ZeroFox Daily Intelligence Brief - March 2, 2023

ZeroFox Daily Intelligence Brief - March 2, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• YouTube Facing UK Watchdog Over Children’s Data Complaint
• Irish Authorities Levy GDPR Fine in Centric Health Breach
• Russia Bans Foreign Messaging Apps in Government Organizations
• Trezor Warns of Massive Crypto Wallet Phishing Campaign
• Social Engineering Scams Targeting Fashion and Brand Influencers Increasing in Prevalence and Sophistication

YouTube Facing UK Watchdog Over Children’s Data Complaint

The United Kingdom’s (UK) data-protection body, the Information Commissioner’s Office, has decided to hear a complaint alleging that YouTube violates the Children’s Code. The Children's Code (or Age Appropriate Design Code) is a set of standards for electronic information services on dealing with children and data related to children in an appropriate way. A charity group named 5Rights and a private individual have issued a complaint stating that YouTube is collecting at least the location, viewing habits, and preferences of five million children in the UK. Violating the Children’s Code can invoke a fine of up to 4 percent of a company’s annual global revenue.

Recommendations:

• Media companies dealing with content for minors are advised to protect childrens’ need for privacy and support appropriate content viewing and age-appropriate experiences.
• Companies should switch off non-essential location tracking, and privacy settings should default to very high.
• Parental consent tools and data-protection provisions should be adequately provided.

Irish Authorities Levy GDPR Fine in Centric Health Breach

The Irish Data Protection Commission has fined Centric Health Ltd EUR 460,000 for violation of General Data Protection Regulation (GDPR) requirements. The healthcare provider suffered a ransomware attack in 2019, which led to exposure of sensitive information of 70,000 patients—including the permanent deletion of data of close to 2,500 individuals. The fine was levied because of inadequate breach communication to affected individuals and other GDPR infringements, including failure to implement technical and organizational measures appropriate to the level of risk.

Recommendations:

• Organizations should inform all affected individuals in the event of a data breach at the earliest opportunity, so that they can act to mitigate the impact of their data exposure.
• Patients should be wary of unexpected contact claiming to be from Centric Health employees, as cybercriminals could attempt follow-on attacks using the leaked data.
• Personal brand and data protection services, such as those provided by IDX, can help protect Centric Health Users from unauthorized use of their personal information.

Russia Bans Foreign Messaging Apps in Government Organizations

The Russian government has banned the use of foreign messaging applications in government bodies as part of a law called “On information, information technology, and information protection" (Parts 8-10 of Article 10). Interestingly, Zoom and Signal are not explicitly mentioned in the notification by Roskomnadzor (The Federal Service for Supervision of Communications, Information Technology, and Mass Media in Russia). Russia has banned most reputable virtual private network (VPN) services in the past few years, and the Federal Assembly has proposed the establishment of a national VPN in the country.

Recommendation:

• Follow ZeroFox Intelligence to remain up-to-date on global cybersecurity and geopolitical developments.

Trezor Warns of Massive Crypto Wallet Phishing Campaign

An ongoing campaign is using phishing messages masquerading as data-breach notifications to steal people’s digital assets. Users of Trezor hardware wallets are receiving SMS and email messages falsely informing them of a data breach and prompting them to visit a specific website to secure their device. This malicious website asks the users to enter their recovery seed, which is a 12- or 24-word secret phrase that can be used to recover a wallet if a device is lost. Once the user hands over the secret phrase, the threat actors gain complete access to the cryptocurrency wallet and can steal all digital assets, such as cryptocurrency tokens and non-fungible tokens (NFTs).

Recommendations:

• While using a hardware wallet, rather than an internet-connected software wallet, can secure digital assets from malware and compromised devices, it is essential to also secure your wallet from social-engineering attacks. The most crucial security measure is to never disclose your recovery key or phrase to anyone and to never enter it on any website.
• Be wary of emails or messages over social media from people claiming to be support executives of Trezor. Scammers will typically send such communications in an attempt to gain access to your wallet; block and report any such users.

Social Engineering Scams Targeting Fashion and Brand Influencers Increasing in Prevalence and Sophistication

Social engineering scammers are targeting social media figures and user-generated content creators, or “influencers,” by impersonating large retailers and claiming to be recruiting influencers as brand ambassadors, models, and creators. The scamsters contact these influencers via email or from fake accounts on social media platforms and trick them into paying them shipping fees for free merchandise or revealing personal identifiable information (PII). Some victims are even coerced to undress for “virtual fittings” and then recorded without consent.

Recommendations:

• Content generators and influencers should be cautious when dealing with unsolicited communication and report scammers to law enforcement officials.
• Personal brand and data protection services, such as those provided by ZeroFox’s IDX services, can help protect people from impersonation attacks and unauthorized use of personal information.