The U.S. Justice Department unsealed a criminal indictment charging seven alleged Russian GRU military intelligence agency officers with hacking multiple organizations, including the World Anti-Doping Agency, as part of APT 28 - aka Fancy Bear - cyber espionage operations.
Did the Chinese government pull off one of the most secretive hardware hacks of all time? That's what information security experts are pondering after a Bloomberg report described an espionage operation that purportedly planted a tiny spying chip on widely distributed server motherboards.
The East African institution State Bank of Mauritius says its India operations may have lost $14 million as a result of a cyberattack Tuesday. Although the bank did not confirm the exact nature of the attack, some security experts suspect it involved fraudulent transactions via the SWIFT network.
The latest edition of the ISMG Security Report features an analysis of the latest developments in Facebook's massive data breach and expert analysis of the potential for nation-state interference in the U.S. midterm elections.
India's Ministry of Electronics and IT has asked Facebook for an update on the number of Indian users impacted by its recent data breach, which affected 50 million users worldwide. But it's not yet clear what steps the government can take to make sure the social media platform is secure.
A gang of North Korean government hackers, known as APT38, has stolen more than $100 million from banks in Asia and Africa via fraudulent SWIFT transfers, cybersecurity firm FireEye warns. Separately, the U.S. government says North Korea is also behind serious ATM malware cash-out attacks.
Warning: Attackers behind the recently revealed Facebook mega-breach may still be able to access victims' accounts at some third-party web services and mobile apps, and Facebook has offered no timeline for when a full lockdown might occur - although there are no signs of third-party account takeovers.
Step away from the social media single sign-on services, cybersecurity experts say, citing numerous privacy and security risks. Instead, they recommend that everyone use password managers to create unique and complex passwords for every site, service or app they use.
Tesco Bank has been hit with a £16.4 million ($21.3 million) fine by the U.K.'s Financial Conduct Authority for failing to prevent and more rapidly block thousands of fraudulent transactions that drained £2.3 million ($3 million) directly from customers' bank accounts.
The U.K.'s data protection regulator has fined Bupa Insurance Services £175,000 ($228,000) for failing to stop an employee from stealing 547,000 customer records, which were later offered for sale on the dark web. The ICO found that the health insurer's CRM system lacked adequate security controls.
Education plays a critical role in any program designed to combat insider threats, says Christopher Greany, head of group investigations at Barclays. He'll discuss how to start an insider threat program in a presentation at Information Security Media Group's Security Summit: London, to be held Oct. 23.
While Facebook has invalidated 90 million users' single sign-on access tokens following a mega-breach, researchers warn that most access token hijacking victims still lack any reliable "single sign-off" capabilities that will revoke attackers' access to hyper-connected web services and mobile apps.
The recent breach at Facebook, which affects 50 million users, is likely to have a big impact on Asians who use Facebook's single sign-on feature to log into third-party apps. India is the world's largest market for the social media giant.
Facebook says that whoever hacked 50 million user accounts, putting the privacy of those users' personal data at risk, did so by abusing its "View As" privacy feature. Facebook says the attack successfully targeted three separate bugs in its video-uploading functionality.
The four-member Committee of Inquiry investigating the SingHealth data breach that affected 1.5 billion patients in Singapore heard testimony at a hearing that the healthcare organization's technology vendor failed to take prompt action on security alerts because a key cybersecurity employee was on leave.