Recent Breaches
-
February 1, 2018 • The Purchase Line School District is the victim of a email spoofing attack by an individual pretending to be a school district employee.
-
February 1, 2018 • The City of Pittsburg in Kansas reveals to have been subjected to a sophisticated phishing scheme targeting employee payroll data. The attack results in the release of sensitive information for current and former city employees who received a W-2 for the 2017 fiscal year.
-
February 1, 2018 Kinetics Systems falls victim of a phishing attack. The personal information of 11 residents of New Hampshire, including their W-2 forms, is compromised.
-
February 1, 2018 • HORNE LLP notifies an incident affecting the security of protected health information of certain Forrest General Hospital patients. On November 1, 2017, the company discovered that the email account of one of its employees was sending phishing emails.
-
February 1, 2018 • In approximately February 2018, the employment website Jobandtalent suffered a data breach which then appeared for sale alongside other breaches a year later. The incident impacted 11 million subscribers and exposed their names, email and IP addresses and passwords stored as salted SHA-1 hashes.
-
February 1, 2018 • In February 2018, the diet and exercise service MyFitnessPal suffered a data breach. The incident exposed 144 million unique email addresses alongside usernames, IP addresses and passwords stored as SHA-1 and bcrypt hashes (the former for earlier accounts, the latter for newer accounts). In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. The data was provided to HIBP by a source who requested it to be attributed to "BenjaminBlue@exploit.im".
-
January 31, 2018 • Users who were aiming to buy Bee Tokens during a Token Generation Event (i.e., an initial coin offering) are tricked into sending the money to scammers instead. The attackers steal nearly $1M worth of cryptocurrency.
-
January 31, 2018 • Car-sharing company GoGet discloses a major data breach seven months after it was first detected in June 2017 as the alleged hacker is arrested by Australian police this week. In an email sent to customers, the firm says its IT team identified "unauthorised activity" on its system on 27 June last year and immediately launched a full internal investigation.
-
January 30, 2018 • ABN Ambro is targeted by a new DDoS attack. Now the fingers are pointed to Russia.
-
January 30, 2018 • And during the same wave of DDoS attacks, also ING is targeted (once again).
-
January 30, 2018 • The Spartanburg Public Library system is shut down after it is hit with a ransomware attack.
-
January 30, 2018 • In January 2018, the Indian property website PropTiger suffered a data breach which resulted in a 3.46GB database file being exposed and subsequently shared extensively on a popular hacking forum 2 years later. The exposed data contained both user records and login histories with over 2M unique customer email addresses. Exposed data also included additional personal attributes such as names, dates of birth, genders, IP addresses and passwords stored as MD5 hashes. PropTiger advised they believe the usability of the data is "limited" due to how certain data attributes were generated and stored. The data was provided to HIBP by dehashed.com.
-
January 30, 2018 • In January 2018, the Joomla template website JoomlArt inadvertently exposed more than 22k unique customer records in a Jira ticket. The exposed data was from iJoomla and JomSocial, both services that JoomlArt acquired the previous year. The data included usernames, email addresses, purchases and passwords stored as MD5 hashes. When contacted, JoomlArt advised they were aware of the incident and had previously notified impacted parties.
-
January 29, 2018 • The Dutch Tax Authority is also taken down by a DDoS attack.
-
January 29, 2018 • Rabobank is the third of the big Dutch banks to be targeted by a DDoS attack.
-
January 29, 2018 • Chester County School District posts on its Facebook page that ransomware hit the district's servers over the weekend.
-
January 29, 2018 • The Dutch official online signature system DigID is also reportedly hit by the same wave of DDoS attacks.
-
January 28, 2018 A hacker tricks Experty ICO participants into sending Ethereum funds to the wrong wallet address. He is able to do this by sending emails with a fake pre-ICO sale announcement to Experty users who signed up for notifications. The bounty amounts to $150,000.
-
January 28, 2018 • The Ontario Progressive Conservative Party's internal database is locked up by a ransomware attack in early November. The incident is first being acknowledged now.
-
January 27, 2018 • ABN Ambro is the victim of a sustained DDoS attack. The wave of cyberattacks comes just days after local media reported that Dutch intelligence agency AIVD spied on Russia-linked hacker group Cozy Bear, also known as APT29, as early as 2014.