CRA disables online services after 'credential stuffing' cyberattack

Embed from Getty Images 

The Canada Revenue Agency's website was just hit with a "credential stuffing" cyberattack, giving hackers access to 9,041 users' usernames and data. The Government of Canada temporarily shut down access to its online services as the bad actors tried to access GC's services. Approximately 5,500 GCKey service and CRA accounts were affected by this attack and another recent credential stuffing attack. 

The attacks use passwords and usernames taken from previous hacks of accounts globally, taking advantage of the fact that many people reuse passwords and usernames on multiple accounts. Here's another reminder to please use different usernames and passwords for different accounts.

Click to read more ...

Uber admits that 815,000 Canadians are affected by the data breach

Uber has admitted that more than 815,000 of their Canadian customers have had their data compromised by the data breach which Uber is accused of having tried to cover up.

Customer information that was exposed in the data breach includes the names, email addresses and mobile phone numbers of customers. It is not known if credit card orother payment information. The data breach saw the theft of information from some 57 million Uber accounts globally in October 2016. Uber reportedly paid off the hackers $100,000 to delete the data and keep the breach hidden from the public.

Click to read more ...

Yahoo finally confirms 2014 breach that affected over 500 million users

The Yahoo breach first broke in August when a hacker called Peace was promising to sell 200 million usernames, passwords, birthdates, and email addresses for less than US$2,000. Yahoo wouldn’t confirm the legitimacy of the attack but now we finally get confirmation that the company was victim of a “state-sponsored” attack back in 2014. Yahoo elaborated on a statement on its investor relations site the types of data the hackers might have had access to. "The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers," the statement reads. This doesn’t include sensitive payment information but the hack is considered large enough that Yahoo is working with law enforcement to see what happens.

There is no word yet if there will be a government investigation brought about by this incident. Yahoo hasn’t also said why it took so long to publicly confirm the report. It could do with the fact that the beleaguered company is selling itself to Verizon and the news could cause harm to the deal before it officially closes in early 2017.

Source: Engadget

Hundreds of Dropbox passwords leak online, third party blamed for breach

In what has been a month of monumental security breaches and cloud compromise stories, 400 Dropbox user names and  passwords appeared online yesterday in a leak purporting access to over 7 million accounts taken from Dropbox servers.

Dropbox, whose business model is anchored on secure storage of free and paid user information, denied that there had been a breach and instead pointed to a third party source from which the information was taken. Dropbox added that many of the said passwords are no longer updated or in use but cautioned users to consider using two-step verification when putting information up on the service. Hit jump for their statement.

Click to read more ...