Cybercrime and politics crossed paths yet again as a data breach at the Clinton Foundation was revealed as part of a wide reaching campaign. A massive cryptocurrency theft led to tens of millions of dollars in potential losses for The DAO. Acer is notifying users of a breach at the company's e-commerce site. And banks continue to be targeted with DDoS attacks. A variety of companies are also reporting secondary breaches stemming from the breaches at LinkedIn and others, keeping the issue of password reuse in the spotlight. Researchers highlighted a variety of malware this week including PunkeyPOS, DED Cryptor, RAA ransomware, Magnit and GozNym. The FBI released updated stats on business email compromise scams, and surprise, it's only getting worse. Legal news includes financial institutions filing a lawsuit against Wendy's, Home Depot filing an antitrust lawsuit against Visa and MasterCard over chip-and-signature issues, the SEC warning of a man hacking accounts to make unauthorized trades, and a $950,000 privacy settlement with the FTC. Also, some people are not too happy about a Game of Thrones spoiler service.
This week's trending cybercrime events include Wendy's announcing its point-of-sale breach is significantly larger than previously reported, a breach at the Democratic National Committee and theft of Donald Trump opposition research, and a nearly 8-million strong breach at Japan's top travel agency. The University of Calgary also joined the growing list of organizations that have made sizable ransomware payments, and file sharing service iMesh became the latest company to face a massive breach of user records. Advisories include more dark web dumps, a variety of espionage-related headlines, the apparent demise of the Angler Exploit Kit, and updates on malware, including ransomware targeting smart TVs. Trending legal stories include a hearing on the 6-month-old Cybersecurity Information Sharing Act, a ruling in favor of Net Neutrality, and a $1 million Morgan Stanley fine. Also, the once maligned Healthcare.gov website now ranks among the web's most trustworthy sites.
This week saw more news about password breaches as 427 million Myspace passwords and 65 million Tumblr passwords were put up for sale on the dark web. Scrum.org announced a potential data breach stemming from a vulnerability in third-party email server software. TeamViewer faced a DDoS attack and what the company claims are false accusations that it suffered a data breach. Australia's NSW Trainlink halted its online reservation system due to a compromise. Pakistan's Zameen real estate was hacked and had its entire database allegedly posted online. Trending advisories include warnings of a potential cryptoworm known as ZCrypt, the dormant FrameworkPOS campaign resurfacing, and Kovter malware targeting Fortune 500 companies by escalating from low-level adware to more advanced threats. The FBI also warned of data breach victims being extorted, and there was a vulnerability discovered in the popular WordPress Jetpack plugin. Legal stories include developments in the Anthem, CareFirst and Kroger breach lawsuits as well as warnings from the UK's IOC and the largest ever arrest of Russian hackers. Finally, one apartment complex found a controversial new way to get Facebook likes.