With cyber threats increasing every month, we’ll be looking to provide weekly updates on the different cyber security threats that have taken place recently to highlight all the different ways in which our data can be accessed by those wishing to do harm.

Malware installed on to USB

In the US, the FBI have been made aware of cyber criminals sending malware infected USB sticks in the post to people. The USB devices are being presented as coming from trusted organisations such as the US Department of Health and Human Services, and contain software that allows hackers to control certain aspects of a user’s device once connected. This then allows them to install malware to the device.

Shopping platform discloses potential data breach affecting 200,000 shoppers

According to reports, an online store called Pulse TV has revealed that over 200,000 users may have had their credit card information stolen as a result of a data breach. The users that may have been affected have been outlined to be those that used the platform between November 2019 to August 2021. As well as credit card information, users may have also had their names and email addresses compromised.

Those conducting an investigation have found that the platform had been used as a “common point of purchase'' for transactions paid for with unauthorised credit cards. It's important to note however that Pulse TV conducted their own investigation and were unable to verify that their website was the cause. The company is increasing their security features, including two factor authentication to their platform.

It’s therefore important that users stay vigilant to credit card transactions to ensure there aren’t any unauthorised ones, and try to use platforms which have higher levels of security such as two-factor authentication.

Over a million accounts compromised by credential stuffers

Our next story is about a cyber attack strategy called ‘credential stuffing’. Credential stuffing is a type of cyber attack where user credentials which have been stolen (such as usernames/emails and their corresponding passwords) are used to make automated login requests. These attacks become most effective when users have the same email/password configuration for multiple accounts, meaning that when their credentials are obtained as a result of a brech, the attackers automatically have access to multiple accounts across different websites. 

An investigation into credential stuffing conducted in New York has recently found that 1.1 million customer accounts linked to 17 well-known companies had been compromised. The National Cyber Security Centre (NCSC) therefore recommends that users ensure that they have strong and separate passwords on your different accounts, as having different passwords will protect you from being a victim of credential stuffing. If your account details are stolen as part of a data breach, this will ensure that only the details for that specific account are compromised. This will also limit the number of passwords that you need to change if the password is stolen. To ensure you are as protected as you can be against credential stuffing however, ideally you would have different passwords for each account and website/platform you use, with the details of those passwords being stored in a password manager which can help so that you don’t need to remember 20+ different passwords. Finally, our good friend two-factor authentication is also a great tool to protect yourself from credential stuffing, as attackers won’t be able to access your account(s) with just the username and password, should those details be stolen as part of a breach.