Month: January 2020

Popular researcher Bob Diachenko found an unprotected database containing over 250 million customer support records, including some personally identifiable information. The unprotected database contained support requests submitted to Microsoft from 2005 to December 2019.

A post published by Microsoft on January 22, 2020 says: “Today, we concluded an investigation into a misconfiguration of an internal customer support database used for Microsoft support case analytics. While the investigation found no malicious use, and although most customers did not have personally identifiable information exposed, we want to be transparent about this incident with all customers and reassure them that we are taking it very seriously and holding ourselves accountable.”

Diachenko confirmed the presence of many records containing the following attributes:

• Customer email addresses
• IP addresses
• Locations
• Descriptions of CSS (Customer Service and Support) claims and cases
• Microsoft support agent emails
• Case numbers, resolutions, and remarks
• Internal notes marked as “confidential”

Most, but not all, personally identifiable information was redacted from the records.
Here is the timeline of the data breach:

• December 28, 2019: The databases were indexed by search engine BinaryEdge
• December 29, 2019: Diachenko discovered the databases and immediately notified Microsoft.
• December 30-31, 2019: Microsoft secured the servers and data. Diachenko and Microsoft continued the investigation and remediation process.
• January 21, 2020: Microsoft disclosed additional details about the exposure as a result of the investigation.

Read more about it here.

Mariah Carey’s Twitter account was hacked on New Year’s Eve. The attackers posted a series of offensive, racist and lewd tweets, including a personal insult against rapper Eminem.

The tweets began around 3 pm PST and continued throughout the day. It is not clear how the account was hacked. Access was regained later that evening. At 9:51 PM on December 31, 2019, the vocalist tweeted: “I take a freaking nap and this happens?”

Read more about it here.

The Wawa convenience store chain, with 850 stores along the US east coast, has been breached. Wawa disclosed that on December 10, 2019, a malicious code was found on its Point of Sale systems. Officials with the company, based in Wawa, Pennsylvania, believe the malware had been collecting card numbers, cardholder names and other data since as early as March 4, 2019. The malware was removed on December 12.

According to the Philadelphia Inquirer, at least six lawsuits seeking class-action status have been filed in federal court in Philadelphia. “The data breach was the inevitable result of Wawa’s inadequate data security measures and cavalier approach to data security”, said one suit.

Read more about it here.