Author Archives: BrianKrebs

Phishing Victims Muddle Tax Fraud Fight

Posted on by

Many U.S. citizens are bound to experience delays in getting their tax returns processed this year, thanks largely to more stringent controls enacted by Uncle Sam and the states to block fraudulent tax refund requests filed by identity thieves. A steady drip of corporate data breaches involving phished employee W-2 information is adding to the backlog, as is an apparent mass adoption by ID thieves of professional tax services for processing large numbers of phony refund requests. Continue reading Phishing Victims Muddle Tax Fraud Fight→

Hospital Declares ‘Internal State of Emergency’ After Ransomware Infection

Posted on by

A Kentucky hospital says it is operating in an “internal state of emergency” after a ransomware attack rattled around inside its networks, encrypting files on computer systems and holding the data on them hostage unless and until the hospital pays up. Continue reading Hospital Declares ‘Internal State of Emergency’ After Ransomware Infection→

Carders Park Piles of Cash at Joker’s Stash

Posted on by

A steady stream of card breaches at retailers, restaurants and hotels has flooded underground markets with a historic glut of stolen debit and credit card data. Today there are at least hundreds of sites online selling stolen account data, yet only a handful of them actively court bulk buyers and organized crime rings. Faced with a buyer’s market, these elite shops set themselves apart by focusing on loyalty programs, frequent-buyer discounts, money-back guarantees and just plain old good customer service. Continue reading Carders Park Piles of Cash at Joker’s Stash→

Thieves Phish Moneytree Employee Tax Data

Posted on by

Payday lending firm Moneytree is the latest company to alert current and former employees that their tax data — including Social Security numbers, salary and address information — was accidentally handed over directly to scam artists. Continue reading Thieves Phish Moneytree Employee Tax Data→

From Stolen Wallet to ID Theft, Wrongful Arrest

Posted on by

It’s remarkable how quickly a stolen purse or wallet can morph into full-blow identity theft, and possibly even result in the victim’s wrongful arrest. All of the above was visited recently on a fellow infosec professional whose admitted lapse in physical security lead to a mistaken early morning arrest in front of his kids. Continue reading From Stolen Wallet to ID Theft, Wrongful Arrest→

eero: A Mesh WiFi Router Built for Security

Posted on by

Consumer-friendly and secure. Hardly anyone would pick either word to describe the vast majority of wireless routers in use today. So naturally I was intrigued a year ago when I had the chance to pre-order a eero, a new WiFi system billed as easy-to-use, designed with security in mind, and able to dramatically extend the range of a wireless network without compromising speed. Here’s a brief review of the eero system I received and installed a week ago. Continue reading eero: A Mesh WiFi Router Built for Security→

Adobe, Microsoft Push Critical Updates

Posted on by

Microsoft today pushed out 13 security updates to fix at least 39 separate vulnerabilities in its various Windows operating systems and software. Five of the updates fix flaws that allow hackers or malware to break into vulnerable systems without any help from the user, save for perhaps visiting a hacked Web site. Continue reading Adobe, Microsoft Push Critical Updates→

IRS Suspends Insecure ‘Get IP PIN’ Feature

Posted on by

Citing ongoing security concerns, the Internal Revenue Service (IRS) has suspended a service offered via its Web site that allowed taxpayers to retrieve so-called IP Protection PINs (IP PINs), codes that the IRS has assigned to some 2.7 million taxpayers to help prevent those individuals from becoming victims of tax refund fraud two years in a row. The move comes just days after KrebsOnSecurity first exposed how ID thieves were abusing the service to revisit tax refund on innocent taxpayers two years running. Continue reading IRS Suspends Insecure ‘Get IP PIN’ Feature→