The Data Breach Thread

[Isgrimnur]

So, what, exactly, would a credit freeze interfere with?

Probably nothing for you.

That was my thought, but I do have a thing or two I was wanting to look into (which is why I was asking.) If it would affect my idea, I may expedite that (or, rather, looking into it (or, rather, getting confused and starting a thread)) and then just leave it frozen.

Buying things on credit. Changing providers for auto insurance, cell phones, cable, etc... I have left my frozen with all the creditors since Experian(? Or was the other one, Not Trans... The other other one) was hacked and they were sheepish about about revealing that my information was compromised. Mine has been frozen so long, I don't know where I put the thawing documents.

Equifax

[LordMortis]

Bastards!

[Rumpy]

That's certainly how it feel, as I grow more and more security conscious. I actually kinda hate that now I'm giving everyone my number because I want MFA so when they get hacked, my number is one more thing to add to the connection. I'm also beginning to put in fake info in their collecting data about me, like grandmother's maiden name and street I grew up.

Have a friend who's come to despise companies that make TFA or MFA mandatory, due to the simple fact that he doesn't get a cell signal at home. He has to drive 5 miles into town to just get a signal, which makes the entire idea absolutely useless to him.

[gilraen]

That's certainly how it feel, as I grow more and more security conscious. I actually kinda hate that now I'm giving everyone my number because I want MFA so when they get hacked, my number is one more thing to add to the connection. I'm also beginning to put in fake info in their collecting data about me, like grandmother's maiden name and street I grew up.

Have a friend who's come to despise companies that make TFA or MFA mandatory, due to the simple fact that he doesn't get a cell signal at home. He has to drive 5 miles into town to just get a signal, which makes the entire idea absolutely useless to him.

Uhm...you can get text messages on your phone via wifi if there's no cell signal. Also, many companies will give you the option to get the code via email or use Google authenticator.

[coopasonic]

So, what, exactly, would a credit freeze interfere with?

Probably nothing for you.

That was my thought, but I do have a thing or two I was wanting to look into (which is why I was asking.) If it would affect my idea, I may expedite that (or, rather, looking into it (or, rather, getting confused and starting a thread)) and then just leave it frozen.

Buying things on credit. Changing providers for auto insurance, cell phones, cable, etc... I have left my frozen with all the creditors since Experian(? Or was the other one, Not Trans... The other other one) was hacked and they were sheepish about about revealing that my information was compromised. Mine has been frozen so long, I don't know where I put the thawing documents.

When he says "buying things on credit" it means any new lines of credit. An existing credit card will continue to function normally. A credit freeze prevents the credit reporting agencies from giving data to potential lenders primarily for the purposes of originating new credit. Basically anything that asks you for an SSN that isn't the government is probably going to be impacted.

[Blackhawk]

That's fine. I knew that things like new credit cards, loans, and anything that involved an up-front credit check would be affected. I was more concerned about the things that weren't so well known - like I had no idea that things like car and medical insurance would be affected. And I completely forgot that they do credit checks when renting an apartment now.

Still, it looks like, other than one 'maybe', there's nothing there that I need worry about.

[malchior]

Unfortunately, privacy legislation is a patchwork in the US and our identity data is continuously being compromised. I have a constant 4-credit bureau credit freeze in place. Once properly set up (with MFA!) it is trivial to unfreeze for a few days to open a new line of credit using their online tools.

That said people also need to monitor retirement accounts and have the appropriate security enabled with the financial institutions. For many, credit is the biggest and most obvious risk but account takeover of financial accounts and especially those target at retirement accounts which people often monitor less frequently is also a real issue. Many institutions are improving there controls around this but there are institutions with more risk like credit unions which sometimes don't have sophisticated cyber security, insider risk, and fraud units.

[LordMortis]

That's fine. I knew that things like new credit cards, loans, and anything that involved an up-front credit check would be affected. I was more concerned about the things that weren't so well known - like I had no idea that things like car and medical insurance would be affected. And I completely forgot that they do credit checks when renting an apartment now.

Still, it looks like, other than one 'maybe', there's nothing there that I need worry about.

I don't think it affects medical and and as far as I know, it only affects home and auto when you move companies. That would suggest to me that over time it normalizes, but that's all AFAIK, and I am not in the know.

That said people also need to monitor retirement accounts and have the appropriate security enabled with the financial institutions. For many, credit is the biggest and most obvious risk but account takeover of financial accounts and especially those target at retirement accounts which people often monitor less frequently is also a real issue. Many institutions are improving there controls around this but there are institutions with more risk like credit unions which sometimes don't have sophisticated cyber security, insider risk, and fraud units.

Aye, it's a big concern of mine for me and my parents. I check often. Not sure what I'll do if I ever get compromised. I turn on every security feature they offer and wish they'd offer more. I advise my father to do the same and he won't. He complains it's too hard to use a phone or email when he is trying to log in to an account. I just hope when he gets in trouble, he can get out or the damages are small. He has been trained to tell callers nothing when they start by asking him to confirm x when they call him.

[Anonymous Bosch]

That's certainly how it feel, as I grow more and more security conscious. I actually kinda hate that now I'm giving everyone my number because I want MFA so when they get hacked, my number is one more thing to add to the connection. I'm also beginning to put in fake info in their collecting data about me, like grandmother's maiden name and street I grew up.

Have a friend who's come to despise companies that make TFA or MFA mandatory, due to the simple fact that he doesn't get a cell signal at home. He has to drive 5 miles into town to just get a signal, which makes the entire idea absolutely useless to him.

FWIW, your friend would likely be better off using hardware-based authentication instead, such as a YubiKey:

The YubiKey
The industry’s #1 security key, enabling strong two-factor, multi-factor and passwordless authentication.

[Rumpy]

That's certainly how it feel, as I grow more and more security conscious. I actually kinda hate that now I'm giving everyone my number because I want MFA so when they get hacked, my number is one more thing to add to the connection. I'm also beginning to put in fake info in their collecting data about me, like grandmother's maiden name and street I grew up.

Have a friend who's come to despise companies that make TFA or MFA mandatory, due to the simple fact that he doesn't get a cell signal at home. He has to drive 5 miles into town to just get a signal, which makes the entire idea absolutely useless to him.

Uhm...you can get text messages on your phone via wifi if there's no cell signal. Also, many companies will give you the option to get the code via email or use Google authenticator.

Not on all phones. And depends on the provider as well, from what I understand. But the fact is that some sites require the use of a phone number and don't seem to take no for an answer.

FWIW, your friend would likely be better off using hardware-based authentication instead, such as a YubiKey:

Can those be used via wifi?

[Kraken]

So, what, exactly, would a credit freeze interfere with?

Probably nothing for you.

That was my thought, but I do have a thing or two I was wanting to look into (which is why I was asking.) If it would affect my idea, I may expedite that (or, rather, looking into it (or, rather, getting confused and starting a thread)) and then just leave it frozen.

Buying things on credit. Changing providers for auto insurance, cell phones, cable, etc... I have left my frozen with all the creditors since Experian(? Or was the other one, Not Trans... The other other one) was hacked and they were sheepish about about revealing that my information was compromised. Mine has been frozen so long, I don't know where I put the thawing documents.

You can freeze/unfreeze your accounts with a few clicks. Thanks to the gubmint it's easy-peasy now with no fees or restrictions. At least one of the services even lets you set a temporary thaw -- if you know you're going to apply for something in the next couple of weeks, you can unfreeze the reports just for that interval.

[Octavious]

Ya we had to do that with my MIL as her lovely ex had all her bank information and loved to open credit cards and cars in her name. Pretty simple to setup.

[Anonymous Bosch]

That's certainly how it feel, as I grow more and more security conscious. I actually kinda hate that now I'm giving everyone my number because I want MFA so when they get hacked, my number is one more thing to add to the connection. I'm also beginning to put in fake info in their collecting data about me, like grandmother's maiden name and street I grew up.

Have a friend who's come to despise companies that make TFA or MFA mandatory, due to the simple fact that he doesn't get a cell signal at home. He has to drive 5 miles into town to just get a signal, which makes the entire idea absolutely useless to him.

Uhm...you can get text messages on your phone via wifi if there's no cell signal. Also, many companies will give you the option to get the code via email or use Google authenticator.

Not on all phones. And depends on the provider as well, from what I understand. But the fact is that some sites require the use of a phone number and don't seem to take no for an answer.

FWIW, your friend would likely be better off using hardware-based authentication instead, such as a YubiKey:

Can those be used via wifi?

WiFi is irrelevant, since a Yubikey basically provides a much faster, easier, and more secure hardware-based alternative to SMS and software-based authentication, as explained and demonstrated in the video below:

[Blackhawk]

Do they require that the site opt in?

[Rumpy]

WiFi is irrelevant, since a Yubikey basically provides a much faster, easier, and more secure hardware-based alternative to SMS and software-based authentication, as explained and demonstrated in the video below:

Ok, thanks, I appreciate that, because for the layperson, I think they're largely unknown, both in what they are and how they work.

[Anonymous Bosch]

Do they require that the site opt in?

A YubiKey will work with any sites that provide time-based one-time password (TOTP), as it works exactly the same as the Google authenticator. Though not every site is necessarily compatible with Google authenticator, and some may only support phone call, SMS, e-mail, or custom software dual factor authentication (e.g. Steam). Although with some additional steps you can, for example, add Steam to your Yubikey's TOTP list via YubiKey's Authenticator app.

2FA Directory is a mighty useful site you can use to check what particular methods of dual factor authentication most popular and well-known web sites support. A YubiKey works with any sites that have a check mark in the 'Hardware' or 'Software' columns listed there.

[gilraen]

Do they require that the site opt in?

Yeah, they have a list on their website of which companies/applications are supported. They appear to be well-represented in "high-tech" areas like cloud services and developer tools, but a very poor showing in "day-to-day" stuff like financial services or communications providers. And let's face it, for a layperson, most frequent 2FA requirement is going to be for their bank website/app (ironically, almost every site where I use 2FA gives me an option to use Google Authenticator but not the banks).

[malchior]

Most banks won't risk federating out identity. And that's probably a good thing even if not the most user friendly thing.

[Blackhawk]

Do they require that the site opt in?

Yeah, they have a list on their website of which companies/applications are supported. They appear to be well-represented in "high-tech" areas like cloud services and developer tools, but a very poor showing in "day-to-day" stuff like financial services or communications providers. And let's face it, for a layperson, most frequent 2FA requirement is going to be for their bank website/app (ironically, almost every site where I use 2FA gives me an option to use Google Authenticator but not the banks).

That's what I'm noticing. I think I only saw eight or ten that I even have accounts with, and all of those that I care enough to have 2FA on I already do through the phone app. I mean, if someone wants my Reddit account that badly...

[LordMortis]

...And I get notice from IBM that their database supporting health care has been breached and again, they can't tell if my information has been compromised but it may included anything that Jansen knows about me. Two notices in four days. I'm beginning to move toward the belief that anyone who hasn't frozen their credit is playing with fire. I also am beginning to fear that people are going to start collecting benefits in my name. (I also locked down my electronic social security account when people started talking about how here)

I think you'll relate to the end.

Hey look, I got a notification from "Welltok" that my medical information has been compromised because the MOVEit service was compromised in July. That makes four times this year, I think, that my medical information has been compromised. Nearly all related to my accident.

[Blackhawk]

Welltok

Oh, goody.

The facility that my doctor moved to last year uses a tech service that has been breached. As usual, they found out in August, and are notifying people in November (probably to spend time making sure that their asses are covered.) Luckily, the only data that was taken from the server is my name, personal information (possibly including my SSN), demographic information, medical information, and insurance information.

The facility that my doctor moved from last year uses a tech service that has been breached.

This one also waited months to tell anyone, and this one didn't have to decency to even offer credit monitoring.

That's literally every doctor's office I've been a regular in during the last decade that's been breached in the last year. Looking at a chart of the breaches of medical services over the past 24 months, I'm in two of the top four. Yay! I'm winning!

[LordMortis]

That's literally every doctor's office I've been a regular in during the last decade that's been breached in the last year.

For me it's every doctor and related service associated with my accident in March. My (until October 31st) PCP and his referrals and hospital system were OK. Getting hit while crossing is just the mess that keeps on messing with me, so say nothing of the pain.

[Blackhawk]

Oh, goody.

Ubisoft. Around a terabyte of data walked off. Ubisoft won't say if there's anything sensitive in there - it may be our credit card info, or it may just be just be the proposals for the next couple of thousand Assassins' Creed and Far Cry titles.

If they follow the recent pattern, we'll find out in six months or so.

[Max Peck]

Oh, goody.

Ubisoft. Around a terabyte of data walked off. Ubisoft won't say if there's anything sensitive in there - it may be our credit card info, or it may just be just be the proposals for the next couple of thousand Assassins' Creed and Far Cry titles.

If they follow the recent pattern, we'll find out in six months or so.

According to the article you linked, the hackers were detected and shut out of Ubisoft's network before they could exfiltrate the data.

[Max Peck]

Lapsus$: GTA 6 hacker handed indefinite hospital order

An 18-year-old hacker who leaked clips of a forthcoming Grand Theft Auto (GTA) game has been sentenced to an indefinite hospital order.

Arion Kurtaj from Oxford, who is autistic, was a key member of international gang Lapsus$.

The gang's attacks on tech giants including Uber, Nvidia and Rockstar Games cost the firms nearly $10m.

The judge said Kurtaj's skills and desire to commit cyber-crime meant he remained a high risk to the public.

He will remain at a secure hospital for life unless doctors deem him no longer a danger.

The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.

Doctors deemed Kurtaj unfit to stand trial due to his severe autism so the jury was asked to determine whether or not he committed the alleged acts - not if he did so with criminal intent.

A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."

The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack.

Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

In completely unrelated news...

Rumor: GTA 5 Source Code and Other Rockstar Files Leak Online

In an unexpected and significant development, rumors have emerged suggesting that the source code for Grand Theft Auto 5, along with a vast array of other confidential materials from Rockstar Games, have been leaked online. This incident comes after initial reports last year hinted at a partial leak of GTA 5's source code.

Rockstar Games has faced a tumultuous year, grappling with a series of security breaches that have marred its operations. Last year, the company was rocked by a network intrusion, leading to the unauthorized release of nearly an hour's worth of gameplay from the much-anticipated Grand Theft Auto 6. The situation worsened recently when plans for a grand trailer reveal were upended by another leak which forced the developers to officially release the trailer early. Now, it appears that Rockstar Games is confronting an even more daunting challenge with this latest leak.

A recent tweet from GTA Focal reveals the GTA 5 source code has been leaked online, following its earlier exchange between individuals. It has been reported that today's leak involved a 4GB file predominantly comprising code, yet a complete version encompassing the entire source has not been observed. This extensive source file, which includes assets and 3D models, would likely enable the construction and execution of the game. Given the substantial size of the full source, which is rumored to be around 200GB, its leakage appears to be less straightforward.

The situation worsens with the revelation that the leak not only involves GTA 5 but also encompasses files from the long-awaited, yet unrealized, Bully 2, and portions of code from GTA 6. Additionally, the leak exposes several unreleased DLCs, including the GTA 5 Trevor expansion which was highlighted in previous leaks as well. Also unearthed is a map from a project known as "Agent," a canceled endeavor rumored to draw inspiration from the James Bond franchise.

Other reporting indicates that the leak reveals that there were a total of 8 DLC that were planned but cancelled, presumably because it was more profitable to devote resources to GTA Online than to release additional single-player content.

[LordMortis]

Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

Wow. Though I suppose mobile phone plus internet could be enough by itself and perhaps firestick plus TV got him to Internet.

[malchior]

Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

Wow. Though I suppose mobile phone plus internet could be enough by itself and perhaps firestick plus TV got him to Internet.

I've done this before. Well not this scale of hack but the general idea. He almost certainly sideloaded the FireTV with tools to remote into some existing system (probably up in AWS or GCP or maybe a Homeserver and used the TV as a monitor and the phone as the keyboard.

[Jaymann]

I got a notice of a class action suit against Blackhawk.

[Daehawk]

Mr. Cooper is supposedly looking out for me.

[Rumpy]

And the latest is Roku, according to The Verge. Haven't received any email, but changed my password just in case.

https://www.theverge.com/2024/3/12/2409 ... -card-info

[LordMortis]

ATT

https://www.npr.org/2024/03/30/12418637 ... h-dark-web

According to information about the breach on the company's website, 7.6 million current account holders and 65.4 million former account holders have been impacted. An AT&T press release said the breach occurred about two weeks ago, and that the incident has not yet had a "material impact" on its operations.

AT&T said the information included in the compromised data set varies from person to person. It could include social security numbers, full names, email and mailing addresses, phone numbers, and dates of birth, as well as AT&T account numbers and passcodes.

[Unagi]

Fantastic