The Record reports that the UK Legal Aid Agency breach is worse than first disclosed, with records now believed to go back to 1978. The stolen data can include names, dates of birth, National Insurance numbers, addresses, bank details and some partially redacted payment card details. The agency says it has strengthened authentication and access controls, improved monitoring and is retiring or isolating higher-risk legacy systems.
Source: therecord.media
…
The Record reports that CISA and Ivanti warned about a new vulnerability in Ivanti Connect Secure that is being exploited. The attackers focused on credential theft, data exfiltration, log tampering and network reconnaissance. Ivanti said it is working with a limited number of customers who were affected. Windows users should update affected systems promptly, especially where VPN access is used to protect accounts and data.
Source: therecord.media
SecurityWeek reports that Meta is notifying about 1,500 people after hackers got into some of its GitHub repositories using an employee’s stolen credentials. Meta says most of the taken data was business code, but a small amount of personal data was also involved. Affected people are being offered credit and dark web monitoring, and Meta says it rotated secrets and added controls to keep user data off GitHub.
Source: securityweek.com
Infosecurity Magazine reports that ASOS confirmed an unauthorized intrusion into third-party platforms it uses to communicate with customers. Names, contact details and some non-payment account information were accessed, but the company said no payment-card information or account passwords were impacted. Customers should watch their accounts for suspicious activity and be careful with unexpected messages that could use stolen contact details.
Source: infosecurity-magazine.com
