 

So far, their handling of the aftermath of the hack has been exemplary, though that's at least in part because they've had their share of practice. Back in 2017, the company suffered an attack that revealed a cross-site scripting vulnerability that left customer passwords exposed and stored as plain text.

If you live in the US, Korea or Taiwan and are a regular McDonalds customer and have created a login on the company's site or have downloaded the McDonalds app, you may be getting a letter from the company explaining that the information you shared with the company was compromised. The letter should outline the company's next planned steps. Even if you don't get a communication from them, your best bet is to change your McDonalds or app password right away.

 

Call SpartanTec, Inc. now if you need help of IT support professionals in preventing data breaches and other types of online threats by developing effective cybersecurity solutions.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

Beware Of Voice Message Phishing Attacks Called Vishing

Hackers and scammers have been experimenting with a cybersecurity threat called "vishing" in recent months, as a subset of phishing.

Conventional phishing tactics rely on sending emails that employ a variety of social engineering tricks to convince unsuspecting recipients to hand over sensitive information up to and including login credentials.

However, "vishing" adds a new angle: Voice, either via pre-recorded message or employing an email that contains a phone number with a live person at the other end, who will try to coax the desired information from the caller live and in person.

Worse, in the case of incorporating pre-recorded messages, scammers can take a scattershot approach, generating thousands, or even tens of thousands of emails. These emails point back to a fairly convincing-sounding pre-recorded message, and even spoof their caller IDs while doing it so they come across as legitimate operations.

Internet security firm Armorblox has been studying the issue and recently released a pair of case studies relating to the phenomenon. Both studies involve impersonating Amazon, with the goal of convincing unsuspecting users to give up their credit card details.

 

Call Now

 

Armorblox's first case study involved a campaign that targeted more than nine thousand email addresses, sent from a Gmail account with the subject line of "Invoice: ID" followed by an invoice number and content that made it appear as though the communication came from Amazon.

According to the email, an order for some piece of tech (television, computer, gaming console, etc.) was placed by the recipient, and asking that individual to contact the company at the number provided if there are any questions or problems with the details. In this case, the included phone number is the "payload," or at least the gateway to the payload.

The second campaign the company tracked was functionally similar, but was only sent to some 4,000 inboxes. In both cases though, since there are no poisoned attachments, there's nothing for the spam filters of email systems to flag, which is what makes "vishing" such a dangerous phenomenon. Stay vigilant out there especially when it concerns your computer security.

 

Call SpartanTec, Inc. now and let our team of IT experts help protect your business against cybersecurity threats such as phishing and malware.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

Email Unsubscribe Scam Can Easily Fool Any User

Scammers are increasingly relying on a tried and true bit of social engineering to fool unsuspecting users into unwittingly signing up to receive a flood of additional spam email. They accomplish this by blasting out an email asking recipients if they wish to unsubscribe, which makes email security essential.

The emails don't specify exactly what the recipient is unsubscribing from, or why unsubscribing is necessary. Of course, the main purpose here is to verify that the email address is valid and that the recipient is susceptible to phishing scams.

Most of the emails in the current campaign contain two brightly colored icons, one green, that says, "Keep me subscribed!" and one red that says "Unsubscribe."

Ultimately, it doesn't matter which you click on. If you opt to stay subscribed, you'll be emailed another "Verification" email that may ask you for additional personal information. If you click the link to unsubscribe, you'll be sent a verification email asking why you're leaving and of course, for additional personal information.

 

Call Now

 

In either case, you're playing into the hands of the scammers and self-identifying as a person susceptible to such things.

As ever, education, along with an effective email protection solution, is the best defense against this kind of thing. If you get an email like the one described above, your best bet is to simply mark it as spam and delete it. All reputable companies will clearly identify themselves and what, specifically, you are unsubscribing from.

If you do fall victim to this ploy, you can expect to be inundated with a wide assortment of phishing emails, which will invariably increase your risk. After all, the scammers only need to succeed once to make your life a living nightmare for months, and possibly years. You have to stay vigilant twenty four hours a day, seven days a week to protect yourself and the best way to do this is hire professionals who offer IT services.

 

Call SpartanTec, Inc. now and find out how our email protection and managed IT services can help keep hackers, spammers, and cyber threats at bay.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence