Top security stories of 2015

Not a shocker to have data breaches lead the way as criminals get ever more devious.

Data breaches
More data breaches

Hacking Team, Comcast, Ashley Madison… the list goes on of companies who became just another notch in the belt of cybercriminals. Like in years past, data breaches were top of the list for our year in review story. Here are some stories that made headlines in 2015.

Dell puts privacy at risk with dangerous root certificate
Dell puts privacy at risk with dangerous root certificate

Dell has come under fire for shipping PCs with a pre-installed trusted root certificate that can be used to compromise the security of encrypted HTTPS connections.

"Surely Dell had to have seen what kind of bad press Lenovo got when people discovered what Superfish was up to. Yet, they decided to do the same thing but worse. This isn't even a third-party application that placed it there; it's from Dell's very own bloatware," commented the Reddit poster under the name "rotorcowboy".

Read the full story.

Comcast Xfinity Wi-Fi discloses customer names and addresses
Credit: Derek Walter
Comcast Xfinity Wi-Fi discloses customer names and addresses

The Xfinity Wi-Fi service from Comcast disclosed the full name and home address of residential customers, which is something the company says isn’t supposed to happen. The disclosure of such information increases an already exposed attack surface, by allowing anyone with malicious intent to selectively target their marks.

It has been just over two years since Comcast launched the Xfinity Wi-Fi service, which created a separate wireless network in homes and businesses for existing customers and the general public.

Read the full story.

Police arrest 15-year-old in TalkTalk hack
Police arrest 15-year-old in TalkTalk hack

UK telecom TalkTalk disclosed a possible breach, which could impact upwards of 4 million customers. Those responsible for the attack likely compromised names, addresses, birthdays, phone numbers, email addresses, TalkTalk account information, credit card data, and banking information. A 15-year-old boy was later arrested.

Soon after the disclosure, TalkTalk reported that someone claiming to be responsible for the attack demanded a ransom, but the company didn't go into detail on the demand itself.

Read the full story.

4.6M customers impacted by Scottrade breach
Credit: Thinkstock
4.6M customers impacted by Scottrade breach

Brokerage firm Scottrade alerted customers to a data breach, which affected 4.6 million people. Scottrade learned about the problem after being contacted by the FBI. According to the email sent to customers, and a public notice, the authorities learned that Scottrade was compromised while investigating other data-theft cases.

"If your information was contained in the affected database, you will receive a letter or email from Scottrade with additional information and resources. We have secured the known intrusion point and conducted an internal data forensics investigation on this incident with assistance from a leading computer security firm. We have taken appropriate steps to further strengthen our network defenses," Scottrade told customers.

Read the full story.

T-Mobile US says Experian breach exposed 15M customers
Credit: Martyn Williams
T-Mobile US says Experian breach exposed 15M customers

T-Mobile US CEO, John Legere, said that the names, addresses, Social Security numbers, birthdays, and ID information on more than 15 million customers had been compromised after a breach at Experian.

"The investigation is ongoing, but what we know right now is that the hacker acquired the records of approximately 15 million people, including new applicants requiring a credit check for service or device financing from September 1, 2013 through September 16, 2015," a statement from T-Mobile's head executive added.

Read the full story.

IRS: Breach larger than first reported, 220k additional taxpayers affected
Credit: iStockphoto/Thinkstock
IRS: Breach larger than first reported, 220k additional taxpayers affected

The Internal Revenue Service (IRS) said that the data breach reported in May has now impacted a total to 330,000 taxpayers. In addition, the agency sent 170,000 taxpayers notifications that their personal information was potentially exposed during the incident.

The compromise occurred through the "Get Transcript" application used by the tax agency. Using previously acquired personal information (PII), criminals were able to access the "Get Transcript" application to obtain old tax returns.

Read the full story.

OPM says second breach compromised 21 million records
OPM says second breach compromised 21 million records

The breach at the Office of Personnel Management impacted 21.5 million people.The incident exposed Social Security Numbers and biometric data for federal employees and in some cases their families. OPM became aware of the second breach while investigating the first one disclosed in June.

At the time, the OPM said that the breach impacted the personal information of 4.2 million current and former federal employees. This second incident began in May of 2014 and went undiscovered for a year, however the OPM has stated that patches applied to systems in January halted the extraction of data.

Read the full story.

Hacking Team hacked, attackers claim 400GB in dumped data
Credit: Steve Ragan / Twitter
Hacking Team hacked, attackers claim 400GB in dumped data

Specializing in surveillance technology, Hacking Team is now learning how it feels to have their internal matters exposed to the world, and privacy advocates are enjoying a bit of schadenfreude at their expense.

Hacking Team is an Italian company that sells intrusion and surveillance tools to governments and law enforcement agencies.

The attackers published a Torrent file with 400GB of internal documents, source code, and email communications to the public at large.

Read the full story.

CareFirst data breach affects 1.1 million people
Credit: Thinkstock
CareFirst data breach affects 1.1 million people

CareFirst BlueCross BlueShield (CareFirst) disclosed a data breach that impacts 1.1 million current and former members, who registered to use the insurer's websites or who did business with them online prior to June 20, 2014.

CareFirst stated that they detected the initial compromise and took action to contain the attack. The assumption made was that their actions helped avoid a crisis.

Read the full story.

Anthem: 78.8 million affected, FBI close to naming suspect
Credit: iStockphoto
Anthem: 78.8 million affected, FBI close to naming suspect

Anthem, the nation's second largest health insurer, said that 8.8 to 18.8 million people who were not customers could be impacted by their recent data breach, which at last count is presumed to affect some 78.8 million people. This latest count now includes customers of independent Blue Cross Blue Shield (BCBS) plans in several states.

Read the full story