Hacking News: June 2012

Personal Information of 123,000 US Government Employees Stolen

Posted by J-admin

Posted on -

Personal Information of 123,000 US Government Employees Stolen

Personal information of over 123,000 federal employees have been exposed after a cyber attack in last July. The cyberattack occurred against a Thrift Savings Plan (TSP) contractor, Serco Inc. The FBI notified both Serco and the TSP last month about the attack. According to the Guardian has called Serco "probably the biggest company you have never heard of." It's on the FTSE 100 (Big!), has 100,000 employees and operates everything from railways in the UK and Australia to driver licensing in Ontario, Canada to retirement accounts for US government employees, members of the armed forces and US Postal Service workers. Perhaps taking advantage of the holiday weekend in the United States, Sercoannounced this morning that hackers had compromised systems at its Thrift Savings Plan (TSP) operation.

After extensive forensic investigation it was determined that 43,000 members' names, addresses and Social Security Numbers had been accessed by the intruders, and the Social Security Numbers of another 80,000 may have been involved.

"Serco regrets this incident and the inconvenience it may cause to some Thrift Savings Plan participants and payees whose personal data was involved," said Serco Chairman and CEO Ed Casey in the statement. "We have fortified our information security measures and cyber defenses."

Further information has been published that shows the original intrusion into Serco's system occurred in July 2011. Information that was accessed has been available to criminals for nearly a year before Serco was notified by the FBI.

[......]

Dating Site eHarmony Hacked, 1.6 Million Password Stolen

Posted by J-admin

Posted on -

Dating Site eHarmony Hacked, 1.6 Million Password Stolen

POSTED BY VOGH REPORTER ON 6/09/2012 07:00:00 PM

Dating Site eHarmony Hacked, 1.6 Million Password Stolen

After LinkedIn now cyber criminals targeted one of the famous dating site eHarmony and stolen more than1.6 millions of passwords from the database. The authority has admitted that its password database has been compromised, with around 1.5 million hashed passwords being found in the wild. The leaked database that appeared in public contained unsalted MD5 hashed passwords and was reported to not contain any identifying user-names or email addresses. According to the sources all the password hashes has been randomly submitted to some underground hacker's forum where a user asked for help in cracking the hashes. This help was collectively given by the forum members who were then reportedly given the LinkedIn hashed passwords to work on. After the primary investigation eHarmony confirmed that a small fraction of user database has been affected. And affected members password has already been reset. eHarmony did not give any details of how the passwords were leaked and says they will continuing to investigate what happened.

[......]

LinkedIn Hired FBI To Investigate on Password Theft Issue

Posted by J-admin

Posted on -

LinkedIn Hired FBI To Investigate onPassword Theft Issue

Few days ago one of world's popular social networking site LinkedIn faced cyber attack where it has been confirmed that more than 6.5 millions of hashed passwords get exposed and among them hackers able to decrypt those hashes into plain text. After this scenario now LinkedIn Corporation confirmed that they are working with the FBI to investigate that cyber attack. In their official blog LinkedIn announced that they are working with law enforcement to find more information about the recent hacking. The company does not know of any accounts that were taken over as a result of the security violations, according to LinkedIn spokesman Hani Durzy. A spokeswoman with the FBI declined to comment. LinkedIn is still in the early stages of the investigation. Durzy said it was not yet determined whether the email addresses that corresponded to the hacked passwords were also stolen. LinkedIn is requiring all users whose passwords were compromised to change their passwords, and in its post Thursday, it announced that it also would lock out additional users who may have been affected until they changed their passwords as well. "Since we became aware of this issue, we have been taking active steps to protect our members," the company said in its post. "Our first priority was to lock down and protect the accounts associated with the decoded passwords that we believed were at the greatest risk." LinkedIn has yet to say how the hacker accessed its users' passwords and what other information may have been accessed. It also did not address complaints of phishing scams targeting its users after the hacking attack. But the FBI authority did not respond to requests for comment on this particular topic.

[......]