High school students who raised the alarm after discovering a severe data breach involving teachers’ personal information say they were ignored for months. 

In January, students at Brooklyn Technical High School reportedly stumbled across a Google Drive containing documents uploaded by staff and students at schools across New York City. Among the documents were college recommendation letters, classwork, and parent-teacher conference sign-up sheets.

The students could access the files because of a quirk in the school’s education department’s Google Drive sharing settings. A hidden setting automatically allowed anyone with an email address provided by the education department to search for files in Google Drive.

After making the discovery, the students arranged a meeting with a senior staff member at their school and used a PowerPoint presentation to walk them through the data breach. 

“At that point [after the meeting], we thought the issue was going to get taken care of,” one of the students who discovered the breach and who wished to remain anonymous told Chalkbeat.

When the students rechecked the Google Drive in March, they found that even more documents were now accessible. This time, the students could view a school’s payroll document that contained teachers’ salary information, Social Security numbers, phone numbers, and addresses.

The student said they began calling teachers on the list to find one who could remove the document from the drive. 

When a teacher answered, the student said, “he was in shock because no one really expects a 16-year-old to call them at 10 o’clock in the morning saying, ‘I have your Social Security number.’”

On March 18, the student notified three officials at the city’s education department of the data breach via email. Earlier this month, the department confirmed a data leak that impacted approximately 3,000 students and 100 employees.

The department told Chalkbeat that confidentiality laws prevented them from confirming that this leak was linked to the data breach reported by the Brooklyn Tech students in March. However, a teacher anonymously told the publication that a data breach notification letter they had received from the department stated that the leak had taken in place in March.

A former editor of the New York Observer who was pardoned in January for alleged cyber-stalking has been re-charged for a similar, related offense. 

New Jersey resident Kenneth Kurson, also known as Jayden Wagner and Eddie Train, was charged on October 23, 2020, with cyber-stalking three individuals and harassing two additional people. His alleged victims include his former wife, her friend, and a doctor employed by Mount Sinai Hospital. 

Kurson’s alleged crimes dated back to November and December 2015, when he and his ex-wife were engaged in divorce proceedings. He was accused of sending harassing emails and impersonating others to leave negative reviews online about the doctor, whom Kurson believed to be responsible for the breakdown of his marriage. 

In January 2021, before Kurson’s case could come to court, he was pardoned of interstate stalking and harassment charges by the outgoing U.S. president, Donald Trump.

On August 18, the Manhattan District Attorney’s office charged 52-year-old Kurson with felony eavesdropping and computer trespass “for unlawfully accessing communications of his then-wife from September 2015 through March 2016 while he served as Editor-In-Chief of Observer Media Group.”

This latest complaint alleges that from September 24, 2015, to March 3, 2016, while still living with his ex-wife, Kurson unlawfully used an electronic monitoring software program commonly known as “spyware” on her computer.

He is accused of obtaining login credentials to her Gmail and Facebook accounts by monitoring her keystrokes. It is alleged that in October 2015, Kurson anonymously shared private Facebook messages.

The DA’s office said IP address records indicate that Kurson used the spyware from his computer at the offices of the Observer Media Group in Manhattan, where he was employed at the time as editor-in-chief. 

“We will not accept presidential pardons as get-out-of-jail-free cards for the well-connected in New York,” said District Attorney Cy Vance. 

“As alleged in the complaint, Mr. Kurson launched a campaign of cybercrime, manipulation, and abuse from his perch at the New York Observer, and now the people of New York will hold him accountable. We encourage all survivors and witnesses of this type of cybercrime and intimate partner abuse to report these crimes to our Office.”

A cyber-criminal group has been emailing employees and asking them to help attack their own companies with malware. 

The insider threat solicitation scheme was discovered by researchers at Abnormal Security. The author of the emails is someone who claims to have links with the DemonWare ransomware group, also known as Black Kingdom and DEMON.

“On August 12, 2021, we identified and blocked a number of emails sent to Abnormal Security customers soliciting them to become accomplices in an insider threat scheme,” stated Abnormal Security’s Crane Hassold. 

“The goal was for them to infect their companies’ networks with ransomware.”

To entice the employees into becoming their criminal accomplices, the email’s author offers them a cut of the loot. 

“The sender tells the employee that if they’re able to deploy ransomware on a company computer or Windows server, then they would be paid $1m in Bitcoin, or 40% of the presumed $2.5m ransom,” wrote Hassold. 

Employees are told how to launch the ransomware physically or remotely. Interested employees are instructed to contact the sender via an email address or via Telegram. 

This new and rather brazen attack tactic stood out to researchers, who are used to seeing ransomware deployed via other, more subtle, methods. 

“Historically, ransomware has been delivered via email attachments or, more recently, using direct network access obtained through things like unsecure VPN accounts or software vulnerabilities,” wrote Hassold. “Seeing an actor attempt to use basic social engineering techniques to convince an internal target to be complicit in an attack against their employer was notable.”

Researchers created a fake persona and contacted the attacker asking how they could help in the attack. The attacker sent download links to an executable file that researchers confirmed was ransomware. 

Further communication with the attacker revealed that he picked his targets and found their email addresses on the networking site LinkedIn. 

“You can defeat most social engineering that gets by your technical defenses by using security awareness training and MFA,” commented Roger Grimes, data driven defense evangelist at KnowBe4. 

“You can worry about disgruntled employees, but while you are doing that, your loyal employee is getting socially engineered. That is your real problem.”

Global fines for anti-money laundering (AML) and data privacy compliance breaches have fallen by nearly 50% year-on-year in the first half of 2021, but could bounce back quickly as financial crime continues apace, according to Fenergo.

The digital transformation company claimed that 85 individual fines were levied on global financial institutions for breaches of AML, Know Your Customer (KYC) and data privacy laws in the first six months of 2021 — a drop of 26% on the figure for 1H 2020.

It added that these fines translate into a value of nearly $938m, which is a 46% decline.

The US-led the way with $711m in fines, followed by Switzerland ($85m), Norway ($48m) and the UK ($33m).

Fenergo’s global director of financial crime, Rachel Woolley, noted that the drop comes after a period of several years, which has seen regulators levy record fines in response to significant scandals.

However, the figures could quickly rebound in the second half of the year as several major cases are due to reach their conclusion, she added.

“We continue to see enforcement action-driven, at least in part, by recent Financial Action task Force (FATF) activity as countries facing scrutiny clampdown on perceived weaknesses in their regulatory regimes,” said Woolley.

“We’re also seeing the continuation of the trend in fines aimed at non-financial firms such as gambling companies as regulators look to close the net on criminals.”

Fraud is occurring on a massive scale during the pandemic, especially in the US, which will prompt further investigations into banks that may unwittingly or otherwise have facilitated these crimes, the Fenergo expert noted.

The scale of global money laundering is notoriously difficult to estimate given the failure of regulators, law enforcers and financial institutions to detect and stop nefarious activity. However, the UN believes it could be between 2-5% of global GDP annually, which could mean as much as $4tn or more.

Many in the financial services industry believe the compliance system itself is not fit-for-purpose, with FATF rules ultimately encouraging banks to focus not on reducing money laundering, but on protecting their reputation and bottom line.

A New York man has been sentenced to three years behind bars after stealing nude images of dozens of female victims whose social media accounts he hacked.

Nicholas Faber, 25, of Rochester, pleaded guilty back in February to one count of computer intrusion causing damage and one count of aggravated identity theft.

From around 2017 to 2019, Faber admitted to working with co-conspirator Michael Fish to access the email accounts of dozens of female college students at the State University of New York (SUNY)-Plattsburgh.

They are said to have used that information to access the victims’ social media accounts, steal intimate photos and movies and even trade them with others online.

According to the Department of Justice, the university was forced to allocate staff and extra funds to identify the compromised accounts, review access logs, reset passwords and notify students and parents.

As reported by Infosecurity earlier this year, Fish is said to have also created and sold collages featuring personal photos, sexually explicit images, and formal graduation photos of the victims.

He pleaded guilty in May to computer hacking, aggravated identity theft, and child pornography offenses and was later charged with obstruction of justice after allegedly submitting six fraudulent letters to a judge attesting to his good character.

Former high school valedictorian Faber, who graduated from SUNY-Plattsburgh in 2017, will also face three years of federal supervision following his release. He has agreed to pay $35,430 in restitution to the university.

The case calls to mind the infamous “Celebgate” iCloud attacks from 2014, in which explicit private photos of around 100 celebrities were stolen from email and social media accounts and leaked online.

It also highlights the importance of strong email and social media security, particularly enabling two-factor authentication where possible.

A Japanese cryptocurrency exchange is estimated to have lost $97m after threat actors targeted the company.

Tokyo-headquartered Liquid revealed the incident on Thursday evening local time.

“We are sorry to announce that #LiquidGlobal warm wallets were compromised, we are moving assets into the cold wallet,” it said in a brief update. “We are currently investigating and will provide regular updates. In the meantime, deposits and withdrawals will be suspended.”

According to London-based blockchain analysis company Elliptic, the cyber-thieves stole nearly $100m in various currencies, including Ether ($32.5m), XRP ($12.9m), Bitcoin ($4.8m), Tron ($200,000) and Stablecoins ($9.2m).

“This includes $45m in Ethereum tokens, which are currently being converted into Ether using decentralized exchanges (DEXs) such as Uniswap and SushiSwap. This enables the hacker to avoid having these assets frozen — as is possible with many Ethereum tokens,” the firm explained.

“Elliptic has added the addresses associated with the thief to our system, ensuring that our clients will be alerted if they receive any of these funds. Our investigators are also aiding Liquid with tracking the stolen funds.”

With over 800,000 customers, 100+ supported countries, 80 listed digital currencies and a daily trading volume that exceeded $1bn in 2021, Liquid has a large presence in the cryptocurrency market.

However, it’s by no means the first Japanese exchange to be targeted. Mt Gox was undoubtedly the largest, losing around $500m in cyber-attacks back in 2014, forcing it to close.

Other notable victims over the years include Coincheck ($425m), Zaif ($60m), Bitpoint ($32m), and UpBit ($52m).

Some of these attacks may have originated from North Korea. A UN report from 2019 estimated that the Kim Jong-un regime might have amassed as much as $2bn from audacious raids on banks and cryptocurrency exchanges.

The biggest cryptocurrency theft of all time happened only last week when Poly Network lost over $600m to thieves. However, fortunately for the firm, the ‘ethical’ hackers that stole the money had returned most of it within days.

Four Floridians have been charged in connection with a child sexual abuse material (CSAM) subscription service that produced millions of images and videos of sexualized minors. 

International Florida-based business Newstar Enterprise, which was founded in 2005, built, maintained, hosted, and operated what appeared to be a series of legitimate child modeling websites called Newstar Websites on servers based in the US and abroad.

According to court documents, Newstar was in reality “an internet-based business aimed at for-profit sexual exploitation of vulnerable children under the guise of ‘child modeling’.”

Some of the images and videos sold via the Newstar Websites showed children as young as 6 years old in sexual and provocative poses, wearing police and cheerleader costumes, revealing swimsuits, pantyhose and miniskirts, thong underwear, and transparent underwear.

Though the images and videos did not depict any minor as completely nude, some of the children were shown engaging in sexually explicit conduct. 

“To populate the Newstar Websites with content, Newstar Enterprise members sourced, enticed, solicited and recruited males and females under the age of 18, some of whom were prepubescent, to use as ‘child models’ for the Newstar Websites,” said the Department of Justice in a statement. 

“Using the recruited child-victims, the Newstar Enterprise produced more than 4.6 million sexualized images and videos to distribute and sell on the Newstar Websites.”

The websites attracted users from 101 different countries. Some images were provided free, while other content was unlocked by paying a subscription fee. 

More than $9.4m in income was generated by the websites. Newstar Enterprise employees fraudulently opened merchant and bank accounts in the United States, using a bogus jewelry company to launder the proceeds.

Investigators found most of the children pictured on the site were recruited from Eastern Europe. 

Weston resident 58-year-old Kenneth Power was charged with conspiracy to advertise child pornography and conspiracy to distribute child pornography, but the case against him was dismissed following his death on March 9.

Power’s wife, 41-year-old Tatiana Power, was charged with conspiracy to commit money laundering, international promotion money laundering, and concealment money laundering.

Patrice Eileen Wilowski-Mevorah, 53, of Tampa, and Mary Lou Bjorkman, 58, of Lutz, pleaded guilty to laundering money for Newstar Enterprise.