Hacks

Recently, a hacker has claimed that he/she managed to steal more than 500GB of data from the tech giant Microsoft’s private GitHub repositories. By observing the timestamps in the files that the hacker has published, indicates that the alleged hack could have occurred on March 28, 2020.  On Wednesday evening, May 6, 2020, someone named as ‘Shiny Hunters’ have contacted the BleepingComputer security portal and clearly announced that they had hacked a Microsoft’s Private GitHub repositories. Moreover, the hacker, ‘Shiny Hunters’ told the BleepingComputer security portal that they have stolen more than 500 GB of private projects from the company’s private GitHub repositories with the intention of selling them, but somehow they changed their mind and decided to publish this data for free. Microsoft’s Private Repositories Leaked As a teaser, the hacker offers 1 GB of data on one of the hacker forums for registered users, but, somehow the members of the forum doubt the aut...

DigitalOcean, one of the biggest modern web hosting platforms, recently hit with a concerning data leak incident that exposed some of its customers' data to unknown and unauthorized third parties. Though the hosting company has not yet publicly released a statement, it did has started warning affected customers of the scope of the breach via an email. According to the breach notification email that affected customers [ 1 ,  2 ] received, the data leak happened due to negligence where DigitalOcean 'unintentionally' left an internal document accessible to the Internet without requiring any password. "This document contained your email address and/or account name (the name you gave your account at sign-up) as well as some data about your account that may have included Droplet count, bandwidth usage, some support or sales communications notes, and the amount you paid during 2018," the company said in the warning email as shown below. Upon discovery, a quick di...

A security error with Reliance Jio’s  Coronavirus  Symptom Checker App exposes its core database to the Internet without a password. The COVID-19 symptoms checker app was launched by India’s largest cell network provider Jio in late March, this app allows users to check from their phone for COVID-19 infection. Jio Symptom Checker Database Leaked The security error was first observed by security researcher  Anurag Sen  on May 1 and contacted TechCrunch to notify the company. TechCrunch  contacted  Reliance Jio and the database contains reports of users’ Covid-19 tests that were taken offline quickly. The leaked database includes millions of results starting from April 17 to the time it was taken offline. It includes details of users such as age, gender, symptoms, and health data of the people who signed in to create a profile. The database also contains details such as a person’s user agent, user’s precise location if they allowed the app t...

Cybersecurity researchers today uncovered an ongoing new Magecart skimmer campaign that so far has successfully compromised at least 19 different e-commerce websites to steal payment card details of their customers. According to a  report  published today and shared with The Hacker News, RiskIQ researchers spotted a new digital skimmer, dubbed " MakeFrame ," that injects HTML iframes into web-pages to phish payment data. MakeFrame attacks have been attributed to Magecart Group 7 for its approach of using the compromised sites to host the skimming code, load the skimmer on other compromised websites, and siphoned off the stolen data. Magecart attacks usually involve bad actors compromising a company's online store to siphon credit card numbers and account details of users who're making purchases on the infected site by placing malicious JavaScript skimmers on payment forms. It's the latest in a series of attacks by Magecart, an umbrella term for eight differen...

On the same day yesterday, when the US-based telecom giant  T-Mobile admitted a data breach , the UK-based telecommunication provider Virgin Media announced that it has also suffered a data leak incident exposing the personal information of roughly 900,000 customers. What happened? Unlike the T-Mobile data breach that involved a sophisticated cyber attack, Virgin Media said the incident was neither a cyber attack nor the company's database was hacked. Rather the personal details of around 900,000 Virgin Media UK-based customers were exposed after one of its marketing databases was left unsecured on the Internet and accessible to anyone without requiring any authentication. "The precise situation is that information stored on one of our databases has been accessed without permission. The incident did not occur due to a hack, but as a result of the database being incorrectly configured," the company said in a  note published  on its website on Thursday night. Accord...