Security in brief 23andMe has concluded that the recent data breach was the result of illicit access to just 14,000 accounts, enabled by credential stuffing – the use of username and password combinations from other breaches. This underscores the need for individuals to avoid password reuse and to enable multifactor authentication.
Stolen data includes “DNA relatives” profiles, with 5.5 million sets of data taken. Additional Family Tree data, comprising of 1.4 million sets, was also compromised. 23andMe appears to be concerned about potential legal repercussions and has updated its terms of service to modify dispute resolution and customer acceptance of changes provisions.
Meanwhile, in a routine traffic stop in California’s Yolo County, law enforcement has uncovered a theft ring involving 114 laptops stolen from a well-known Bay Area tech company. And health care products and services firm Henry Schein has reportedly been targeted by a ransomware gang, resulting in the breach of data belonging to 29,112 employees past and present.
Critical vulnerabilities of the week
Reported critical vulnerabilities are few this week, with most ICS advisories related to less severe threats. However, some noteworthy vulnerabilities to mention include a buffer overflow vulnerability in all versions of Mitsubishi Electric CNC series devices, as well as a series of vulnerabilities in Sierra Wireless AirLink routers that can lead to credential theft, DoS, RCE, and total takeover.
Ransomware gang shakes down staffers… individually
Health care products and services firm Henry Schein has been reeling since an October cyber attack allegedly perpetrated by the notorious AlphaV/BlackCat ransomware gang, and it’s now sending letters to employees whose data – lots of it – has allegedly been stolen as a result of the hit.
