• 888-966-4827
Menu

Tag Archives:
security

Home / Blog / Tag: security

Millions Potentially Exposed by Neiman Marcus Breach

Dallas-based Neiman Marcus Group (NMG), a luxury department store chain that includes Bergdorf Goodman, recently learned that an unauthorized party gained access to a cloud database platform used by NMG that is provided by a third party named Snowflake. The company notified Maine’s Attorney General’s Office that the breach has impacted more than 64,000 customers. The company started mailing notification letters on June 24th. This is not the first cybersecurity incident for Neiman Marcus. Previous breaches are known to have occurred in 2013, 2015 and 2020 for the high-end retailer.

NMG disclosed the incident just as a hacker announced the sale of the database. According to SecurityWeek, although a ransom was demanded, the retailer refused to pay. SecurityWeek also reported that the database sold for $150,000 and allegedly includes information on 180 million users which is far more than the 64,000+ NMG reported. The hacker is now advertising 70 million transactions, 50 million customer email addresses, 12 million gift card numbers and six billion rows of customer shopping records, employee data and store information.

Campaigns have targeted at least 165 organizations associated with Snowflake cloud storage systems, such as Advance Auto Parts, Allstate, Anheuser-Busch, Mitsubishi, Progressive, State Farm and Ticketmaster. We expect to see a heightened volume of cybersecurity incidents surrounding Snowflake and will notify you as soon as we hear any further news. Learn More

Guard Well Identity Theft Solutions exists to provide you, your family and your employees from the damages of identity theft. Please don’t hesitate to reach out if you need help or have any questions or concerns. We are available for you 24/7/365 at 888.966.4827 (GUARD) and [email protected].

Fraud Trend Alert: End-of-life IT Gear

Fraud Trend Alert: End-of-life IT Gear

There is a new fraud trend we are seeing that almost victimized a client of ours who is a very large, well-known employer in the Cincinnati, Ohio tri-state region. We highly suggest that you share this blog to your company IT contact or a company team member whose duties include data security – IT security – technology security and/or IT gear and infrastructure protection.

 

One of our Guard Well product offerings is Enterprise Data Risk Mitigation. It is a program we developed to help organizations by purchasing their end-of-life IT gear, wipe and certify the drives … at no cost … then repurpose the gear. Essentially we turn a data risk and pending expense into a liability shift and a profit. It’s a very effective … and popular program.

 

Last week we were preparing to pull a large lot of gear from one of our clients when two individuals, claiming to be hired by a third party, showed up on the campus insisting they needed to pick up any used IT gear for “processing.” Luckily our client sensed something was incorrect and reached out to Guard Well asking us if we had sent two men to pick up the gear. We informed them that we did not send these individuals and by the time our phone call ended both men had left the campus.

 

What these men were attempting to do is steal the IT gear, most likely to harvest the sensitive company data and sell it to hackers or hold it for ransom until the company paid them to return the data. Due to the large security concerns, we highly suggest that your organization verifies steps taken to protect the sensitive data stored in end-of-life IT gear. Guard Well will partner with any organization looking for a safe, reliable way to manage the proper decommissioning of this gear and turn a profit from its remaining, but depreciating, value.

 

We can work anywhere in the USA, so please let us know how we can help. Be vigilant. Be strong. If you have any concerns or think you have been a victim of fraud, please contact our Member Services immediately so we can fully resolve the issue for you. We are always available 24/7/365 at 888.966.GUARD (4827).

 

Photo credit: Malachi Brooks via unsplash.com

Cybersecurity Trends in Store for 2020

Cybersecurity Trends in Store for 2020

Did you know that the first documented ransomware attack was more than 30 years ago in 1989? That was around the time when a mobile phone was called a bag phone because it sat in a big black bag in your passenger seat … and that curly cord was wound so tight it hardly let it extend to your ear. If you were lucky, you could store about 30 numbers in it. But back then, that was pretty amazing storage. Then flip phones started to make our lives easier in later years. It was pretty simple but the fact that it could actually fit in your pocket made it truly mobile. There was rarely a thought that anyone was listening in on your conversations or tracking your locations (which they probably were but the average person didn’t think doing so was devious). Boy, have times changed.

 

Attacks involving ransomware, which were originally designed to target individuals, are occurring every 14 seconds now. Shocking isn’t it. After you read this sentence, focus on how long it takes you to breathe … inhale and exhale. Your full circle breathing process is likely anywhere from six to eight seconds, which is how long hackers are trying to increase the speed of ransomware attacks by this time next year.

 

Dave Wallen discussed some of the expected 2020 cybersecurity trends in a blog last week for Security Boulevard so we all can be “better prepared against the ever-evolving nature of cyber threats.” He wrote, “With today’s pervasive use of the internet, a modern surge in cyberattacks and the benefit of hindsight, it’s easy to see how ignoring security decades ago was a massive flaw.” It’s not just the speed of the attacks that is alarming, it is the variety of them that are going to keep things interesting for 2020.

 

So what are some of the trends we will be seeing in 2020?

 

– Fear will drive spending. Gartner forecasts that worldwide spending on cybersecurity is going to reach $133.7 billion in 2022. The General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have pushed businesses and government agencies to a more sophisticated cybersecurity infrastructure than ever. Wallen noted that 76% of organizations plan to increase their cybersecurity budgets this year.

 

– The cybersecurity labor market will continue to experience labor shortages. There are many reasons for this skills gap. Not only are there more cybercriminals, but there are also more places for scammers to hide with our ever-expanding reliance on technology. Also, there still needs to be a balance of expanding skills in a very specific area with teaching broad skills that can be useful across many sectors. Think of those with titles such as chief information officer (CIO) and chief information security officer (CISO) – they are currently undervalued.

 

– Cloud security will require a more pragmatic approach. The assumption that our data is secure on ‘the cloud’ in applications such as Microsoft and Google will be a thing of the past. In 2019, we saw massive attacks against Office 365 and G Suite that can bypass two-factor authentification making shared accounts exceptionally vulnerable.

 

– Mobile devices will become even a greater target. As the number of mobile users increases, so will the amount of business data stored in them. Wallen wrote, “It’s a compelling reason why mobiles are seen as the primary cyberattack vector in 2020.”

 

– Election security will be off the charts. With over 70 elections globally planned in 2020, there will be an intense focus on the spreading of disinformation.

 

– 5G, the fifth-generation wireless technology, will cause an increase in loT-based (Internet of Things) attacks. There will need to be a higher level of security which many current vendors are not able to provide yet. Hackers will take advantage of this gap to “sneak in malware and steal large volumes of your SaaS data at breakneck speed.”

 

– AI (Artificial Intelligence) will become even more two-faced. While the benefits of AI are countless and help to protect our security, defakes (fake videos) that can spread misinformation will become more prominent and new types of cyberattacks will result because of them.

 

– Organizations will continue to see their biggest asset, their employees, become their biggest threat. As reported in Governing.com, “The problem is that now our most important information, whether it’s sales prospects or customer lists or source code … is spread across the organization and is highly portable on a thumb drive or e-mail … information is less ‘siloed.'” Their study shows that “63 percent of people admit that they took data from their last job and brought it to their current job.”

 

We will also continue to see more fake apps and shopping cart viruses, new account fraud, apps that share our data along with phishing scams (and whaling scams if you’re a high-ranking executive or banker). Identity theft will also be rampant through social media. Lastly, child identity theft will continue to rise. It is suggested that every child have a credit freeze on their file. If you would like more information about how to do so, please reach out to our Member Services team at [email protected] or call 1.888.966.4827. We are here to help 24/7/365.

Scams, Scams and More Darn Scams

Scams, Scams and More Darn Scams

Did you know that there are at least 48 different types of identity theft and the number of scams involved in each is growing daily? Romance scams, residence scams, utility scams, employment scams, telephone scams, email scams, charity scams, Apple care scams, AirBNB scams, PayPal scams, census scams, ticket scams, government scams, medical scams, insurance scams, real estate scams, investment scams, lottery and sweepstakes scams … there really isn’t one facet of our lives that isn’t ‘scam-able.’ As the weather turns colder, it kind of makes you want to curl up under an electric blanket and hibernate for a bit doesn’t it!

 

Although everyone with a social security number is at risk for identity theft, there are two groups that are targeted more often: children and seniors. The U.S. Department of Health & Human Services has studied why. They explain, “Children are targeted to establish a ‘clean slate.’ Seniors are targeted over the telephone and through phishing scams. Some studies suggest that people become more trusting as they age, which helps to explain why it’s more difficult for older adults to detect fraudsters.”

 

The next high-risk group that follows children and seniors are the military mostly due to deployment, which impacts their ability to respond to a threat in a timely manner. According to the Federal Trade Commission, military consumers are most affected by credit card and bank fraud. Another high-risk group is identity theft repeat victims. As reported in Consumer Affairs, “people who have previously been affected by identity theft are at a greater risk for future identity theft and fraud.” According to the Center for Victim Research, “7-10% of the U.S. population are victims of identity fraud each year and 21% of those experience multiple incidents of identity theft.”

 

Lastly, the deceased are targeted. Stealing a dead person’s identity, commonly known as “ghosting,” will often go unnoticed by surviving family for months or years. A report dating from 2012 stated that 2.5 million deceased American identities are stolen each year. Of those 2.5 million stolen identities, 800,000 were used to open lines of credit or get a mobile phone plan.

 

Fraudsters oftentimes repeat their favorite most lucrative scams, which are driven by major financial life moments, such as taxes and holiday shopping. Yes, it’s getting to be that time of year, and, guess what … the world’s largest online retailer, Amazon, is seeing a huge increase in fake Amazon.com order cancellation scams. If you receive an email about an order cancellation from Amazon, there’s a good chance it’s a scam. Click on links in the email and you could unintentionally download malware onto your device. Or you might be sent to a site that aims to collect your Amazon account information, like your username and password. If you receive such an email and recently placed an order, go to Amazon.com directly to check your order status.

 

Most of our blogs offer tips to help protect yourself and your family from identity theft. There is one tip in this blog: Remain aware of scams and that they can touch every facet of your life. By staying in-the-know, you can help every month be National Cybersecurity Awareness month … not just October.

 

If you suspect that you or a loved one has suffered identity theft, please reach out to us as soon as possible. Our Guard Well member services team is available around the clock, every day of the year. Email [email protected] or call 888.966.GUARD (4827) for help.

Top 10 Identity and Access Management Solution Providers – 2019

Top 10 Identity and Access Management Solution Providers – 2019

An Intelligent Way to Protect Your Employees

Guard Well Identity Theft Solutions was listed as one of the “Top 10 Identity and Access Management (IAM) Solutions Providers – 2019” in Enterprise Security Magazine. “What has intrigued us the most is that Guard Well always takes the driver’s seat in addressing the identity theft and restoration challenges through its full resolution solutions, cutting edge advanced monitoring tools and proprietary API technology. The company has been on the pinnacle in combining their 24/7 availability and an intense focus on customer service to provide the best IAM solutions today,” remarked Michael Brown, Managing Editor.

 

You can read the entire article HERE.

Two-factor Authentication Phishing Scam

Two-factor Authentication Phishing Scam

Have you tried to log into an account of yours, such as your insurance or financial institution, and been told to confirm your identity in order to keep your credentials safe? You then receive a code either via text or email which is required for you to enter. Also known as 2FA, this SMS multi-step process has been the trusted security step to protect your accounts … until recently.

 

Unfortunately, there is an automated phishing attack on 2FA, which utilizes two tools: Muraena and NecroBrowser. Reported by Fortune, “The two tools work together like the perfect crime duo. Think of Muraena as the clever bank robber and NecroBrowser as the getaway driver.”

 

The attack was first demonstrated at the Hack in the Box Security Conference in Amsterdam last month. A video of the presentation was posted on YouTube on June 2nd bringing renewed attention to how hackers are getting better at penetrating extra layers of security, despite people using stronger tools, like 2FA.

 

So, what do you do? Do you still want to utilize SMS-based 2FA for your accounts? For the most part, the answer is yes.

 

Think of it like this. Say you want to put a lock on your front door to protect your home. Security professionals are arguing that the best type of lock available is way better than cheaper locks. Sure, makes sense. But if that more expensive lock isn’t available to you, isn’t having a cheaper lock still better than not having a lock at all?

 

As discussed on How-to-Geek’s website, there are some people who are more likely than others to be targeted by sophisticated hackers and should avoid using this SMS-based 2FA. For example, if you’re a politician, journalist, celebrity, or business leader, you could be targeted. Also, if you’re a person with access to sensitive corporate data, such as a system administrator, or just very wealthy, SMS may be too risky.

 

But, if you’re the average person with a Gmail or Facebook account and no one has a reason to spend a bunch of time getting access to your accounts, SMS authentication is fine and you should absolutely use it rather than using nothing at all.

 

If you suspect that your login credentials have been compromised, change your passwords as quickly as possible and report the website to the FTC and/or your identity theft resolution provider.

 

Sources:

https://conference.hitb.org/

https://Howtogeek.com/