Eva Short reports: … in an ironic turn of fortunes for the firm, HackerOne has now paid out a $20,000 bounty for the identification of a bug on its own platform. The hacker in question, user ‘haxta4ok00’, had been communicating with one of HackerOne’s security analysts last month. Throughout the course of the conversation, the…
Category: Exposure
JP: More HDDs with personal data found to be auctioned
Officials of Kanagawa Prefecture say nine more hard disk drives with taxpayers’ personal information are still missing in addition to another nine drives that have been recovered. The 18 HDDs were auctioned away online by a worker of a recycling firm in violation of contracts. Read more on NHK.
A Sprint contractor left thousands of US cell phone bills on the internet by mistake
Zack Whittaker reports: A contractor working for cell giant Sprint stored on an unprotected cloud server hundreds of thousands of cell phone bills of AT&T, Verizon and T-Mobile subscribers. […] U.K.-based penetration testing company Fidus Information Security found the exposed data, but it wasn’t immediately clear who owned the bucket. Read more on TechCrunch.
NZ: Police investigating potential privacy breach of firearms buyback database
1NewsNow reports: Police say they are investigating after a member of the public made them aware of a potential privacy breach involving the firearms buyback programme. In a statement, police said they were made aware by the person today, and that the online notification platform for the buy-back programme has been closed down while they…
Millions of SMS messages exposed in database security lapse
Zack Whittaker reports: A massive database storing tens of millions of SMS text messages, most of which were sent by businesses to potential customers, has been found online. The database is run by TrueDialog, a business SMS provider for businesses and higher education providers, which lets companies, colleges, and universities send bulk text messages to…
OCR Secures $2.175 Million HIPAA Settlement after Sentara Hospitals Failed to Properly Notify HHS of a Breach of Unsecured Protected Health Information
OCR has announced another settlement. This one involves Sentara Hospitals, and it’s a somewhat surprising one in the sense that Sentara not only seems to have gotten the fundamentals of HIPAA and notification compliance wrong, but then they seem to have insisted in their wrongheaded ways even after HHS told them what their obligations were. …