Weekly Cyber Risk Roundup: MyFitnessPal Breach, Carbanak Leader Arrested

Under Armor announced this week that approximately 150 million users of the diet and fitness app MyFitnessPal had their personal information acquired by an unauthorized third party sometime in February 2018. As Reuters noted, it is the largest data breach of 2018 in terms of the number of records affected.

The breach was discovered on March 25, and the data compromised includes usernames, email addresses, and hashed passwords — the majority of which used bcrypt, the company said.

“The affected data did not include government-issued identifiers (such as Social Security numbers and driver’s license numbers) because we don’t collect that information from users,” the company said in a statement. “Payment card data was not affected because it is collected and processed separately.”

MyFitnessPal also said that it would be requiring users to change their passwords and is urging users to do so immediately. The company is also urging users to review their accounts for suspicious activity as well as to change passwords on any other online accounts that used the same or a similar password to their now-breached MyFitnessPal credentials.

It is unclear how the unauthorized third party acquired the data, and the investigation is ongoing. Under Armour bought MyFitnessPal in February 2015 for $475 million.

Other trending cybercrime events from the week include:

• Employee accounts targeted: The Retirement Advantage is notifying clients that their employees’ personal information may have been compromised due to unauthorized access to an employee email account at its Applied Plan Administrators division. Storemont in Northern Ireland is warning all staff of a cyber-attack targeting email accounts with numerous password attempts, and a number of accounts were compromised due to the attack. Shutterfly is notifying customers that their personal information may have been compromised due to an employee’s credentials being used without authorization to access its Workday test environment.
• Payment card breaches: Manduka is notifying customers of a year-long payment card breach after discovering malware on its e-commerce web platform. Mintie Corporation is notifying customers of a ransomware attack that may have compromised customer payment card information. Fred Usinger said its hosting service provider notified the company of a breach involving personal information and stored payment information.
• Other data breaches: A report from New York’s Attorney General said that 9.2 million New Yorkers had their data exposed in 2017, quadruple the number from 2016. Motherboard obtained thousands of user account details that are circulating on public image boards, and many of those accounts are related to a bestiality website. Mendes & Haney is notifying customers of unauthorized access to its network. Branton, de Jong and Associates is notifying customers that their tax information may have been compromised due to unauthorized access to its tax program. Researchers discovered a misconfigured database belonging to the New York internal medicine and cardiovascular health practice Cohen Bergman Klepper Romano Mds PC that exposed the patient information of 42,000 individuals.
• Other notable events: Baltimore’s 911 dispatch system was temporarily shut down after a hack by an unknown actor led to “limited breach” of the system that supports the city’s 911 and 311 services. Kent NHS Trust is notifying patients that a staff member who had accessed their medical records “without a legitimate business reason” has been dismissed. The Malaysian central bank said it thwarted a cyber-attack that involved falsified wire-transfer requests over the SWIFT bank messaging network. Boeing said that a few machines were infected with the WannaCry malware.

SurfWatch Labs collected data on many different companies tied to cybercrime over the past week. Some of the top trending targets are shown in the chart below.

Cyber Risk Trends From the Past Week

Law enforcement officials in Spain have arrested the alleged leader of the cybercriminal syndicate behind the Carbankak and Cobalt malware attacks, which have targeted more than 100 financial organizations around the world and caused cumulative losses of over €1 billion since 2013.

Europol’s press release did not name the alleged mastermind behind the group; however, Bloomberg reported that Spain’s Interior Ministry named the suspect as Denis K, a Ukrainian national who had accumulated about 15,000 bitcoins (worth approximately $120 million at the time of his arrest). Europol noted that numerous other coders, mule networks, and money launderers connected to the group were also the target of the international law enforcement operation.

The group first used the Anunak malware in 2013 to target financial transfers and ATM networks, and by the following year they had created a more sophisticated version of the malware known as Carbanak, which was used by the group used until 2016. At that point the group carried out an even more sophisticated wave of attacks using custom-made malware based on the Cobalt Strike penetration testing software, Europol said.

“The criminals would send out to bank employees spear phishing emails with a malicious attachment impersonating legitimate companies,” Europol wrote in a press release. “Once downloaded, the malicious software allowed the criminals to remotely control the victims’ infected machines, giving them access to the internal banking network and infecting the servers controlling the ATMs. This provided them with the knowledge they needed to cash out the money.”

Carlos Yuste, a Spanish police chief inspector who helped lead the operation, told Bloomberg that “the head has been cut off” of the high-profile group. Steven Wilson, Head of Europol’s European Cybercrime Centre, said that the arrest illustrates how law enforcement “is having a major impact on top level cybercriminality.”

*** This is a Security Bloggers Network syndicated blog from SurfWatch Labs, Inc. authored by Jeff Peters. Read the original post at: https://blog.surfwatchlabs.com/2018/03/31/weekly-cyber-risk-roundup-myfitnesspal-breach-carbanak-leader-arrested/