1. Accessories Giant Claire’s Hacked to Steal Credit Card Info by Lawrence Abrams

The websites belonging to a popular U.S. based jewelry and accessories store, Claire’s, and its subsidiary Icing, were recently targeted by hackers. According to security researchers, the hackers compromised the website through a MageCart attack shortly after the accessories giant shut down all of their brick and mortar stores due to COVID-19 restrictions. Malicious JavaScript was injected into the sites with the goal of stealing customer’s payment information when purchasing from the site. Claire’s promptly removed the malicious code after being notified, but it is estimated that the script was trying to steal customers’ credit cards from between April 30 and June 13. Any customer that made a purchase on Claire’s or Icing’s site in the past couple months should take precaution and closely monitor their credit statements.

Read more

2. Ransomware Attack Could Lead to Beer Shortages by Anthony Spadafora

This headline might be the most terrifying we’ve seen in months – there could be a beer shortage. Australia’s beverage giant, Lion, recently suffered a cyber incident that forced it to shut down production, which could soon make it difficult for the country’s residents to get ahold of their favorite beer. In a statement posted to its website, Lion disclosed that the incident was in fact a ransomware attack, so it shut down key systems as a precaution. The investigation is ongoing with the company’s IT teams and expert cyber advisors working to safely bring systems back online to resume business as soon as possible. Fortunately, the company found no evidence that any financial or personal information was compromised in the attack but the process of restoring systems is taking longer than expected. Lion has stock at hand as they were able to safely continue to brew beer during the pandemic lockdown period but recovering from this incident could cause some temporary shortages.

Read more

3. Dating Apps Exposed 845 GB of Explicit Photos, Chats, and More by Lily Hay Newman

Two security researchers, Noam Rotem and Ran Locar, recently discovered a collection of publicly accessible Amazon Web Services “buckets” belonging to many different dating apps. In total, there was 845 gigabytes and close to 2.5 million records of exposed data in the trove, likely representing information from hundreds of thousands of app users. The dating apps which sloppily stored the data all cater to specific groups and interests, which makes the information particularly sensitive as users assumed that others outside the app would not be able to see or download the content. The data included sexually explicit photos and audio recordings. Although limited personally identifying information was exposed, a hacker could still use the photos and other miscellaneous information to identify many users. The information could have a real impact on user safety as it creates the potential for doxxing, extortion, and other online abuse. Unfortunately, there is no way for the researchers to know if the data was downloaded by others before they discovered it.

Read more

4. Zoom Will Offer End-to-End Encryption for All Users by Phil Muncaster

We saw last week that Zoom’s recent decision to restrict access to end-to-end encryption (E2EE) for some users spurred lots of online blowback – now the company has announced that they're reversing the controversial decision. After consulting with rights groups, such as child safety advocates, government representatives, and encryption experts, Zoom made the decision to offer their E2EE feature to both free and premium app subscribers. In a blog post, the company’s CEO Eric Yuan wrote, “We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform." This announcement came shortly after rights groups started a petition that argued that the encryption feature was too important to the safety of many vulnerable groups to be considered just a premium feature. To “reduce the mass creation of abusive accounts,” users of the free service will be required to authenticate their membership in order to gain access to the security add-on feature.

Read more

5. Cosmetics Company Avon Offline After Cyber Attack by Alex Scroxton

Avon, the Brazilian-owned cosmetics and beauty company, disclosed a “cyber incident” to the US Securities and Exchange Commission over a week ago, and parts of the UK website still remain offline. Although it was not confirmed by the company, security researchers suspect the breach was the result of a ransomware attack. The back-end systems used by Avon’s sales representatives in multiple countries were impacted, which left customers unable to place orders with the company. Avon stated that the company is “planning to restart some of its affected systems in impacted markets throughout the course of next week” in their disclosure to the SEC, and most sites for countries other than the UK have been brought back online. The investigation has not found any evidence that credit card details were compromised, but Avon’s teams are continuing to work on the affected systems and will notify customers of any malicious activity.

Read more