TikTok faces a ban in the US, Tesla profits drop and healthcare data leaks | TechCrunch

April 28, 2024 2:09 AM0

Welcome, folks, to Week in Review (WiR), TechCrunch’s regular newsletter covering this week’s noteworthy happenings in tech.

TikTok’s fate in the U.S. looks uncertain after President Joe Biden signed a bill that included a deadline for ByteDance, TikTok’s parent company, to divest itself of TikTok within nine months or face a ban on distributing it in the U.S. Ivan writes about how the impact of TikTok bans in other countries could signal what’s to come stateside.

Meanwhile, fallout from the Change Healthcare hack continues. Change, a subsidiary of health insurance giant UnitedHealth, confirmed this week that the ransomware attack targeting it earlier this year resulted in a huge theft of Americans’ private health info, possibly covering “a substantial proportion” of Americans.

And Tesla profits dropped 55% as the EV company contends with increased pressure from hybrid carmakers. The automaker’s growth plan is centered around mysterious cheaper EVs scheduled to launch next year — as well as perhaps a robotaxi. But a recall on the Cybertruck for faulty accelerator pedals certainly won’t help in the interim.

Lots else happened. We recap it all in this edition of WiR — but first, a reminder to sign up to receive the WiR newsletter in your inbox every Saturday.

News

Amazon grocery plan: Amazon launched a new unlimited grocery delivery subscription in the U.S. The plan, which costs $9.99 per month for Amazon Prime users, comes with free deliveries for grocery orders over $35 across Amazon Fresh, Whole Foods Market and other local grocery retailers.

California drones grounded: In more Amazon news, the tech giant confirmed that it’s ending Prime Air drone delivery operations in Lockeford, California. The Central California town of 3,500 was the company’s second U.S. drone delivery site after College Station, Texas; Amazon didn’t offer any details around the setback.

Fisker plans layoffs: Fisker says it’s planning more layoffs less than two months after cutting 15% of its workforce, as the EV startup scrambles to raise cash to stay alive. Fisker expects to seek bankruptcy protection within the next 30 days if it can’t come up with the money.

Stripe expansion: Among a slew of other announcements at its Sessions conference in San Francisco, Stripe said that it’ll be de-coupling payments from the rest of its financial services stack. Given that Stripe previously required businesses to be payments customers in order to use any of its other products, that’s a big change.

Analysis

Rabbit hands on: Brian writes about the R1, the first gizmo from AI startup R1. The $199 price point, touchscreen and funky aesthetic from storied design firm Teenage Engineering make the R1 far more accessible than Humane’s Ai Pin, he concludes.

Lab-grown diamonds: Pascal, an Andreessen Horowitz-backed startup, claims it can make high-end jewelry accessible by using lab-grown diamonds chemically and physically akin to natural diamonds but that cost one-twentieth of the price.

AI poetry: An experiment called the Poetry Camera — an actual, physical camera — combines open source technology with playful design and artistic vision. Instead of merely capturing images, the Poetry Camera arranges thought-provoking, AI-generated stanzas based on the visuals it encounters.

Rippling deep dive: Connie interviewed Parker Conrad, the CEO of workforce management startup Rippling, on the company’s new $200 million funding round, new San Francisco lease (the second biggest to be signed in the city this year) and more.

Software Development in Sri Lanka

Robotic Automations

Health insurance giant Kaiser notifies millions of a data breach | TechCrunch

April 26, 2024 1:19 AM0

U.S. health conglomerate Kaiser is notifying millions of its members of a data breach earlier this month.

In a legally required notice filed with the U.S. government on April 12 but made public on Thursday, the Kaiser Foundation Health Plan confirmed that 13.4 million residents had information taken in a data breach.

The notice did not share the specific nature of the data breach, describing the incident only as “unauthorized access/disclosure” involving a network server.

U.S. organizations covered under the health privacy law known as HIPAA are required to notify the U.S. Department of Health and Human Services of data breaches involving protected health information, such as medical data and patient records. Kaiser also notified California’s attorney general of the data breach, but did not provide any further details.

Kaiser spokesperson Catherine Hernandez did not respond to a request for comment Thursday.

The Kaiser Foundation Health Plan is the parent organization of several entities that make up Kaiser Permanente, one of the largest healthcare organizations in the United States. The Kaiser Foundation Health Plan provides health insurance plans to employers and reported 12.5 million members as of the end of 2023.

The breach at Kaiser is listed on the Department of Health and Human Services’ website as the largest confirmed health-related data breach of 2024 so far.

It’s unclear if the breach at Kaiser is related to the ongoing recovery at U.S. health tech giant Change Healthcare, which was hit by ransomware in February. Earlier this week, Change Healthcare’s parent company UnitedHealth Group said that the criminal hackers stole sensitive health information on a “substantial proportion of people in America,” but fell short of providing a clear figure.

Do you know more about the data breach at Kaiser? To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.

Software Development in Sri Lanka

Robotic Automations

US government urges Sisense customers to reset credentials after hack | TechCrunch

April 20, 2024 3:51 AM0

U.S. cybersecurity agency CISA is warning Sisense customers to reset their credentials and secrets after the data analytics company reported a security incident.

In a brief statement on Thursday, CISA said it was responding to a “recent compromise” at Sisense, which provides business intelligence and data analytics to companies around the world.

CISA urged Sisense customers to “reset credentials and secrets potentially exposed to, or used to access, Sisense services,” and report to the agency any suspicious activity involving the use of compromised credentials.

The exact nature of the cybersecurity incident is not clear yet.

Founded in 2004, Sisense develops business intelligence and data analytics software for big companies, including telcos, airlines and tech giants. Sisense’s technology allows organizations to collect, analyze and visualize large amounts of their corporate data by tapping directly into their existing technologies and cloud systems.

Companies like Sisense rely on using credentials, such as passwords and private keys, to access a customer’s various stores of data for analysis. With access to these credentials, an attacker could potentially also access a customer’s data.

CISA said it is “taking an active role in collaborating with private industry partners to respond to this incident, especially as it relates to impacted critical infrastructure sector organizations.”

Sisense counts Air Canada, PagerDuty, Philips Healthcare, Skullcandy and Verizon as its customers, as well as thousands of other organizations globally.

News of the incident first emerged on Wednesday after cybersecurity journalist Brian Krebs published a note sent by Sisense Chief Information Security Officer Sangram Dash urging customers to “rotate any credentials that you use within your Sisense application.”

Neither Dash nor a spokesperson for Sisense responded to an email seeking comment.

Israeli media reported in January that Sisense had laid off about half of its employees since 2022. It is unclear if the layoffs impacted the company’s security posture. Sisense has taken in close to $300 million in funding from investors, which include Insight Partners, Bessemer Ventures Partners and Battery Ventures.

Do you know more about the Sisense breach? To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.

Software Development in Sri Lanka

Robotic Automations

AT&T notifies regulators after customer data breach | TechCrunch

April 19, 2024 3:56 AM0

AT&T has begun notifying U.S. state authorities and regulators of a security incident after confirming that millions of customer records posted online last month were authentic.

In a legally required filing with Maine’s attorney general’s office, the U.S. telco giant said it sent out letters notifying more than 51 million people that their personal information was compromised in the data breach, including around 90,000 individuals in Maine. AT&T also notified California’s attorney general of the breach.

AT&T — the largest telco in the United States — said that the breached data included customers’ full name, email address, mailing address, date of birth, phone number and Social Security number.

Leaked customer information dated back to mid-2019 and earlier. According to AT&T the records contained valid data on more than 7.9 million current AT&T customers.

AT&T took action some three years after a subset of the leaked data first appeared online, which prevented any meaningful analysis of the data. The full cache of 73 million leaked customer records was dumped online last month, allowing customers to verify that their data was genuine. Some of the records included duplicates.

The leaked data also included encrypted account passcodes, which allow access to customer accounts.

Soon after the full dataset was published, a security researcher notified TechCrunch that the encrypted passcodes found in the leaked data were easy to decipher. AT&T reset those account passcodes after TechCrunch alerted AT&T on March 26 to the risk posed to customers. TechCrunch held its story until AT&T could complete the process of resetting affected customer passcodes.

AT&T eventually acknowledged that the leaked data belongs to its customers, including about 65 million former customers.

Companies experiencing data breaches that affect large numbers of people are required to disclose the incident with U.S. attorneys general under state data breach notification laws. In its notices filed in Maine and California, AT&T said it is offering identity theft and credit monitoring to affected customers.

AT&T has still not identified the source of the leak.

AT&T resets account passcodes after millions of customer records leak online

Software Development in Sri Lanka

Robotic Automations

Hackers are threatening to publish a huge stolen sanctions and financial crimes watchlist | TechCrunch

April 18, 2024 10:57 PM0

A financially motivated criminal hacking group says it has stolen a confidential database containing millions of records that companies use for screening potential customers for links to sanctions and financial crime.

The hackers, which call themselves GhostR, said they stole 5.3 million records from the World-Check screening database in March and are threatening to publish the data online.

World-Check is a screening database used for “know your customer” checks (or KYC), allowing companies to determine if prospective customers are high risk or potential criminals, such as people with links to money laundering or who are under government sanctions.The hackers told TechCrunch that they stole the data from a Singapore-based firm with access to the World-Check database, but did not name the firm.

A portion of the stolen data, which the hackers shared with TechCrunch, includes individuals who were sanctioned as recently as this year.

Simon Henrick, a spokesperson for the London Stock Exchange Group, which maintains the database, told TechCrunch: “This was not a security breach of LSEG/our systems. The incident involves a third party’s data set, which includes a copy of the World-Check data file. This was illegally obtained from the third party’s system. We are liaising with the affected third party, to ensure our data is protected and ensuring that any appropriate authorities are notified.”

LSEG did not name the third-party company, but did not dispute the amount of data stolen.

The portion of stolen data seen by TechCrunch contains records on thousands of people, including current and former government officials, diplomats, and private companies whose leaders are considered “politically exposed people,” who are at a higher risk of involvement in corruption or bribery. The list also contains individuals accused of involvement in organized crime, suspected terrorists, intelligence operatives, and a European spyware vendor.

The data varies by record. The database contains names, passport numbers, Social Security numbers, online crypto account identifiers and bank account numbers, and more.

World-Check is currently owned by the London Stock Exchange Group following a $27 billion deal to buy financial data provider Refinitiv in 2021. LSEG collects information from public sources, including sanctions lists, government sources, and news outlets, then provides the database as a subscription to companies for conducting customer due diligence.

But privately run databases, like World-Check, are known to contain errors that can affect entirely innocent people with no nexus or connection to crime but whose information is stored in these databases.

In 2016, an older copy of the World-Check database leaked online following a security lapse at a third-party company with access to the data, including a former advisor to the U.K. government that World-Check had applied a “terrorism” label to his name. Banking giant HSBC shut down bank accounts belonging to several prominent British Muslims after the World-Check database branded them with “terrorism” tags.

A spokesperson for the U.K.’s data protection authority, the Information Commissioner’s Office, did not immediately comment on the breach.

To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.

Software Development in Sri Lanka

Robotic Automations

Targus says cyberattack is causing operational outage | TechCrunch

April 17, 2024 2:13 AM0

Mobile gadget and bag maker Targus says it is experiencing a “temporary interruption” to its business operations following a cyberattack on Friday.

In a notice with regulators on Monday, Targus’ parent company, B. Riley Financial, said it discovered “a threat actor gained unauthorized access to certain of Targus’ file systems,” and shut down much of its network to isolate the incident.

“The incident has been contained and Targus systems recovery efforts are in process,” the statement said.

Details of the cyberattack at Targus are now public thanks to a new rule by the U.S. securities regulator that requires public companies disclose cyberattacks — including on their subsidiaries — that could have a material impact on investors within 96 hours of their discovery.

Targus did not say what kind of interruption to its operations it was experiencing. It’s not uncommon for companies to shut down their networks in an effort to prevent intruders from accessing other systems or sensitive data. The company did not give a timeframe for when its operations would return to normal.

It’s not known if any Targus customer data was stolen in the intrusion, but the company said it will “work with law enforcement with respect to the unauthorized access to information.”

Founded in 1983, Targus is a popular mobile electronics brand and accessory maker. B. Riley acquired Targus in a 2022 deal worth approximately $250 million.

When reached by email, B. Riley spokesperson Jo Anne McCusker did not immediately comment.

Software Development in Sri Lanka

Robotic Automations

Hackers stole 340,000 Social Security numbers from government consulting firm | TechCrunch

April 17, 2024 12:13 AM0

U.S. consulting firm Greylock McKinnon Associates (GMA) disclosed a data breach in which hackers stole as many as 341,650 Social Security numbers.

The data breach was disclosed on Friday on Maine’s government website, where the state posts data breach notifications.

In its data breach notice sent by mail to affected victims, GMA said it was hit by an unspecified cyberattack in May 2023 and “promptly took steps to mitigate the incident.”

GMA provides economic and litigation support to companies and U.S. government agencies, including the U.S. Department of Justice, bringing civil litigation. According to its data breach notice, GMA told affected individuals that their personal information “was obtained by the U.S. Department of Justice (“DOJ”) as part of a civil litigation matter” supported by GMA.

The reasons and target of the DOJ’s civil litigation are not known. A spokesperson for the Justice Department did not respond to a request for comment.

GMA said that individuals notified of the data breach are “not the subject of this investigation or the associated litigation matters,” and that the cyberattack “does not impact your current Medicare benefits or coverage.”

“We consulted with third-party cybersecurity specialists to assist with our response to the incident, and we notified law enforcement and the DOJ. We received confirmation of which individuals’ information was affected and obtained their contact addresses on February 7, 2024,” the firm wrote.

GMA told victims that “your personal and Medicare information was likely affected in this incident,” which includes names, dates of birth, home address, some medical information and health insurance information, and Medicare claim numbers, which included Social Security numbers.

It’s unclear why it took GMA nine months to determine the extent of the breach and notify victims.

GMA, and the firm’s outside legal counsel, Linn Freedman of Robinson & Cole LLP, did not immediately respond to a request for comment.

Software Development in Sri Lanka

Robotic Automations

Omni Hotels says customers' personal data stolen in ransomware attack | TechCrunch

April 16, 2024 8:07 PM0

Hotel chain giant Omni Hotels & Resorts has confirmed cybercriminals stole the personal information of its customers in an apparent ransomware attack last month.

In an update on its website posted on Sunday, Omni said the stolen data includes customer names, email addresses, and postal addresses, as well as guest loyalty program information. The company said the stolen data does not include financial information or Social Security numbers.

Omni said it shut down its systems on March 29 after identifying intruders in its systems. Guests reported widespread outages across Omni’s properties, including phone and Wi-Fi issues. Some customers said that their room keys stopped working. The hotel chain restored its systems a week later on April 8.

Omni operates dozens of properties across the United States and Canada, and employs more than 14,000 staff, per its website.

A ransomware gang called Daixin has taken credit for the breach.

The Daixin gang said in a post on its dark web site that it would soon leak reams of customer records dating back to 2017. Ransomware gangs typically use such dark web sites to publish stolen information to extort a ransom from their victims.

The gang did not post evidence of their claims, but shared portions of the allegedly stolen files with veteran data breach watcher DataBreaches.net. Per the publication, the gang claimed to steal 3.5 million Omni customer records. A sample of the stolen data shared with DataBreaches.net matched the types of customers’ personal information that Omni said was taken.

A spokesperson for Omni did not immediately respond to a request for comment.

Daixin was the subject of a public advisory by U.S. cybersecurity agency CISA in October after the ransomware crew began targeting businesses across the U.S., including healthcare organizations. The Daixin gang previously took credit for several cyberattacks targeting U.S. hospitals and medical facilities.

Do you know more about the Omni Hotels breach? To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.

Software Development in Sri Lanka

Robotic Automations

Change Healthcare stolen patient data leaked by ransomware gang | TechCrunch

April 16, 2024 2:47 AM0

An extortion group has published a portion of what it says are the private and sensitive patient records on millions of Americans stolen during the ransomware attack on Change Healthcare in February.

On Monday, a new ransomware and extortion gang that calls itself RansomHub published several files on its dark web leak site containing personal information about patients across different documents, including billing files, insurance records and medical information.

Some of the files, which TechCrunch has seen, also contain contracts and agreements between Change Healthcare and its partners.

RansomHub threatened to sell the data to the highest bidder unless Change Healthcare pays a ransom.

It’s the first time that cybercriminals have published evidence that they have in their possession medical and patient records from the cyberattack.

For Change Healthcare, there’s another complication: This is the second group to demand a ransom payment to prevent the release of stolen patient data in as many months.

UnitedHealth Group, the parent company of Change Healthcare, said there was no evidence of a new cyber incident. “We are working with law enforcement and outside experts to investigate claims posted online to understand the extent of potentially impacted data. Our investigation remains active and ongoing,” said Tyler Mason, a spokesperson for UnitedHealth Group.

What’s more likely is that a dispute between members and affiliates of the ransomware gang left the stolen data in limbo and Change Healthcare exposed to further extortion.

A Russia-based ransomware gang called ALPHV took credit for the Change Healthcare data theft. Then, in early March, ALPHV suddenly disappeared along with a $22 million ransom payment that Change Healthcare allegedly paid to prevent the public release of patient data.

An ALPHV affiliate — essentially a contractor who earns a commission on the cyberattacks they launch using the gang’s malware — went public claiming to have carried out the data theft at Change Healthcare, but that the main ALPHV/BlackCat crew stiffed them out of their portion of the ransom payment and vanished with the lot. The contractor said the millions of patients’ data was “still with us.”

Now, RansomHub says “we have the data and not ALPHV.” Wired, which first reported the second group’s extortion effort on Friday, cited RansomHub as saying it was associated with the affiliate that still had the data.

UnitedHealth previously declined to say whether it paid the hackers’ ransom, nor did it say how much data was stolen in the cyberattack.

The healthcare giant said in a statement on March 27 that it obtained a dataset “safe for us to access and analyze,” which the company obtained in exchange for the ransom payment, TechCrunch learned from a source with knowledge of the ongoing incident. UHG said it was “prioritizing the review of data that we believe would likely have health information, personally identifiable information, claims and eligibility or financial information.”

As the Change Healthcare outage drags on, fears grow that patient data could spill online

Software Development in Sri Lanka

Robotic Automations

A ransomware gang is leaking Change Healthcare's stolen patient data | TechCrunch

April 16, 2024 2:15 AM0