Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Identity Theft. Show all posts
Identity Theft
AssuranceAmerica Data Breach Drivers license Financial Fraud Identity Theft

Nearly 7 Million Driver's License Numbers Exposed After AssuranceAmerica Data Breach

 


Nearly seven million people are being notified after a cyberattack on Atlanta-based auto insurer AssuranceAmerica exposed highly sensitive personal information, including driver's license numbers, Social Security numbers and insurance records, raising concerns about long-term identity theft risks.

According to the company's breach notice and filings submitted to state regulators, the incident began on March 16, 2026, when a threat actor gained unauthorized access to AssuranceAmerica's internal network using compromised employee credentials obtained through a phishing attack. The company detected suspicious activity the following day, secured the affected systems, and launched a forensic investigation to determine the scope of the compromise.

The investigation later revealed that the attackers had copied files containing personal information belonging to approximately 6.99 million individuals. The exposed data varies by person but may include names, residential addresses, driver's license numbers, Social Security numbers, taxpayer identification numbers, insurance policy and account details, claims information, as well as driver and vehicle records.

The scale of the breach makes it one of the larger disclosures involving government-issued identity documents this year. South Carolina alone reported that 611,046 residents may have been affected, according to the state's Department of Consumer Affairs.

Unlike passwords, driver's license numbers are not easily replaced after they are exposed. These identifiers are widely used to verify identity across banks, insurers, vehicle rental companies, government agencies and financial institutions. When combined with Social Security numbers and other personally identifiable information, they can enable criminals to apply for loans, open fraudulent accounts, submit false tax returns or impersonate victims during identity verification processes.

Law firm Edelson Lechtzin LLP, which announced an investigation into the incident, warned that the compromised information could be used to facilitate identity theft and other forms of financial fraud.

Although AssuranceAmerica identified the intrusion within roughly 24 hours, affected individuals were not notified until late June after investigators completed their review of the compromised data on June 15. The nearly three-month gap between the initial breach and customer notifications has drawn attention to the time required to determine exactly whose information had been accessed before notifications could be issued.

In its public notice, AssuranceAmerica said it disabled the compromised accounts, reset credentials, strengthened network monitoring and provided additional cybersecurity awareness training to employees. The company also engaged external forensic specialists to investigate the incident. However, it has not publicly confirmed whether all affected individuals will receive complimentary credit monitoring or identity protection services.

The AssuranceAmerica breach comes amid a growing number of incidents involving government-issued identity documents. In June, Texas disclosed a separate cyberattack affecting approximately three million driver's license and passport records maintained by the Texas Parks and Wildlife Department, adding to a broader trend of organizations reporting the theft of sensitive identification data.

The growing reliance on digital identity verification has also increased the amount of personal identification collected by businesses and online platforms. As governments and private organizations increasingly require users to upload driver's licenses and other official documents for account verification and age checks, cybersecurity experts warn that breaches involving these records can have lasting consequences because many of these identifiers cannot be easily changed once exposed.

Individuals who may have been affected are encouraged to closely review financial and insurance accounts for suspicious activity, consider placing a credit freeze or fraud alert with the major credit bureaus, monitor their credit reports for unauthorized accounts and remain cautious of phishing emails or phone calls that attempt to exploit information exposed during the breach. Victims should also follow guidance issued by their state consumer protection agencies and promptly report any suspected identity theft.

Read more »
Zero-Day Exploit
Council of Europe CVE-2026-35273 Cyber Extortion Data Breach Data Leak Employee Data Exposure Identity Theft Oracle PeopleSoft Vulnerability ShinyHunters Zero-Day Exploit

Council of Europe Data Breach Exposes Records of 10000 Employees After ShinyHunters Leak


 

Council of Europe is investigating a major data breach following the public release of approximately 297 GB of sensitive employee data by cybercriminal group ShinyHunters following the expiration of a ransom deadline. 

An archive has been leaked that contains information regarding more than 10,000 current and former employees, contractors, and job applicants dating from 15 years ago. As one of Europe's leading human rights organizations since 1949, the Council of Europe has been an official observer at the United Nations since 1949. It represents 46 member states and is a central force in promoting democracy, human rights, and the rule of law throughout Europe. 

Since the information it holds is sensitive, the breach of confidentiality is particularly significant. As reported by ShinyHunters, more than 429,000 files, including personnel data, were obtained from multiple Council departments, including human resources and administrative units. This was one of the largest breaches of personal data involving an intergovernmental organization in Europe. 

Information available indicates that payroll records, bank account information, medical information, tax information, social security information, salary histories, personnel files, and thousands of CVs were exposed. Due to the large size of the dataset, identity theft, financial fraud, and highly targeted phishing are significantly more likely to occur. It has been reported that the breach is related to CVE-2026-35273, a critical 9.8-severity zero-day vulnerability affecting Oracle PeopleSoft's Environment Management Hub (PSEMHUB). 

According to security researchers, the vulnerability allowed attackers to execute arbitrary code remotely without authentication. According to Google's Mandiant team, more than 100 organizations had actively exploited the vulnerability prior to Oracle's release of security guidance. Using the zero-day vulnerability in combination with older vulnerabilities, ShinyHunters obtained persistent access, migrated laterally through compromised environments, and exfiltrated data while posing as legitimate users. 

The exploit was conducted between May 27 and June 9, before mitigations were available. ShinyHunters has also altered its extortion strategy significantly following the Council of Europe declining to meet the ransom demand. In response to the Council's refusal to pay the ransom, ShinyHunters announced it would permanently distribute stolen datasets through multiple mirror sites and torrent networks, thereby reducing the likelihood of future takedown efforts.

In addition, the incident adds to the growing number of campaigns involving ShinyHunterS Researchers have recently linked the group to attacks targeting multiple organizations, while Google's threat intelligence team has linked the group's latest activity to widespread exploitation of the Oracle PeopleSoft zero-day vulnerability before mitigations were available. 

According to a brief statement issued by the Council of Europe, the organization was "investigating the matter and assessing the situation." Further comment was not provided. The organization has not yet announced a formal notification process or measures to protect individuals' identities. Zero-day exploitation and data extortion campaigns are becoming increasingly prevalent, with public disclosure increasingly taking precedence over traditional ransomware encryption. 

The threat of persistent leak strategies is increasing, which is why organizations are being urged to strengthen vulnerability management, accelerate patch deployment, and improve incident response to minimize both institutions and individuals' long-term risks.
Read more »
Social Engineering
Computer Intrusion CyberCrime cybersecurity news Data Breach FBI Cyber Division Identity Theft Ransomware Scattered Spider Social Engineering

U.S. Secures Extradition of 19-Year-Old Linked to Scattered Spider


US authorities have intensified their pursuit of individuals linked to the financially motivated hacking collective Scattered Spider, and the extradition of a 19-year-old suspect marks another significant development. 

Peter Stokes, who is a dual citizen of the United States and Estonia, is accused of taking part in coordinated cyber intrusions, ransomware extortion, and fraud operations linked to the group, which disrupted more than 100 organizations across critical industries and generated more than $100 million in extortion payments for the group. 

After Stokes was arrested in Finland on a Red Notice from Interpol, he was transferred to the United States to be tried on several federal charges, which included conspiracy, computer intrusion, and extortion, demonstrating the increasing international cooperation being deployed for the dismantling of one of the most persistent cybercrime groups. 

In describing the prosecution, Federal officials said it is part of an ongoing effort to combat increasingly sophisticated cybercrime activities that target U.S. organizations across a range of industries. In his remarks, Andrew S. Boutros, U.S. Attorney for the Northern District of Illinois, co-chair of the Acting Attorney General's White Collar, Cyber, and Crypto Subcommittee Advisory Committee, stated that the allegations of the Scattered Spider attack caused widespread disruption to businesses nationwide and highlighted the increased capabilities of cybercriminals operating across international borders driven by financial gain. 

The Justice Department has demonstrated its commitment to pursuing technologically advanced threat actors regardless of where they are located with the charges, he stressed. In support of this position, Brett Leatherman, Assistant Director of the FBI's Cyber Division, stated that the group has consistently used employee-focused extortion and network compromise campaigns, which have resulted in millions of dollars of financial losses and disruptions to critical business operations. 

According to him, the investigation illustrates the importance of coordinating the efforts of domestic and international law enforcement to identify, disrupt, and prosecute cybercriminals, wherever they operate. The superseding criminal complaint alleges that Stokes is associated with several cyber intrusions allegedly conducted by his online alias "Bouquet," including activities that date back to his 16th year of age. 

A prosecutor contends that these activities were part of Scattered Spider's overall intrusion campaign, which also includes Octo Tempest, UNC3944, and 0ktapus, which are also tracked by security researchers. According to the investigation, the group compromised more than 100 networks by using highly targeted social engineering techniques, enabling the deployment of ransomware, data theft, and extortion schemes that collectively resulted in over $100 million in ransom payments as well as millions more in recovery costs for the organizations affected.

The complaint details a number of incidents in which Stokes and his co-conspirators allegedly breached a luxury jewelry retailer's network in May 2025, exfiltrating sensitive corporate data and demanding approximately $8 million in cryptocurrency. According to reports, the company declined to negotiate with the attackers, removed them from its environment, and incurred remediation expenses ranging from $2 million to $3 million. 

Stokes was reportedly apprehended at Helsinki Airport as he attempted to board a flight to Japan, where Finnish law enforcement officials confiscated two 2-terabyte hard drives as part of the investigation. According to investigators, Scattered Spider is not a traditional hierarchical cybercrime syndicate, but rather a decentralized, English-speaking network of young threat actors operating throughout the United States, the United Kingdom, and Europe. 

In order to gain initial access, the attackers utilize sophisticated social engineering techniques rather than exploiting software vulnerabilities. In their investigations, investigators assert that Scattered Spider has consistently focused on human manipulation rather than technical exploitation. It has been reported that members impersonate legitimate employees when contacting corporate IT support desks, convincing them to reset their credentials or authorize their account access before moving laterally through compromised environments, exfiltrating sensitive data, and demanding payment under the threat of publication.

After the high-profile compromises of MGM Resorts and Caesars Entertainment in 2023, the group's techniques have come under scrutiny. The intrusion at MGM severely disrupted casino and hotel operations. Several security researchers have observed a sector-focused targeting strategy since then, connecting the collective with multiple campaigns against major UK retailers, including Marks & Spencer, Harrods, and Co-op before it moved on to target American insurance companies, followed by the aviation industry. 

A. Tysen Duva, assistant attorney general, pointed out that the collective was responsible for over 100 network intrusions resulting in over $100 million in ransom payments. It is important to note that Stokes' case also represents the culmination of a broader international law enforcement campaign that has relentlessly dismantled the individuals operating under the pseudonym Scattered Spider. 

During recent prosecutions, Scottish national Tyler Buchanan, 24, admitted to fraud and identity theft by admitting to his role in phishing campaigns targeting Twilio and LastPass. As a result, prosecutors stated that $8 million in cryptocurrency was stolen and carries a maximum sentence of 22 years in prison.

In addition, Florida-based member Noah Urban was sentenced in August 2025 to 10 years in prison as well as a $12 million fine, while U.K. citizens Thalha Jubair and Owen Flowers pleaded guilty in June 2026 in connection with the Transport for London hack in 2024. As indicated in court documents, Flowers admitted to conspiring to compromise the networks of U.S. healthcare providers SSM Health and Sutter Health, demonstrating how far prosecutions have spread in an effort to dismantle the group's international cybercrime network. 

Despite successive arrests disrupting Scattered Spider's operations, cybersecurity researchers caution that the group's tactics continue to affect the wider threat landscape. As a result of the law enforcement actions of 2025, Mandiant observed a temporary drop in activity; however, it also stated that other financially motivated threat groups have begun replicating the collective's social engineering approach. 

An important defensive lesson of the assessment is that identity verification processes are often the primary attack surface rather than perimeter security measures. It is recommended that assistance desk authentication procedures be strengthened and that phishing-resistant authentication methods, such as hardware-backed passkeys or security keys, be adopted as effective measures for limiting unauthorized access through credential reset abuse. 

According to a joint advisory issued by U.S. and international cybersecurity authorities, once the attackers gained initial access, they have reportedly been observed monitoring internal collaboration platforms and taking part in incident response calls as a way of tracking defensive actions in real-time and evading containment measures.

Researchers believe the digital evidence recovered during Stokes' arrest in Helsinki may provide valuable information about the group's broader infrastructure as well as potential associates. Even though Stokes remains presumed innocent until proven guilty in court, this latest extradition highlights a growing international enforcement effort that is demonstrating the inability of geographical distance, decentralized operations, and youth to provide reliable barriers to coordinated cybercrime prosecution. 

International authorities are increasingly combining cross-border investigations with coordinated prosecutions to pursue individuals behind sophisticated intrusion campaigns that can disrupt businesses and disrupt lives. Increasing sophistication in identity-based attacks requires organizations to strengthen authentication controls, harden help desk verification processes, and continuously monitor privileged access in order to reduce the impact of increasingly sophisticated social engineering tactics.
Read more »
Zero Trust Security
AI governance Cloud Security Data protection Financial Cybersecurity Hybrid Cloud Security Identity Theft ransomware attacks Technology Threat Intelligence Zero Trust Security

Financial Services Must Prepare for Attacks Originating Inside the Cloud



With the increase in adoption of cloud-based infrastructure, digital banking ecosystems, and interconnected transaction platforms, cybersecurity has evolved from a regulatory requirement to a critical element of operational resilience. 

Payment service providers, banks, insurance companies, and investment firms now process massive amounts of sensitive financial data and transactions across increasingly complex environments, which makes them persistent targets for sophisticated cyber-adversaries. It encompasses the protection of internal networks, cloud workloads, customer records, mobile banking systems, and critical transaction pipelines against unauthorised access, fraud, and compromise of data. 

A comprehensive financial cybersecurity strategy today goes far beyond perimeter defence, in addition to protecting internal networks, cloud workloads, customer records, and mobile banking systems. As threats evolve, preserving the confidentiality, integrity, and accessibility of financial systems becomes increasingly important not only to prevent cyberattacks and financial losses, but also to maintain institutional trust, regulatory compliance, and overall financial system stability. 

Cloud-based applications and distributed financial platforms are simultaneously expanding the attack surface for threat actors targeting the financial sector due to the increasing reliance on cloud-native applications. As explained by Cristian Rodriguez, CrowdStrike Field CTO for the Americas, an increasing frequency of cloud-based intrusions has been directly linked to the rapid migration of financial workloads and services to cloud-based environments. 

By leveraging stolen credentials and compromised digital identities, attackers have bypassed traditional exploitation techniques altogether in many observed incidents. The ability to move discreetly across environments allows adversaries to exfiltrate data, deploy malware, and run ransomware operations at a large scale, as well as abuse cloud infrastructure to perform command and control functions. 

Based on CrowdStrike's 2025 Threat Hunting Report, intrusions targeting the financial sector increased by 26 percent during 2024, with a significant portion associated with credentials acquired through cybercriminal marketplaces operated by access brokers. A significant increase of almost 80 percent in nation-state activity targeting financial institutions was also observed, reflecting growing geopolitical and economic reasons for these attacks. 

There is an increasing focus on obtaining intelligence regarding mergers, acquisitions, investment movements, and broader market trends from threat groups, who use stolen financial data to support strategic influence operations and economic espionage. 

Genesis Panda was observed as an actor in these operations, demonstrating the continued involvement of advanced state-aligned cyber groups in financial-driven cyber attacks. Due to the rapidly expanding digital footprint within the financial sector, cybersecurity has evolved from a technical safeguard to a critical business necessity. The financial sector is increasingly targeted by cybercriminals due to the vast amounts of sensitive customer information, financial credentials, and transaction records it manages. 

By encrypting, segmenting networks, implementing multi-factor authentication, protecting endpoints, and continuously monitoring threats, organizations are ensuring that their security is strengthened to combat evolving threats. As a consequence of cyber incidents, institutions face fraud, ransomware, regulatory penalties, operational disruption, and reputational damage in addition to data theft. 

Increasingly sophisticated attacks have made sophisticated technologies like intrusion detection systems, malware defense, and real-time incident response critical to reducing financial and operational risks. In addition to maintaining consumer trust, cybersecurity plays a key role in regulatory compliance and ensuring compliance with financial standards. 

Several frameworks, including the Bank Secrecy Act, Dodd-Frank Act, Sarbanes-Oxley Act and PCI DSS, require strict controls regarding access management, data protection, and network security throughout financial environments. As threat groups become more sophisticated, their vulnerabilities are becoming more apparent across hybrid cloud environments, particularly where cloud control planes interact with legacy on-premises infrastructures. 

The threat actor Genesis Panda has demonstrated a deep understanding of cloud architectures, exploiting configuration errors and identity vulnerabilities associated with integrating distributed IT systems on a regular basis. In order to keep abreast of evolving threat actors, attack indicators, and emerging configuration risks, financial institutions need to maintain constant engagement with cybersecurity vendors and intelligence providers. 

According to Matt Immler, Okta's Regional Chief Security Officer for the Americas, security teams cannot afford to be complacent as cloud ecosystems grow increasingly complex, and that proactive vendor collaboration is essential for ensuring defensive readiness is maintained. For nearly two years, Okta’s Threat Intelligence Team has provided financial organizations with insights into active cyber campaigns and attack tactics through quarterly intelligence briefings. 

A data-driven approach has proven beneficial to organizations such as NASDAQ, where security teams have been able to remain on top of rapidly evolving threats within the sector, according to Immler. Additionally, briefings have highlighted the increasing activity of groups such as Scattered Spider that exploit human weaknesses in order to gain unauthorized access to enterprise systems by manipulating help desks and identity recovery processes. 

Additionally, CrowdStrike’s Cristian Rodriguez observed that zero-trust security frameworks that have traditionally been applied to identity and endpoint protection need to be extended to cloud workloads and operational infrastructure, to prevent attackers from lateral movement. Additionally, destructive malware such as wiper malware remains a major concern in many sectors. 

In order to detect these attacks, which are intended to permanently destroy data and render systems inoperable, state-backed actors, particularly those linked to China, often use stealth-focused tactics that make them particularly difficult to detect. In particular, Immler noted that adversaries of this type often prioritize long-term persistence, quietly integrating themselves into target environments, remaining undetected for extended periods of time before unleashing disruptive payloads. 

With this increasing challenge, organizations are increasingly finding it difficult to determine the accurate depth of compromise within financial networks, therefore reinforcing the importance of continuous monitoring, integrated threat intelligence, and resilient cloud security architectures. 

Credential Theft Continues to Dominate Financial Attacks 

The financial institutions are experiencing a significant increase in credential-driven intrusions due to sophisticated and targeted phishing campaigns. The threat actors are now utilizing a variety of methods to bypass multi-factor authentication, including adversary-in-the-middle attacks and QR-code phishing operations capable of fooling even experienced employees.

As of mid-2025, Darktrace observed nearly 2.4 million phishing emails across financial sector environments, with almost 30% targeting VIPs and high-privilege users, a reflection of the growing importance of identity compromise as an initial method of access. 

Data Loss Prevention Risks Are Expanding

Organizations have expressed concerns about confidentiality and regulatory exposure as they struggle to safeguard sensitive information, leaving enterprise environments vulnerable to malicious attacks. In October 2025, Darktrace identified more than 214,000 emails with unfamiliar attachments sent to suspected personal accounts within the financial sector. There were also 351,000 emails that carried unfamiliar files that were forwarded to freemail services such as Gmail, Yahoo, and iCloud, reinforcing the concerns regarding the leakage of data, insider risk, and compliance failures regarding sensitive financial records and internal communications. 

Ransomware Operations Are Becoming More Destructive 

The majority of modern ransomware groups prioritize data theft and extortion before attempting to encrypt data. Cybercriminals, including Cl0p and RansomHub, have emphasized the use of trusted file-transfer platforms provided by financial institutions to exfiltrate sensitive information and exert increased reputational and regulatory pressure. Fortra GoAnywhere MFT was targeted by Darktrace research several days before the related vulnerability was publicly disclosed, showing how attackers are taking advantage of vulnerabilities before traditional patching cycles are available. 

Edge Infrastructure Has Become a Primary Target 

As a result of the growing threat of virtual private networking, firewalls, and remote access gateways, researchers have observed pre-disclosure exploitation campaigns affecting Citrix, Palo Alto, and Ivanti technologies, allowing attackers to hijack sessions, gather credentials, and enter critical banking environments lateral. VPN infrastructure is increasingly being described as a concentrated attack surface, particularly where patching delays and weak segmentation give attackers the opportunity to compromise systems more deeply. 

State-Backed Threat Activity Is Intensifying 

It has been reported that state-sponsored campaigns, linked to North Korean actors affiliated with the Lazarus Group, continue to expand across cryptocurrency and fintech organizations. According to investigators, malicious NPM packages, BeaverTail and InvisibleFerret malware, and exploiting React2Shell vulnerabilities were utilized to facilitate credential theft and persistent access. Organizations throughout Europe, Africa, the Middle East, and Latin America have been affected by the activity, demonstrating the global scope and extent of these financial crimes cyber operations. 

Cloud and AI Governance Challenges Are Growing 

There is an increasing perception among financial sector CISOs that cloud complexity, insider exposure, and uncontrolled AI adoption pose systemic security risks. Keeping visibility across distributed, multi-cloud environments while preventing sensitive information from being exposed through emerging artificial intelligence tools has become increasingly challenging. With the rapid integration of AI-driven technologies into operations, governance, compliance oversight and cloud security resilience are increasingly becoming board-level cybersecurity priorities rather than merely technical concerns. 

Building Long-Term Cyber Resilience 

Due to increasing sophistication of cyber threats, financial institutions are adopting resilient security strategies to strengthen cloud, identity, and data protection. AI-powered cybersecurity tools are being used increasingly by organizations across cloud and endpoint environments to enhance threat detection, automate security operations, and expedite incident response.

Meanwhile, financial firms are increasingly relying on third-party platforms, APIs, and connected services, which require stronger identity and access management controls. In addition to addressing resource and expertise gaps, many institutions are turning to managed security services to enhance operational readiness and address resource and expertise gaps. 

A number of industry leaders emphasize that data protection is not simply a compliance obligation, but rather a fundamental business risk, putting greater emphasis on enterprise-wide governance, risk classification, and ownership of sensitive financial information. In light of the increasingly volatile cyber landscape, financial institutions are shifting their focus from reactive defenses to long-term operational resilience in response to this threat. 

Cloud expansion, identity-driven attacks, ransomware evolution, and AI-related governance risks have all contributed to the strategic business priority of cybersecurity rather than an IT function alone. In order to maintain resilience, experts warn that continuous threat intelligence collaboration, enhanced identity security frameworks, proactive cloud governance, and increased incident response capabilities that are capable of responding to rapidly changing attack patterns will be necessary. 

With attackers increasingly exploiting trust, misconfigurations, and human vulnerabilities in an environment, securing critical infrastructure, sensitive data, and digital operations will be a critical component of preserving institutional stability, regulatory confidence, and customer trust.
Read more »
Scam Detection
Cyber Frauds Cybersecurity awareness Data protection Financial Fraud Prevention Identity Theft Mobile Security Online Scams Phishing Attacks Scam Detection

Surge in Digital Fraud Prompts Consumer Reports to Issue Safety Guidance


 

By incorporating digitally mediated communication into nearly every aspect of modern life, digital media has fundamentally reshaped the way individuals interact, transact, and manage daily responsibilities, adding convenience to nearly every aspect of life. However, this same interconnected infrastructure has also broadened cybercriminal attack surfaces. 

Increasing communication channels, such as voice networks, social platforms, and messaging platforms, have led to an increase in fraud activity and sophistication. In addition to occasional phishing emails, persistent, multi-channel intrusion attempts have been developed that exploit user trust, behavior, and familiarity with platforms. 

Digital fraud is a systemic risk that is characterized by the exploitation of technological interfaces to exploit financial assets, sensitive data, and identity credentials, and has become a systemic risk in this context. According to the Consumer Cyber Readiness assessment for 2025, there is an extensive exposure rate, with nearly half of the surveyed individuals reporting a direct encounter with fraudulent schemes. 

Financial losses were a measurable component of these incidents, demonstrating the operational effectiveness of current threat models. Using a collaborative analysis conducted by consumer advocacy and cybersecurity organizations, the data also illustrates a shift in attack vectors as a result of these incidents. 

Fraud attempts are now primarily transmitted through digital channels, including email, social media, SMS, and messaging applications. Message-based fraud has experienced significant growth, with its share increasing significantly year over year, reflecting both higher user engagement on these platforms and the relative ease with which attackers can execute scalable campaigns. This trend has been confirmed by observations of threat actors, which indicate that text-based scams generate substantial illegal revenue streams alone.

Even though technology providers are implementing enhanced safeguards and detection mechanisms within their ecosystems, these controls are subject to inherent limitations. The prevention of digital fraud increasingly requires user awareness, behavioral vigilance, and proactive security practices tailored to an evolving threat environment, as well as heightened awareness and behavioral vigilance. 

Digital fraud in the Indian landscape has become even more intensified, as scale and frequency are combined to create sustained financial and psychological pressure on consumers against such a global backdrop. In recent years, fraudulent communication has become a persistent operational risk within the digital economy, as opposed to an isolated incident. 

A successful fraud attack is not only financially severe but also extremely efficient, as threat actors often compress the fraud lifecycle into a few minutes by reporting loss patterns. In conjunction with the high interaction rate among recipients of suspicious messages, this acceleration indicates an active behavioral gap exploited by adversaries. 

Through digital adoption, a larger attack surface is made available across payments, social platforms, and mobile-first services, leading to more targeted and context-aware fraud campaigns. As a consequence of the rapid evolution of attack methodologies, conventional phishing tactics are increasingly being supplemented by artificial intelligence-driven deception techniques, such as synthetic media and voice impersonation, compounding this challenge. 

Furthermore, these tools enhance credibility at large scale, making detection more difficult for the typical user. This illustrates the continuing disparity between technological sophistication and the level of user readiness. Institutional response initiatives, such as awareness programs and reporting frameworks, are gaining momentum, yet they are often operating reactively in an environment defined by continuous innovation characterized by continuous threat. 

Unless parallel advances are made in consumer education, real-time threat intelligence, and adaptive regulatory measures, the economic and systemic consequences of digital fraud will continue to hinder the country's digital growth ambitions. It is imperative that practical safeguards at the user level remain a critical line of defense in this increasingly complex threat environment. 

In Consumer Reports, the importance of utilizing native security features embedded into modern smartphones is highlighted, which are designed to detect and filter potentially malicious communication immediately. This first line of defense against high volume scam attempts is provided by these controls, whether they are advanced message filtering capabilities on iOS devices or automated spam detection within Android-based messaging platforms. 

The report recommends, however, that independent verification is necessary before initiating any financial transaction, particularly in scenarios involving urgency and emotional distress, which are common tactics used by impersonation-based fraudsters. Technical safeguards alone are not sufficient without disciplined user behavior.

By cross-checking requests using alternate communication channels, users can reduce the possibility of compromised accounts and deceptive communication. In addition, it is essential to use digital payment applications cautiously, since, despite their efficiency, they frequently lack the robust fraud prevention frameworks associated with traditional banking instruments. Because such platforms are not mandated to provide reimbursement mechanisms, users have a greater responsibility for due diligence. 

Due to this, it is recommended that financial transactions be conducted only between verified and trusted recipients, and that higher-risk payments be made through a more secure and regulated channel, such as credit-backed transactions or direct bank transfers. 

The combined measures demonstrate a broader reality in a digitally adversarial digital environment. Ultimately, resilience to digital fraud depends on a combination of technological controls, informed user judgment, and proactive risk mitigation within an increasingly adversarial digital environment.
Read more »
Malicious Link
2FA Cyber Phishing Data Breach Financial Fraud Fraud Alert Identity Theft Malicious Link

Data Breach Alert: What It Means, Why It Matters, and How to Protect Yourself Immediately




Data breach notifications should never be ignored. Discarding them as junk mail can expose you to serious risks, including financial fraud, identity theft, and unauthorized access to your personal records.

These alerts are now extremely common. They often arrive as emails or letters from organizations such as banks, telecom providers, insurers, or even gyms. Because of their frequency, many individuals overlook them. However, the Identity Theft Resource Center reports that nearly 80 percent of people received at least one such notice in the past year, with many receiving several. This repeated exposure has led to what experts describe as “breach fatigue,” where individuals stop responding to warnings altogether.

The consequences of ignoring these alerts can be severe. Criminals may open credit accounts in your name, accumulate large debts within minutes, or misuse identification numbers to access services such as healthcare. For example, a recent breach involving a U.S.-based benefits administrator exposed Social Security numbers of 2.7 million individuals. In 2024 alone, 1.36 billion breach notifications were issued. While 2025 saw fewer victims overall, the incidents became more serious. Highly sensitive data, including Social Security numbers, appeared in two-thirds of cases, while financial details or driver’s license information were involved in roughly one-third.

Cybersecurity professionals, including Sandra Glading, Greg Oslan, and David Trapp, define a data breach as an incident where unauthorized actors gain access to systems and extract personal data. This information may include basic details such as names and contact information, or more sensitive data like passwords, banking details, or national identifiers. The level of risk increases significantly when multiple types of data are combined, as attackers can reconstruct identities and carry out complex fraud.

The scale of the issue has grown rapidly. The Identity Theft Resource Center recorded 3,322 breaches affecting more than 278 million individuals in the United States in 2025, marking the highest level on record and a 79 percent increase over five years. Two decades ago, such incidents were far less frequent. Around 2010, there were roughly 600 breaches annually, and attackers primarily targeted governments or large institutions. Today, the threat landscape has shifted toward mass exploitation driven by financial incentives. According to the Federal Bureau of Investigation, cybercrime losses reached $16.6 billion in 2024, demonstrating the scale of this criminal ecosystem.


How Do You Know If You’ve Been Affected?

In many countries, including the United States, companies are legally required to inform individuals when their personal data is compromised. Notifications may arrive via email, physical mail, or identity-protection services. In major incidents, the news media may report the breach before individuals receive direct communication.

However, this system is not foolproof. Experts warn that notifications often take months because companies need time to investigate. By the time you are informed, your data may already be in use by attackers.

At the same time, scammers exploit these situations by sending fake breach alerts. These messages may include links offering free credit monitoring or contact numbers. You should never act immediately on such messages. Always verify the information through the official website of the organization before clicking links or sharing personal data.


What to Do Immediately After a Data Breach

Security experts stress that speed matters. According to IBM, the average data breach remains active for 241 days, giving attackers an advantage before detection.

1. Identify What Information Was Exposed

Different types of data create different risks. For example, an exposed email address may lead to phishing attempts, while a leaked Social Security number can enable identity theft.

Carefully review the breach notification and locate the section that lists the compromised data. If the details are unclear, contact the organization directly. You can also use trusted breach-checking tools such as services provided by the National Cybersecurity Center or “Have I Been Pwned” to verify whether your email appears in known leaks.

2. Freeze Your Credit

A credit freeze prevents lenders from accessing your credit report, making it difficult for criminals to open new accounts in your name.

To do this, contact the three major credit bureaus:

• Experian

• Equifax

• TransUnion

This process is free and can typically be completed online within minutes.

3. Place a Fraud Alert

A fraud alert requires lenders to verify your identity before approving new credit.

You only need to contact one credit bureau, which will notify the others. Standard alerts last one year, while extended alerts for confirmed identity theft victims can remain active for up to seven years.

4. Monitor Financial Accounts Closely

Unauthorized transactions may appear quickly or after a delay.

Review your bank and credit card statements regularly for several months. Enable transaction alerts to receive real-time notifications of account activity. If you notice suspicious charges, report them immediately. Most financial institutions offer zero-liability protection, but timely reporting is essential.

5. Update Your Passwords

If login credentials are exposed, attackers often attempt to reuse them across multiple platforms.

Immediately change the password for the affected account. Then update any other accounts that use the same or similar credentials. Use strong, unique passwords for each account to reduce risk.

6. Enable Two-Factor Authentication

Two-factor authentication adds an additional layer of security by requiring a temporary code generated on your device.

Although it may seem inconvenient, it significantly reduces the chances of unauthorized access. Whenever possible, use authenticator apps instead of SMS-based codes, as they are more secure.


Additional Steps to Strengthen Long-Term Protection

After addressing immediate risks, you should adopt preventive measures:

• Use a password manager to create and store complex passwords.

• Enable passkeys, which rely on biometrics or device authentication instead of traditional passwords.

• Consider identity-protection services that monitor credit activity and data leaks.

• Stay alert to phishing attempts, especially after a breach, as attackers often impersonate trusted organizations. Avoid clicking unknown links or downloading unexpected attachments.

Experts also recommend tools like the Personal Cyber Advisor from the National Cybersecurity Center, which provides tailored guidance and alerts to help users reduce their risk.


Why This Matters Now

Data breaches are no longer rare or isolated events. They have become part of a large-scale, financially driven cybercrime ecosystem. The increasing frequency, combined with the growing sensitivity of exposed data, means individuals must take a more proactive approach to digital security.

Ignoring a breach notification is no longer a safe option. Acting quickly and following the correct steps can significantly reduce the potential damage.


Read more »
Volvo Breach
Conduent Hack Data Breach Identity Theft Ransomware attack Volvo Breach

Volvo Hit in Conduent Breach Affecting 25 Million

 

A major data breach at business services provider Conduent has spiraled into a large-scale security incident affecting at least 25 million people across the United States, with Volvo Group North America among the latest victims. The breach, originally disclosed in early 2025, is now understood to be far more extensive than first reported, impacting residents in multiple states and exposing sensitive personal data. Texas authorities now estimate that 15 million people have been affected, up from an initial 4 million, while more than 10 million individuals in Oregon have also been caught up in the incident.

Conduent first confirmed in November 2025 that a cyberattack in January 2025 had exposed personal data belonging to over 10 million people. The compromised information included names, addresses, dates of birth, Social Security numbers, and health and insurance details, making it highly valuable for identity theft and fraud. Earlier, in April 2025, the company had revealed that attackers stole names and Social Security numbers during the same January intrusion, highlighting a pattern of gradually escalating disclosures as the scale of the breach became clearer.

Operational disruption accompanied the data exposure, as Conduent disclosed that a January cyberattack caused service outages impacting agencies in multiple U.S. states. Wisconsin and Oklahoma reported issues affecting payments and customer support, underscoring how attacks on back-office providers can cascade into interruptions of public services. Subsequent investigation determined that hackers had maintained access to Conduent’s network from October 21, 2024, to January 13, 2025, giving them ample time to exfiltrate personal data, including Social Security numbers, dates of birth, addresses, and health-related information.

The Safepay ransomware group later claimed responsibility for the attack in February 2025, adding an extortion dimension to the incident. Conduent, which offers printing and mailroom services, document processing, payment integrity, and other back-office support, has been sending breach notifications on behalf of affected clients, including Volvo Group North America. According to a filing with the Maine Attorney General, Volvo reported that 16,991 employees were impacted, and the company said it only learned of the incident in January 2026, many months after the original intrusion window.

In its notification letters, Conduent informed individuals that some of their personal information may have been involved due to services provided to their current or former health plans. The company stated it is not aware of any attempted or actual misuse of the compromised data but is urging recipients to consider steps to protect themselves. As part of its response, Conduent is offering free identity protection services to those affected, reflecting ongoing concern about long-term risks posed by the theft of such highly sensitive information.
Read more »
Network Attacks
AI technology AI threats Cyber Security Cyberattacks Digital Security Identity Theft Network Attacks

AI and Network Attacks Redefine Cybersecurity Risks on Safer Internet Day 2026

 

As Safer Internet Day 2026 approaches, expanding AI capabilities and a rise in network-based attacks are reshaping digital risk. Automated systems now drive both legitimate platforms and criminal activity, prompting leaders at Ping Identity, Cloudflare, KnowBe4, and WatchGuard to call for updated approaches to identity management, network security, and user education. Traditional defences are struggling against faster, more adaptive threats, pushing organisations to rethink protections across access, infrastructure, and human behaviour. While innovation delivers clear benefits, it also equips attackers with powerful tools, increasing risks for businesses, schools, and policymakers who fail to adapt.  

Ping Identity highlights a widening gap between legacy security models and modern AI operations. Systems designed for static environments are ill-suited to dynamic AI applications that operate independently and make real-time decisions. Alex Laurie, the company’s go-to-market CTO, explained that AI agents now behave like active users, initiating processes, accessing sensitive data, and choosing next steps without human prompts. Because their actions closely resemble those of real people, distinguishing between human and machine activity is increasingly difficult. Without proper oversight, these agents can introduce unpredictable risks and expand organisational attack surfaces. 

Laurie advocates moving beyond static credentials toward continuous, verified trust. Instead of assuming legitimacy after login, organisations should validate identity, intent, and context at every interaction. Access decisions must adapt in real time, guided by behaviour and current risk conditions. This approach enables AI innovation while protecting data and users in an environment filled with autonomous digital actors. 

Cloudflare also warns of AI’s dual-use nature. While it boosts efficiency, it accelerates cybercrime by making attacks faster, cheaper, and harder to detect. Pat Breen cited Australian data from 2024–25, when more than 1,200 cyber incidents required response, including a sharp rise in denial-of-service attacks. Such disruptions immediately impact essential services like healthcare, banking, education, transport, and government systems. Whether AI ultimately increases safety or risk depends on how quickly cyber defences evolve. 

KnowBe4’s Erich Kron stresses the importance of digital mindfulness as AI-generated content and deepfakes spread. Identifying fake content is no longer a technical skill but a basic life skill. Verifying information, protecting personal data, using strong authentication, and keeping software updated are critical habits for reducing harm. WatchGuard Technologies reports a shift away from malware toward network-focused attacks. 

Anthony Daniel notes that this trend reinforces the need for Zero Trust strategies that verify every connection. Safer Internet Day underscores that cybersecurity is a shared responsibility, strengthened through consistent, everyday actions.
Read more »
Subscription Abuse
Cyber Fraud Identity Theft PayPal Scam Phishing Campaign Subscription Abuse

PayPal Subscriptions Exploited in Sophisticated Email Scam

 

Hackers have found a clever way to misuse PayPal's legitimate email system to send authentic looking phishing scams that are able to bypass security filters and look genuine to the end users.

Over the last few weeks, users are complaining that they are receiving emails from PayPal's legitimate address "service@paypal.com" informing that their automatic payment has expired. The emails successfully pass all the usual security checks such as DKIM and SPF authentication and have proved to be coming directly from PayPal’s mail servers. 

One of the reasons these messages are potent is that the scammers have altered the Customer Service URL to take users to their own websites from where they can see fake purchase notifications, claiming victims have purchased high-priced electronics such as MacBooks, iPhones, or Sony devices for USD 1,300 to 1,600.

The spam text message contains Unicode characters which can make the words bold or in different fonts, all this is to help to get round spam filters and keyword detection. Instead, the messages tell recipients to call a phony “PayPal support” phone number to cancel or dispute the alleged charges. 

BleepingComputer's analysis of logs and transactions shows that the PayPal Subscriptions feature is being abused by scammers. When merchants hold a subscriber's subscription, they can do so with their own mechanism, and PayPal, in turn, will notify subscribers via email. PayPal seems to be vulnerable to a subscription metadata attack - perhaps in an API or legacy platform - which lets attackers insert arbitrary text in the Customer Service URL field (it normally only accepts valid URLs). 

The scammers can forge emails and register a fake subscriber account for an email address associated with Google Workspace mailing list. When these accounts receive the notification from PayPal, the mailing list service sends what looks like a legitimate e-mail from PayPal to the list of "victims", making it looks more and more like a scam.

Safety measures

Recipients should ignore these emails and avoid calling the provided phone numbers. These tactics historically aim to facilitate bank fraud or trick victims into installing malware on their devices . PayPal confirmed awareness of the scam and recommends customers contact support directly through the official PayPal app or website if they suspect fraudulent activity. Users concerned about account compromise should log into their PayPal account directly rather than clicking email links to verify whether any unauthorized charges actually occurred.
Read more »
WhatsApp Security
Banking Malware Cyber Attacks Cybercrime Trends Digital Fraud Identity Theft Malware Threats Online Safety Screen Sharing Scam Social Engineering WhatsApp Security

Screen Sharing on WhatsApp Turns Costly with Major Financial Loss

 


Several disturbing patterns of digital deception have quietly developed in recent months, revealing just how readily everyday communications tools can be turned into instruments of financial ruin in an instant. According to security researchers, there has been an increase in sophisticated cybercriminal schemes utilizing the trust users place in familiar platforms, particularly WhatsApp, to gain access to the internet. 

It is a common occurrence that what initially starts out as a friendly message, an unexpected image, or a polite call claiming that an “urgent issue” with a bank account is a crafted scam which soon unravels into a meticulously crafted scam. It is very possible for malicious software to be installed through downloading an innocuous-looking picture that can allow you to infiltrate banking applications, harvest passwords, and expose personal identification information without your knowledge. 

There have been instances where fraudsters impersonating bank representatives have coaxed users into sharing their screens with the false pretense that they are resolving account discrepancy. When this has happened, these fraudsters can observe every detail in real time - OTP codes, login credentials, account balances - and in some cases, they will convince victims to install remote access programs or screen mirroring programs so they can further control the device. 

It is evident from the intertwined tactics that a troubling trend in digital crime has taken place, emphasizing the need for increased vigilance among Indians and beyond, underscoring a troubling development. There is a fast-growing network of social-engineering groups operating across multiple regions, who are utilizing WhatsApp's screen-sharing capabilities to bypass safety measures and gain control of their financial lives by manipulating their screen-sharing capabilities. 

Investigators have begun piecing together the contours of this network. Initially introduced in 2023 as a convenience feature, screen-sharing has since become a critical point of exploitation for fraudsters who place unsolicited video calls, pretend to be bank officials or service providers, and convince victims to reveal their screens, or install remote-access applications masquerading as diagnostic tools, to exploit their vulnerabilities. 

Almost $700,000 was defrauded by one victim in one of the cases of abuse that spanned from India and the U.K. to Brazil and Hong Kong. This demonstrates how swiftly and precisely these schemes emerge. In describing the technique, it is noted that it is not based on sophisticated malware, but rather on urgency, trust, and psychological manipulation, allowing scammers to circumvent a lot of traditional technical protections. 

Furthermore, criminal networks are enhancing their arsenals by spreading malicious files via WhatsApp Web, including one Brazilian operation that uses self-replicating payloads to hijack contacts, automate fraudulent outreach, and compromise online banking credentials through its use of malicious payloads distributed through WhatsApp Web. 

The investigators of the fraud note that the mechanisms are based less on technical sophistication and more on psychological pressure intended to disarm victims. An unsolicited WhatsApp video call made by a number that appears local can be the start of the scam, usually presented as a bank officer, customer service agent, or even an acquaintance in need of assistance. 

Callers claim to have an urgent problem to solve - an unauthorized transaction, an account suspension threat, or even an error in the verification process - that creates a feeling of panic that encourages their victims to comply without hesitation.

The imposter will initially convince the victim that the issue is being resolved, thereby leading to them sharing their screen or installing a legitimate remote-access application, such as AnyDesk or TeamViewer, which will enable the fraudster to watch every action that occurs on the screen in real time, as they pretend to resolve it. 

By using this live feed, an attacker can access one-time passwords, authentication prompts, banking app interfaces, as well as other sensitive credentials. By doing so, attackers can be able to take control of WhatsApp accounts, initiate unauthorized transfers, or coax the victim into carrying out these actions on their own.

A more elaborate variant consists of guiding the victim into downloading applications that secretly contain keyloggers or spyware that can collect passwords and financial information long after the call has ended, allowing them to collect it all. When scammers have access to personal information such as banking details or social media profiles, they can drain accounts, take over accounts on social networks, and assume the identity of victims to target others on their contact list.

Authorities caution that the success of these schemes depends on trust exploiting, so user vigilance is key. According to the advisories, individuals should be cautious when receiving unknown phone calls, avoid sharing screens with unknown parties, disable installations coming from untrusted sources, and refrain from opening financial apps when they are receiving remote access. 

These measures are crucial in order to prevent these social engineering scams from getting the better of them, as they continue to develop. As far as the most advanced variations of the scam are concerned, the most sophisticated versions of the scam entail criminals installing malicious software through deceptive links or media files in a victim's device, thus granting them complete control of that victim's computer. 

When these kinds of malware are installed, they can record keystrokes, capture screens, gather banking credentials, intercept two-factor authentication codes, and even gain access to sensitive identity documents. It is possible for attackers to take control of cameras and microphones remotely, which allows them to utilize the device as a tool for surveillance, coercion, or a long-term digital impersonation device. 

In addition to financial theft, the extent to which the compromised identity may be exploited goes far beyond immediate financial exploitation, often enabling blackmail and continuous abuse of the victim's identity. 

In light of this backdrop, cybersecurity agencies emphasize the significance of adopting preventative habits that can significantly reduce exposure to cybercriminals. There is still an important role to play in ensuring that users do not download unfamiliar media, disable WhatsApp's automatic download feature, and keep reputable mobile security tools up to date. 

WhatsApp still has the built-in features that allow them to block and report suspicious contacts, while officials urge individuals to spread basic cyber-hygiene knowledge among their communities, pointing out that many people fall victim to cyber-attacks simply because they lack awareness of the dangers that lurk. 

There has been a surge of fraud attempts across messaging platforms, and Indian authorities, including the Indian Cybercrime Coordination Centre, as well as various state cyber cells have issued a number of public advisories about this, and citizens are encouraged to report such attacks to the National Cybercrime Reporting Portal as soon as possible. 

In conjunction with these warnings, these findings shed light on a broader point: even the most ordinary digital interactions are capable of masking sophisticated threats, and sustained vigilance remains the strongest defense against the growing epidemic of social engineering and malware-driven crimes that are booming in modern society. 

As the majority of the fraud is carried out by social-engineering tactics, researchers have also observed a parallel wave of malware campaigns that are utilizing WhatsApp's broader ecosystem, which demonstrates how WhatsApp is capable of serving as a powerful channel for large-scale infection. As an example of self-replicating chains delivered through WhatsApp Web, one of the most striking cases was reported by analysts in Brazil. 

A ZIP archive was sent to the victims, which when opened, triggered the obfuscated VBS installer SORVEPOTEL, which was an obfuscated VBS installer. In this PowerShell routine, the malware used ChromeDriver and Selenium to re-enter the victim's active WhatsApp Web session, enabling the malware to take full control of the victim's active WhatsApp Web session. 

In order to spread the malware, the script retrieved message templates from a command-and-control server, exfiltrated the user's contact list, and automatically distributed the same malicious ZIP file to every network member that was connected with it—often while displaying a fake banner that said "WhatsApp Automation v6.0" to give it the appearance of legitimacy. 

Researchers found that Maverick was a payload that was evasive and highly targeted, and it was also accompanied by a suite of malicious capabilities. It was also packaged inside the ZIP with a Windows LNK file that could execute additional code through the use of a remote server that had the first stage loader on it. As soon as the malware discovered that the device was belonging to a Brazilian user, it launched its banking module only after checking for debugging tools, examining the system locale indicators such as the time zone and language settings. 

A Maverick server monitoring website activity for URLs linked to Latin American financial institutions, when activated, was aligned with credential harvesting and account manipulation against regional banks, aligning its behavior with credential harvesting. As Trend Micro pointed out previously, an account ban could be issued as a result of the sheer volume of outbound messages caused by a similar WhatsApp Web abuse vector, which relied on active sessions to mass-distribute infected ZIP files. 

These malware infections acted primarily as infostealers that targeted Brazilian banking and cryptocurrency platforms, thereby demonstrating the fact that financial fraud objectives can be easily mapped to WhatsApp-based lures when it comes to financial fraud. 

It is important to note, however, that security analysts emphasize that the global screen-sharing scams are not primarily the work of a single sophisticated actor, but rather the work of a diffuse criminal ecosystem that combines trust, urgency, and social manipulation to make them successful. According to ESET researchers, these tactics are fundamentally human-driven rather than based on technical exploits over a long period of time, whereas Brazilian malware operations show clearer signs of being involved in structured criminal activity. 

It is thought that the Maverick Trojan can be linked to the group that has been named Water Saci, whose operations overlap with those of the Coyote banking malware family-which indicates that these groups have been sharing techniques and developing tools within Brazil's underground cybercrime market. 

Even though the associations that have been drawn between WhatsApp and opportunistic scammers still seem to be rooted in moderate confidence, they reveal an evolving threat landscape in which both opportunistic scammers and organized cybercriminals work towards exploiting WhatsApp to their advantage. 

A number of analysts have indicated that the success of the scheme is a function of a carefully orchestrated combination of trust, urgency, and control. By presenting themselves as legitimate entities through video calls that appear to originate from banks, service providers, or other reliable entities, scammers achieve a veneer of legitimacy by appearing authentic.

In addition, they will fabricate a crisis – a fake transaction, a compromised account, or a suspended service – in order to pressure the victim into making a hasty decision. The last step is perhaps the most consequential: convincing the victim to share their screen with the attacker, or installing a remote access tool, which in effect grants the attacker complete access to the device. 

In the event that a phone is gained access to, then every action, notification, and security prompt becomes visible, revealing the phone as an open book that needs to be monitored. Security professionals indicate that preventative measures depend more on vigilance and personal precautions than on technical measures alone. 

Unsolicited calls should be treated with suspicion, particularly those requesting sensitive information or screen access, as soon as they are received, and any alarming claims should be independently verified through official channels before responding to anything unfounded. The use of passwords, OTPs, and banking information should never be disclosed over the telephone or through email, as legitimate institutions would not request such data in this manner. 

Installing remote access apps at the direction of unfamiliar callers should be avoided at all costs, given that remote access applications allow you to control your device completely. It is also recommended to enable WhatsApp's built-in two-step verification feature, which increases the security level even in the event of compromised credentials.

Finally, investigators emphasize that a healthy degree of skepticism remains the most effective defense; if we just pause and check it out independently, we may be able to prevent the cascading damage that these highly persuasive scams intend to cause us.
Read more »
Online Security
Cyber Security Digital Vulnerabilities Identity Theft Internet Safety Internet Security Awareness NordVPN Online Safety Online Security

NordVPN Survey Finds Most Americans Misunderstand Antivirus Protection Capabilities

 

A new survey by NordVPN, one of the world’s leading cybersecurity firms, has revealed a surprising lack of understanding among Americans about what antivirus software actually does. The study, which polled over 1,000 U.S. residents aged 18 to 74, found that while 52% use antivirus software daily, many hold serious misconceptions about its capabilities — misconceptions that could be putting their online safety at risk. 

According to the findings, more than a quarter of respondents incorrectly believe that antivirus software offers complete protection against all online threats. Others assume it can prevent identity theft, block phishing scams, or secure public Wi-Fi connections — functions that go far beyond what antivirus tools are designed to do. NordVPN’s Chief Technology Officer, Marijus Briedis, said the confusion highlights a troubling lack of cybersecurity awareness. “People tend to confuse different technologies and overestimate their capabilities,” he explained. “Some Americans don’t realize antivirus software’s main job is to detect and remove malware, not prevent identity theft or data breaches. This gap in understanding shows how much more cybersecurity education is needed.” 

The survey also found that many Americans mix up antivirus software with other digital security tools, such as firewalls, password managers, ad blockers, and VPNs. This misunderstanding can create a false sense of security, leaving users vulnerable to attacks. Even more concerning, over one-third of those surveyed reported not using any cybersecurity software at all, despite nearly half admitting their personal information had been exposed in a data breach. 

NordVPN’s research indicates that many users believe following good online habits alone is sufficient protection. While best practices like avoiding suspicious links, using strong passwords, and steering clear of phishing attempts are important, experts warn they are not enough in today’s sophisticated cyber landscape. Modern malware can infect devices without any direct user action, making layered protection essential. 

Participants in the survey expressed particular concern about the exposure of sensitive personal data, such as social security numbers and credit card details. However, the most commonly leaked information remains email addresses, phone numbers, and physical addresses — details often dismissed as harmless but frequently exploited by cybercriminals. Such data enables more personalized and convincing phishing or “smishing” attacks, which can lead to identity theft and financial fraud. 

Experts emphasize that while antivirus software remains a critical first line of defense, it cannot protect against every cyber threat. A combination of tools — including secure VPNs, multi-factor authentication, and strong, unique passwords — is necessary to ensure comprehensive protection. A VPN like NordVPN encrypts internet traffic, hides IP addresses, and shields users from tracking and surveillance, especially on unsecured public networks. Multi-factor authentication adds an additional verification layer to prevent unauthorized account access, while password managers help users create and store complex, unique passwords safely. 

The key takeaway from NordVPN’s research is clear: cybersecurity requires more than just one solution. Relying solely on antivirus software creates dangerous blind spots, especially when users misunderstand its limitations. As Briedis put it, “This behavior undoubtedly contributes to the concerning cybersecurity situation in the U.S. Education, awareness, and layered protection are the best ways to stay safe online.” 

With cyberattacks and data breaches on the rise, experts urge Americans to take a proactive approach — combining trusted software, informed digital habits, and vigilance about what personal information they share online.
Read more »
Identity Theft
Airline Customer Data Cyber Attacks cyberattacks on airline Data Breaches Data Leak data security Hackers Identity Theft

Qantas Data Leak Highlights Rising Airline Cyberattacks and Identity Theft Risks

 

Airlines continue to attract the attention of cybercriminals due to the vast amounts of personal data they collect, with passports and government IDs among the most valuable targets. According to privacy firm Incogni, the exposure of such documents poses a “severe, long-term identity theft risk” since they are difficult to replace and can be exploited for years in fraud schemes involving fake identities, counterfeit documents, and impersonation scams. 

The recent Qantas Airways data breach, claimed by the Scattered LAPSUS$ Hunters group, underscores the sector’s growing vulnerability. The stolen data included names, email addresses, Frequent Flyer details, and limited personal information such as phone numbers and birth dates. Fortunately, Qantas confirmed that no passport details, financial information, or credit card data were compromised. 

However, experts warn that even limited leaks can have serious consequences. “Attackers often combine personal identifiers like names and loyalty program details from multiple breaches to build complete identity profiles,” said Darius Belejevas, Head of Incogni. Such composite records can enable large-scale fraud even without financial data exposure. 

The Qantas incident also highlights the danger of third-party compromises. The breach reportedly stemmed from Salesforce social engineering and vendor vulnerabilities, illustrating how a single compromised supplier can have ripple effects across industries. Belejevas emphasized that “one compromised partner can expose millions of records in a single incident.” 

Data breaches in the airline industry are escalating rapidly. According to Cyble’s threat intelligence database, more than 20 airline-related breaches have been reported on the dark web in 2025 — a 50% increase from 2024. Much of this surge is attributed to coordinated attacks by Scattered Spider and the broader Scattered LAPSUS$ Hunters alliance, although other groups have also begun targeting the aviation sector. 

In a separate incident, the CL0P ransomware group claimed to have breached Envoy Air, a regional carrier of American Airlines. Envoy confirmed the intrusion but stated that no customer data was affected, only limited business information. In contrast, WestJet, which suffered a breach in June 2025, had passports and government-issued IDs exposed, prompting it to offer two years of free identity monitoring to affected customers. Incogni, however, warned that identity theft risks from such documents can persist well beyond two years. 

Experts urge travelers to take preventive security measures. Incogni recommends enrolling in identity theft monitoring, reporting phishing attempts to national anti-fraud agencies, using strong passwords with multi-factor authentication, and removing personal data from data broker sites. 

“Individuals and organizations must do more to safeguard sensitive data,” said Ron Zayas, CEO of Incogni. “In today’s world, data isn’t just being stolen by hackers — it’s also being misused by legitimate entities to manipulate outcomes.”
Read more »
Salesforce
Airways Data Breach Data Leaked Identity Theft LAPSUS$ Qantas Salesforce

Qantas Faces Scrutiny After Massive Data Leak Exposes Millions of Customer Records

 



Qantas Airways is under investigation after personal data belonging to millions of its customers appeared online following a major cyberattack. The breach, which originated from an offshore call centre using Salesforce software, is believed to have exposed information from around 5.7 million individuals.

According to cybersecurity reports, the data was released after a criminal group known as Scattered LAPSUS$ Hunters followed through on a ransom threat. The leaked files reportedly include customers’ full names, email addresses, Frequent Flyer membership numbers, phone numbers, home and business addresses, dates of birth, and gender details. In some cases, even meal preferences were among the stolen data.

Although Qantas had outsourced customer support operations to an external provider, Australian officials emphasized that responsibility for data protection remains with the airline. “Outsourcing does not remove a company’s cybersecurity obligations,” warned Cyber Security Minister Tony Burke, who added that serious penalties may apply if organisations fail to meet legal requirements for safeguarding personal data.

Experts have cautioned customers not to search for the leaked information online, particularly on dark web platforms, to avoid scams or exposure to malicious content.

Cybersecurity researcher Troy Hunt explained that while the stolen data may not include financial details, it still poses serious risks of identity theft. “The information provides multiple points of verification that can be exploited for impersonation attacks,” he noted. Hunt added that Qantas would likely face substantial legal and financial repercussions from the incident, including class-action lawsuits.

RMIT University’s Professor Matthew Warren described the event as the beginning of a “second wave of scams,” predicting that fraudsters could impersonate Qantas representatives to trick customers into disclosing more information. “Attackers may contact victims, claiming to offer compensation or refunds, and request bank or card details,” he said. With most Qantas passengers being Australian, he warned, “a quarter of the population could be at risk.”

In response, Qantas has established a dedicated helpline and identity protection support for affected customers. The airline also secured a court injunction from the New South Wales Supreme Court to block access to the stolen data. However, this order only applies within Australia, leaving the information still accessible on some foreign websites where the databases were leaked alongside data from other companies, including Vietnam Airlines, GAP, and Fujifilm.

Legal experts have already lodged a complaint with the Office of the Australian Information Commissioner, alleging that Qantas failed to take sufficient steps to protect personal information. Similar to previous high-profile breaches involving Optus and Medibank in 2022, the case may lead to compensation claims and regulatory fines.

Professor Warren emphasised that low conviction rates for cybercrimes continue to embolden hackers. “When attackers see few consequences, it reinforces the idea that cyber laws are not a real deterrent,” he said.


Read more »
Subscribe to: Posts (Atom)