Category: IT Security

You’d think the head of Facebook would have tip-top security on all his accounts on Facebook, but you’d be wrong.

Mark’s fan page, which has nearly three million ‘likes’, seemingly posted a message calling for Facebook to transform into a ‘social business’.

However, it was neither Mark nor his PR team who posted the status, which was swiftly removed (but not before over a thousand people ‘liked’ it).

While it’s unknown whether the hacker actually did anything more sophisticated than guess the password for Zuckerberg’s fan page, the fact that such a prominent user can be hacked is worrying to all Facebookers.

Facebook has declined to comment thus far; probably busy trying to think up a new password.

Read more: http://www.techradar.com/news/internet/mark-zuckerberg-s-facebook-fan-page-hacked-923992

We monitor a lot of spam messages for clients and have noticed a significant increase in the “Phishing” messages coming in pertaining to be from Natwest. These e-mail messages are fake and do not originate from Natwest or any reputable Bank.

The contents of the email read as follows:

Dear NatWest Customer,

National Westminster Bank have been receiving complaints from our customers for unauthorised use of their Natwest Online accounts

Sign In Here For Your Account Verification

The “Sign In Here” section of the e-mail message actually takes you to a clone of the real Natwest login page. When you enter your details on this page, instead of being authenticated with Natwest’s system, your personal details are simply forwarded to the fraudsters.

Whenever you want to log in to your online banking, always type in the address manually, or at least ensure the address in your browsers address bar is correct. A quick check of the address before logging in can save you hours of struggle and potentially financial losses!

The medic waited 2 weeks before informing his superiors about the theft. The doctor took unencrypted patient information – including names, dates of birth, the treatments – on 1,147 patients and loaded it onto his laptop, which was stolen in November.

Now, Phil Morley, chief executive at Hull and East Yorkshire Hospitals NHS Trust, which runs Hull Royal Infirmary and Castle Hill Hospital in Cottingham, has written to the 1,147 patients affected to apologise.

In the letter, he said: “I am writing this letter to inform you of the incident and also to apologise unreservedly for the loss of your confidential data.
“The doctor acted outside trust and NHS regulations in taking unencrypted patient data away from the trust and installing it on his personal computer.
“I can advise that the trust treats these matters very seriously and the doctor concerned is being managed in accordance with the trust’s policies and procedures.”

The breach is the third incident of personal data exposure to affect Hull residents in less than a year, following an earlier event involving the theft of sensitive data from A4e.

The trust said the doctor informed police the laptop had been stolen following the theft in November but did not notify the trust until two weeks after the incident.

Cathie Holmes, 37, of Beverley, said she was furious when her 12-year-old daughter, Mary, received one of the letters.

Mrs Holmes said: “You can’t send a letter of that magnitude to a child and expect them to understand it.

Sources:-
http://www.theregister.co.uk/2011/01/19/hull_hospital_data_breach_flap/
http://www.thisishullandeastriding.co.uk/news/Undefined-Headline/article-3111119-detail/article.html

Sook Shin lost the 13-inch white MacBook, that contained years of research on prostate cancer, last Sunday after thieves smashed the window of her car, and made off with the laptop. Data on the machine was not backed up, nor was it encrypted.

Shin told News 9: “I’m devastated…”

Consider IT’s Views:
Making sure that your computer is backed up is important to keeping your information safe and saving you money in the long run. Having to start over when your computers crash and you have no backup is far more expensive than simply paying for the security that comes with having effective backup in place. This is one area that cutting corners is not a good idea.

The Information Commissioner’s Office (ICO) has found Yorkshire Building Society (YBS) in breach of the Data Protection Act after an unencrypted laptop belonging to the former Chelsea Building Society (CBS), which had recently merged with YBS, was stolen from its Cheltenham premises. The laptop contained a substantial part of the CBS customer database.

The laptop was recovered within 48 hours after YBS appointed private investigators, and forensic investigations revealed that none of the data had been accessed during that time, although there had been several attempts to do so.

It was later discovered that the manager had written down the passwords to the computer and left these in a bag with the laptop under a desk overnight.

Mick Gorrill, Head of Enforcement at the ICO, said: “It is extremely concerning that an unencrypted laptop containing large amounts of personal data was left unsecured overnight, together with details of its passwords. What’s more, the fact that the employee did not require all the information to carry out the task in hand created an unnecessary risk which could easily have been avoided; employees should only have access to information that is absolutely vital to work which is being carried out.”

Iain Cornish, Chief Executive of Yorkshire Building Society has agreed to take a series of remedial steps to ensure that such a data security breach does not happen again. This will include ensuring that all portable devices including laptops are encrypted (a measure that is already in place at1YBS), that all staff are made aware of the company’s policies for the storage and use of personal data and that staff will only have access to the type and amount of personal data that is necessary for their work.

For more information about getting your business secure and laptops encrypted, see our Business Encryption Services page.

A new scam which sees fraudsters calling your home landline and taking control of your home PC is surfacing in Edinburgh.

The conmen, who are thought to be calling hundreds of Edinburgh based PC users, are claiming to work for Microsoft and are warning the PC users that they have an infected computer. They then convince the unsuspecting user to click on a web link directing them to malware which allows the caller access to the remote PC.  This allows them to copy bank details, passwords, and other sensitive data off the computer.

A spokeswoman for Lothian and Borders Police said: “Our advice to avoid falling victim to fraud would be to never engage with someone who cold calls out of the blue and give them access to your computer. If you have concerns about your computer security, ask a known and trusted expert to assist.”

The Edinburgh Evening News Reports: http://edinburghnews.scotsman.com/news/Conmen-take-control-of-home.6488963.jp

Virgin Media, the UK’s third-largest Internet Service Provider will match lists of compromised IP addresses collected by the Shadowserver Foundation against its customer lists so that they are able to issue a letter of warning about their security.

Subscribers to Virgin Media whose computers are part of a botnet can expect the warning letter telling them to tighten up their security immediately. Those with infected machines will be asked to download free security software to remove the malware and protect their computers and connection.

Virgin Media said it expects to send out hundreds of these letter per week initially, and has plans to expand their campaign based on customer feedback. Virgin Media will also take the opportunity to try and sell its Digital Home Support service offering remote PC maintenance over the phone.

The Information Commissioner’s Office (ICO) remains highly concerned that data breaches involving people’s personal information are continuing to occur in NHS organisations.

Today NHS Stoke-on-Trent and Basingstoke and North Hampshire NHS Foundation Trust are the latest NHS bodies found to have breached the Data Protection Act (DPA). Both NHS organisations’ chief executives have signed formal Undertakings outlining that they will process personal information in line with the DPA.

Mick Gorrill, Head of Enforcement at the ICO, said: “Everyone makes mistakes, but regrettably there are far too many within the NHS…”

The NHS organisations have agreed to implement a number of security measures to protect personal information more effectively. All staff will be made aware of the organisations’ policies for the retention and use of personal data and will receive training on how to follow those policies.

NHS Stoke-on-Trent will also apply physical security measures in respect of paper medical records, particularly when they are in transit. The ICO can issue a monetary penalty for serious breaches of the Data Protection Act.

If your business handles personal or confidential information that should really be encrypted in transit, give Consider IT a call now on 0131 510 0110

The Information Commissioner’s Office (ICO) has found Lampeter Medical Practice to be in breach of the Data Protection Act, after an unencrypted memory stick containing the personal details of 8,000 patients was reported lost to the privacy watchdog.

In March 2010, a member of staff downloaded a database containing patient details in contravention of practice policy. The staff member downloaded the information on to an unencrypted and non password protected computer memory stick which was then posted by recorded delivery to the Health Boards Business Service Centre. The memory stick did not arrive at its intended destination and is now accepted to be lost.

Sally-anne Poole, Enforcement Group Manager, said: “It is unnecessarily risky to download 8,000 personal details on to a memory stick. It is imperative that staff are made fully aware of an organisation’s policy for securing personal data and any portable device containing personal information should always be encrypted to prevent it being accessed in the event of loss or theft…”

If your business is at risk of this happening, give us a call and let’s get your data sorted!