07 Feb
Here’s your weekly #databreach news roundup:
Google Fi, Puma, U.S. No Fly list, JD Sports, and Arnold Clark.
JD Sports
UK sports apparel chain JD Sports is warning customers of a #databreach after a server was hacked that contained online order information for 10 million customers. @billtoulas @BleepinComputer https://t.co/BiXyYaX3AN
— DevaOnBreaches (@DevaOnBreaches) January 31, 2023
UK sports apparel chain JD Sports is warning customers of a data breach after a server was hacked that contained online order information for 10 million customers.
In data breach notices shared by affected customers, the company warns that the “attack” exposed customer information for orders placed between November 2018 and October 2020.
JD Sports says it detected the unauthorized access immediately and responded quickly to secure the breached server, preventing subsequent access attempts.
U.S. No Fly list
A U.S. No-Fly list with over 1.5 million records of banned flyers and upwards of 250,000 'selectees' has been shared publicly on a hacking forum.@Ax_Sharma @BleepinComputer https://t.co/VWQQpr8Dc9
— DevaOnBreaches (@DevaOnBreaches) January 31, 2023
A U.S. No Fly list with over 1.5 million records of banned flyers and upwards of 250,000 ‘selectees’ has been shared publicly on a hacking forum.
BleepingComputer has confirmed the list is the same TSA No Fly list that was discovered recently on an unsecured CommuteAir server.
This month, Swiss hacker maia arson crimew (formerly Tillie Kottmann), stumbled upon a misconfigured AWS server containing TSA’s No Fly list, as first reported by Daily Dot journalists Mikael Thalen and David Covucci.
Puma
A threat actor has listed an 84MB-strong dataset for sale that allegedly belongs to the multinational sportswear manufacturer.
The cybercriminal or criminals behind the dataset listing claim that it is from Puma’s Chilean e-commerce website, although at the time of writing Cybernews was unable to independently verify this.
The leaked database included customers’ names and contact information, such as emails, telephone numbers, and billing and shipping addresses. It also contained details about their purchases – order numbers, payment methods, total monies paid, shipping costs, and discounts.
Read more at : https://cybernews.com/security/puma-investigates-data-leak/
Private data allegedly belonging to more than 230,000 Puma customers in Chile has been found on a hacker forum.
— DevaOnBreaches (@DevaOnBreaches) January 31, 2023
The leaked database included customers' names and contact information, such as emails, telephone numbers, billing, and more. #databreach https://t.co/ZXNyMKpPaD
Google Fi
Google’s cell network provider Google Fi has confirmed a #databreach, likely related to the recent security incident at T-Mobile, which allowed hackers to steal millions of customers’ information. @CarlyPage_ @TechCrunch https://t.co/nZ4hKLe72Z
— DevaOnBreaches (@DevaOnBreaches) January 31, 2023
Google’s cell network provider Google Fi has confirmed a data breach, likely related to the recent security incident at T-Mobile, which allowed hackers to steal millions of customers’ information.
In an email sent to customers on Monday, obtained by TechCrunch, Google said that the primary network provider for Google Fi recently informed the company that there had been suspicious activity relating to a third-party support system containing a “limited amount” of Google Fi customer data.
The timing of the notice — and the fact that Google Fi uses a combination of T-Mobile and U.S. Cellular for network connectivity — suggests the breach is linked to the most recent T-Mobile hack. This breach, disclosed on January 19, allowed intruders access to a trove of personal data belonging to 37 million customers, including billing addresses, dates of birth and T-Mobile account details. The incident marked the eighth time T-Mobile has been hacked since 2018.
Arnold Clark
Arnold Clark, self-described as Europe's largest independent car retailer, is notifying some customers that their personal information was stolen in a December 23 cyberattack claimed by the Play ransomware group. #databreach https://t.co/B2ARG9C2kA
— DevaOnBreaches (@DevaOnBreaches) February 2, 2023
Arnold Clark, self-described as Europe’s largest independent car retailer, is notifying some customers that their personal information was stolen in a December 23 cyberattack claimed by the Play ransomware group.
The company said in emails sent to affected clients on Tuesday that the stolen data includes ID information and banking details.
“During this incident, it appears that some personal data stored in our network may have been stolen, including names, contact details, dates of birth, vehicle details, ID documents (such as passports and driver’s licenses), National Insurance numbers (in limited cases) and bank account details,” the car retailer said.
“Upon advice from our cyber security team, we understand the some personal data has been extracted by the hackers who carried out the cyber attack.”
