Weekly Cyber News Roundup – September 26th- 30th 2022

It’s been another busy week in the world of cyber security which is why every week Integrity360 highlights just a few of the biggest stories hitting the headlines.

Optus Breach Hacker releases over 10,000 customer records

Australian Federal Police have launched Operation Hurricane in an effort to identify the hackers responsible for last week’s cyberattack on the nation’s second largest telecoms company Optus.

Since the company announced that it had been a victim of an attack the hacker(s) behind the incident had demanded $1 million in cryptocurrency after briefly releasing the sensitive details of over 10,000 of Optus’ customers. The move prompted Australian authorities to warn customers to be aware of an increase in fraudulent emails and text messages.

On Tuesday, however, news broke that the hacker behind the breach had seemingly had a change of heart.

They announced that they have deleted the compromised data and apologized to Optus saying: “Too many eyes. We will not sale [sic] data to anyone. We can’t if we even want to: personally deleted data from drive (Only copy).“Sorry too 10,200 Australian who’s data was leaked. Australia will see no gain in fraud, this can be monitored. Maybe for 10,200 Australian but rest of population no. Very sorry to you.”

Despite this the pressure has mounted on Optus with Australians venting their anger over the incident online and the Australian government demanding that the company foots the bill for impacted people who need to change their IDs and passports as a result of the breach.

Optus claims the breach occurred due to a “sophisticated attack”, but the federal government has publicly disagreed stating that ‘it was due to an error by the company that had left the data accessible online’. Either way the reputational and financial damage to the company is likely to be immense.

Hacking Group ‘neutralized’ by Ukrainian Authorities

The conflict between Ukraine and Russia continues to rage online after the Ukrainian authorities announced that it had ‘neutralized’ a hacker group that was claimed to have been responsible for operating bot farms used to produce and spread information aimed to destabilize the political situation in Ukraine.

“Their wholesale clients were pro-kremlin propagandists. It was them who used the received identification data of Ukrainian and foreign citizens to spread fake news from the front lines and spread panic,” said the Ukrainian law enforcement agency.

Police arrest 17-year old hacker behind Uber and Rockstar Games breaches

City of London Police arrested a 17-year old teenager in Oxfordshire last week on suspicion of being involved in the high profile breaches at Rockstar Games and Uber. The suspect, who’s name has not been released pleaded not guilty to charges of breaches of their bail conditions and multiple counts of computer misuse.

The charges of multiple computer misuse are according to TechCrunch linked to a series of arrests earlier this year which saw Police arrest seven teenagers for suspected connections to the Lapsus$ hacking group who has been blamed for breaches at Samsung, Microsoft, Nvidia and Okta.

Seven Public and private sector organisations in hot water with ICO over GDPR failures

The UK’s Information Commissioner’s Office (ICO) has taken action against several organisations for failing to meet their GDPR obligations.

The main issue was a failure to respond to Subject Access Requests (SARs) within the one to three months timeframe stipulated within the regulation. The organisations in question received numerous complaints that forced the ICO to intervene. All seven organisations were issued with reprimands which could be increased to fines if they continue to fail to adhere to the GDPR rules.

The organisations in question are: The Ministry of Defence (MoD), The Home Office, Kent Police, The London Borough of Croydon, The London Borough of Hackney, The London Borough of Lambeth and lastly Virgin Media.

If you need assistance with GDPR compliance read our Essential Guide to GDPR

Cyber Criminals exploiting October energy price rise

A new warning has been issued by the National Fraud Intelligence Bureau that cyber criminals are trying to exploit concerns over next month's energy price rise by sending out millions of SMS messages and emails containing links to malicious sites and malware.

As with many phishing scams this one preys on people's fears, in this case worries overpaying their energy bills. In the messages the fraudsters claim to be from a government agency or energy provider and try to trick potential victims by claiming they can get money back on their bills by visiting a false government website. Visitors to said site are then encouraged to fill out a form with their details to receive a fake £400 bill refund.

Speaking about the latest attack, energy regulator Ofgem said: "It is alarming that vulnerable customers are being preyed upon in this way when people are already struggling so much. On top of issuing our own warnings and advice, we have asked all energy suppliers to ensure clear and up-to-date information on scams is easily accessible on their websites.

"We take these attempts to exploit consumers very seriously."

Integrity360 has proven experience working with major financial institutions and banks, helping to ensure their customers and employees always stay protected.