Data Breaches

[kccadcam]

So many lately, Comcast is the latest.
I'll bet every one of us has some exposed data somewhere.
Next will be sites like BitWarden and other password managers (if not already)

How do you even keep up with this now?


https://www.bleepingcomputer.com/tag/data-breach/

[mkd]

Mr Cooper got breached. They basically have all past and present customer's data exposed, but are saying they'll notify whose been effected.
 What do you know about Bitwarden? I just started using them

[Jim at Gentex]

If you are using ANY online password manager, STOP DOING THAT!

Nuff said...

[Zoffen]

https://keepass.info/

 

[Tim Johnson]

If you are using ANY online password manager, STOP DOING THAT!

Nuff said...

My passwords are on paper and stored in my safe.

[gcode]

and another one
this is the web site for PCT Cutting tools
The front page is still OK
https://pct-imc.com/ 

The pages to check stock and such are down
I don't know how long they've been down

https://www.imc-companies.com/alert/

[__]

Some good tips for avoiding being hacked, using 2factor authentication,

 avoid apps such as whatsapp with

vulnerabilities to pegasus software, clear your cookies, don't save passwords in your browser,

 use a VPN on public wifi,
Use strong passwords generated by a password generator, don't re use passwords

[CNCAppsJames]

NEVER use public WiFi. 

[mattq]

I also got a notice from Mr. Cooper that they had a breach.  That is also my mortgage company.     

[JParis]

For those using Bitwarden

Bitwarden uses AES-CBC 256-bit encryption for your vault data, and PBKDF2 SHA-256 or Argon2 to derive your encryption key.

Bitwarden always encrypts and/or hashes your data on your local device before anything is sent to cloud servers for storage. Bitwarden servers are only used for storing encrypted data. For more information, see Storage.

Vault data can only be decrypted using the key derived from your master password. Bitwarden is a zero knowledge encryption solution, meaning you are the only party with access to your key and the ability to decrypt your vault data.

https://bitwarden.com/help/what-encryption-is-used/

Use a Strong password and rotate it....

In my opinion, instead of a password.....use a passphrase and substitute characters and/or numbers in several places for your encryption key.

and remember, once Quantum computing goes "real world" no passphrase will be safe from being cracked.

[Jeff]

and another one
this is the web site for PCT Cutting tools
The front page is still OK
https://pct-imc.com/ 

The pages to check stock and such are down
I don't know how long they've been down

https://www.imc-companies.com/alert/

Recently tried one of their end mills for stainless. That Exxtral Silver coating is insane.
Did a ton of cutting and it still looks brand new.

[MIL-TFP-41]

Came in this morning to this e-mail from Berkshire eSupply. Berkshire host websites for a whole bunch of small vendors, like west tool. I didn't order tons of stuff from Berkshire, and could really care less if they see that I purchased deburring tools, but the scope of this hack has got to be hurting those smaller vendors.

These are the hackers speaking. Yes, the ones responsible for wiping out Berkshire E-Supply almost two months ago, and because of whom, Berkshire is still down to this very day. Berkshire sent out an email about the incident two weeks ago, trying to slither their way out of responsibility, and claiming that their systems weren't truly affected (yet somehow their systems remain down to this day?!). We thought we'd set the record straight ourselves, and come to you from their very own mailing systems.
 
Berkshire E-Supply claims we only compromised a third-party, and that we don't have all of their clients' data. That is far from the truth. We have 100s of GBs of client data, including all customer details, orders, and shipments ever handled by Berkshire E-Supply, and have already released a select portion of the data on our telegram channel. It is either that Berkshire knows we have all this data, in which case they are unashamedly lying to you, or they are still clueless to the scale of the compromise. We will let you decide which is worse.
 
Okay, we understand why you wiped out the Israeli National Archive, the State Payment Gateway, Ikea Israel, Toyota Israel, the Israeli cyber security firms Radware and MAX Security & Intelligence, as well as hundreds of other Israeli companies. But why did you choose to wipe out the servers and databases of Berkshire E-Supply, PTS Tools, IMC, and ISCAR (and their backups)?
 
The answer is quite simple. Every single one of these companies either has a large office/HQ in Israel, or has chosen to sign huge financial contracts with Israeli entities. Doing business with Israel is complicity in the crimes it is currently committing, including the cold blooded murder of over 9,000 of our children. 9,000 dead children is equivalent to death toll of three 9/11's, except every dead body is that of a lifeless infant or child.
 
Let it be clear: There will be no mercy for the complicit. Any organisation or entity that chooses to support those occupying our land and killing our children, whether financially, politically, or through any other means, is choosing to put themselves in the line of fire. Let this be a warning, and let Berkshire E-Supply (which is still down almost two months later) be a lesson for those that wish not to entangle their businesses in the murder of our children and (by effect) the destruction of their companies.
 
Indeed, any entity that chooses to continue in their complicity of the murder of our children, will certainly pay the price of their complicity.

[gcode]

A pretty substantial hack

CyberNews

[mkd]

I also got a notice from Mr. Cooper that they had a breach.  That is also my mortgage company.     

How did you get notified? I haven't heard anything.

There needs to be a revamp of how the western world deals with sensitive info. Having your info with 100 different private companies clearly isn't working.
How workable would it be to have a centralized database (like the credit reporting agencies we have or a gov't entity) where only certified and credentialed entities can get a yes/no credit answer without transacting in irrevocable personal data? So, like a temporary ID using blockchain technology. .....

[RobertELee]

Today we recieved a letter stating 'LoanCare, our Mortgage Loan Servicers Subservicer' (too many hands in the cookie jar IMO) had a data breach and they now may have our name, address, SSN, and loan number.