Jerrys Blog

TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. […]

You just spend a few hundred dollars on a fancy 2TB NVMe SSD, but when you plug it in to your Windows PC, you notice that only about 1.8TB show up. Given the cost of storage, it is painful to “lose” 9% of the storage you intended to buy before you transferred a single file.

So you’ve found an old CRT PC monitor, or maybe you inherited it from your grandpa. Either way, it’s just a heavy old piece of junk, right? Best to just send it off for recycling, because there’s no good use for these anymore. Wrong!

An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse.

The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the CPR system, unauthorized people gained access to the names, addresses, CPR numbers, and other information belonging to around 8.8 million people registered in the system. CPR numbers are Denmark’s personal identification numbers.

How could a password so weak that it should have been rejected by the system open the door to so much personal information?

The attacker reportedly gained access through Pays ApS, an IT company based in Odense. According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused. Pays offers services including data updates and “CPR cleansing,” allowing customers to check records against the register to update addresses, identify people who have died, and obtain information about changes of address.

The attacker reportedly used a leaked password associated with a former Pays employee. TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research.

The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have stopped on September 20. An unusually large bill for around 14 million searches drew attention to the breach.

Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.

A weak, leaked password opened an authorized route into a sensitive register. That access allowed millions of searches, and the activity was discovered only after an unusually large bill drew attention to it.

How to stay safe

If your organization handles sensitive data:

• Don’t reuse passwords or use personal passwords for work accounts. Use a password manager to create and remember strong, unique passwords for you.
• For systems that give access to sensitive data, enforce authentication that would reject weak passwords and make multi-factor authentication mandatory.
• Monitor for unusual activity. That many searches from one account should have been noticed earlier.

If your data may have been exposed in this breach:

• Keep an eye on official updates about the incident.
• Be alert to phishing and other scams. Scammers could use personal details to make their messages more convincing.
• Read our blog Involved in a data breach? Here’s what you need to know.

Pro tip: Use Malwarebytes Scam Guard if you’re unsure if a message is legitimate. It can help you determine whether it’s a scam and what to do next.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free ? 

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users’ cryptocurrency wallets. […]

Last week on Malwarebytes Labs:

• ASOS breach update: Hackers stole customer details and shopping searches
• Attackers hijack country-code domains to impersonate Google and other services
• Amazon has an uncomfortably personal profile on you
• Meta’s Muse AI files away your friendships, arguments, and secrets
• Google issues Android security updates: who can get them and how
• AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes
• Update Chrome and ChromeOS to fix critical security issues
• Another ShinyHunters suspect arrested
• ASOS “hackers” send push notifications to customers
• Facebook Marketplace scam uses your name and number
• Domino’s customers targeted in credential stuffing attacks
• Google pauses open source bug bounty program after rise in AI submissions
• Proposed anti-Flock bills could spell trouble for license plate readers

Stay safe!

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free ? 

While the term “agentic AI” has circulated in tech and business for some time, frontier AI companies like OpenAI and Meta are now reimagining it for the masses. Imagine an AI pet with a cute name and a distinctive personality that can perform tasks on your behalf. That’s essentially the idea behind OpenAI’s Dots and Meta’s Muse — personal AI agents designed to handle tasks for you.

The dream of “one cable to rule them all” is finally a reality, and dozens of devices are better off because of it. USB-C gave us permission to own fewer single-use cables than we used to, and it opened the door to interesting functionality that would otherwise be impossible, like running data, power, and video between a single port on a laptop and a monitor.

The customer data stolen from global fashion retailer ASOS includes more than just names and contact details, raising questions about its early reassurances.

As we reported earlier this week, ASOS customers received a push notification through the ASOS app alleging that the company had been hacked.

ASOS has confirmed that attackers accessed customer information after tricking an employee into handing over login credentials. While the retailer says payment card information and customer passwords were not accessed, reporting by the BBC shows the stolen information includes more than the “basic personal information” initially mentioned by the company.

The stolen login details were used to access information on third-party platforms used by ASOS. The company says it locked down the affected platforms and launched an investigation with internal and external specialists. It also says it has strengthened its security controls.

What data was stolen?

In our initial coverage, we highlighted the potentially detailed customer profiles associated with ASOS’s marketing setup. The BBC’s findings now establish that at least some shopping-related information was taken.

According to the BBC, which received a sample from the attackers, the exposed data includes:

• Names and home addresses
• Phone numbers and email addresses
• Customer numbers and dates of birth
• Searches customers made on the ASOS website
• Details such as when a customer started using ASOS

The BBC reported search terms including “reclaimed vintage,” “glamorous wide fit,” and “Asos petite.” That makes this more than a stolen contact list. The information can also reveal customers’ shopping interests and their relationship with the retailer.

The attackers’ original notification named Snowflake, a data storage and analysis platform. They subsequently told the BBC that they accessed the information through Simon AI, a platform built on Snowflake that ASOS uses for customer personalization.

Snowflake said it had found no compromise of its platform. Using stolen credentials to access a customer’s account or a connected service does not necessarily mean the underlying platform was breached. The available reporting does not establish a vulnerability in Snowflake or Simon AI.

ASOS’s communication with customers

Customers first heard about the breach from the cybercriminals, rather than the retailer. The attackers’ decision to send a notification through the ASOS app may have made that unavoidable.

But the Independent reported that ASOS’s full statement followed roughly five hours of silence, leaving customers alarmed by the notification and waiting for an explanation.

Security expert Kevin Beaumont criticized the response:

“ASOS are experiencing the exact same PR gaffs as Co-op and M&S by not being honest with customers. If you’re dealing with Advanced Persistent Teenagers you need much better crisis plans.”

While the attackers are threatening to release the data, ASOS says its full investigation will continue over the coming weeks. It will contact customers directly where it believes further information, support, or action is required.

Reportedly, the group gave ASOS two weeks to make contact and said it wanted a ransom in exchange for deleting customer information. ASOS did not disclose whether it would pay.

How to stay safe

ASOS says its website and app remain safe to use, and that payment card information and customer passwords were not accessed. But the stolen details and shopping searches could help scammers make targeted phishing messages more convincing.

A message that knows your name, or what you searched for, isn’t proof it came from ASOS.

• Be wary of unexpected emails, texts, or calls about the breach, refunds, deliveries, or problems with your ASOS account.
• Don’t follow links in unexpected messages, and don’t follow the Telegram link in the attackers’ message or engage with them. Go directly to the ASOS website or app to check your account.
• Don’t share passwords, security codes, or payment details in response to an unsolicited message or call. ASOS says it will never ask you to do this.
• If your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know.

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.