17 Jan
Here’s your weekly #databreach news roundup:
BookMyShow, NortonLifeLock, French social security agency (CAF), Maternal & Family Health Services, Aflac, and Robins & Morton.
BookMyShow
A threat actor is selling a huge database of users on a leak forum. As per the listing, the data belongs to BookMyShow. The database has personal records of 4.3 million BookMyShow users. #databreach @deepanker70https://t.co/0YeGT1jIri
— DevaOnBreaches (@DevaOnBreaches) January 15, 2023
It seems BookMyShow recently suffered a data breach. A threat actor with an alias Tango486 is selling a huge database of users on a leak forum. As per the listing, the data belongs to BookMyShow. The database has personal records of 4.3 million BookMyShow users.
Back in 2019, several BookMyShow users reported unauthorized transactions in their accounts. At that time, the company put the blame on other platforms without revealing anything about the number of affected users. I am not sure if the recent data that is for sale belong to the previous breach or a new breach.
NortonLifeLock
Gen Digital, formerly Symantec Corporation and NortonLifeLock, is sending #databreach notifications to customers, that hackers have successfully breached Norton Password Manager accounts in credential-stuffing attacks. @billtoulas @BleepinComputer https://t.co/JYLnniqJrr
— DevaOnBreaches (@DevaOnBreaches) January 14, 2023
Gen Digital, formerly Symantec Corporation and NortonLifeLock, is sending data breach notifications to customers, informing them that hackers have successfully breached Norton Password Manager accounts in credential-stuffing attacks.
According to a letter sample shared with the Office of the Vermont Attorney General, the attacks did not result from a breach on the company but from account compromise on other platforms.
“Our own systems were not compromised. However, we strongly believe that an unauthorized third party knows and has utilized your username and password for your account,” NortonLifeLock said.
“This username and password combination may potentially also be known to others.”
French social security agency (CAF)
More than 10,000 recipients of the French social security agency CAF saw their data exposed for nearly a year and a half after a file containing personal information was sent to a service provider responsible for training statisticians. #dataleak https://t.co/paAQAwUcvT
— DevaOnBreaches (@DevaOnBreaches) January 13, 2023
More than 10,000 beneficiaries of a local branch of the French social security agency CAF, or Family Allowance Fund, saw their data exposed for about 18 months, after a file containing personal information was sent to a service provider.
The mistake, discovered by France Info — Radio France’s news and investigation service — just before the year-end holidays, could hit the CAF hard. The investigation found that the CAF in Gironde (Nouvelle-Aquitaine) sent a file containing sensitive and personal information of 10,204 beneficiaries to a service provider responsible for training the organization’s statisticians.
Maternal & Family Health Services
U.S. nonprofit healthcare giant Maternal & Family Health Services has confirmed hackers accessed sensitive patient, financial, and medical information months earlier. @CarlyPage_ @TechCrunch https://t.co/MNg9YAmoaG
— DevaOnBreaches (@DevaOnBreaches) January 13, 2023
U.S. nonprofit healthcare giant Maternal & Family Health Services has confirmed hackers accessed sensitive patient, financial and medical information months earlier.
In an advisory published on its website on Thursday, MFHS said a “sophisticated ransomware incident” exposed the sensitive information of current and former patients, employees and vendors. This information included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account data and payment card information, usernames and passwords, and medical and health insurance information.
Aflac
Personal information for more than 1.3 million Aflac cancer insurance policyholders and almost 760,000 Zurich Insurance auto insurance policyholders was on the dark web following a hack on a third-party contractor. #databreach https://t.co/cT40qEh88M
— DevaOnBreaches (@DevaOnBreaches) January 13, 2023
Personal information for more than 1.3 million Aflac cancer insurance policyholders and almost 760,000 Zurich Insurance auto insurance policyholders is on the dark web following a hack on a third-party contractor.
Neither company named the data leak site or third-party vendor involved with its breaches, so it is unclear if the incidents are related. Affected individuals from both hacks reside in Japan.
In an apology published Tuesday, Aflac’s Japanese unit says it confirmed information it received on Jan. 9 about customer information being posted onto a criminal data breach forum. A hacker took the data from a server used by an external outsourced contractor, Aflac says.
Robins & Morton
Robins & Morton Group (“Robins & Morton”) filed a notice of a #databreach with the Montana Attorney General after an unauthorized party was able to access files on the company’s computer system containing confidential consumer information.https://t.co/XiLgLBKBra
— DevaOnBreaches (@DevaOnBreaches) January 9, 2023
On December 22, 2022, the Robins & Morton Group (“Robins & Morton”) filed notice of a data breach with the Montana Attorney General after an unauthorized party was able to access files on the company’s computer system containing confidential consumer information. Based on the company’s official filing, the incident resulted in an unauthorized party gaining access to consumers’ names and Social Security numbers. After confirming that consumer data was leaked, Robins & Morton began sending out data breach notification letters to all individuals who were impacted by the recent data security incident.
