The world’s first trillion-dollar company, Apple, has suffered an embarrassing hack by an Aussie teen. The company is known to be highly security conscious, yet a teenager from Melbourne was able to hack into the company’s  network’s and steal over 90 GB of data over the course of a year.

Investigators discovered the hacker had ‘authorization keys’ on his computer, stored in a folder called ‘hacky hack hack’, and bragged of his accomplishments on WhatsApp. He admitted to the investigators that his dream was to work for Apple.

Apple contacted the FBI after discovering the breach, who in turn contacted the Australian Federal Police. Working together they soon caught the teenager, whose name is being withheld as he is a minor and may be placed in danger if details were released.

The Australian Federal Police raided his home, finding a variety of Apple computers, mobiles and drives, which matched IDs from the attack. The teenager pleaded guilty in court and is now awaiting sentencing. The company claims that no customer personal data was compromised,

The attack follows the news that a group of hackers named Lazarus is said to be behind a crypto-coin stealing malware targeting Macs known as AppleJeus, adapted from a Windows virus. Lazarus is believed to have ties to North Korea.

The last time Apple faced serious security issues was in 2014 when four hackers admitted to using social engineering ‘phishing’ emails to steal female celebrities’ nude photos, including Jennifer Lawrence and Kin Kardashian, from their iCloud accounts. Known as the ‘Fappening’, hundreds of images were released on the 4Chan website and the hackers  have all received between eight-month to 18-month sentences between them.

The latest incident shows that even the most security conscious company is not immune from determined hackers, who are increasingly using ever more sophisticated methods to bypass security. More than ever, it is imperative that business train their staff to recognise social engineering phishing attacks as a last line of defence and to have an effective recovery system in placeto reduce downtime and lost profits.

Most experts recommend that recovery tools and services make up at least 20% of your network security budget to quickly recover from any loss of data and to prevent downtime.

Globalnet works with businesses throughout London, Essex, Kent and Herts to ensure their data and networks are secure from all threats. Call us on 0203 005 9650 today to find out how we can provide the right protection for you.

Globalnet aims to be an integral part of your success, providing the best business advice, superior IT support and technology to help you reach your goals. 

Find out more about Globalnet’s cyber security plans

The details of almost 20,000 online Superdrug customers have been hacked, the cosmetics retailer has confirmed. Payment card details are not said to be among the data stolen.

Superdrug boss Peter Macnab has emailed customers to inform them of the “possible disclosure of your personal data, but not including your payment card information.”

“On the evening of the 20th of August, we were contacted by hackers who claimed they had obtained a number of our customers’ online shopping information. There is no evidence that Superdrug’s systems have been compromised. We believe the hacker obtained customers’ email addresses and passwords from other websites and then used those credentials to access accounts on our website.”

The email explained that the hackers had “obtained information on approximately 20,000 customers but we have only seen 386.”

According to IT site, The Register, it seems that the hackers had “taken passwords and usernames stolen from one website and used them to log into accounts on other sites, exploiting the fact people reuse their passphrases across various online services and profiles.”

The Superdrug email also stated that customers’ names, postal addresses and “in some instances” dates of birth, phone numbers and points balances “may have been accessed”. Superdrug advises its customers to update their Superdrug.com password “now and on an on-going, frequent basis.”

Action Fraud and the police have been notified and it is believed the hackers contacted Superdrug to extort money from the business to keep the hack quiet.

Globalnet works with businesses throughout London, Essex, Kent and Herts to ensure their data and networks are secure from all antivirus, malware and ransomware threats. Call us on 0203 005 9650 today to find out how we can provide the right protection for you.

Globalnet aims to be an integral part of your success, providing the best business advice, superior IT support and technology to help you reach your goals. 

Find out more about Globalnet’s cyber security plans

The University of Greenwich has been fined £120,000 by the Information Commissioner’s Office (ICO) for a security breach that demonstrates the importance of maintaining active security controls on websites.

It was discovered that a forgotten microsite, created by a student and professor in 2004 for a training conference had been hacked, creating a backdoor to the universities network for the hackers to steal the personal details of 19,500 people. According to the ICO, the data included names, addresses and telephone numbers.

Organisational responsibility for security breach

Although the microsite was developed without the university’s knowledge, the ICO said that the university didn’t have appropriate technical and organisational measures in place for ensuring security and that it was down to the university to take responsibility for security throughout the institution.

ICO head of enforcement Steve Eckersley said, “Students and members of staff had a right to expect that their personal information would be held securely, and this serious breach would have caused significant distress. The nature of the data and the number of people affected have informed our decision to impose this level of fine.”

The University of Greenwich said it would not appeal the decision and would take advantage of a prompt payment discount to reduce the fine by 20% to £96,000 and had since carried out an overhaul of data protection and security systems.

University secretary Peter Garrod said, “No organisation can say it will be immune to unauthorised access in the future, but we can say with confidence to our students, staff, alumni and other stakeholders, that our systems are far more robust than they were two years ago as a result of the changes we have made.”

Previous data breach by University of Greenwich

The ICO said this was the first time that a university had been fined under the current legislation, which dates back to 1998, although other breaches have been reported and investigated in that time. This includes a separate data breach involving Greenwich University in 2016, in which the personal details of postgraduate research students were hacked. The hackers posted this information online.

In one example, it was disclosed that a student had a brother who was fighting in a Middle Eastern army and references were made to an asylum application. However, the university said that the ICO had concluded that no enforcement action was necessary in this instance.

GDPR

With the implementation of GDPR on May 25^th, organisations will be subjected to greater scrutiny over data protection and security and may be subject to fines of up to 4% of their annual turnover, or up to €20 million, although fines will be made with a tiered system depending on the level of the violation.

Make sure your organisation is fully secured against data breaches and hackers. Globalnet offers managed cyber security plans for businesses of all sizes, including the UK Government backed Cyber Essentials Scheme. Speak to one of our consultants for more details. Call 0203 005 9650.