Hacks

Recently, a hacker has claimed that he/she managed to steal more than 500GB of data from the tech giant Microsoft’s private GitHub repositories. By observing the timestamps in the files that the hacker has published, indicates that the alleged hack could have occurred on March 28, 2020.  On Wednesday evening, May 6, 2020, someone named as ‘Shiny Hunters’ have contacted the BleepingComputer security portal and clearly announced that they had hacked a Microsoft’s Private GitHub repositories. Moreover, the hacker, ‘Shiny Hunters’ told the BleepingComputer security portal that they have stolen more than 500 GB of private projects from the company’s private GitHub repositories with the intention of selling them, but somehow they changed their mind and decided to publish this data for free. Microsoft’s Private Repositories Leaked As a teaser, the hacker offers 1 GB of data on one of the hacker forums for registered users, but, somehow the members of the forum doubt the aut...

On the same day yesterday, when the US-based telecom giant  T-Mobile admitted a data breach , the UK-based telecommunication provider Virgin Media announced that it has also suffered a data leak incident exposing the personal information of roughly 900,000 customers. What happened? Unlike the T-Mobile data breach that involved a sophisticated cyber attack, Virgin Media said the incident was neither a cyber attack nor the company's database was hacked. Rather the personal details of around 900,000 Virgin Media UK-based customers were exposed after one of its marketing databases was left unsecured on the Internet and accessible to anyone without requiring any authentication. "The precise situation is that information stored on one of our databases has been accessed without permission. The incident did not occur due to a hack, but as a result of the database being incorrectly configured," the company said in a  note published  on its website on Thursday night. Accord...

Google removed 500 malicious Chrome extensions from its Web Store after they found to inject malicious ads and siphon off user browsing data to servers under the control of attackers. These extensions were part of a malvertising and ad-fraud campaign that's been operating at least since January 2019, although evidence points out the possibility that the actor behind the scheme may have been active since 2017. The findings come as part of a  joint investigation  by security researcher Jamila Kaya and Cisco-owned Duo Security, which unearthed 70 Chrome Extensions with over 1.7 million installations. Upon sharing the discovery privately with Google, the company went on to identify 430 more problematic browser extensions, all of which have since been deactivated. "The prominence of malvertising as an attack vector will continue to rise as long as tracking-based advertising remains ubiquitous, and particularly if users remain underserved by protection mechanisms," s...

If you're among those millions of customers who shopped at any of 850 Wawa stores last year but haven't yet hotlisted your cards, it's high time to take immediate action. That's because hackers have finally put up payment card details of more than 30 million Wawa breach victims on sale at Joker's Stash, one of the largest dark web marketplaces where cybercriminals buy and sell stolen payment card data. As The Hacker News  reported  last month, on 10th December Wawa learned that its point-of-sale servers had malware installed since March 2019, which stole payment details of its customers from potentially all Wawa locations. At that time, the company said it's not aware of how many customers may have been affected in the nine-month-long breach or of any unauthorized use of payment card information as a result of the incident. Now it turns out that the Wawa breach marked itself in the list of largest credit card breaches ever happened in the history of the U...

If you have ever contacted Microsoft for support in the past 14 years, your technical query, along with some personally identifiable information might have been compromised. Microsoft today admitted a security incident that exposed nearly 250 million "Customer Service and Support" (CSS) records on the Internet due to a misconfigured server containing logs of conversations between its support team and customers. According to Bob Diachenko, a cybersecurity researcher who spotted the unprotected database and reported to Microsoft, the logs contained records spanning from 2005 right through to December 2019. In a blog post, Microsoft  confirmed  that due to misconfigured security rules added to the server in question on December 5, 2019, enabled exposure of the data, which remained the same until engineers remediated the configuration on December 31, 2019 Microsoft also said that the database was redacted using automated tools to remove the personally identifiable informat...