Police in the United States have made an arrest in connection with a million-dollar cyber-scam involving the sale of an airplane in Australia. 

An investigation was launched in 2018 after a Business Email Compromise (BEC) attack interfered with digital communications between a company in New Zealand that was buying an airplane and a company in Australia that was selling it for $1,028,000. 

By infiltrating the emails of the two companies, cyber-scammers managed to replace the seller’s bank routing information with details of their own bank accounts in Houston, Texas. 

Using this ruse netted the attackers $928,000, paid in two separate transactions. 

The audacious theft sparked a two-and-a-half-year international criminal investigation that has already resulted in arrests and prosecutions. On November 18, that investigation led to the arrest of 36-year-old Cletus N. Anyanwu by Houston Police and the FBI.

Anyanwu was charged with first-degree felony of Engaging in Organized Criminal Activity, specifically money laundering of $300,000 or more. If convicted, he faces anywhere from 15 to 99 years behind bars in an unflattering orange jumpsuit. 

Harris County District Attorney Kim Ogg said that Anyanwu was the individual flying at the controls of the financial side of the BEC airplane scam.

Court documents present Anyanwu as a ringleader who organized hackers and bank accounts to receive the stolen funds from the bogus airplane sale that took place in May 2018. 

“Cyber fraud is among the fastest-growing crimes in the world,” said Ogg.

“Small business can be crushed, a government can be held hostage, or a corporation brought to a standstill all by hacking and fraud.  We are dedicated to helping victims by bringing cyber terrorists and thieves to justice.”

BEC scams caused the highest losses across all scam types in Australia in 2019, costing businesses $132m, according to the ACCC’s “Targeting Scams” report.

“We’re trying to stop all kinds of computer and email scams, including business scams like this. This company lost a million dollars, and that money is just gone,” said assistant Harris County district attorney Keith Houston, the prosecutor handling the case.

The data of thousands of patients has been exposed following a cyber-attack on Louisiana State University medical centers.

LSU Health New Orleans issued a HIPAA breach notification on November 20 after detecting a cyber-intrusion into an employee’s electronic mailbox. 

“The intrusion appears to have occurred on September 15, 2020, and the mailbox access was discovered and disabled on September 18, 2020,” said LSU Health.

Email messages or attachments in the compromised account contained limited information about patients who received care at Lallie Kemp Regional Medical Center in Independence; Leonard J. Chabert Medical Center in Houma; W. O. Moss Regional Medical Center in Lake Charles; the former Earl K. Long Medical Center in Baton Rouge; Bogalusa Medical Center in Bogalusa; University Medical Center in Lafayette; and Interim LSU Hospital in New Orleans.

Data exposed in the attack may have included patients’ names, medical record numbers, account numbers, dates of birth, Social Security numbers, dates of service, types of services received, phone numbers and/or addresses, and insurance identification numbers.

The type and amount of patient information compromised in the incident varied by location of care and each email message. LSU said that “a few” email messages “contained a patient’s bank account number and health information including a diagnosis.”

LSU Health said that while “it is possible that this information was accessible,” the Health Care Services Division “is not aware that the intruder actually accessed or misused the patient information in the employee’s mailbox.” 

A final tally has not yet been reached of the total number of patients who may have been affected by the incident.

“When the intrusion was discovered, the LSU Health Care Services Division’s Compliance and Privacy Department began the difficult and laborious process of identifying any patients whose information may have been compromised,” said LSU Health. 

“While the exhaustive investigation has found thousands of patients, work continues to discover any others.”

LSU has encouraged all the patients who may have been affected to monitor their credit reports for potential identity theft. 

The healthcare provider said that “strict privacy and security policies” that were in place at the time of the intrusion would now be reviewed to determine if improvements can be made.

Hacktivists have reportedly downed the website of Uganda Police in the wake of protests triggered by the arrest of Robert Kyagulanyi Ssentamu, also known by his pop star alias, Bobi Wine.

Wine is the presidential candidate of the center-left progressive political party, the National Unity Platform (NUP). He was arrested in Eastern Uganda’s Luuka District and charged with violating government restrictions on gatherings put in place to slow the spread of COVID-19 by holding mass rallies.

Nicholas Opiyo, Wine’s lawyer, said that the Iganga Court released the singer on bail in the afternoon of Friday, November 20. According to RedPepper Digital, the Uganda Police website went down later that same night. 

Visitors to https://www.upf.go.ug/ were redirected to a different address where the following message was displayed: “This site can’t be reached. www.upf.go.ug took too long to respond.”

RedPepper reports that well-known international hacking collective Anonymous was responsible for the cyber-attack. 

“Anonymous owned up to the incident revealing that they were responding to recent events in Uganda that saw lives lost as police tried to disperse protestors who were against the arrest of NUP presidential candidate, Robert Kyagulanyi alias Bobi Wine.” 

Anonymous shared the following message via its Twitter account @YouAnonCentral on November 20: “#Uganda: Anonymous has taken down @PoliceUg’s website in response to recent violent government repression & killings.

“Anonymous calls for police to respect human lives & the freedom of peaceful assembly and protest. #UgandaIsBleeding #ugandanlivesmatter.”

Last week, Ugandan officials said that 37 people had been killed in violent protests in the country as Wine’s supporters clashed with security forces. 

Uganda Police’s chief pathologist, Moses Byaruhanga, said that while it was not clear who was responsible for the deaths, most of the individuals whose lives were snatched away from them through violence died from gunshot wounds and traumatic injuries. 

Opiyo said the arrest of Wine was an attempt to stifle the voice of the country’s strongest political challenger to Uganda’s longtime leader Yoweri Museveni ahead of elections scheduled to take place early next year.

Recent political rallies held by 76-year-old Museveni have not attracted police interference or resulted in any charges being brought against the president for coronavirus violations.

One in five people have been affected by identity fraud this year, having been informed that their personal information has been exposed as the result of a data breach. This is according to the GBG State of Digital Identity: 2020 report, which found that the trust gap between businesses and consumers could be widening due to the greater prevalence of identity theft since the start of the COVID-19 pandemic.

The findings come amid a year in which there has been a much greater reliance on digital services as a result of social distancing restrictions. GBG noted that 47% of people had opened up a new online shopping account while 35% had opened a new social media account and 31% an online bank account in 2020. Additionally, a third of consumers aged 75 or older had signed up to a new online account this year.

The study revealed that a third of consumers have become more concerned about fraud due to COVID-19 and 33% of the public believe their personal information is currently for sale on the dark web. Despite these concerns, many businesses appear to have a lax attitude to this issue, with more than a quarter (28%) surveyed stating that “high” or “extreme” levels of fraud are accepted within their organization. This could be because of a greater emphasis on delivering a frictionless customer experience ahead of fraud prevention and security, with 54% of businesses finding this a more difficult balance to strike in the past three years.

GBG also predicts that during this year’s festive shopping period, online retailers will face an average of 20,000 fraud attempts each, potentially leading to up to 24 million customers falling victim to e-commerce fraud from November to January.

Gus Tomlinson, GM of identity fraud, Europe at GBG, commented: “The complex set of data points which shape our identity are now vital in keeping the wheels of commerce turning. They create digital trust, allowing people and providers to interact safely without opening the floodgates to fraud.”

She added: “The research shows that not only is identity fraud already prolific, the ‘trust gap’ it creates poses a risk to industries which will depend on digital trust if they are to thrive in 2021 and beyond. For some businesses and even entire sectors, we are nearing a tipping point: get this balance wrong, and lose trust – and therefore customers – for good.”

Multi-cloud adoption grew by 70% year-over-year in 2020 outpacing the previous 12 months by more than 20%.

According to the Continuous Intelligence Report The State of Modern applications, DevSecOps and the Impact of COVID-19 from Sumo Logic, customers adopted CloudTrail (60%), VPC Flow Logs (34%) and GuardDuty (22%) to meet the expanded need for cloud services.

The report, which is developed using data from more than 2100 Sumo Logic customers running applications across all major cloud platforms and on-premises environments, also claimed that securing cloud workloads requires adoption of both cloud-native security technologies and consuming available cloud data sources.

Due to the need to support remote workers during the pandemic, multi-cloud adoption grew by 70% year-over-year, outpacing the previous 12 months that saw a 50% growth. This led enterprises to turn to modern cloud platforms such as Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP), to deliver high quality and secure applications to their customers.

Also, AWS regional centers in the US and EU were top targets for attackers, based on Sumo Logic’s global intelligence.

“This year was unlike any other that we have witnessed with a significant shift in organizations’ technology priorities, in part as a result of the COVID-19 pandemic,” said Bruno Kurtic, founding VP of strategy and solutions at Sumo Logic.

“This continued acceleration to digital was further fueled key trends including multi-cloud adoption, an expanding threat landscape and the need for improved collaboration across DevSecOps, as companies quickly made changes to adapt to new business demands. The need for continuous intelligence is even more critical as digital businesses require real time analytics in order to deliver high performance, highly scalable, always-on digital services to speed decision making and drive the best customer experiences.”

Google has finally announced that end-to-end encryption (E2EE) will begin rolling out on its Messages platform, bringing it in line with rivals WhatsApp and iMessage in the security stakes.

Messages by Google is built on the open Rich Communication Services (RCS) standard to offer improvements over legacy SMS such as anti-spam, launching of video calls direct from conversations, Smart Reply and more.

Google announced late last Friday that it had completed its global rollout of the platform for all Android users.

However, until now the missing piece in the puzzle was security, with both Facebook (WhatsApp) and Apple offering E2EE to maximize privacy for their users.

Google now joins its rivals with these capabilities, starting with one-to-one conversations and only when both users are on Messages.

“End-to-end encryption ensures that no one, including Google and third parties, can read the content of your messages as they travel between your phone and the phone of the person you’re messaging,” explained product lead, Drew Rowney. “This will roll out to beta testers beginning this month and continue into next year.”

However, while the new functionality is likely to be a hit with consumers and business users, it will put Google on a collision path with legislators and law enforcers in the US.

Over recent years, high-profile figures have tried to pressure tech giants like Apple into engineering bespoke backdoors into their products so that investigators can unlock phones and read the encrypted messages of suspects.

They argue that E2EE otherwise offers a safe haven for terrorists, child abusers and other criminal elements — disregarding the fact that if Apple et al were to accede to their wishes, these individuals would surely migrate to other platforms.

Now Google will have to stand up for its users and argue that backdoors cannot be engineered for law enforcement without undermining security for all — a point repeatedly batted away by lawmakers.

In its most recent missive last month, the Five Eyes intelligence community plus India and Japan repeated its demands, and argued that the tech community just isn’t trying hard enough to find a way forward.