Another Breach - CafePress

[dcontesti]

And it seems that another breach has been reported.

https://www.forbes.com/sites/daveywinder/2019/08/05/cafepress-hacked-23m-accounts-compromised-is-you...

This time, it says 23 Million accounts may have been breached along with passwords of about 1/2 of those.

[AppDefects]

Can anyone keep up with the daily barrage of data breach announcements? 

[dcontesti]

---

@AppDefects wrote:

Can anyone keep up with the daily barrage of data breach announcements? 

---

Not really but I remember when these were not reported by corporations as they were afraid for their reputations or CIOs/CISO were afraid they would lose their jobs.

A number of organizations still require silence on these events and only when things like GDPR (or other) audits highlight them do them come to light.

I applaud companies like Norsk Hydro and their openness on the Ransomware that hit them.  Believe it allows the benefit of their experience to be shared with the community (what happened, how they handled it, the final outcome).

[rslade]

> dcontesti (Community Champion) posted a new topic in Industry News on 08-05-2019

>   This time, it says 23 Million
> accounts may have been breached along with passwords of about 1/2 of those.    

According to email from Have I Been Pwned, I had, over the years, acquired at
least two accounts there. Both, undoubtedly, with "throw away" passwords.

(My little brother, at one time, conducted a lot of business there, so he might be
more involved ...)

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
A paradox is only the truth standing on its head to attract
attention. - G. K. Chesterton
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

[CISOScott]

To build off what @rslade said, If you are the primary security POC for your agency (or can at least get an email account setup that matches one of 4 parameters) you can get alerts from HaveIBeenPwned everytime someone from your domain (@domain.extention) has an email identified in these new breaches.

I get these and then notify the users that whatever password they used in conjunction with their CORPORATE/BUSINESS email has been compromised and to never use that password, or any variation, again. It also helps me see how users are misusing the business email address they were given that was supposed to be for official use only.