Three’s UK network has been hit by a major data breach that could have exposed the personal details of millions of customers.

However, Irish customers of the mobile network have not been affected by the attack on the customer upgrade database, which is believed to have been carried out using compromised employee log-ins.

“Three Ireland is not affected. The system impacted is used solely by Three UK,” a spokeswoman for the Irish network said.

The UK network said it was still looking into how many of its nine million customers had been affected. The affected database did not contain customers’ financial details, a spokesman for Three UK said. However, it did contain personal data such a names and addresses.

That information was used to apply for upgraded handsets for a number of customers, which were then intercepted.

Three men have been arrested in connection with the breach. </s> Customer information from more than 130,000 users of the Three mobile network has been compromised in a cyber security breach, the mobile operator has said.



Three boss, Dave Dyson, said in a statement that all affected customers were being contacted individually and that while personal information had been accessed, no financial information had been compromised.

Three men were arrested after the data breach was revealed, over the alleged fraudulent use of the company’s phone upgrade system in an attempt to steal handsets.

Dyson said: “As you may already know, we recently became aware of suspicious activity on the system we use to upgrade existing customers to new devices and I wanted to update all our customers on what happened and what we have done.

“On 17 November we were able to confirm that eight customers had been unlawfully upgraded to a new device by fraudsters who intended to intercept and sell on those devices. I can now confirm that the people carrying out this activity were also able to obtain some customer information.

“In total, information from 133,827 customer accounts was obtained but no bank details, passwords, pin numbers, payment information or credit/debit card information are stored on the upgrade system in question. We believe the primary purpose of this was not to steal customer information but was criminal activity to acquire new handsets fraudulently.”

Three said it was continuing to work with law enforcement agencies, and as a precaution additional security measures had been placed on customer accounts.

The company had been criticised by some customers on social media for what was seen as a muted response to the breach. However, Dyson said Three would address all consumer concerns.

“I understand that our customers will be concerned about this issue and I would like to apologise for this and any inconvenience this has caused,” he said. “We are contacting all of these customers today to individually confirm what information has been accessed and directly answer any questions they have.”

Security experts have again called for major companies with large amounts of customer data to do more to protect consumers. The breach is the latest in a string of cyber attacks and data breaches, including those on TalkTalk and Yahoo. </s> The National Crime Agency is investigating the breach and said that three people have been arrested, two for computer misuse and one for perverting the course of justice.

A spokesman for Three said: "Over the last four weeks Three has seen an increasing level of attempted handset fraud. This has been visible through higher levels of burglaries of retail stores and attempts to unlawfully intercept upgrade devices.

"We’ve been working closely with the Police and relevant authorities. To date, we have confirmed approximately 400 high value handsets have been stolen through burglaries and eight devices have been illegally obtained through the upgrade activity.

"The investigation is ongoing and we have taken a number of steps to further strengthen our controls.

"In order to commit this type of upgrade handset fraud, the perpetrators used authorised logins to Three’s upgrade system.

"This upgrade system does not include any customer payment, card information or bank account information."

Three has over nine million customers and it is understood that hackers, who used company access codes to get into the system, had access to large parts of the upgrade database.

The theft will prompt concerns that personal information of millions of customers could be sold online to criminals.

A spokesman for the National Crime Agency said: "On Wednesday 16 November 2016, officers from the National Crime Agency arrested a 48-year old man from Orpington, Kent and a 39-year old man from Ashton-under-Lyne, Manchester on suspicion of computer misuse offences, and a 35-year old man from Moston, Manchester on suspicion of attempting to pervert the course of justice.

“All three have since been released on bail pending further enquiries. As investigations are on-going no further information will be provided at this time”.

Three was founded in 2003 and employs over 4,000 people in the UK. The network carries over 37 per cent of all the UK's mobile phone data.

This latest data breach follows a similar hack at Talk Talk where the details of more than 150,000 customers were stolen including the bank account details of around 15,000.

The company lost 95,000 subscribers as a result of the attack, which cost it £60million.

A 17 year old boy pleased guilty to seven counts of breaching the Computer Misuse Act 1990 at Norwich Crown Court earlier this week. </s> Ellen is a Verdict staff writer and reporter. You can reach her at ellen.daniel@verdict.co.uk

Air Canada has revealed that a security breach, affecting 20,000 customers, may have left passport information vulnerable to cyber attackers.

The largest airline in Canada reported the breach on 28 August, and urged users of its mobile app to reset their accounts as a security precaution following “unusual login behaviour”. It has also locked all Air Canada mobile app accounts to protect customer data.

Of the 1.7 million Air Canada mobile app users, the airline has reported that approximately 1%, or 20,000 profiles, may potentially have been improperly accessed.

As well as users’ names, email addresses and telephone numbers, Air Canada has confirmed that more sensitive information, including passport numbers, may be included in the breach. Credit card information, however, is encrypted and therefore not at risk.

According to the BBC, the Air Canada data breach may have been caused by a weak password system. Air Canada’s mobile app only requires passwords to be between six and ten characters, and does not allow symbols, making passwords easy to guess. The airline has said that it has since implemented “improved password guidelines” designed to “further enhance security measures”.

In a statement, the airline said:

Air Canada data breach is the latest in a series of breaches

The Air Canada data breach is just one in a long line of similar cyber-attacks. Just last week, telecom company T-Mobile confirmed that it had suffered a security breach on its US servers, exposing the personal data of up to two million customers.

Earlier this month, Butlins, a UK holiday camp, also admitted that the details of 34,000 customers, including addresses and telephone numbers, may have been stolen.

This follows the news that data breach complaints made to the Information Commissioner’s Office have increased by 160% since the General Data Protection Regulation (GDPR) came into force in May.

The sheer number and scale of recent breaches calls the security practices of the companies involved into question. Last year, a report from Identity Theft Resource Center and CyberScout revealed that data breaches in the US hit a record high in 2017, increasing by 29% in the first half of the year.

Furthermore, a survey by software and cyber-security company OGL found that 51% of businesses thought they wouldn’t be able to cope with a data breach.

Commenting on the T-Mobile data breach, Chief Security Strategy Officer, SecureData Charl van der Walt, believes that the problem of data breaches could take years to untangle:

“No doubt the causes of this breach will be scrutinised in minute detail to determine whether, how and to what extent T-Mobile is responsible for this loss, and regulatory fines, SEC penalties and civil law suits may all follow. But none of this is likely to change the fundamental fact that billions of these kinds of records are being leaked to the Internet at a growing rate with all the implications for privacy, digital security and person safety that that brings. “Addressing the problem of personal data leaks will take years or decades even and will require political will and deep commitment from business, government, and the security industry.” </s> In only 22 lines of code, hackers took on the UK's largest airline and stole data from up to 380,000 people.

But the hackers behind British Airways' data breach left behind a trail of evidence showing just how the major airliner had suffered its cyberattack, said researchers from cybersecurity firm RiskIQ.

The clues showed that the attacker was likely Magecart, the same cybercriminal group behind Ticketmaster UK's breach in June, said Yonathan Klijnsma, a head researcher with RiskIQ.

Cybercriminal gangs represent a new, more potent threat to businesses because the organized efforts don't just steal from companies, but also the millions of customers paying for their services. While hackers can act alone, coordinated cyberattacks mean the potential to affect more people.

The FBI announced in August that it arrested three alleged members of FIN7, another cybercrime group that hacked restaurants like Chipotle, Chili's and Arby's and got its hands on the credit card info of more than 15 million people.

Magecart is set to be "bigger than any other credit card breach to date," security researchers said in July.

The British Airways hack is part of Magecart's massive skimming campaign, as it almost identically follows the script from previous attacks, RiskIQ's researchers said. Credit card skimmers are usually a physical problem, with thieves putting fake readers on ATMs to steal financial data from people swiping their cards. But Magecart has brought that threat online, compromising more than 800 e-commerce websites and stealing financial data.

And the attacks are getting smarter. While previous attacks from Magecart used the same code that researchers could find automatically, RiskIQ's blacklist missed the British Airways attack because the hack was customized this time, Klijnsma said.

"We're now seeing them target specific brands, crafting their attacks to match the functionality of specific sites," the threat researcher said.

The group stashed some modified code in British Airways' baggage claim webpage, where customers would fill in their names, addresses, email and financial information. Looking through data logs, RiskIQ's researchers found a slight change on the page's code from mid-August.

The baggage claim page contained a JavaScript library that sent all the data on the screen to the URL "baways.com." The hackers would obtain a copy of the data while the victim was sending that personal and financial information to the airliner and not know anything was wrong.

To an unsuspecting eye, "Baways" might look like short-hand for British Airways, but RiskIQ found that the URL was hosted in Romania and only registered on Aug. 15 -- just six days before Magecart started stealing data from the airliner.

It's still unclear how Magecart's hackers were able to inject its custom JavaScript into British Airways' website. The only way that Magecart would have been able to do that is through server-side access to British Airways' infrastructure, Klijnsma said.

RiskIQ warns that with British Airways' customized attack, it's likley Magecart will carry out more sophisticated attacks against major companies.

"Magecart is extremely cunning and will continue to find ways to exploit the lack of visibility many e-commerce brands have into the code running on their websites to victimize more and more customers," Klijnsma said in an email. "We get alerts for new Magecart attacks almost hourly, so we don't see this stopping any time soon."

Security: Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.

Blockchain Decoded: CNET looks at the tech powering bitcoin -- and soon, too, a myriad services that will change your life. </s> LONDON (AP) — A global “ransomware” cyberattack, unprecedented in scale, had technicians scrambling to restore Britain’s crippled hospital network Saturday and secure the computers that run factories, banks, government agencies and transport systems in many other nations.

The worldwide effort to extort cash from computer users is so unprecedented that Microsoft quickly changed its policy, making security fixes available for free for the older Windows systems still used by millions of individuals and smaller businesses.

A malware tracking map showed “WannaCry” infections popping up around the world. Britain canceled or delayed treatments for thousands of patients, even people with cancer. Train systems were hit in Germany and Russia, and phone companies in Madrid and Moscow. Renault’s futuristic assembly line in Slovenia, where rows of robots weld car bodies together, was stopped cold.

In Brazil, the social security system had to disconnect its computers and cancel public access. The state-owned oil company Petrobras and Brazil’s Foreign Ministry also disconnected computers as a precautionary measure, and court systems went down, too.

Britain’s home secretary said one in five of 248 National Health Service groups had been hit. Home Secretary Amber Rudd said all but six of the NHS trusts back to normal Saturday.

The U.K.’s National Cyber Security Center was “working round the clock” to restore vital health services, while urging people to update security software fixes, run anti-virus software and back up their data elsewhere.

Who perpetrated this wave of attacks remains unknown. Two security firms — Kaspersky Lab and Avast — said they identified the malicious software in more than 70 countries. Both said Russia was hit hardest.

These hackers “have caused enormous amounts of disruption– probably the biggest ransomware cyberattack in history,” said Graham Cluley, a veteran of the anti-virus industry in Oxford, England.

And all this may be just a taste of what’s coming, another cyber security expert warned.

Computer users worldwide — and everyone else who depends on them — should assume that the next big “ransomware” attack has already been launched, and just hasn’t manifested itself yet, Ori Eisen, who founded the Trusona cybersecurity firm in Scottsdale, Arizona, told The Associated Press.

The attack held hospitals and other entities hostage by freezing computers, encrypting data and demanding money through online bitcoin payments. But it appears to be “low-level” stuff, Eisen said Saturday, given the amount of ransom demanded — $300 at first, rising to $600 before it destroys files hours later.

He said the same thing could be done to crucial infrastructure, like nuclear power plants, dams or railway systems.

“This is child’s play, what happened. This is not the serious stuff yet. What if the same thing happened to 10 nuclear power plants, and they would shut down all the electricity to the grid? What if the same exact thing happened to a water dam or to a bridge?” he asked.

“Today, it happened to 10,000 computers,” Eisen said. “There’s no barrier to do it tomorrow to 100 million computers.”

This is already believed to be the biggest online extortion attack ever recorded, disrupting services in nations as diverse as the U.S., Ukraine, Brazil, Spain and India. Europol, the European Union’s police agency, said the onslaught was at “an unprecedented level and will require a complex international investigation to identify the culprits.”

In Russia, government agencies insisted that all attacks had been resolved. Russian Interior Ministry, which runs the national police, said the problem had been “localized” with no information compromised. Russia’s health ministry said its attacks were “effectively repelled.”

The ransomware appeared to exploit a vulnerability in Microsoft Windows that was purportedly identified by the U.S. National Security Agency for its own intelligence-gathering purposes. The NSA tools were stolen by hackers and dumped on the internet.

“There’s clearly some culpability on the part of the U.S. intelligence services. Because they could have done something ages ago to get this problem fixed, and they didn’t do it, Cluley said.

“I have some sympathy toward the intelligence services, because it’s very, very difficult these days, with encryption, to spy on people,” Cluley added. “But I don’t think that those concerns should hide the fact that ALL of us need to be protected … We’re living an online life, and we all deserve security there.”

It could have been much worse if not for a young cybersecurity researcher who helped to halt its spread by accidentally activating a so-called “kill switch” in the malicious software.

The 22-year-old Britain-based researcher, identified online only as MalwareTech, explained Saturday how he registered a garbled domain name he spotted in the code. His $11 purchase of the name on Friday activated the domain, which commanded the malware to stop spreading. It may have saved governments and companies millions of dollars and slowed the outbreak before U.S.-based computers were more widely infected.

Indeed, while FedEx Corp. reported that its Windows computers were “experiencing interference” from malware — it wouldn’t say if it had been hit by the ransomware — other impacts in the U.S. were not readily apparent on Saturday.

The kill switch couldn’t help those already infected, however. Short of paying, options for these individuals and companies are usually limited to recovering data files from a backup, if available, or living without them.

Security experts said it appeared to be caused by a self-replicating piece of software that enters companies when employees click on email attachments, then spreads quickly as employees share documents.

The security holes it exploits were disclosed weeks ago by TheShadowBrokers, a mysterious group that published what it said are hacking tools used by the NSA. Microsoft swiftly announced that it had already issued software “patches” to fix those holes, but many users haven’t yet installed updates or still use older versions of Windows.

Microsoft had made fixes for older systems, such as 2001’s Windows XP, available only to mostly larger organizations, including Britain’s National Health Service, that paid extra for extended technical support.

In light of Friday’s attacks, Microsoft announced that it’s making the fixes free to all.

Copyright 2017 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed. </s> The personal details of hundreds of millions of users of adult meet-up websites have been exposed following the hacking of AdultFriendFinder and related sites.

The total of 412 million accounts includes 5.2 million UK email addresses, as well as associated information which could prove useful such as purchasing data.

The security breach occurred in October at the site’s parent company, California-based Friend Finder Networks. Other sites which may have ben affected include Cams.com, Penthouse.com, Stripshow.com and iCams.com.

The total includes information from 15 million accounts which had been deleted by users but which remained on the company’s servers and could stretch back as far as 20 years.

The latest leaking of personal data is a reminder of how vulnerable websites can be to attack, emphasised by the revelation that close to a million of the users whose data was compromised had used ‘123456’ as their password, with similar numerical combinations as well as ‘password’ and ‘qwerty’ also in the top 10.

ActionFraud - the UK’s national fraud and cyber crime reporting centre - offered the following advice:

If you use the same password for AdultFriendFinder.com anywhere else on the internet, then change it immediately. Use three words which mean something to you but are random to others - this creates a password that is strong and more memorable.

The data taken in the breach includes email addresses and usernames, which could be used in future for phishing attempts. If you receive unsolicited emails never reply with personal details and don’t click on any links as you could end up downloading malware.

Be wary of anyone calling asking for personal information, bank details or passwords. If in doubt, just hang up. </s> Luke covers sports, tech and lifestyle for Verdict. You can reach him at luke.christou@verdict.co.uk

The recent British Airways data breach was caused by a malicious script injected into the company’s website, cybersecurity firm RiskIQ has found.

Analysis of code from BA’s website around the time when the breach is thought to have occurred shows evidence of a script designed to steal financial data entered into BA’s online payment forms.

The airline has admitted that the data of more than 380,000 customers was stolen as the breach went undetected for 16 days.

But who was behind the latest attack on a mainline airline, following attacks on Air Canada and Delta Air Lines earlier this year?

RiskIQ has settled on the conclusion that Magecart, a cybercriminal group that has been operating since 2015, was behind the hack. The group has been linked with attacks on over 7,000 online stores in the last three years.

According to RiskIQ, the latest breach can be linked to the group due to the similarities between the code placed on the BA site and the code used to steal the payment data of tens of thousands of Ticketmaster customers earlier this year, another attack thought to have been carried out by Magecart.

The code is designed to steal payment card information entered into checkout pages, as well as sensitive information such as credit card numbers, names and addresses. However, on this occasion the script’s appearance had been altered in order to make it blend in on the BA site.

This certainly seems to suggest that the breach is the work of a more organised group, given that the breach went undetected for so long.

What does this mean for those affected?

Having your data stolen is concerning at the best of times. However, the type of data that was potentially compromised in the BA breach is particularly worrying.

It’s still too early to know how much damage the breach has or will cause. However, if an organised group like Magecart is behind it, then it is highly likely that this data will be used to maliciously target BA customers in the future.

According to Bill Conner, CEO of cybersecurity specialist SonicWall, personal information that doesn’t change frequently, such as credit card numbers, drive a high price on the Dark Web. </s> (RTTNews) - The U.S. Securities and Exchange Commission said that Altaba Inc. (AABA), formerly known as Yahoo! Inc., has agreed to pay a $35 million penalty to settle charges that it misled investors by failing to disclose one of the world's largest data breaches in which hackers stole personal data relating to hundreds of millions of user accounts.

According to the SEC's order, within days of the December 2014 intrusion, Yahoo's information security team learned that Russian hackers had stolen what the security team referred to internally as the company's "crown jewels": usernames, email addresses, phone numbers, birthdates, encrypted passwords, and security questions and answers for hundreds of millions of user accounts.

Although information relating to the breach was reported to members of Yahoo's senior management and legal department, Yahoo failed to properly investigate the circumstances of the breach and to adequately consider whether the breach needed to be disclosed to investors. The fact of the breach was not disclosed to the investing public until more than two years later, when in 2016 Yahoo was in the process of closing the acquisition of its operating business by Verizon Communications, Inc.
The Three UK mobile phone company admits that there has been a cyber-security breach involving the details of millions of customers.