This week’s essential cybersecurity and privacy news for the cyber-aware and the cyber-concerned. Designed to educate, support, and advocate.
Stan’s Top of the News
Our Top of the News this week is fraud. Read Charlotte Cowles heart-wrenching story of the day she gave $50,000 to scammers. 2.6 million of our neighbors reported losses to the Federal Trade Commission. Warn the people you know and love so they don’t become victims. Please. Don’t let what happened to Charlotte Cowles happen to the people you love.
- The Day I Put $50,000 in a Shoe Box and Handed It to a Stranger: I never thought I was the kind of person to fall for a scam. … On a Tuesday evening this past October, I put $50,000 in cash in a shoe box, taped it shut as instructed, and carried it to the sidewalk in front of my apartment, my phone clasped to my ear. “Don’t let anyone hurt me,” I told the man on the line, feeling pathetic. … “You won’t be hurt,” he answered. “Just keep doing exactly as I say.”
- As Nationwide Fraud Losses Top $10 Billion in 2023, FTC Steps Up Efforts to Protect the Public: Newly released Federal Trade Commission data show that consumers reported losing more than $10 billion to fraud in 2023, marking the first time that fraud losses have reached that benchmark. This marks a 14% increase over reported losses in 2022. … Consumers reported losing more money to investment scams—more than $4.6 billion—than any other category in 2023. That amount represents a 21% increase over 2022. The second highest reported loss amount came from imposter scams, with losses of nearly $2.7 billion reported. In 2023, consumers reported losing more money to bank transfers and cryptocurrency than all other methods combined.
- How to avoid the top scam of 2023: The internet has ‘really supercharged’ it, expert says: Imposter scams were the most prevalent type of consumer fraud in 2023, according to the Federal Trade Commission. … There are many forms, but they share a basic premise: Criminals pretend to be someone you trust, such as a romantic interest, government agent, relative or well-known business, to persuade you to send them money. … The best way for consumers to counter imposter scams is by pausing and verifying that a communication is accurate, according to fraud experts.
- BBB Pacific Southwest shares tips to protect yourself from tax scams: Tax scams are among the most stubborn cons out there. They reappear often, each time with a slightly different spin. The main theme is scammers posing as the Internal Revenue Service (IRS), trying to trick people into either paying up or sharing personal information.
Small and Midsize Organizations. Take your security to the next level. Apply Now! If you’re a small business, nonprofit, or IT / MSP in the greater Los Angeles area, apply NOW for LA Cybersecure, a pilot program with coaching and guidance that costs less than two cups of coffee a week. https://securethevillage.org/la-cybersecure-pilot/ The LA Cybersecure Pilot Program is funded by a grant from the Center for Internet Security (CIS) Alan Paller Laureate Program.
Family Protection Newsletter: Did you know we created the Family Protection Newsletter for non-cyber experts? For your parents, friends, those who need to protect themselves in a digital world. Sign up or share with a friend! Click here to learn more and quickly add to your free subscription!
How Hackable Are You? Take our test. Find out how hackable you are and download our free updated 13-step guide.
- How Hackable Are You? Think your defenses are strong. Find out as SecureTheVillage tests you on five basics. Please take our short test as your answers will help you and guide us to improve community safety.
Upcoming events. Please join us.
- Los Angeles Cybersecurity Workforce Coalition: The monthly meeting of the workforce coalition, Tue, March 5, 1:00 pm – 2:00 pm PT. The LA Cybersecurity Workforce Coalition is for employers, educators, government, nonprofits, and others with a professional interest in the cybersecurity workforce challenge.
Quick Survey. Please Help the Cyber Readiness Institute.
The Cyber Readiness Institute (CRI) is conducting a survey to gauge the state of cyber readiness among small and medium-sized businesses (SMBs). The non-profit organization is asking SMBs, as well as cross section of industry experts to participate to better understand the awareness of cyber issues, the implementation of cyber hygiene practices, and the incentives that drive SMBs. The survey will run until the end of February. We encourage you to take just 10 minutes to share your perspectives. Your input will help CRI advocate for improved cybersecurity preparedness among SMBs. Here is the link to the survey: https://www.surveymonkey.com/r/CGDYNW7.
Please Support SecureTheVillage.
- We need your help if we’re to build a world of CyberGuardians TM. Please donate to SecureTheVillage. Thank you. It takes a village to secure the village. TM.
Cyber Humor
Cybersecurity Nonprofit of the Week … The Institute for Security and Technology.
Kudos this week to The Institute for Security and Technology and their Ransomware Task Force (RTF). The Task Force aims to equip businesses, organizations, and governments of all sizes to prepare for ransomware attacks, effectively respond, and quickly recover. The Task Force has published the Cyber Incident Reporting Framework and the Blueprint for Ransomware Defense representing a set of foundational and actionable safeguards derived from the Center for Internet Security’s Critical Security Controls. Like SecureTheVillage, the Institute is a member of Nonprofit Cyber, a coalition of implementation-focused cybersecurity nonprofits.
Live on Cyber with Dr. Stan Stahl – Live on LinkedIn and Your Favorite Podcast Platform
And now for something completely different (LinkedIn) (CIS Podcast): Our #LiveOnCyber podcast cohost Julie Michelle Morris joined Tony Sager, Chief Evangelist at the Center for Internet Security for an inspiring discussion of the role of thought leadership in cybersecurity. Catch a few moments of their candid discussion on our LinkedIn page and the full episode on the Center’s Cybersecurity Where You Are podcast.
Section 2 – Let’s Be Careful Out There. And Let’s Help Others Who Aren’t Yet Cyber-Aware.
Patch Tuesday is a reminder to keep your computing devices patched and updated.
- Fat Patch Tuesday, February 2024 Edition: Microsoft Corp. today pushed software updates to plug more than 70 security holes in its Windows operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks.
In the market for a cyber-friend? Be aware. They gossip!!!
- Don’t date robots — their privacy policies are terrible: Research from Mozilla found many AI companion apps fail privacy checkups and often don’t stand by what their chatbots ask of users. … Talkie Soulful Character AI, Chai, iGirl: AI Girlfriend, Romantic AI, Genesia – AI Friend & Partner, Anima: My Virtual AI Boyfriend, Replika, Anima: AI Friend, Mimico – Your AI Friends, EVA AI Chat Bot & Soulmate, and CrushOn.AI are not just the names of 11 chatbots ready to play fantasy girlfriend — they’re also potential privacy and security risks.
A report from the Electronic Frontier Foundation on the state of privacy.
- Privacy Isn’t Dead. Far From It.: The fact that you’re reading this means that you probably care deeply about the issue of privacy, which warms our hearts. Unfortunately, even though you care about privacy, or perhaps because you care so much about it, you may feel that there’s not much you (or anyone) can really do to protect it, no matter how hard you try. Perhaps you think “privacy is dead.”
Section 3 – Cybersecurity and Privacy News for the Cyber-Concerned.
International Cybersecurity
- US disrupts Russian hacking campaign that infiltrated home, small business routers: DOJ: The FBI coordinated with other foreign partners to disrupt the GRU-led campaign. … The FBI announced Thursday it successfully disrupted a Russian GRU-led hacking campaign that infiltrated more than a thousand home and small business routers that were used to carry out cyber operations against countries around the world, including in the U.S.
- U.S. conducted cyberattack on suspected Iranian spy ship: The covert operation was intended to inhibit the ship’s ability to share intelligence with Houthi rebels who have been attacking cargo ships in the Red Sea. … The U.S. recently conducted a cyberattack against an Iranian military ship that had been collecting intelligence on cargo vessels in the Red Sea and the Gulf of Aden, according to three U.S. officials. … The cyberattack, which occurred more than a week ago, was part of the Biden administration’s response to the drone attack by Iranian-backed militias in Iraq that killed three U.S. service members in Jordan and wounded dozens of others late last month, the officials said.
- North Korea hacked emails of South Korea president’s aide: This is thought to be the first time the North has successfully hacked a member of the South Korean President’s team. … The breach occurred in the run-up to President Yoon Suk Yeol’s state visit to the UK last November. … The staff member was hacked after using a personal email account for official work, the president’s office said.
- Volt Typhoon targeted emergency management services, per report: Dragos researchers found that the China-sponsored hacking group has been attacking electric utilities since 2023. … Volt Typhoon, the China-sponsored hacking group that has been the focus of grim warnings from U.S. security agencies, has been targeting satellite and emergency management services in addition to electric utilities, according to a new report. … The industrial cybersecurity firm Dragos’s Tuesday report outlines how the notorious hacking group is positioning themselves to have disruptive or destructive impacts on critical infrastructure in the U.S.
- Microsoft, OpenAI: Nation-States Are Weaponizing AI in Cyberattacks: It’s not theoretical anymore: the world’s major powers are working with large language models to enhance their offensive cyber operations. … Advanced persistent threats (APTs) aligned with China, Iran, North Korea, and Russia are all using large language models (LLMs) to enhance their operations. … New blog posts from OpenAI and Microsoft reveal that five major threat actors have been using OpenAI software for research, fraud, and other malicious purposes. After identifying them, OpenAI shuttered all their accounts.
Kudos to New York Attorney General Letitia James as she continues to crack down on cybersecurity and cyber privacy violators.
- College Board, which runs SAT, AP exams, fined $730K by NYS for selling student data: The College Board will have to pay a $750,000 settlement with the New York Attorney General’s Office, which said the organization unlawfully shared students’ personal data with organizations such as colleges and scholarship programs. … Attorney General Letitia James’ office said Tuesday that the College Board, a nonprofit that administers the PSAT, SAT and AP tests, shared the data of 237,000 New York students in 2019. … “Students have more than enough to be stressed about when they take college entrance exams, and shouldn’t have to worry about their personal information being bought and sold,” James said in a statement.
The changing face of the cybersecurity insurance industry.
- How Two Former Spies Cracked The $11 Billion Cyber Insurance Market: Fintech startups Coalition and At-Bay, founded by security and spy-agency veterans, are using their tech smarts to transform the fast-growing business of protecting companies against hackers.
This week in cybercrime
- Prudential Financial breached in data theft cyberattack: Prudential Financial has disclosed that its network was breached last week, with the attackers stealing employee and contractor data before being blocked from compromised systems one day later.
- German battery maker Varta halts production after cyberattack: Battery maker VARTA AG announced yesterday that it was targeted by a cyberattack that forced it to shut down IT systems, causing production to stop at its plants. … VARTA is a German manufacturer of batteries for the automotive, consumer, and industrial sectors, partially owned by Energizer Holdings. The brand has an R&D history spanning 136 years, and its products are available worldwide. VARTA’s annual revenue exceeds $875 million. … “Last night, February 12th, 2024, the VARTA Group was the target of a cyber attack on parts of its IT systems,” reads a press announcement shared by VARTA. … “This affects the five production plants and the administration. The IT systems and, thus, production were proactively shut down temporarily for security reasons and disconnected from the internet.” …The scope of the incident’s impact is currently under evaluation, and the damage caused has yet to be determined.
- Ransomware attack forces Colorado public defenders to disable network: The Office of Colorado State Public defenders was forced to shut down its computer network on Monday, after officials became aware of malware-encrypted data within its system. … The “cybersecurity incident,” first reported by the Denver Post, is the latest in a string of cyberattacks that have impacted local courts systems nationwide. Last week, Pennsylvania‘s state court website suffered a distributed denial-of-service attack, which disrupted several of its computer systems, including online docket sheets and an electronic case document filing portal. The website for Kansas district court cases only recently came back online after an October 12 cyberattack that caused a months-long outage.
- Pennsylvania county pays $350,000 cyberattack ransom: The local government in Washington County, Pennsylvania, said Thursday night that it had authorized a ransom payment of about $350,000 in response to a cyberattack in January.
- “Catastrophic” hack on email provider destroys almost two decades of data: VFEmail says data for virtually all US users is gone for good. … Email provider VFEmail said it has suffered a catastrophic destruction of all of its servers by an unknown assailant who wiped out almost two decades’ worth of data and backups in a matter of hours. … “Yes, @VFEmail is effectively gone,” VFEmail founder Rick Romero wrote on Twitter Tuesday morning after watching someone methodically reformat hard drives of the service he started in 2001. “It will likely not return. I never thought anyone would care about my labor of love so much that they’d want to completely and thoroughly destroy it.”
