Content by Mathew J. Schwartz

Report: Uber Paid Florida 20-Year-Old $100,000 Over Hack

Mathew J. Schwartz  •  December 7, 2017

The hacker to whom Uber paid $100,000 to destroy data and keep quiet about its big, bad breach is a 20-year-old man living in Florida, Reuters reports. But numerous questions remain about the 2016 breach, including whether the payment was a bug bounty, extortion payoff or hush money.

Parliament Admits to Unsafe Email Habits

Mathew J. Schwartz  •  December 6, 2017

Parliament to the populace: Do as we say, not as we do. How else to characterize multiple U.K. lawmakers' flagrant disregard for the data privacy laws that they themselves voted into effect?

Researchers: Andromeda Bust Collared Cybercrime Mastermind

Mathew J. Schwartz  •  December 5, 2017

An international police operation has resulted in the disruption of the long-running Andromeda botnet and associated Gamarue crimeware toolkit. Andromeda has been used to distribute 80 types of malware, including backdoors, banking Trojans and ransomware, security experts say.

Parliament's Email Practices Probed by Privacy Watchdog

Mathew J. Schwartz  •  December 5, 2017

The U.K.'s privacy watchdog has launched a probe after some Members of Parliament admitted they share email passwords or leave workstations unlocked. The MPs were attempting to defend a colleague who's been accused of downloading and viewing pornography on his work PC.

Senators Again Propose National Breach Notification Law

Mathew J. Schwartz  •  December 1, 2017

A trio of Democratic senators is pushing for passage of a U.S. national data breach notification law. Data breach expert Troy Hunt tells lawmakers that data breaches will only get worse. But will Congress, which has rejected similar measures, enact this latest proposal?

Equifax UK Breach Notification Demands Victims' Details

Mathew J. Schwartz  •  November 29, 2017

Fool me once, shame on you. Fool me twice, shame on me. That's the situation facing victims of Equifax's massive data breach, who are being offered identity theft or fraud monitoring services from none other than Equifax. First, however, they have to share some personal information.

Uber's British Breach Tally: 2.7 Million Victims

Mathew J. Schwartz  •  November 29, 2017

Beleaguered ride-sharing service Uber has informed Britain's privacy regulator that 2.7 million U.K. riders and drivers had personal details exposed by the massive 2016 data breach that it covered up for a year.

Canadian Hacker-for-Hire for Russia Pleads Guilty

Mathew J. Schwartz  •  November 29, 2017

Canadian citizen Karim Baratov has pleaded guilty to targeting more than 11,000 webmail accountholders to steal their passwords, including targeting 80 Gmail accounts at the request of an alleged Russian intelligence agent tied to a 2014 hack attack against Yahoo that exposed 500 million accounts.

Russia's Accused Hacker Repeat Play: Extradition Tug of War

Mathew J. Schwartz  •  November 28, 2017

Are you an accused Russian hacker who's been detained on foreign soil at the request of U.S. authorities? Bad news: While Mother Russia will go to court to try to bring you home, your odds of resisting U.S. extradition don't look good.

Alleged Yahoo Hacker-For-Hire: Plea Reports Are Premature

Mathew J. Schwartz  •  November 27, 2017

Reports that a plea deal is about to be reached for Karim Baratov - extradited from Canada to the United States on charges that he assisted Russian intelligence agents with the massive hack of Yahoo in 2014 - are premature, his attorney tells Information Security Media Group.

Did Uber Break Breach Notification Minimum-Speed Limits?

Mathew J. Schwartz  •  November 24, 2017

Uber's tardy data breach notification - one year after the incident occurred - has trigged fresh questions about how quickly companies should come clean after they suffer a cybersecurity incident.

Zeus Banking Trojan Spawn: Alive and Kicking

Mathew J. Schwartz  •  November 24, 2017

Like its mythological namesake, the source code for Zeus malware appears to be immortal. New variants continue to surface, including the Terdot banking Trojan, which is also designed to steal email and social networking credentials while remaining hidden.

Drive-By Phishing Scams Race Toward Uber Users

Mathew J. Schwartz  •  November 23, 2017

Give crooks credit for topicality: They remain loathe to miss a trick. Indeed, hardly any time elapsed after Uber came clean about the year-old breach it had concealed before crack teams of social engineers unleashed appropriately themed phishing messages designed to bamboozle the masses.

Fast and Furious Data Breach Scandal Overtakes Uber

Mathew J. Schwartz  •  November 22, 2017

Move over Equifax. There's a massive new data breach notification in town. And Uber is still struggling to come clean about why it waited for one year to notify data breach victims and regulators.

Driving Privacy Regulators Crazy: UK Probes Uber Breach

Mathew J. Schwartz  •  November 22, 2017

Britain's data privacy watchdog has launched a probe of the massive 2016 data breach suffered by Uber. More than 12 months after the breach, the ride-hailing service is scrambling to notify 57 million individuals across multiple countries that their personal details were exposed.