Data Breach Exposes Personal Information of Tate Gallery Job Seekers

The Guardian has revealed that personal information from job applicants at the Tate has been exposed online, compromising addresses, salaries, and phone numbers of examiners.

These extensive records, running hundreds of pages, were shared on a site not affiliated with the government-supported organization managing London’s Tate Modern, Tate Britain, Tate St Ives in Cornwall, and Tate Liverpool.

The leaked data encompasses details like the current employers and educational background of applicants related to the Tate’s Website Developer Search in October 2023, affecting 111 individuals. While names are undisclosed, referees’ phone numbers and personal email addresses might be included. It remains unclear how long this information has been available online.

Max Kohler, a 29-year-old software developer, learned his data had been compromised after one of his application reviewers received an email from an unfamiliar source who accessed the online data dump.

Kohler found that the breach contained his last paycheck, current employer’s name, other reviewers’ names, email addresses, home addresses, and extensive responses to job interview questions.

“I feel extremely disappointed and disheartened,” he stated. “You dedicate time filling out sensitive information like your previous salary and home address, yet they fail to secure it properly and allow it to be publicly accessible.”

“They should publicly address this issue, provide an apology, and clarify how this happened, along with actions to prevent future occurrences. It likely stems from inadequate staff training or procedural oversights.”

Reported incidents of data security breaches to the UK’s Information Commissioner’s Office (ICO) continue to rise. Over 2,000 incidents were reported quarterly in 2022, increasing to over 3,200 between April and June of this year.

Kate Brimstead, a partner at Shoesmith law firm and an authority on data privacy, information law, and cybersecurity, commented: “Breaches do not always have to be intentional. While ransomware attacks attract significant attention, the scale of current breaches is substantial.” Errors can often contribute to these incidents, highlighting the necessity for robust checks and procedures in daily operations. “Managing our data can be tedious, but it remains crucial,” she added.

The ICO emphasized that organizations must report a personal data breach to them within 72 hours of being aware, unless there is no risk to individuals’ rights and freedoms. If an organization decides not to report, they should maintain a record of the breach and justify their decision if needed.

Skip past newsletter promotions

A spokesperson for Tate stated: “We are meticulously reviewing all reports and investigating this issue. Thus far, we haven’t identified any breaches in our systems and will refrain from further comment while this issue is under investigation.”

quick guide

Contact us about this story

show

The integrity of public interest journalism relies on firsthand accounts from knowledgeable individuals.

If you have insights regarding this issue, please contact us confidentially using the methods listed below.

Secure messaging in the Guardian app

The Guardian app provides a way to share story tips. Messages sent via this feature are encrypted end-to-end and integrated within typical app functions, keeping your communication with us secure.

If you haven’t yet downloaded the Guardian app, you can find it on (iOS/Android) and select “Secure Messaging” from the menu.

SecureDrop, instant messaging, email, phone, and postal mail

If you can secure your use of the Tor network, you can send us messages and documents through our <a href=”https://www.theguardian.com/securedrop”>SecureDrop platform</a>.

Additionally, our guide located at <a href=”https://www.theguardian.com/tips”>theguardian.com/tips</a> lists several secure contact methods and discusses the advantages and disadvantages of each.

Illustration: Guardian Design/Rich Cousins

Thank you for your feedback.

Source: www.theguardian.com

Hackers Allegedly Breach Kido Nursery Chain, Exposing Photos of 8,000 Children

Approximately 8,000 names, photos, and addresses of children were allegedly taken from the Kido Nursery chain by a group of cybercriminals.

According to the BBC, these criminals are demanding ransoms from companies operating 18 sites in London, as well as additional locations in the US, India, and China.

The hackers also accessed details about the children’s parents and caregivers, claiming they were securing notes. They reached out to several individuals by phone, employing tactics associated with the Frightor.


Kido has been approached for comment but has yet to confirm the hackers’ assertions. The company has not released an official statement regarding the incident.

A nursery employee informed the BBC that she had been made aware of the data breach.

The Metropolitan Police indicated that they were alerted on Thursday “following reports of ransomware attacks on a London-based organization,” adding that “enquiries are ongoing and remain in the initial phase within Met’s cybercrime division. No arrests have been made to date.”

A spokesperson for the Intelligence Committee office stated that “Kido International has reported the incident to us and we are currently assessing the provided information.”

Many organizations have experienced cyberattacks recently. The Cooperative reported a £80 million decline in profits due to a hacking incident in April.

Skip past newsletter promotions

Jaguar Land Rover (JLR) was unable to assemble vehicles at the start of the month following a cyberattack that compromised their computer systems.

As a result, the company had to shut down most systems used for tracking factory components, vehicles, and tools, impacting their luxury Range Rover, Discovery, and Defender SUV sales.

The company has since reopened a limited number of computer systems.

Quick Guide

Please contact Guardian Business about this story








The best public interest journalism depends on firsthand accounts from informed individuals.

If you have any insights on this topic, confidentially reach out to the business team through the following means:

Secure Messages in Guardian App

The Guardian app features a tool for sending tips about stories. All messages are encrypted and embedded within routine uses of the Guardian app, ensuring no one can detect your communication with us.

If you haven’t installed the Guardian app yet, download it (iOS/Android), navigate to the menu, scroll down, and click Secure Messaging. Choose Guardian Business when prompted about whom you wish to contact.

SecureDrop, Instant Messenger, Email, Phone, and Mail

If you can safely access the TOR network without being detected, you can send messages and documents to the Guardian through our SecureDrop platform.

Lastly, our guide at theguardian.com/tips provides various secure communication methods while discussing their respective advantages and disadvantages.


Illustration: Guardian Design / Rich Cousins

Thank you for your feedback.


Source: www.theguardian.com

23AndMe Fined £2.3 Million by UK Regulators Over 2023 Data Breach | Technology News

The genetic testing firm 23AndMe has been penalized with a fine exceeding £2.3 million following a significant cyberattack in 2023, which compromised the personal information of over 150,000 UK residents.

Sensitive data, including family tree details, health reports, names, and postal codes, were among the information breached from the California-based company. The UK Intelligence Commission’s office confirmed the breach after employees discovered that stolen data was being offered for sale on the social media platform Reddit.

Intelligence Commissioner John Edwards referred to the incidents during the summer of 2023 as “a deeply damaging violation.” The data breach affecting the UK was just a fraction of a larger security incident that compromised data from 7 million individuals.

23AndMe offers DNA screening for £89 through a saliva-based kit, allowing users to trace their ancestry in terms of ethnicity and geographical origin. However, many customers sought bankruptcy protection in the US in March, requesting the removal of their DNA data from the company’s records following the hack.

The penalty coincided with a $355 million acquisition bid for the company led by former CEO Anne Wassicki.

Edwards noted that the data breaches included sensitive personal information, family histories, and even health conditions of numerous individuals in the UK.

“As one affected individual remarked, once this information is out there, it cannot be altered or replaced like a password or credit card number,” he added.

UK data protection regulators found that 23AndMe did not take fundamental steps to safeguard user information, revealing inadequacies in its security system, including a failure to implement stricter user authentication measures.

Hackers exploited a widespread weakness due to the reuse of passwords compromised in unrelated data breaches. They employed automated tools in a method called “credential stuffing.”

Edwards remarked, “The warning signs were evident, and the company’s response was sluggish. This has made individuals’ most sensitive data vulnerable to exploitation and harm.”

Skip past newsletter promotions

A company spokesperson stated that 23AndMe has taken various measures to enhance security for individual accounts and data. They have made a firm commitment to improving the protection of customer data and privacy in connection with an initiative that will benefit 23AndMe, a nonprofit associated with Wojcicki, the TTAM Research Institute.

Fines are part of the substantial penalties imposed on various organizations by ICOs in recent years due to their inability to secure data from hacking and ransomware incidents. In 2022, a fine levied against construction firms exceeded £4.4 million when staff data was compromised, including contact information, bank details, sexual orientation, and health data.

In March of this year, NHS IT supplier Advanced Computer Software Group faced a fine of nearly £3.1 million for endangering the personal information of approximately 80,000 individuals.

Source: www.theguardian.com

Spyware used in WhatsApp breach leads to end of contract with owner

Reports suggest that 90 individuals, including journalists and members of civil society, have been targeted by those familiar with the issue.

The termination of the contract came soon after WhatsApp revealed that Paragon’s spyware was used to target multiple individuals. Paragon, like other spyware vendors, sells cyber weapons to government clients for crime prevention purposes. The entities behind the alleged attacks on certain government clients remain unknown.

The decision to end the Italian contract was prompted by the discovery that two activists critical of Italian investigative journalist and dealings with Libya were among those targeted. All three were vocal opponents of Italian Prime Minister Giorgia Meloni’s right-wing government.

Meloni’s office denied any involvement in the alleged violations after accusations surfaced, stating that neither the national intelligence reporting agency nor the government was responsible.

Anonymous sources speaking to The Guardian revealed that Paragon initially faced scrutiny when the allegations of spyware abuse emerged. The Italian contract was temporarily suspended, and later terminated for violating the terms of service and ethical framework agreed upon.

A request for comment from an Italian government spokesman was made by The Guardian. Meloni is expected to address the alleged violations in Congress, and WhatsApp reported that approximately seven Italians were affected.

In response to inquiries, a Paragon representative declined to confirm or deny developments, citing company policy not to discuss matters related to potential clients.

Francesco Cancello, editor-in-chief of investigative news outlet FanPage, was informed that his phone was targeted using hacking software. The Graphite Spyware, similar to Pegasus, can infect phones without user interaction, possibly compromising devices.

WhatsApp detected the hacking attempts with the help of the University of Toronto’s Civic Research Institute. There is uncertainty about ongoing monitoring by government clients and the extent of involvement in each case.

The motive behind Cancello’s targeting remains unclear, but previous investigations by the publication may have played a role. Paragon’s move may allay some concerns, but unanswered questions remain about other cases uncovered by WhatsApp.

Paragon, recently acquired by US company AE Industry Partners, specializes in national security markets. The company has not responded to requests for comment about the acquisition.

Paragon previously secured a contract with ICE, the US immigration and customs enforcement agency, under the Biden administration. The contract’s compliance with regulations restricting spyware use by the federal government is unclear, as it was reportedly suspended.

Source: www.theguardian.com

Meta permitted pornographic advertisements that breach content moderation standards

Meta owns social media platforms such as Facebook and Instagram

JRdes / Shutterstock

In 2024, Meta allowed more than 3,300 pornographic ads, many featuring AI-generated content, to run on social media platforms such as Facebook and Instagram.

The survey results are available below. report by AI forensics a European non-profit organization focused on researching technology platform algorithms. Researchers also found inconsistencies in Meta’s content moderation policies by reuploading many of the same explicit images as standard Instagram and Facebook posts. Unlike ads, these posts violated Meta’s terms and were quickly removed. community standards.

“I am disappointed and not surprised by this report, as my research has already revealed double standards in content moderation, particularly in the area of sexual content,” he said. carolina are At the Center for Digital Citizenship at Northumbria University, UK.

The AI Forensics report focuses on a small sample of ads targeting the European Union. As a result, the explicit meta-authorized ads primarily target middle-aged and older men promoting “shady sexual enhancement products” and “dating sites,” with a total reach of 8.2 million impressions. It turned out that it was exceeded.

This permissiveness reflects a widespread double standard in content moderation, Allais said. She says tech platforms often block content by “women, femme presentations, and LGBTQIA+ users.” That double standard extends to the sexual health of men and women. “Examples include lingerie and period-related advertising. [removed] Ads from Meta are approved, but ads for Viagra are approved,” she says.

In addition to discovering AI-generated images within ads, the AI Forensics team also discovered audio deepfakes. For example, some ads for sex-enhancing drugs featured the digitally manipulated voice of actor Vincent Cassel superimposed over pornographic visuals.

“Meta prohibits the display of nudity or sexual activity in ads or organic posts on our platform, and we remove violating content shared with us,” a Meta spokesperson said. “Bad actors are constantly evolving their tactics to evade law enforcement, which is why we continue to invest in the best tools and technology to identify and remove violating content.”

The report comes at the same time that Meta CEO Mark Zuckerberg announced he would be eliminating the fact-checking team in favor of crowd-sourced community notes.

“If you really want to sound dystopian, which I think there’s reason to do so at this point given Zuckerberg’s latest decision to eliminate fact checkers, Meta You could even say that they’re quickly stripping agencies of their users by taking money from questionable ads,” Allais said.

topic:

Source: www.newscientist.com

Possible rewrite: AI tool hosted by Amazon for UK military recruitment at risk for data breach

Reports indicate that an artificial intelligence tool hosted by Amazon to enhance recruitment for the UK Ministry of Defense is potentially exposing defense workers to public identification risks. This information comes from a government evaluation.

The data utilized by automated systems in tailoring defense job advertisements to attract diverse candidates through inclusive language includes details like service member names, roles, and emails, and is stored by Amazon in the United States. A government document released for the first time today indicates that there is a risk of data breaches that could lead to the identification of defense personnel.

Although the risk has been classified as “low,” the Defense Department assured that there are “strong safeguards” in place by suppliers Textio, Amazon Web Services, and threat detection service Amazon GuardDuty.

The government acknowledges several risks associated with the use of AI tools in the public sector, as highlighted in a series of documents released to enhance transparency around algorithm use in central governments.

Ministers are advocating for the use of AI to enhance the UK’s economic productivity and deliver better public services. Safety measures are emphasized to mitigate risks and ensure resilience.

The UK government is collaborating with Google and Meta to pilot AI in public services. Microsoft is also offering its AI-powered Copilot system to civil servants, aligning with the government’s ambition to adopt a more startup-oriented mindset.

Some of the identified risks and benefits of current central government AI applications include:

  • Potential generation of inappropriate lesson material using a Lesson planning tool powered by AI, assisting teachers in customizing lesson plans efficiently.

  • Introduction of a chatbot to address queries concerning child welfare in family court, providing round-the-clock information and reducing wait times.

  • Utilization of a policy engine by the Ministry of Finance to model tax and benefit changes accurately.

  • Potential negative impact on human decision-making caused by excessive reliance on AI users in food hygiene inspections, leading to inconsistent scoring of establishments.

These disclosures will be documented in the expanded Algorithm Transparency Register, detailing information about 23 central government algorithms. Some algorithms with bias indications, like those in the Department for Work and Pensions welfare system, are yet to be recorded.

Source: www.theguardian.com

Review of Tactical Breach Wizards: A Fun and Intense Strategy Game that Rivals XCOM 2

aThe best place to start with Tactical Breach Wizards, a game that relies heavily on glimpses into the future, is a little further down the line. Let’s start with the fact that this special ops tour of magical mystery is the most important turn-based tactics game since the classic XCOM 2. Its blend of inventive, flexible puzzles and highly entertaining writing is enough to warrant active play on anyone’s console. But what makes the game worthy of Special Arcane Service is how boldly it critiques the murky morality of military-themed games.

In Tactical Breach Wizards you take command of a ragtag team of witch detectives, necromancers, time-manipulating wizards and druid hitmen and use your team’s diverse abilities to overcome escalating tactical siege scenarios. A typical level requires you to break into and enter a room, neutralize six enemies, seal a door to stop reinforcements, and reach a computer that will open a passage to the next room.

This is a simplified example of the format where you don’t have to worry about base management or higher layers of strategy. Instead, it focuses on creatively using magical powers to resolve scenarios as cleanly as possible. Jen, a freelance storm witch, casts lightning spells that can push people away without causing damage and knock out enemies by pushing them into objects or out of windows. Zan, a naval seer, can foresee events a second ahead, allowing him to roughly predict how his enemies will attack, but also to set up ambushes or give his teammates extra actions. Combining powers to maximize efficiency is a key tactic, for example, using Zan’s time boost ability to have Zan use his lightning power twice.

Each room you enter introduces a new ability, enemy, or idea that increases the challenge and your ability to face it. For example, you can recruit the necromancer Dessa to kill people and resurrect them to heal them, or place interdimensional portals in your walls to push through enemies and eliminate them quickly.

Tactical Breach Wizards wants to maximize the puzzle potential by having you move lots of small enemies around a room. But unlike XCOM, it doesn’t extend lateral thinking with brute force. Most scenarios are relatively easy to solve, as you can undo decisions you made on any given turn. However, each stage also has bonus objectives, such as completing a stage without taking any damage at all. Rather than punishing mistakes and killing your allies, Tactical Breach Wizards gently guides you towards excellence.

This more tolerant attitude is also reflected in the game’s themes. Tactical Breach Wizards is never a serious game – evidenced by objectives like “jump through the Pyromancer’s window” and the fact that Zan’s “assault rifle” is a machine gun frame with a wizard’s wand rather than a barrel – but it does treat its characters and the problems they face seriously. One of my favorite bits is the heartfelt exchange that happens every time the team gathers to breach another door. Not only is it a great joke, but the conversation that follows is also incredibly witty and offers great insight into each wizard’s inner life.

But the game’s most impressive trick is how it spins a truly intriguing spy thriller out of its ridiculous concept, while refusing to abide by the uncomfortable ethics of modern military games. The team is made up of rebels and outcasts rather than government-sanctioned wizards, and their enemies are enforcers of a religious dictatorship and people hired by private military companies (plus a traffic warlock called Steve). Even when facing these foes, the team only follows non-lethal rules of engagement. You might wonder how they can do this when people are constantly being kicked out of windows, and the answer is simple: they’re wizards.

This is a nearly perfectly balanced game, with nothing wasted. do not have A wicked ode to turn-based tactics, it embraces the genre’s creative puzzles while rejecting its worst excesses. In Tactical Breach Wizards you can see into the future, raise the dead and smash windows with a witch’s broomstick, but the most powerful magic of all is empathy.

Source: www.theguardian.com

Magic-infused military tactics game Tactical Breach Wizards adds a supernatural twist | Games

circle
We’re only halfway through the year, but Tactical Breach Wizards is already a contender for best video game title of 2024. Both ridiculously ridiculous and patently practical, the game’s name nicely reflects the intent of this magic-infused, turn-based tactics game. Commanding a SWAT team of wizards battling through puzzle-like scenarios with guns and spells, Tactical Breach Wizards blends decade-old jokes with a desire to solve the problems endemic to the genre that inspired it.

“This comes from playing a lot of XCOM, especially XCOM 2,” says Tom Francis, director of Suspicious Developments and creator of the acclaimed titles Gunpoint and Heat Signature. “I love the game in a lot of ways, but it’s also incredibly frustrating because so often you misunderstand or don’t understand the rules, and end up losing irreplaceable soldiers or suffering devastating losses.”




Robed thief… Tactical infiltration wizard. Photo: Suspicious developments

Francis wanted to create a tactical game that focused on encouraging experimentation rather than punishing players. His solution was to let players rewind their turns to try new approaches to each situation. But the game still lacked a theme to accompany the concept. So Francis recalled a conversation he had while working as a journalist at PC Gamer: “We were joking that it would be really interesting if there was a serious military game like Call of Duty. [where] The people were all in tactical gear, but some were just wearing robes and hats.”

Thus was born Tactical Breach Wizards, combining Francis’s rewinding ideas with a variety of characters who are more like magical police, from freelance storm witches to riot priests, each with their own unique abilities to experiment with in different ways. One example is the Naval Seer. Blessed with the ability to see one second into the future, the Seer can also throw time-boosting grenades that provide bonus actions to teammates. Another is the Necro Medic, a necromancer who heals characters and replenishes their “mana” by killing and resurrecting them. “She rewinds your body, your body goes back to how it was an hour ago,” Francis says. “When she resurrects you, you get your mana back.”

According to Francis, these characters first appeared as puns, but gradually became central to the game. In fact, Tactical Breach Wizards doesn’t have the free-form structure and base building of XCOM, but instead has a linear story that explores each character’s personality and motivations. “I wanted to know who these characters were,” Francis said. “They each feel like they have a story.” He likens the storytelling approach to Mass Effect 2’s loyalty missions, saying, “To me, that was the most interesting thing about the game.”

Additionally, the Tactical Breach Wizard storyline, according to Francis, ” [on] Unlike works like Tom Clancy or Call of Duty, the game also aims to subvert the authoritarian morality of such fiction. “I don’t like those stories, there’s not a lot of criticism or self-examination,” he says. In Tactical Breach Wizards, the characters you command aren’t state enforcers, but thugs and outcasts battling a coalition of elite organisations, including religious military dictatorships and private military companies. “I didn’t want them to just be soldiers in a national army,” he explains. “You need a compelling reason to commit acts of violence.”

Tactical Breach Wizards has been in development for six years, which is a big investment for a small team. Luckily, you don’t have to be a naval seer to notice the positive signs. The game is high on Steam’s “wishlist” charts, and Francis says the recently released demo has been met with positive reactions from players. “There are some people who laugh when you say ‘Tactical Breach Wizards,'” he says. “I knew those people existed, but I didn’t realize how many there were. I’m very happy.” [that] A lot of people understand that.”

Skip Newsletter Promotions

Tactical Breach Wizards will be released on PC on August 22nd

Source: www.theguardian.com

Minister issues apology for data breach in Northern Ireland special education system

The education secretary of Northern Ireland has issued a sincere apology after the personal information of over 400 individuals who volunteered to assist with a review of special needs education was accidentally leaked.

The breach was discovered when the Department of Education mistakenly sent a spreadsheet to 174 individuals, containing the names, email addresses, and job titles of 407 people interested in participating in the review of special educational needs events in Northern Ireland.

The spreadsheet included comments from several individuals.

The department has requested the 174 recipients to delete the information they received and has confirmed that this has been done.

Many affected individuals have reported their concerns to authorities regarding the data breach.

Education Secretary Paul Givhan stated, “The Department of Education takes data protection seriously and deeply regrets this incident. We apologize to all those impacted and have informed them about the breach.”

Givan has ordered an internal audit department to conduct a thorough investigation into the data leak to prevent such incidents in the future.

An initial report has been submitted to the Information Commissioner’s Office, and updates will be provided as the investigation progresses.

This data breach is not the first in Northern Ireland, as a similar incident occurred last year involving the Police Service of Northern Ireland.

Around 5,000 officers and staff from PSNI took legal action after personal details of approximately 9,500 employees were mistakenly disclosed in response to a Freedom of Information request.

The leaked information included employee last names, initials, ranks, grades, workplaces, and departments, and was later discovered to have reached dissident republicans.

Source: www.theguardian.com

Don Lemon files lawsuit against Elon Musk and X for breach of talk show contract termination

Don Lemon, former CNN anchor, has filed a lawsuit against Elon Musk and Company X for breaching a contract with the now-formerly known Twitter social media platform.

The lawsuit, filed in California Superior Court in San Francisco, alleges fraud, negligent misrepresentation, misappropriation of name and likeness, and breach of contract.

Shortly after filming an interview with Musk, Lemon received a text ending their partnership which led to the abrupt termination.

Don Lemon’s lawyer, Carney Shegerian, stated the executives at Company X used Lemon for their advantage and then tarnished his name.

When contacted for comment, Company X responded with an automated message of being busy.

Lemon, once a prominent CNN figure, was let go due to conflicts and poor reviews as a morning show host. He was fired in April 2023.

Linda Yaccarino, CEO of Company X, initially reached out to Lemon’s agent to propose a new show after his CNN departure. The platform aimed to become a video-centric platform.

Lemon’s first scheduled episode on the platform, an interview with Musk, turned tense as Lemon questioned Musk on various topics, leading to the show’s cancellation over creative differences.

Skip Newsletter Promotions

Musk’s increasing conservatism and Lemon’s conflict with the platform’s content direction resulted in the show’s cancellation. Musk’s efforts to attract talent ended with limited success.

The platform’s shift to video content and creator outreach faced challenges with extremism and content moderation issues leading to advertisers pulling out.

Source: www.theguardian.com

Apple found in breach of EU competition regulations

Apple has been found to be in violation of new EU laws designed to promote competition among smaller companies and help consumers find more affordable alternative apps in tech companies’ app stores.

The European Commission, acting as both the EU’s antitrust and technology regulator, has informed Apple of preliminary findings after launching an investigation in March.

The Commission’s preliminary findings, which Apple can appeal, state that Apple’s conduct rules do not comply with the Digital Markets Act (DMA) as they restrict app developers from freely directing consumers to other platforms for offers and content.


The Commission has also initiated new non-compliance proceedings against Apple over concerns that its new contract terms for third-party app developers do not meet DMA requirements.

This marks the third non-compliance investigation launched by the Commission since the DMA took effect last year.

As part of the investigation, the committee is examining the “core technology fee,” a charge that Apple imposes on developers each time their app is installed on a phone.

The allegations against Apple for violating EU law represent the first case against a tech company under the DMA, significant legislation introduced last August to ensure fair competition among six designated “very large online platforms,” including Google, Amazon, Meta, and ByteDance (TikTok).

The investigation comes after the committee’s initial inquiry into Apple’s treatment of mobile app suppliers three months ago.

Previous findings from an earlier investigation reiterated that Apple must allow developers to inform customers about alternative, cheaper purchasing methods, guide them to these options, and enable them to make purchases free of charge, as required by new digital laws.

The investigation found that Apple’s terms of business did not allow developers to direct customers to more affordable alternatives or provide pricing information within the app.

Moreover, Apple made it challenging for customers to access pricing information and required links to external web pages for contract details.

Ultimately, the Commission determined that the fees charged by the App Store were excessive and not strictly necessary.

The Commission stated that if Apple’s alleged violations are confirmed, all three of its terms and conditions would violate Article 5(4) of the DMA, mandating gatekeepers to allow developers to direct consumers to external offers free of charge. A non-compliance decision will be issued within 12 months of the proceedings’ start on March 25, 2024.

Apple has responded by making several changes in recent months to comply with the DMA based on feedback from developers and the European Commission.

The company believes its adjustments align with the law and estimates that under the new terms, over 99% of developers will pay the same or lower fees to Apple.

All EU-based developers on the App Store now have access to features like directing app users to the web for purchases at competitive prices, reflecting Apple’s commitment to address the European Commission’s concerns.

Source: www.theguardian.com

Live Nation probes data breach at Ticketmaster’s US division | Cybersecurity Breach

Live Nation Entertainment is currently investigating a data breach at its Ticketmaster division that was discovered on May 20. This breach is the latest in a string of major corporate hacks that have occurred over the past year.

In a filing with the U.S. Securities and Exchange Commission, Live Nation reported finding “unauthorized activity” in a third-party cloud database containing primarily Ticketmaster data and is working with forensic investigators to address the issue.

Reports surfaced last week that a cybercrime group known as ShinyHunters claimed to have stolen user data for over 500 million Ticketmaster customers. However, Live Nation did not mention Shiny Hunters in its SEC filing.

Live Nation has not yet responded to requests for comment regarding the breach.

Skip Newsletter Promotions

This breach comes at a time when concert promoters are facing antitrust scrutiny. Live Nation is at the center of this scrutiny as the first target of antitrust lawsuits filed by U.S. and state governments seeking to break up the company for alleged price gouging on concert tickets.

According to Live Nation’s filing, on May 27, a criminal threat actor attempted to sell purported user data from Live Nation on the dark web. The company is actively working to mitigate risks, notify law enforcement, regulators, and users as needed, and ensure the security of personal information.

Despite the breach, Live Nation believes it will not have a significant impact on its operations or finances. The company is evaluating risks and implementing measures to enhance its operations.

Source: www.theguardian.com

Insights from China’s Huge Cyber Breach: The Market for Hackers

A significant data breach from a Chinese cybersecurity company has offered a rare glimpse into the inner workings of Beijing-linked hackers.

Analysts suggest that the breach contains valuable information about the day-to-day operations of China’s hacking program, which the FBI claims is the largest globally. I-Soon has not yet verified the authenticity of the leak and has not responded to requests for comment. As of Friday, the leaked data has been taken down from GitHub, where it was originally posted.

From staff complaints about salaries and office rumors to claims of infiltrating foreign governments, here are some key insights gathered from the leak.

Who was targeted in the hack?

Icesun employees were actively seeking high-profile targets on a daily basis.

The leak exposed that government entities in neighboring countries of China, such as Kyrgyzstan, Thailand, Cambodia, Mongolia, and Vietnam, had their websites and email servers breached. The targets ranged from British government departments to Thai ministries. I-Soon staff also claimed to have gained access to communication service providers in various countries. They specifically mentioned targeting the Indian government, viewed as Beijing’s geopolitical rival, and accessing educational institutions in Hong Kong and Taiwan. However, they acknowledged difficulty in accessing data seized from government agencies in Myanmar and South Korea.

Additional targets included domestic entities from Xinjiang to Tibet, covering topics from illegal activities to gambling establishments.

Who were the clients of Yi Seung?

Based on the leaks, most of Icesun’s customers were local police departments and state security agencies responsible for safeguarding the Communist Party against perceived threats to its authority. The company offered assistance in securing devices and communications with many contracts listed as non-confidential.

There were indications of official corruption, with discussions of kickbacks in sales to law enforcement agencies. Complaints about business challenges in regions like Xinjiang were also highlighted.

The leak mentioned the company’s focus on creating Trojans, compiling personal information databases, and developing technology for various hacking purposes.

Who are the hackers?

The leak sheds light on the daily operations at mid-sized Chinese cybersecurity firms, revealing internal issues like office politics, technical shortcomings, low pay, and customer retention challenges.

Employee conversations included complaints about management decisions, such as extravagant purchases and salary disputes.

The leak illustrates a less flattering side of the operations at these companies, showcasing a mix of competence and ethical concerns.

Source: www.theguardian.com

Chinese Hackers for Hire Exposed in Major Cybersecurity Breach | The Dark Reality of Cybercrime

The recent data breach from a Chinese cybersecurity company has exposed national security agencies paying substantial amounts of money to collect information about a variety of targets, including foreign governments, while hackers gather vast amounts of data on individuals and organizations that might be of interest to potential customers for their companies.

A set of over 500 leaked files from the Chinese company, I-Soon, has been posted on the developer’s website Github, with cybersecurity experts confirming their authenticity. The targets discussed in the leaked files include NATO and the UK Foreign Office.

The leak provides an unprecedented glimpse into the world of Chinese-employed hackers, with Britain’s security chief describing it as a “significant” challenge for the country. The leaked files consist of chat logs, company prospectuses, and data samples, revealing the scope of China’s intelligence-gathering operations and highlighting the market pressures faced by Chinese commercial hackers in a sluggish economy.

Yisun is believed to have collaborated with another Chinese hacking organization, Chengdu 404, which has been indicted by the U.S. Department of Justice for cyberattacks not only in the United States but also on companies in China and Hong Kong democracy activists.

Other targets discussed in the I-Soon leak include the British think tank Chatham House, public health agencies of Asean countries, and foreign ministries. The leak also indicates that certain data has been collected according to specifications, while in other cases special agreements have been made with the Chinese Public Security Bureau to collect specific types of data.

Chatham House has expressed concern over the leaked data, emphasizing the importance of safeguarding their data and information. Similarly, NATO has acknowledged the persistent cyber threats and stated that it is investing in large-scale cyber defense. However, the British Foreign Office declined to comment.

I-Soon’s services range from gaining access to email inboxes to hacking accounts, obtaining personal information from social media platforms, retrieving data from internal databases, and compromising various operating systems. The leaked files also suggest that the Chinese state is collecting as much data as possible.

Isun’s office building in Chengdu, Sichuan Province, southwest China. Photo: Kang Dak/AP

The leaked documents further reveal that I-Soon has sought “anti-terrorism” support and has claimed to have obtained data from various organizations. The company was also involved in discussions about sales practices and the company’s internal situation.

The leaked data also includes screenshots and chat logs where employees discuss the company’s operations and the impact of the COVID-19 pandemic on their business. The company’s CEO expressed concerns about the loss of core staff, the subsequent impact on customer confidence, and the loss of business.

Source: www.theguardian.com