Infosec In Brief Nearly half the citizens of France have had their data exposed in a massive security breach at two third-party healthcare payment servicers, the French data privacy watchdog disclosed last week.
Payments outfits Viamedis and Almerys both experienced breaches of their systems in late January, the National Commission on Informatics and Liberty revealed, leading to the theft of data belonging to more than 33 million customers.
Affected data on customers and their families includes dates of birth, marital status, social security numbers and insurance information.
No banking info, medical data or contact information was compromised, the CNIL added.
Padova believes the breach is the largest in France's history.
Viamedis was reportedly compromised through a phishing attack that targeted healthcare professionals, and used credentials stolen from such professionals to gain access to its systems.
Almerys didn't disclose how its compromise occurred, but it's possible the ingress was similar in nature - it admitted the attacker gained access through a portal used by healthcare providers.
The CNIL said that it's working with Viamedis and Almerys to ensure those affected are informed - as is required under the EU's General Data Protection Regulation - but it'll likely take some time to get the word out to nearly half the country.
In the meantime, French officials are warning that the stolen data could be combined with data from other breaches to be used in phishing attacks or social engineering schemes.
Networking biz Juniper reportedly leaked information about the devices its customers owned, according to a Krebs on Security report.
The source of the leak was Juniper's support portal, which was apparently found by a 17-year-old intern to allow searches on the name of any customer - and then to produce a list of devices they had acquired and registered with Juniper.
Cisco is warning of some serious cross-site request forgery vulnerabilities in its Expressway Series devices that could give an attacker the ability to perform arbitrary actions on compromised devices.
Patches are available, so get 'em installed on both Expressway-C and Expressway-E devices.
No more tricks: Canada wants to ban the Flipper Zero.
The Flipper is a cool piece of hardware that's able to do a lot of stuff - but anyone familiar with the miniscule device is probably already shaking their head at the idea that the device, with its sub-GHz antenna, can help crooks steal cars.
Most modern cars can't be cracked by the Flipper thanks to the use of rolling codes - supposing they're properly implemented, that is.
Florida man sentenced for dark web ID theft scheme while already in prison.
Currently serving 12 years in prison for bank fraud and aggravated identity theft in Florida, Dennis pled guilty this week to additional aggravated ID theft charges out of Georgia that appear related to his previous conviction.
Dennis was sentenced in Florida in 2022 for using fake IDs populated with real information to open bank accounts and take out fraudulent loans, in one case making off with $20k in cash using another person's identity.
Dennis didn't just buy and use stolen PII, though - he also crafted it into profiles to sell to other criminals, and offered guidance on how to use the dodgy dossiers to commit bank fraud.
This Cyber News was published on go.theregister.com. Publication date: Mon, 12 Feb 2024 08:13:03 +0000