IT NEWS

Android users, be on your guard against adware trying to infect your device.

The adware—known as MobiDash—is spreading via several channels, according to ThreatDown research.

One of the characteristics that makes MobiDash stand out is that it can be added to legitimate apps without changing how the original app functions. Say, for example, you install a calculator app: You still get the calculator, but you get adware served to you on the side.

Another devious feature is that MobiDash often waits for a few days before it becomes active, making it harder for the user to work out where the ads are coming from. The app they downloaded works, and because there’s no immediate sign of infection there is no reason to suspect that app.

The ThreatDown investigation started by researching a domain that recently popped up in a phishing campaign. We found that besides the phishing campaign, links to this domain were being spread on Facebook.

But not just Facebook, we found that MobiDash was also being spread on certain sites that specialize in explicit content.

When victims click the link, it starts a chain of redirects (lookebonyhill.com > apkretro.com > 3-dl-app.com) that ends in the automatic download of an .apk file, although some users reportedly had to use the Download button.

Within a few days, the user will start to see ads pop up out of nowhere, until the app is uninstalled.

How to avoid/remove adware

1. Be careful what you click on: In the Facebook example above, you can see there is an unusual looking link. Don’t be tempted to click on a site you don’t know.
2. Don’t install apps from unknown sources: Use the Google Play Store as much as you can.
3. Look out for the Download website we posted a screenshot of above: The fact that the site displays no name for the apk you just downloaded should be a red flag that it’s not be the one you wanted or that it has extra adware attached to it.
4. Use Malwarebytes for Android. We’ll detect and remove MobiDash from your device, as well as block the start of the redirect chain.

Ireland’s privacy watchdog Data Protection Commission (DPC) has fined Meta €91M ($101M) after the discovery in 2019 that Meta had stored 600 million Facebook and Instagram passwords in plaintext.

The DPC ruled that Meta was in violation of GDPR on several occasions related to this breach. It determined that the company failed to “notify the DPC of a personal data breach concerning storage of user passwords in plaintext” without delay, and failed to “document personal data breaches concerning the storage of user passwords in plaintext.”

The DPC also said that Meta violated GDPR by not using appropriate technical measures to ensure the security of users’ passwords against unauthorized processing.

While the DPC does not disclose the number of passwords, several sources at the time quoted internal sources at Facebook who said 600 million password were freely accessible to employees. Most of these passwords belonged to Facebook Lite users, but it affected other Facebook and Instagram users as well.

Facebook found out that it logged the passwords in plaintext by mistake during a code review.

An ongoing issue

Over the years, several data sets belonging to Facebook users have circulated on Dark Web marketplaces. We’ve seen country-specific sets for Iran, Sudan, and Hong Kong. The largest data set that is still publicly accessible contains 303,081,505 records and was shared on a Telegram channel in February 2022. The data contains email addresses, names, phone numbers and additional personal information.

In April 2021, a cybercriminal posted over half a billion scraped Facebook profiles for free on a hacking forum. The data encompassed profiles from over 100 countries and included emails, Facebook IDs, birthdays, phone numbers, and other Personally Identifiable Information (PII). Several other forums mirrored this data set.

Last February, we reported how personal data belonging to Facebook Marketplace users was published online. That leak consisted of around 200,000 records that contained names, phone numbers, email addresses, Facebook IDs, and Facebook profile information.

In 2019, a private security researcher reported finding a database with the names, phone numbers, and unique user IDs of over 267 million Facebook users. The hosting company took the database offline after a tip off from the security researcher.

Social media accounts container a lot of personal information which combined with our email addresses provides cybercriminals with information they can use to add credibility to their phishing attempts.

It’s a good idea to check what personal information of yours is out there, and for that you can use our free Digital Footprint scan. Fill in the email address you use most frequently to sign up for sites and services, and we’ll give you a free report.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

Last week on Malwarebytes Labs:

• Millions of Kia vehicles were vulnerable to remote attacks with just a license plate number
• Privacy watchdog files complaint over Firefox quietly enabling its Privacy Preserving Attribution
• Telegram will hand over user details to law enforcement
• Don’t share the viral Instagram Meta AI “legal” post
• Romance scams costlier than ever: 10 percent of victims lose $10,000 or more
• Malwarebytes Personal Data Remover: A new way to help scrub personal data online
• 100 million+ US citizens have records leaked by background check service
• San Francisco’s fight against deepfake porn, with City Attorney David Chiu (Lock and Code S05E20)
• Relationship broken up? Here’s how to separate your online accounts
• SpaceX, CNN, and The White House internal data allegedly published online. Is it real?

Last week on ThreatDown:

• Introducing Detection Center: Centralized threat management simplified
• Hybrid cloud environments are not safe from ransomware
• Android’s Rusty new code shakes off huge number of memory-safe vulnerabilities
• New integration: Nebula and OneView with Google Chronicle SIEM
• North Korean IT workers—or how not to solve the IT staff shortage

Stay safe!

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

In June of 2024 security researchers uncovered a set of vulnerabilities in the Kia dealer portal that allowed them to remotely take over any Kia vehicle built after 2013—and all they needed was a license plate number.

According to the researchers:

“These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.”

How was this possible?

First, it’s important to understand that the Kia “dealer portal” is where authorized Kia dealers can match customer accounts with the VIN number of their new car. For the customer accounts, Kia would ask the buyer for their email address at the dealership and send a registration link to that address where the customer could either set up a new Kia account or add their newly purchased vehicle to an existing Kia account.

The researchers found out that by sending a specially crafted request they could create a dealer account for themselves. After some more manipulation they were able to access all dealer endpoints which gave them access to customer data like names, phone numbers, and email addresses.

As the new “dealer,” the security researchers were also able to search by Vehicle Identification Number (VIN) number, which is a unique identifier for a vehicle. With the VIN number and the email address of the rightful owner, the researchers were able to demote the owner of the vehicle so that they could add themselves as the primary account holders.

Unfortunately, the rightful owner would not receive any notification that their vehicle had been accessed nor their access permissions modified.

But to find the VIN number of a car you’ll need physical access to the vehicle, right? Not entirely.

In several countries, including the US and the UK, there are vehicle databases that you can query to provide you with a VIN number based on the license plate number. The researchers used a third-party API to convert the license plate number to a VIN.

Depending on the vehicle and whether Kia Connect was active, the primary account holder is able to remotely lock/unlock, start/stop, honk, and locate the vehicle.

The researchers created a proof-of-concept tool where they could enter the license plate and in two steps they could retrieve the owner’s personal information, and then execute remote commands on the vehicle.

The researchers responsibly disclosed their findings to Kia, which has since remediated the vulnerabilities found by the researchers. Kia assured that the vulnerabilities have not been exploited maliciously.

Vulnerabilities in cars are not new. In fact, the researchers that found these vulnerabilities did that as a follow-up to their earlier research. And too often we find that car makers are more interested in adding new features than securing their existing ones. So, we can expect that vulnerabilities like these will continue to be uncovered and we should be glad that these researchers chose to disclose their findings and give Kia a chance to fix the vulnerabilities before disclosing them.

A European privacy watchdog has filed a complaint against Mozilla for quietly enabling Privacy Preserving Attribution (PPA) in its Firefox browser.

Noyb (none of your business) argues that despite its reassuring name, the feature allows the browser to track your online behavior. By design, Privacy Preserving attribution shifts the tracking from the websites to the browser.

With this shift it seems that Mozilla is following Google’s example. Google is focusing on Privacy Sandbox to replace the despised third party tracking cookies. This also puts the browser (Chrome and Chromium based) in charge of the tracking.

The problem noyb has with PPA is not so much the tracking which is less invasive than what we are used to, but the fact that it was introduced without giving users a chance to think about it. Mozilla simply turned it on by default after a recent update, which noyb says is disappointing coming from a company that is supposed to be privacy friendly.

And, even though the Firefox PPA offers more privacy than third-party cookies, noyb says this move means that Mozilla is caving in to advertisers.

Felix Mikolasch, data protection lawyer at noyb, said:

“Mozilla has just bought into the narrative that the advertising industry has a right to track users by turning Firefox into an ad measurement tool.”

Mozilla says that PPA allows advertisers to measure the effectiveness of their advertising without compromising the user’s privacy. Admittedly the user’s benefit indirectly, as the sites they visit are often supported by advertising. Making advertising better also makes it possible for more sites to function using the support that advertising provides.

The costs of getting rid of third-party cookies by using PPA are small, Mozilla says:

• CPU, network, and battery costs for generating and submitting reports. Here, this cost is negligible, particularly relative to what sites are already able to use. This design could replace some of those costs, which might lead to improvements in some cases.
• Privacy loss from use of their information. Attribution information will be aggregated and will include noise that protects the contribution that each person makes. This design is structured so that advertisers learn about what many people do as a group, not what any single person does.

If this is the price we must pay to get rid of third-party cookies and some degree of targeted advertising, is that worth it to you? Let us know in the comments.

Noyb has asked the Austrian data protection authority (DSB) to investigate Mozilla’s behavior. They say Mozilla should properly inform everyone about Firefox’s data processing activities and effectively switch to an opt-in system, as well as delete all unlawfully processed data.

How can I disable PPA?

If you want to disable PPA, this is what you need to do:

1. Click the menu button and select Settings.
2. In the Privacy & Security panel, find the Website Advertising Preferences section.
3. Uncheck the box labeled Allow websites to perform privacy-preserving ad measurement.

Protection, in the browser

Malwarebytes’ free Browser Guard extension can help you block ads and other unwanted content in Firefox.

Last month we reported how Telegram CEO Pavel Durov was indicted on charges of complicity in the distribution of child sex abuse images, aiding organized crime, drug trafficking, fraud, and refusing lawful orders to give information to law enforcement.

Now, in a potentially related development, chat app Telegram has changed its privacy policy to reflect that it will share user’s IP addresses and telephone numbers if they are suspected of committing a crime.

“8.3. Law Enforcement Authorities

If Telegram receives a valid order from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities. If any data is shared, we will include such occurrences in a quarterly transparency report published at: https://t.me/transparency.”

Durov said the changes were made to discourage the criminal abuse of Telegram Search, a feature that is known to be used for buying and selling illegal goods. A dedicated team of moderators will use Artificial Intelligence to make the search safer. These moderators will also go over reports submitted by users through the @SearchReport bot about search terms that can be used to find illegal content.

All these measures together should discourage criminals. Telegram was set up to find friends and news, not to trade illegal goods, Durov emphasized:

“We won’t let bad actors jeopardize the integrity of our platform for almost a billion users.”

It should be clear that this is all a work in progress. The bot for the transparency reports is not yet ready for action, for example.

“This bot can give you a Telegram transparency report as per section 8.3 of the Telegram Privacy Policy.

We are updating this bot with current data. Please come back within the next few days.”

All in all, the future will show how adequate the moderators can act on reports and how easy, or difficult, it will be for law enforcement to submit a “valid order.”

But criminals are probably already looking for alternatives as we speak.

We don’t just report on privacy—we offer you the option to use it.

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

Romance scams continue to plague users, but their costs have risen to staggering heights, according to a Malwarebytes survey carried out last month via our weekly newsletter.

More than 66 percent of 850 respondents have been targeted by a romance scam, and those that were ensnared paid a hefty price, with 10 percent of victims losing $10,000 and up. A shocking 3 percent parted with $100,000 or more. The vast majority of those who lost money were unable to recover it, highlighting the need for increased awareness of evolving romance scam tactics and aggressive new methods of manipulation.

Romance scams, also known as confidence or dating scams, typically involve people being targeted online, with the scammers building their victim’s trust over several months. Victims are led to believe they’re in a committed relationship before being tricked into sending money, valuables, and personal information, or to launder money on the perpetrator’s behalf. In addition, some scammers convince their targets into investing in fraudulent cryptocurrency schemes, a method known as pig butchering.

While these scams are nothing new, their popularity has risen since the pandemic and ensuing loneliness epidemic, driven by an increasing reliance on the internet to connect. However, with the return to in-person gatherings, our survey results show romance scams have hardly petered out. Rather, they’re as pervasive as ever, with 52 percent of respondents targeted in the last year alone. And they’ve advanced, as cybercriminals now tap into global scamming networks for scripts, training, and technology to squeeze more money from victims.

As David Ruiz, Senior Privacy Advocate at Malwarebytes, puts it:

“Romance and dating scams are run by sophisticated cybercriminals who know what they’re doing. They conduct research, and follow a playbook. The more we can remove the stigma surrounding victims and provide education and resources, the faster we can minimize the devastating effects of these scams.”

According to the Federal Trade Commission (FTC), over 64,000 people reported romance scams in 2023, with losses totaling $1.1 billion. The Federal Bureau of Investigation (FBI) received 17,823 complaints last year, costing victims nearly $653 million. However, that data doesn’t capture the recent trend of pig butchering, as romance scammers increasingly incorporate crypto investment fraud for higher payouts. Financial losses from investment fraud totaled $4.6 billion in 2023, the costliest internet crime for consumers.

For a full breakdown of survey results, including demographics, scammer tactics, and financial and emotional impacts, read below.

Demographics of romance scams

The majority of survey respondents were subject to romance scam advances within the last year, with 37 percent saying it happened within the last six months, and an additional 15 percent saying it happened between six months and one year ago.

The majority of targets are over the age of 55 (74 percent) and male (56 percent), a pattern consistent with previous trends. As with most scams, older users are targeted because they typically have more assets but are perhaps less familiar with online security. The Department of Homeland Security says cybercriminals zero in on recently widowed or divorced seniors for their vulnerability and access to cash.

However, 26 percent of victims are between 18 and 54 years old. In fact, the FTC asserts that the most common victims of romance scam sextortion are 18–29 years old.

How romance scammers make contact

Perhaps not surprisingly, the vast majority of phony romantic overtures took place on social media and online dating apps, with 38 and 31 percent of survey respondents targeted on those platforms, respectively. In fact, the proliferation of scams is one reason noted for the decline in social media and dating app use over the last two years. A recent Barclays survey found one third of Brits avoid online dating and dating apps due to romance scam fears.

Romance scams that start on social media end up costing the most. The FTC found from January 2021 to June 2023, more money was lost to scams originating on social media than by any other contact method. Consumers lost $2.7 billion in social media fraud, with crypto investment and romance scams resulting in the steepest costs, accounting for 67 percent of total losses. In the first six months of 2023, half of those who lost money to romance scams said it began on Facebook, Instagram, or Snapchat.

Romance scammers prefer using social media and dating apps to reach their targets because they can easily create fake profiles and tailor their personas to content victims share and like. Criminals can even use advertising tools to methodically select targets based on personal details such as age, interests, or past purchases. More recent trends involve romance scammers using AI to draft convincing emails, create fake photos in the likeness of their target’s recently-departed spouse, or develop deepfake videos of celebrities endorsing their investment scheme.

In addition, despite having strong anti-scam controls, nearly 16 percent of surveyed romance scam targets were initially contacted by email. Just over 10 percent were reached via text, a popular contact method for pig butchering.

How long does the scam last?

If survey results are an indication, the majority of those targeted by romance scams have become savvy to their ways—though Malwarebytes newsletter subscribers may be particularly well-informed. 55 percent knew it was a scam right away and never responded. Almost 19 percent figured out the scam within one week, meaning nearly three-quarters of respondents demonstrated excellent cybersecurity awareness.

Unfortunately, that leaves 26 percent engaging with romance scammers for more than two weeks, with 12 percent spending several months talking to pretend paramours, and 5 percent in a faux relationship for one year or more. In general, the longer a respondent was “together” with their scammer, the more money they lost. The exceptions were those who recognized the scam immediately, but spent weeks or months leading them on to waste their time. While this might seem like poetic justice, many romance scammers themselves are victims of human trafficking, forced to work up to 15 hours a day extracting enough money from victims to meet impossibly high quotas.

Money lost

User awareness wins the day again, preventing nearly three quarters of those targeted by a romance scam from losing money. However, the majority of those who did part with cash lost a lot of it—10 percent lost $10,000 or more, and 3 percent reported losses in the six figures. An additional 7 percent of survey respondents were scammed out of $1,000–$9,999, and 5 percent lost between $200 and $999. Just 3 percent of victims were scammed out of less than $200.

This means a full 22.5 percent of those targeted by a romance scam end up losing $1,000 and up—enough to make a significant impact on finances, especially for those with lower incomes. In 2023, romance scam victims—not counting those who reported crypto investment fraud—lost a median of $2,000 per person, the highest reported losses for any form of imposter scam, according to the FTC. Romance scams were also the third costliest fraud type reported to the FTC by older Americans (age 60 and over).

The FBI 2023 Internet Crimes Report noted financial losses to investment scams rose from $3.3 billion in 2022 to $4.6 billion in 2023—a 38 percent increase over the 183 percent gained the previous year. Combined, romance and investment scams were the costliest and second-most common internet crimes reported to the FBI last year as well, a fact reflected in Malwarebytes’ survey results and participant testimonials.

Tellingly, 94 percent of those who lost money were unable to recover it. Those who wish to recover cryptocurrency should be aware of additional scams by fraudulent businesses promising to trace and return funds. No private sector company can recover crypto—only legal or internal processes can compel cryptocurrency exchanges to release money back to victims.

Reporting the scam

Stigma is still a problem in dealing with the aftermath of a romance scam. Victims report heightened feelings of betrayal and shame on top of their financial burden. Yet 40 percent of surveyed romance scam victims didn’t tell another soul about what happened. An additional 30 percent only opened up to their closest confidantes. And while research suggests individuals impacted by the stress and trauma of romance scams benefit from counseling or support groups, just 4 percent sought out therapy after their experience.

However, there does appear to be a larger portion of romance scam targets willing to speak out than in the past. One quarter of our survey respondents said they told many others about their ordeal, with 11 percent submitting reports to law enforcement and/or nonprofit organizations. Data obtained by the BBC shows there were 7,660 cases processed in England and Wales by a self-reporting tool last year, up from 4,842 in 2019.

How to spot and avoid a romance scam

Romance scams aren’t going away, so here’s how to spot signs that someone isn’t who they say they are.

• Their profile and picture seem too good to be true
• They profess love and affection very quickly
• They share a lot about themselves in the first meeting
• They claim to be overseas and cannot stay in one place for long
• They try to lure you from whatever platform you are on to talk to you via email or video chat
• They claim to need money for something

Here’s what you can do to keep yourself safe:

• Don’t give scammers the information they need. Scammers rely on what you volunteer about yourself online to tweak their script and lure you in. Use tools such as the Malwarebytes Personal Data Remover to minimize the amount of data accessible through search engine results, spam lists, and people search sites.
• Perform an image search of the photo and the name of the person you’re in touch with. Scammers often steal someone else’s image to use as bait, and stolen identities are rife.
• Go slow. Scammers tend to rush, building rapport with their victims as quickly as possible before moving in for the money-themed kill.
• Never give money to anyone you’ve met online
• Get a second opinion from someone you trust
• If in doubt, back away and report the account.

If you’ve been impacted by a romance scam, pig butchering, or crypto investment fraud, you can report the crime to the Internet Crimes Complaint Center (IC3), which is run by the FBI, or the FTC on its reporting and resources page.

To talk with other romance scam victims in safe online forums, go to the reddit thread r/Romancescam, or apply to the private Facebook Support Group for Romance Scam Victims.

A new variation of a hoax that has been doing the rounds on Facebook for years has crossed over to Instagram.

We’re seeing this post on Instagram Stories a lot suddenly over the last few days. The post is usually posted as a shareable screenshot on Instagram Stories, but it’s also been spotted on Facebook and Threads as a copy-and-paste text.

“Repub

Goodbye Meta AI. Please note an attorney has advised us to put this on, failure to do so may result in legal consequences. As Meta is now a public entity all members must post a similar statement. If you do not post at least once it will be assumed you are okay with them using your information and photos. I do not give Met or anyone else permission to use any of my personal data, profile information or photos.”

The fact that this post has been shared by some celebrities is a possible explanation for the sudden popularity. And, as is often the case, true stories about Facebook scraping photos to train its Artificial Intelligence (AI) can rekindle the popularity and urgency to post this type of useless notifications.

Instagram has started to flag versions of the post as false information which means people need to click ‘see post’ to view it. But what happens often is that somebody will start fresh with a slightly revamped version that will not be flagged.

While some may think it doesn’t hurt to share these posts just to be sure, it really isn’t a good idea. It spreads the false posts further, and people may feel they have opted out of their images being used after posting this, when in reality they haven’t. In many cases it would even be contradictory to the terms and conditions they agreed on.

Meta, the company that owns Facebook and Instagram published new terms and conditions, effective on June 26, 2024, which specifically allow it to use posts, images and online tracking data to train its AI large language model called LLaMa 3.

On inspection of the links in the notification, it became clear that the company will use years of personal posts, private images or online tracking data for a “AI technology” that can ingest personal data from any source and share any information with undefined “third parties.”

European and UK users can opt out of this. For others, sadly, it’s not so easy.

How to opt out of Meta using your images for AI training

Logged in citizens of the EU and the UK can visit the Meta Privacy Center from either their Facebook account or their Instagram account.

How to opt out of Meta using your data to train AI on Facebook

• Tap on your profile picture after logging in
• Tap Settings and Privacy
• Scroll down to the Privacy Center
• Under Privacy topics, tap AI at Meta
• Tap Information you’ve shared on Meta products and services
• From there you’ll be presented with a form to fill out and Submit when you’re done.

How to opt out of Meta using your data to train AI on Instagram

• Tap on the hamburger menu from your profile (three stacked lines)
• Scroll down to the Privacy Center
• Under Privacy topics, tap AI at Meta
• Tap Information you’ve shared on Meta products and services
• From there you’ll be presented with a form to fill out and Submit when you’re done.

Whether you use Facebook or Instagram to opt out, you should then receive both an email and a notification on your account confirming whether your request has been successful.

Users in the US or other countries without national data privacy laws don’t have any foolproof ways to prevent Meta from using their data to train AI.

My advice: insist that your politicians make some noise and get you similar opt-out options.

There’s an awful lot about you online that some awful groups want to exploit.  

The right combination of personal data points could help an identity thief fool a bank into opening a new, fraudulent line of credit in your name. Your alma mater, salary, and email address could help an online scammer craft the perfect phishing lure to trick you into donating to a bogus school fund. Your new address could be vulnerable to obsessive stalkers, your phone number could attract countless robocalls, and even your recent divorce status could make you a target for romance scammers.  

There’s now a way to fight back, with Malwarebytes Personal Data Remover. 

For years, the public have had few defenses to evolving online scams, as sensitive, personal details are all too easy to find online. Some of this data gets exposed through the major, corporate data breaches that now punctuate our lives, but some of this data isn’t “exposed” at all.  

Instead, it’s traded through a bustling network of “data brokers” that work tirelessly to collect and sell people’s names, addresses, phone numbers, bankruptcy records, salaries, marital statuses, and more. This can generate easy money though hyper-precise online advertising, or it can be done to power “people search” sites that leave nearly nothing to a scammer’s imagination.  

People deserve better.  

Today, Malwarebytes is simplifying your security and privacy with the release of our new Personal Data Remover.  

For people in the United States, Malwarebytes Personal Data Remover provides:   

• Immediate, deep scans across roughly 175 databases to find your personal data. 
• Personalized, in-depth reports on what data is being sold and who is selling it.  
• Automatic data removal requests for subscribers, which can save 300+¹ hours of manual work in wiping sensitive details off the internet, along with free DIY guides to tackle each site individually.  
• Recurring scans and data removal requests that will make it harder for invasive websites to rebuild their digital portraits of you.²  

Malwarebytes Personal Data Remover represents our latest advancement in extending cybersecurity beyond antivirus.  

The truth is that modern threats to your privacy and your security have changed dramatically in a few short years, as cybercriminals are no longer focused only on infecting and controlling your device with viruses and malware. Rather, online scammers and thieves can glean relevant, personal details about your life to make it easier to steal your identity, take your money, or frighten you with empty ransom demands.  

This is why, almost a year ago, we launched Identity Theft Protection to help people prevent and recover from online identity theft, followed by the release of our free Digital Footprint Portal that provides free, in-depth reports about what data of yours is currently exposed online.  

With Malwarebytes Personal Data Remover, we hope to provide security and privacy beyond your device and into your entire experience online.  

Try Malwarebytes Personal Data Remover today.  Take back control of your data.

_{1. Based on historical user data on the average time it takes to search, remove, and monitor re-exposure.} 

_{2. Available for paid subscribers in the United States only.}  

A background check left a huge database unprotected online containing 2.2TB of people’s data, according to research by Cybernews.

The database was left passwordless and easily accessible to anyone on the internet by background check firm MC2 Data. MC2 Data gathers publicly available data to provide decision makers with information whether someone can rent a house, work at their firm, or be granted a loan.

The data is usually gathered from online sources like criminal records, employment history, family data, and contact details.

Just like the huge National Public Data breach, this is another example of companies that most of us have never heard having extensive databases with an enormous amount of personal data. In this case, the researchers found 106,316,633 records containing private information about US citizens.

Cybernews estimates that at least 100 million individuals are affected, meaning approximately one in three US citizens can expect to find their data in the data set.

The websites that MC2 Data operates include:

• PrivateRecords
• PrivateReports
• PeopleSearcher
• ThePeopleSearchers
• PeopleSearchUSA

And the leaked data included:

• Names
• Emails
• IP addresses
• User agents
• Encrypted passwords
• Partial payment information
• Home addresses
• Dates of birth
• Phone numbers
• Property records
• Legal records
• Property records
• Family, relatives, neighbors data
• Employment history

To make things even worse, the data of 2,319,873 users who subscribed to MC2 Data services were leaked as well.

It is incomprehensible that services like these are allowed to exist without any kind of control or sense of responsibility. Regardless of all the regulations and laws these companies need to abide by, we find time and again that their security measures are below par.

As the researchers put it:

“While background-check services keep trying to prevent such cases, they haven’t been able to stop such use of their services completely. Such a leak is a goldmine for cybercriminals as it eases access and reduces risk for them, allowing them to misuse these detailed reports more effectively.”

Protecting yourself after a data breach

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

• Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
• Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
• Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
• Watch out for fake vendors. The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
• Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
• Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
• Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Check your digital footprint

If you want to find out what personal data of yours has been exposed online, you can use our free Digital Footprint scan. Fill in the email address you’re curious about (it’s best to submit the one you most frequently use) and we’ll send you a free report.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.