Author: Robert Timlick

  • Italy Fines OpenAI €15 Million for ChatGPT GDPR Data Privacy Violations

    Italy Fines OpenAI €15 Million for ChatGPT GDPR Data Privacy Violations

    Italy’s data protection authority has fined ChatGPT maker OpenAI a fine of €15 million ($15.66 million) over how the generative artificial intelligence application handles personal data.
    The fine comes nearly a year after the Garante found that ChatGPT processed users’ information to train its service in violation of the European Union’s General Data Protection Regulation (GDPR).
    The authority
  • LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages

    LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages

    A dual Russian and Israeli national has been charged in the United States for allegedly being the developer of the now-defunct LockBit ransomware-as-a-service (RaaS) operation since its inception in or around 2019 through at least February 2024.
    Rostislav Panev, 51, was arrested in Israel earlier this August and is currently awaiting extradition, the U.S. Department of Justice (DoJ) said in a
  • Protect Yourself: 8 Steps to Take When You Get a Notice Your Data Was Breached                 

    Protect Yourself: 8 Steps to Take When You Get a Notice Your Data Was Breached                 

    When it happens, you feel powerless. You get an email or letter from a business saying someone breached your data. It happens all too often today.

    Data breaches happen at banks, online sites like Facebook, and ecommerce stores. Not only that, but governments are also victims. This leaves things like your address, SSN, and credit card details exposed to thieves. 

    A business getting hacked is something you have little control over. But you can take important steps afterwards. We’ve outlined the most important things to do below. These steps can help you mitigate the financial losses.

    Change Your Passwords

    The very first thing you should do is change your passwords. Change the password for the service that sent you the breach notification first. Then, change it for any logins using the same password. 

    This is one of the reasons it’s a best practice to use unique logins for every site. Many people get in the habit of using the same password in several places. This leaves more than the single breached login at risk. Use a password manager to help you create strong passwords. You only need to remember one to access all the others.

    Enable Multifactor Authentication (MFA)

    Multifactor authentication can keep accounts secure, even if a hacker stole the password. Enable it for the breached service. Then, ensure you have MFA activated for all other logins, where possible. MFA is also called two-factor authentication or two-step verification.

    Common forms of MFA are:

    • Text message
    • Authentication app
    • Security key

    Check Your Bank Accounts

    If payment card details were breached, check bank accounts. You’ll want to watch these for several weeks for fraudulent charges. Report the breach to your bank to have them issue you a new card, if needed.

    Notify your bank about the 3rd party data breach. This can help keep you from being held responsible for fraudulent charges. It’s good to get out ahead of it. Your bank can then help you with appropriate steps to avoid fraud.

    Freeze Your Credit

    Online criminals will often sell breached personal details. These details can enable someone to take out credit in your name. Contact the three credit agencies. They each have ways to freeze your credit to protect you. You can do this right on their websites.

    The three credit agencies are: 

    Carefully Review the Breach Notification

    It’s important to understand exactly how the data breach may impact you. Review the notice you received. Additionally, look for updates on the company website.

    These are the things you should be looking for:

    • The type of data exposed (passwords, card numbers, etc.)
    • What reparations the company is making (e.g., credit monitoring)
    • Any instructions given to secure your account

    Regularly check the company’s website. Often, they don’t immediately know how far reaching the breach is. You may check back later and find out other types of sensitive data were exposed.

    Get Good Cybersecurity Protections

    Make sure you protect your device and network. There are some simple tools you can use to beef up personal device security. These include:

    • A good antivirus/anti-malware program
    • DNS filtering to block malicious sites
    • Email spam filtering for phishing

    Another good protection you can use is a VPN. This helps mask your traffic. It is especially helpful if you’re using a public Wi-Fi. VPNs are easy to use. You can use VPNs for both computers and mobile devices.

    Be On the Lookout for Phishing Scams

    Emails are often exposed in data breaches. This means you may receive an uptick in phishing emails. Phishing is very convincing since criminals have AI at their disposal. Phishing emails often are hard to spot from the real thing.

    Stay ultra-aware of any unexpected emails. Follow best practices to avoid becoming a phishing victim:

    • Hover over links to see them
    • Go to websites directly. Don’t click email or SMS links
    • Beware of unknown senders
    • Watch for phishing on social media and text messages
    • When in doubt, double check through an official source

    Make Sure to Update Software & Systems

    Hackers often exploit unpatched vulnerabilities. How do you get unpatched vulnerabilities? Most times it’s from failing to keep software updated.

    Make sure to update your device operating system. Update all apps or software on your devices. Update firmware for routers and printers. Update firmware for smart devices. 

    There are so many updates we need to do with our electronics. Automating your updates is a good way to stay protected.

    Managed Security Services You Can Count On

    Managed services can keep you protected at work and home. Need help improving device security? We’ll be happy to discuss our options.

    Contact us today to schedule a chat about device security.

    Featured Image Credit

    This Article has been Republished with Permission from The Technology Press.

  • Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

    Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

    The Lazarus Group, an infamous threat actor linked to the Democratic People’s Republic of Korea (DPRK), has been observed leveraging a “complex infection chain” targeting at least two employees belonging to an unnamed nuclear-related organization within the span of one month in January 2024.
    The attacks, which culminated in the deployment of a new modular backdoor referred to as CookiePlus, are
  • Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

    Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

    The developers of Rspack have revealed that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack that allowed a malicious actor to publish malicious versions to the official package registry with cryptocurrency mining malware.
    Following the discovery, versions 1.1.7 of both libraries have been unpublished from the npm registry. The latest
  • Sophos Issues Hotfixes for Critical Firewall Flaws: Update to Prevent Exploitation

    Sophos Issues Hotfixes for Critical Firewall Flaws: Update to Prevent Exploitation

    Sophos has released hotfixes to address three security flaws in Sophos Firewall products that could be exploited to achieve remote code execution and allow privileged system access under certain conditions.
    Of the three, two are rated Critical in severity. There is currently no evidence that the shortcomings have been exploited in the wild. The list of vulnerabilities is as follows –
  • HubPhish Exploits HubSpot Tools to Target 20,000 European Users for Credential Theft

    HubPhish Exploits HubSpot Tools to Target 20,000 European Users for Credential Theft

    Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims’ Microsoft Azure cloud infrastructure.
    The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to the abuse of HubSpot tools in the attack chain. Targets include at least 20,000 automotive, chemical,
  • Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected

    Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected

    Threat actors are attempting to exploit a recently disclosed security flaw impacting Apache Struts that could pave the way for remote code execution.
    The issue, tracked as CVE-2024-53677, carries a CVSS score of 9.5 out of 10.0, indicating critical severity. The vulnerability shares similarities with another critical bug the project maintainers addressed in December 2023 (CVE-2023-50164, CVSS
  • Not Your Old ActiveState: Introducing our End-to-End OS Platform

    Not Your Old ActiveState: Introducing our End-to-End OS Platform

    Having been at ActiveState for nearly eight years, I’ve seen many iterations of our product. However, one thing has stayed true over the years: Our commitment to the open source community and companies using open source in their code.
    ActiveState has been helping enterprises manage open source for over a decade. In the early days, open source was in its infancy. We focused mainly on the
  • APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP

    APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP

    The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol (RDP) configuration files.
    The activity, which has targeted governments and armed forces, think tanks, academic researchers, and Ukrainian entities, entails adopting a “rogue RDP” technique that was previously