All news with #pii tag

Google survey: U.S. consumers report rising online scams

🔒 Google’s latest survey with Morning Consult shows U.S. consumers increasingly aware of online scams and taking new protective steps. Over 60% report an uptick in scams and one-third say they experienced a data breach, with texts and email the most common vectors. The report highlights generational differences in sign-in preferences — older adults rely on passwords while Gen Z favors passkeys and social sign-ins — and recommends Google Password Manager, 2‑Step Verification and modern authentication methods.

Student Loan Servicer Breach Exposes 2.5M Consumer Records

🔒 Nelnet Servicing, the servicing and portal provider for EdFinancial and the Oklahoma Student Loan Authority, disclosed a breach affecting 2,501,324 account holders. The incident exposed names, home addresses, email addresses, phone numbers and social security numbers, but did not include users' financial account data. Nelnet said its cybersecurity team secured systems, engaged third‑party forensic experts, and offered two years of credit monitoring, credit reports and up to $1 million in identity theft insurance. Security specialists warned the exposed PII could be used in targeted phishing and social‑engineering campaigns tied to student loan forgiveness news.

0ktapus Phishing Campaign Compromises 130+ Firms Worldwide

🔐 Researchers link a sprawling phishing campaign to the 0ktapus threat group, which spoofed Okta authentication pages and induced employees to submit credentials and MFA codes. The operation hit more than 130 organizations and led to 9,931 compromised accounts, with targeted activity against Twilio and Cloudflare staff. Group-IB reports 5,441 harvested MFA codes and urges URL vigilance, better password hygiene and adoption of FIDO2 security keys.

Twitter Whistleblower Alleges Major Security Failures

🔍 An 84-page whistleblower complaint from former Twitter head of security Peiter “Mudge” Zatko alleges systemic security and privacy failings at the company, including excessive staff access, unpatched servers, and potential foreign-agent infiltration. Zatko says these issues violate a 2010 FTC order and pose a national security risk. Twitter calls him a disgruntled ex-employee and says many issues are addressed. Congressional inquiries have already begun.

Tetrad Exposure: Data on 120M U.S. Households Leaked

🔓 UpGuard Research discovered an unsecured Amazon S3 bucket containing a broad compilation of consumer data attributed to Tetrad, including blended sources such as Experian Mosaic and Claritas/Nielsen's PRIZM. Three large Mosaic files alone contained names, genders, addresses, and segment codes covering roughly 120–130 million households. The bucket also held retailer clientfiles with loyalty and transaction records from brands like Chipotle, Kate Spade, and Bevmo. After notification, Tetrad removed public access once the misconfiguration was identified.

DSCC S3 Misconfiguration Exposes 6.2M Email Addresses

🔒 UpGuard researchers discovered an Amazon S3 bucket tied to the Democratic Senatorial Campaign Committee (DSCC) that publicly exposed about 6.2 million email addresses. The unprotected archive, EmailExcludeClinton.zip, contained a comma-separated .csv of addresses from major ISPs, universities, government and military domains and was last modified in 2010. UpGuard notified the DSCC on July 26, 2019, and the bucket was secured the same day. The incident highlights persistent operational risks in campaign data handling.

Medico Inc. S3 Exposure Exposes Nearly 14,000 Records

🏥 UpGuard discovered an open Amazon S3 bucket operated by Medico Inc. that exposed nearly 14,000 files (~1.7 GB), including medical records, explanations of benefits, legal documents, and financial PII such as SSNs and bank account details. The bucket was identified on June 20, 2019 and secured within hours after notification. Exposed items also included internal spreadsheets containing account credentials and passwords, plus scanned checks and unredacted treatment notes. The incident highlights common cloud misconfigurations and the need for stronger vendor controls and data-handling processes.

AggregateIQ Repositories Expose Brexit Campaign Sites

🔍 This report details UpGuard's review of publicly downloadable development repositories from data analytics firm AggregateIQ, which contained source code, WordPress backups, database exports, and credentials tied to multiple UK political sites. The exposed repositories appear to link AIQ to web assets for several pro-Brexit groups and campaigns. Sensitive items found include API tokens, payment keys, and admin accounts that, if abused, could grant access to live systems and supporter data. The report highlights misconfiguration and credential management failures with potential regulatory consequences under GDPR.

Open NAS Exposed Thousands' PII at Maryland JIA Systems

🔒 UpGuard discovered a publicly accessible network-attached storage (NAS) device belonging to the Maryland Joint Insurance Association (JIA), exposing backups and administrative files. The repository contained customer PII—including full Social Security numbers, birth dates, addresses, phone numbers, insurance policy identifiers, and check images showing full bank account numbers—alongside plaintext internal credentials and third-party access details. UpGuard notified JIA and the device was secured; the exposure highlights serious configuration and vendor-risk failures that can rapidly put vulnerable policyholders at risk.

Exposed S3 Bucket Leaked Thousands of TigerSwan Resumes

🔓 UpGuard discovered an Amazon S3 bucket publicly exposing 9,402 TigerSwan job applications and resumes, many containing sensitive personal details and hundreds of claims of Top Secret/SCI clearances. The repository, last updated in February 2017 and attributed by TigerSwan to a terminated recruiting vendor, included names, addresses, contacts, passport and partial Social Security numbers, and driver’s license data. UpGuard notified TigerSwan in July 2017; after follow-ups the files were secured on August 24, highlighting the risks of cloud misconfiguration and third-party vendor practices.