Data Breach Notification: Nitro PDF

In September of 2020 there was a breach of the Nitro PDF service. There were 77 million records exposed, which included email addresses, names and passwords for the service.

There were 161 berry.edu or vikings.berry.edu email addresses included in the breach.

To find out if your information is included, you can go to Have I Been Pwned and enter your email address in the search form. While you are there, you can also sign up for breach notifications involving your Berry or other email addresses by clicking on “Notify Me” at the top of any page on the site.

If your information was included, be sure to change your password for the Nitro PDF service. Also, check your settings to make sure they have not been altered.

Be sure to NEVER reuse your Berry email password for any other website or service! Stay vigilant against phishing emails by learning what to look for. Check out the Phishing Quick Info page here on this site at a minimum.

As always, if you have questions about any of this, you can contact Information Security using the information on the right-hand side of any page on this site.

If you haven’t signed up for multi-factor authentication (MFA), you will soon be enrolled by the Office of Information Technology. You can still request this additional security measure so you can set it up on your timeframe, before it is required.. MFA adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and Virtual LunchITS will be posted.

December News from Information Security

Welcome to one of the strangest Decembers we’ve ever had here at Berry. It is certainly the strangest of my 30 years here. The students are gone, but not done. Finals loom for some of them, then almost two full months of no school. What will we do in the silence?

I’m sure we all have different answers to that question, so I’ll leave it hanging rhetorically.

This newsletter will be a little different from previous ones. We’ll be focusing on a minimal number of topics, but for one in particular I will ask for a couple of extra minutes of reading time from you.

If you have perused this site much you will know that I post breach and data exposure announcements here periodically, usually when they affect a good number of the community. If you’ve been unlucky enough to be impacted by a breach, you may have received an email from me explaining what data was exposed and what you should do about it.

A recent notification came to me, announcing that 189 emails belonging to Berry community members had information exposed, specifically passwords. Most breaches affect no more than a couple dozen Berry email addresses and when I get the notices I will sort through them, compose an email and send it out to those affected. This number of emails was larger, but still manageable. Then I read further into the announcement. Those 189 emails were scattered across more than 23,000 potential websites and services. The data did not include enough information to determine which email address went with what service or website.

The bottom line is, 189 Berry community members, who could be faculty, staff, students, alumni, or even retirees, have had a password for some service exposed. You can find out if you were one of these 189 by going to the Have I Been Pwned website and putting in your Berry email address in the search form.

You may find that in addition to this massive exposure notification containing 226 million unique emails, named Cit0day, you may have had information related to your Berry email address exposed by other data breaches. I encourage you to not only check your Berry email, but your personal email accounts as well, and those of your family if you are so inclined. I also strongly encourage you to sign up for notifications from Have I Been Pwned. The link (Notify Me) is at the top of the main page there. It is free and if your email address shows up in a data breach, you’ll get an email notification directly from Have I Been Pwned giving you as much information about the breach as is available.

The important question, once you determine that you are indeed affected by a data breach is this – What do I do now?

Generally, I will suggest you change your password for the service or website that experienced the breach, check that your account information is correct, and if financial data was involved, to closely monitor your bank account and credit card accounts. In the case of the Cit0day notification, you will have no idea which of your twenty to one hundred or more accounts has been affected. What do you do then?

The “nuke the site from orbit” approach would be to reset the password on EVERY account you have. Do you even know all of your accounts? Who hasn’t signed up on a site for a specific purpose, never to return? What data might you have had to give up to create that account? Did it include a credit/debit card number or bank account number?

The real question to ask at this time, if you are affected by the Cit0day announcement is – Did I reuse the password for this account, whatever account it was? Realizing, again, that there is no way to tell what specific service or website exposed the password.

That question leads to the next – How many other accounts are now vulnerable because I reused this exposed password? The scary part is, you don’t have an answer to this question, because you don’t know what account is compromised.

Which leads to the most important question in this article – Why are you not using a password manager to create a unique password for EVERY account, service, and website you use?  Yes, it takes time to set it up.  For some, time is money, right? How much does thirty minutes cost you? The entire amount in your bank account? Unlikely. The maximum amount on your credit line? Probably not.

If you had used a password manager to create a unique password for your account on whichever site among the 23,000 possible  ones that were affected , the potential damage to you would have been limited to that one site. If you reused a password, or worse, use the same password for everything, then the damage could be much greater.

Please, if you are not using a password manager now to manage your accounts, start using one. I’ve written on the subject multiple times here in the monthly newsletter and during Cybersecurity Awareness Months, both this year and in years past (all of which are available from the main menu of this site).

Take a few minutes and visit the links below. Check out the flyer linked at the Quick Info page for some password managers. If you don’t want to follow links,  just type “best password manager” into your favorite search engine. There are password managers for all platforms (Windows, macOS, Linux, Android, iOS, web browsers), needs, and budgets.

Quick Info page on Password Managers

In-depth knowledge article on password managers on this site

Why you need a password manager flyer (PDF)

Two-sided password flyer linked in the Quick Info page above (PDF)

Good password policies flyer with a paragraph at the bottom about password managers (PDF) Don’t try to use the link at the bottom, it is broken.

Because the link in the above PDF is broken, here is a link to a great article on password managers-the good, the bad, the ugly, and the beautiful. My apologies for the pop-up ads, but the article is worth the annoyance. If you read nothing else, read this article.

Whew! That was password managers. The next and final item I want to emphasize in this newsletter is multifactor authentication (MFA). MFA is coming to all accounts at Berry – faculty, staff, and students. With some personnel issues that have come up, the rollout may be delayed a bit, but it is still coming.

Again, I have written about this multiple times over the course of maintaining this site. There is a Quick Info page on MFA for the impatient, or you can go read the instructions for setting up MFA here on the main Berry website. If you are still unclear about why we are requiring this, check out this FAQ article, also on the main Berry website.

You can still request MFA for your account by emailing computing@berry.edu.

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.
If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets.

Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me.

Food for Thought

 

Featured Image: Photo by Science in HD on Unsplash

Data Breach Notification: LiveJournal

In 2019, there was news of a possible breach of LiveJournal data. In May of 2020, the breach was confirmed by the release of the data on a hacking forum. There were 26 million records exposed from the site, which included email addresses, passwords, and usernames for the service.

There were 52 berry.edu or vikings.berry.edu email addresses included in the breach.

To find out if your information is included, you can go to Have I Been Pwned and enter your email address in the search form. While you are there, you can also sign up for breach notifications involving your Berry or other email addresses by clicking on “Notify Me” at the top of any page on the site.

If your information was included, be sure to change your password for the LiveJournal website. Also, check your posts and settings to make sure they have not been altered.

Be sure to NEVER reuse your Berry email password for any other website or service! Stay vigilant against phishing emails by learning what to look for. Check out the Phishing Quick Info page here on this site at a minimum.

As always, if you have questions about any of this, you can contact Information Security using the information on the right-hand side of any page on this site.

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

Data Breach Notification: Covve

In February of 2020, it was revealed that Covve, who bills their address book app as the “smartest, simplest, contacts app”, experienced a data breach. Covve left a database exposed to the Internet without a password. There were nearly 23 million records exposed by the site, which included email addresses, job titles, names, phone numbers, physical addresses and social media profiles. Your data might have been included in the breach even if you did not use the service, as the data was provided by users of the service who chose to sync their phone and email contact lists with the site.

There were 57 berry.edu or vikings.berry.edu email addresses included in the breach.

To find out if your information was included, you can go to Have I Been Pwned and enter your email address in the search form. You can also sign up to be notified when your information appears in a breach by clicking on “Notify Me” at the top of any page on the Have I Been Pwned site.

If your information was included, there is not much that can be done to remove it from circulation. There were no passwords exposed by the breach, but there was plenty of personal information, as mentioned above. Hackers may attempt to impersonate your contacts or you using the information. As always, be very cautious when dealing with unexpected texts or emails, especially when they contain links or attachments.

Be sure to NEVER reuse your Berry email password for any other website or service! Stay vigilant against phishing emails by learning what to look for. Check out the Phishing Quick Info page here on this site at a minimum.

As always, if you have questions about any of this, you can contact Information Security using the information on the right-hand side of any site page.

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me.

Data Breach Notification: Adult Friend Finder Website

In October of 2016, the website Adult Friend Finder experienced a data breach. This was a part of the larger Friend Finder Networks breach. There were nearly 170 million records exposed from the site, which included email addresses, passwords, spoken languages, and usernames for the service. 

There were 22 berry.edu or vikings.berry.edu email addresses included in the breach.

To find out if your information is included, you can go to Have I Been Pwned and enter your email address in the search form. You can also sign up for breach notifications from Have I Been Pwned by clicking on “Notify Me” at the top of any page on the site.

If your information was included, be sure to change your password for this website.  Also, there is a chance that hackers may attempt to blackmail you with this information.

Be sure to NEVER reuse your Berry email password for any other website or service! Stay vigilant against phishing emails by learning what to look for. Check out the Phishing Quick Info page here on this site at a minimum.

As always, if you have questions about any of this, you can contact Information Security using the information on the right-hand side of any site page.

Data Breach Notification: Data Enrichment Exposure

In October, a large database was left unsecured and exposed to the Internet. This database contained “enriched” data profiles, which means that someone had taken some basic information about a person, like an email address or social media profile, and then searched and cross-referenced publicly available data to gather as much information as possible about that person. Companies do this for millions of people and then sell these “enriched” profiles to ad companies to help them target potential customers. It’s one of the reasons you get SO MUCH SPAM.

There were over 600 million accounts in the exposed database. There were 2,789 berry.edu or vikings.berry.edu email address in those records. There were NO passwords included in this breach.

To find out if your information is included, you can go to Have I Been Pwned and enter your email address in the search form. You can also sign up for breach notifications from Have I Been Pwned by clicking on “Notify Me” at the top of any page on the site.

The information included email addresses, employers, geographic locations, job titles, names, phone numbers, and social media profiles. While none of the individual pieces of this information alone are considered damaging or sensitive, the accumulation of this data in a single profile not only helps advertisers, but it also helps scammers more accurately target people by sending focused phishing emails that seem more credible.

Stay vigilant against phishing emails by learning what to look for. Check out the Phishing Quick Info page here on this site at a minimum.

As always, if you have questions about any of this, you can contact Information Security using the information on the right-hand side of any site page.

 

Data Breach Notification: Wanelo

 

Sometime in December 2018, the digital mall Wanelo suffered a data breach that included 23 million unique email addresses along with passwords. Some passwords were stored with weak encryption, others with better encryption. Either way, they are exposed and should be changed. The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in April 2019. There were 142 Berry email addresses included in this breach. You can read more about it by clicking on the link in the first sentence of this notice. To find out if you are included, you can go to Have I Been Pwned and enter your email address in the search form. You can also sign up for breach notifications from Have I Been Pwned by clicking on “Notify Me” at the top of any page on the site.

If you are affected by this breach, take the following steps to control and secure your online data:

  1. Go to the site and check that your information is correct
  2. While you are there, CHANGE YOUR PASSWORD!
  3. If you reused that password anywhere else, go to those sites and change the password.
  4. Don’t use that password again!
  5. If the site offers multi-factor authentication (sometimes called two-step authentication), enable it, configure it, and feel a little safer.