Content by Mathew J. Schwartz

Panera Bread Security Lesson: Rise to the Challenge

Mathew J. Schwartz  •  April 4, 2018

Panera Bread appears to have failed to fix a customer data leak for more than eight months after getting a heads-up from an independent security researcher. Here's what others should learn from the bakery café chain's mistakes.

LinkedIn Breach: Russian Suspect Extradited to US

Mathew J. Schwartz  •  April 3, 2018

Russian national Yevgeniy Nikulin, 30, has been extradited to the U.S. from the Czech Republic to face charges that he hacked LinkedIn, Dropbox and Formspring, offering at least some stolen data for sale.

Malaysia's Central Bank Blocks Attempted SWIFT Fraud

Mathew J. Schwartz  •  April 2, 2018

Malaysia's central bank, Bank Negara Malaysia, says it detected and successfully blocked an attack that attempted to steal funds via fraudulent SWIFT interbank money-moving messages. The attack against BNM led the central bank of the Philippines to issue an alert to banks in that country.

Saks, Lord & Taylor Suffer Payment Card Data Breach

Mathew J. Schwartz  •  April 2, 2018

Department store chains Saks Fifth Avenue, Saks Off Fifth and Lord & Taylor have suffered a data breach that apparently exposed details on 5 million payment cards. Cybersecurity firm Gemini Advisory says the JokerStash syndicate - aka Carbanak gang - is selling the stolen card data.

Police Bust 20 Phishing Suspects in Italy, Romania

Mathew J. Schwartz  •  March 30, 2018

Police have charged 20 Romanian and Italian nationals with running spear-phishing attacks that stole more than $1 million from online bank customers. Phishing remains a favored criminal technique for harvesting account credentials and cryptocurrency, as well as corporate secrets.

Crypto-Locking Malware Hits Atlanta, Baltimore, Boeing

Mathew J. Schwartz  •  March 30, 2018

Leading the latest edition of the ISMG Security Report: Ransomware hits the city of Atlanta, Baltimore's 911 system as well as aviation giant Boeing. Plus, WikiLeaks and its Julian Assange get taken for a ride by Russian intelligence.

Julian Assange Gets Another Internet Timeout

Mathew J. Schwartz  •  March 29, 2018

Ecuador's embassy in London has again revoked internet access for seven-year houseguest Julian Assange, saying the WikiLeaks chief violated an agreement to not interfere in other countries' matters. WikiLeaks' star has continued to fall since it's been revealed to be an apparent Russian stooge.

Atlanta After Ransomware Attack: Please Restart Your PC

Mathew J. Schwartz  •  March 28, 2018

Five days after a ransomware outbreak crypto-locked city systems, Atlanta has advised its 8,000 employees that they can once again boot their PCs and printers. But information security experts warn that the city's infrastructure still appears to have easily exploitable misconfigurations.

Spain Busts Alleged Kingpin Behind Prolific Malware

Mathew J. Schwartz  •  March 27, 2018

The alleged leader of a cybercrime gang tied to more than $1 billion in losses has been arrested in Alicante, Spain. Authorities say "Denis K." is a Ukrainian national who led a gang that developed Carbanak and Cobalt malware to infect PCs as well as perpetrate ATM jackpotting attacks.

Analysis: VPN Fail Reveals 'Guccifer 2.0' is 'Fancy Bear'

Mathew J. Schwartz  •  March 27, 2018

Evidence continues to mount that Russian intelligence created the "Guccifer 2.0" hacker online persona as a "plausible deniability" cover for dumping information stolen from the U.S. Democratic National Committee, among other targets, says cybersecurity expert Alan Woodward.

Britain Backs US Hacking Allegations Against Iranians

Mathew J. Schwartz  •  March 26, 2018

The U.K. government concurs with allegations contained in a U.S. Department of Justice indictment, which charges nine Iranians, plus the Mabna Institute, with perpetrating a five-year hacking campaign designed to steal scientific secrets for Iran's military and private industry.

Report: Guccifer 2.0 Unmasked at Last

Mathew J. Schwartz  •  March 23, 2018

The notorious "lone hacker" known as "Guccifer 2.0," who claimed credit for breaching the Democratic National Committee and dumping stolen emails, failed to activate a VPN client at least once, revealing an IP address at the headquarters of Russia's GRU military intelligence agency, the Daily Beast reports.

Lawmakers Tell Facebook's Zuckerberg: You Will Testify

Mathew J. Schwartz  •  March 23, 2018

As the Cambridge Analytica scandal continues to unfold, Congress seeks answers from Facebook, calling on CEO Mark Zuckerberg to testify. Also in the latest edition of the ISMG Security Report: Is it possible to build a secure digital wallet for storing cryptocurrency?

Will Congress Lose Midterm Elections to Hackers?

Mathew J. Schwartz  •  March 22, 2018

States will not have the full range of much-needed cybersecurity practices and equipment in place for this year's U.S. midterm elections. But efforts underway might deliver many much-needed improvements in time for the 2020 elections, Homeland Security Secretary Kirstjen Nielsen tells a Senate committee.

Chipmaker AMD Confirms 13 Chipset Flaws, Preps Fixes

Mathew J. Schwartz  •  March 21, 2018

Multinational semiconductor maker Advanced Micro Devices has confirmed that there are 13 flaws in some of its chipsets that could be exploited to manipulate chip firmware for malicious purposes. AMD plans to provide fixes in the form of firmware updates that it claims should not affect system performance.