New York's Data Breach

22.8 million New Yorkers' personal records exposed

Nearly 23 million private records of New Yorkers have been exposed in data security breaches reported by more than 3,000 businesses, nonprofits and governments over the past eight years, New York's attorney general reported.

Deliberate hacking was responsible for 40 percent of the 5,000 incidents, which exposed a majority of the records, followed by lost or stolen equipment, insider wrongdoing and inadvertent errors, according to the report released on Tuesday.

"As we increasingly share our personal information with stores, restaurants, health care providers and other organizations, we should be able to enjoy the benefits of new technology without putting ourselves at risk," Attorney General Eric Schneiderman said. He urged collaboration between industry and security experts so businesses and organizations have the tools to secure data and address the growing, complex problem.

Since 2005, New York law has required breached institutions to advise the attorney general and the individuals when computerized private data consisting of names and account, social security or driver's license numbers were acquired by an unauthorized user. The report noted that it excludes thousands of data breaches involving sensitive information that don't fit under the law's reporting requirements.

The 7.3 million records exposed in 900 security breaches last year cost institutions an estimated $1.37 billion to investigate, rectify and help customers, the report said. They included the two largest so far, both involving retailers, when Target Corp. was hacked, exposing the personal information and credit card numbers of more than 70 million customers nationwide including 1.8 million New Yorkers, and LivingSocial's data was hacked, exposing 4.75 million records of New Yorkers.

Target said it subsequently imposed several security measures with enhanced monitoring, limiting vendor access, streamlining firewalls and resetting passwords.

LivingSocial spokesman Kevin Nolan said none of their customers' credit card data was ever compromised, that the exposed data in 2013 was limited to usernames and encrypted passwords that were useless outside of its system.

While black market sales of private data were cited as the primary motivation for hacking, the report didn't identify New York consumer losses. It cited studies by the Javelin Strategy and Research Group and LexisNexis estimating one-fourth of records lost in data security breaches end up used for fraudulent purposes, often identity theft, which accounted for $24.7 billion direct and indirect losses in the U.S. in 2012, exceeding all other property crimes combined.

For businesses, nonprofits and governments, the report advises identifying the data they require and how it's secured, collecting no unnecessary data and setting expiration dates on collected information, and establishing a security plan with encryption.  For consumers, it advises creating strong and different passwords for various accounts, not storing them electronically, carefully monitoring credit and debit card statements, and not posting sensitive information on social media.

As the Net Neutrality feedback deadline looms, an overflow of submissions broke the Federal Communications Commission’s public comment tool today.


As a result of the downtime, the FCC has extended its feedback deadline to July 18. In VentureBeat’s own tests, submissions to the FFC’s “comment filing system” yielded an error. The FCC confirmed the site issues in an official statement [below].


Due to the FCC’s technical issues, major Net Neutrality protestors, including Reddit, Mozilla, the ACLU, the EFF, have opted to deliver “hundreds of thousands of public comments” by hand, according to a statement released by Free Press, a non-profit organization which says it’s “fighting to save the free and open Internet.”

Microsoft Corp is planning to cut 1,000 jobs in Finland from its mobile phone unit, a Finnish daily said on Wednesday, quoting anonymous sources.

Some 25,000 Nokia workers moved this spring to Microsoft with the cellphone unit acquisition, 4,700 of them in Finland. Globally, Microsoft now has 127,000 employees, far more than rivals Apple and Google.

Wall Street is expecting Chief Executive Satya Nadella to make some cuts, which would represent Microsoft’s first major layoffs since 2009.

News agency Bloomberg said on Monday that total job cuts could be the biggest in Microsoft history, topping the 5,800 jobs lost in 2009.

Finnish daily Helsingin Sanomat said on Wednesday Microsoft planned to close former Nokia research and development unit in Oulu, northern Finland.

The Oulu unit employs 500 people, mainly working on software used in basic cellphones. The other half of the cuts would come from other locations in Finland.

Finland is struggling with a severe economic recession. Its economy has already contracted for two years in a row and some analysts expect this year to make it three.

Alan Mulally not retiring after stepping down as CEO of Ford Motors -- he joined Google's BoD effective July 9th

Google Inc (NASDAQ:GOOGL) (NASDAQ:GOOG) issued a press release on Tuesday, July 15th, announcing the company has appointed Alan Mulally to its Board of Directors. As an experienced exec in the automotive and aviation industries and former CSO of Ford Motor Company, Mulally has been asked to serve on Google’s Audit Committee on the BoD. The statement said his appointment was effective as of July 9th, 2014.

Statements from Alan Mulally and Google CEO Page

The press release announcing Alan Mulally’s appointment included a statement from Google CEP Larry Page and Mulally. “Alan brings a wealth of proven business and technology leadership experience,” said Page. “I am so pleased that Alan is now joining Google’s board!”

“I am honored to serve on the board of a global iconic company that is dedicated to enhancing our lives,” Mulally said in the Google Inc (NASDAQ:GOOGL) (NASDAQ:GOOG) statement . “I look forward to working together with the Google board and management team to continue to deliver their compelling vision.”

Alan Mulally’s bio

Alan Mulally was employed as President and CEO of Ford Motor Company from September 2006 through June 2014. He was also a member of the BoD of Ford and served on its finance committee from September 2006 until June 2014.

Moreover, Alan Mulally served as Executive VP of the Boeing Company, and President and Chief Executive Officer of Boeing Commercial Airplanes, Inc from March 2001 to September 2006. During that time he also served in the Boeing Executive Council. He was also earlier employed as President of Boeing’s space and defense business.

An active participant in local and national community affairs, Mulally served as co-chair of the Washington Competitiveness Council as well as being a member of the advisory boards of NASA, the University of Washington, the University of Kansas, the Massachusetts Institute Technology and the U.S. Air Force Scientific Advisory Board. In addition, Alan Mulally is a member of the U.S. National Academy of Engineering and a fellow of England’s Royal Academy of Engineering.

Mulally earned both a Bachelor’s and Master’s degrees in aeronautical and astronautical engineering from the University of Kansas, as well as a Master’s in Management from the Massachusetts Institute of Technology.

It’s hardly the notorious hacker group Anonymous, but the results are similar. Technology review site CNET was attacked by Russian hackers over the weekend.

A Twitter user or users who goes by the name “w0rm” with the handle @rev-priv8 put up an image of an apparent remote Relevant Products/Services access to a CNET.com server Relevant Products/Services. According to Forbes, the screenshot depicted a shell proving hackers had compromised the site.

So far, CNET is not offering insight into what may have motivated the hacker or hackers or whether or not any of its data Relevant Products/Services was compromised. In a published statement, Jen Boscacci, senior manager of corporate communications at CNET, said: “Here’s the situation, a few servers were accessed. We identified the issue and resolved it yesterday. We will continue to monitor Relevant Products/Services.”

A String of Media Attacks

Janne Ahlberg, a product security Relevant Products/Services professional at Microsoft who speaks freely on Twitter about security issues, offered an update to the Forbes story on Twitter early Monday. He said the “perpetrator appears to be offering database for 1 Bitcoin.”

This would seem logical, given suspected ties between w0rm and the Dec. 2013 BBC hack. Reports of Russian hackers who stealthily took over a BBC computer server before Christmas circulated far and wide last year. Those hackers were known by the monikers "HASH" and "Rev0lver" and attempted to sell access to the BBC server on Dec. 25, according to Reuters.

There was a rush of hackers attacking media sites in 2013. Last December, hackers hit The Washington Post for at least the third time in the past three years. The Post was more forthcoming than the BBC, disclosing that the extent of the data loss was not clear, but employees were instructed to change their user names and passwords -- even though they were stored in encrypted form -- based on the assumption that they may have been compromised.

Last August, the Syrian Electronic Army hit The New York Times, Twitter and its image server Twimg, among other sites, with a DNS Relevant Products/Services attack Relevant Products/Services. And in early 2013, the SEA targeted The Financial Times, The Guardian and The Associated Press, as well as The Washington Post.

Drilling Into the Attack

We caught up with TK Keanini, CTO of Lancope, to get his take on the Russian hack attack. He told us it’s important that we quickly get to the method and technique used in this compromise because given the commonality of the infrastructure Relevant Products/Services with other major Web sites, others may be at risk by the same exploit.

“These days, it is just as important to have the advanced telemetry in place for incident response as it is to have the protective proactive measures,” Keanini said. “These content management systems are large and extremely complex and it is a game of who has more time to find vulnerabilities -- these attackers make it a full time job and thus almost always succeed first.

Keanini then asked a couple of important questions: With the CNET hack, what if this individual were not so noisy? How would this exploit have been detected?

“Scary thinking I know,” he said, “but CNET is lucky this attacker was a showoff because most highly skilled in this craft would rather not brag and sell the compromised site to the highest bidder.”

New rules proposed by the F.C.C. could divide the Internet into fast lanes and slow lanes, violating the central concept of “net neutrality.”