After a policy change in June, thousands of banks who work with Zelle have started refunding money to victims of imposter scams as the company aims to strengthen consumer protections at the request of U.S. lawmakers and federal consumer watchdogs.There are 2,100 financial groups that offer money transfer services through Zelle. They began reversing fraudulent transactions on June 30 for customers conned into wiring money to scammers who claimed to be from government agencies, banks, and service providers, according to Early Warning Services, a company that owns Zelle.

While there are a lot of safeguards in place across financial institutions for people targeted by fraudsters who illegally gain access to a person’s account, there are few protections to help people tricked into sending money to scammers. Venmo, the other popular money-transfer service, doesn’t offer any way to get a refund after a payment is sent.

For more information, visit the Zelle Pay it Safe Education Center.

Conor LaHiff, a former IT manager for a New Jersey public high school, has admitted to committing a cyberattack against his former employer following the termination of his employment in June 2023. Last week, the U.S. Department of Justice (DOJ) announced that LaHiff pleaded guilty to one count of unauthorized damage to protected computers, violating the Computer Fraud and Abuse Act (CFAA).

The DOJ announcement describes the cyberattack as an act of retaliation, specifically targeting Apple and IT administrator accounts to cause damage and disruption to the school’s operations.

…

This is another case of a disgruntled former employee using their not-revoked high-level access to cause damage to critical networks out of spite. The simple act of coordinating human resource decisions with IT department actions, such as revoking account access for dismissed personnel, would significantly mitigate such risks. Interestingly, despite his actions, LaHiff had already filled a similar position at another public high school, which the judge is requiring LaHiff to notify about the guilty plea. LaHiff is scheduled to be sentenced on March 20, 2024, and faces a potential maximum penalty of 10 years in prison and fines of up to $250,000.

Tagged:

(JTA) — Hundreds of synagogues and Jewish institutions across the United States received bomb threats by email this weekend, in a substantial acceleration of a months-long spree of hoax threats. The Secure Community Network, which coordinates security for Jewish institutions nationwide, said early Sunday that it had tracked 199 threats over the past 24 hours, with nearly 100 in California and 62 in Arizona. Synagogues in at least 17 states plus Washington, D.C., were affected, according to local media reports.

The surge in threats comes at a time of high anxiety for American Jews amid a spike in reports of antisemitic incidents amid Israel’s war in Gaza. It also follows multiple arrests of people who have been charged with sending bomb threats targeting Jewish and other institutions, including a minor in California last week and a man in Peru in September.

Comcast Cable Communications, doing business as Xfinity, disclosed on Monday that attackers who breached one of its Citrix servers in October also stole customer-sensitive information from its systems.On October 25, roughly two weeks after Citrix released security updates to address a critical vulnerability now known as Citrix Bleed and tracked as CVE-2023-4966, the telecommunications company found evidence of malicious activity on its network between October 16 and October 19.

Cybersecurity company Mandiant says the Citrix flaw had been actively exploited as a zero-day since at least late August 2023. Following an investigation into the impact of the security breach, Xfinity discovered on November 16 that the attackers also exfiltrated data belonging to an undisclosed number of customers from its systems.

“After additional review of the affected systems and data, Xfinity concluded on December 6, 2023, that the customer information in scope included usernames and hashed passwords,” the company said.

Users’ passwords reset without any info. While Xfinity says it has asked users to reset their passwords to protect affected accounts, customers report that they had been getting password reset requests last week without any indication as to why that was happening.

Due to what the Federal Trade Commission calls Rite Aid’s “reckless” use of facial recognition technology in hundreds of stores from 2012 to 2020, the drugstore chain is now prohibited from using it for five years. The ban is part of Rite Aid’s settlement with the FTC over charges that its use of AI-based facial recognition technology harmed customers, the Hill reports. The FTC says the retailer didn’t alert customers that the tech was being used, then captured images of all customers and created a database of anyone believed to be shoplifting or otherwise acting suspiciously. For some customers, their names and birth dates were included in the database, the Verge reports….

Interpol, an international police organization, has arrested nearly 3,500 people allegedly connected to cybercrime in a sweeping operation announced on Tuesday. $300 million worth of assets across 34 countries were reportedly seized. The operation, Haechi IV, blocked over 80,000 suspicious bank accounts and warned government officials of new types of scams using AI and fake NFTs.

Malicious hacks have dominated the news cycle recently, as Interpol’s operation reported a 200% surge in arrests this year. Comcast experienced a data breach affecting 36 million accounts according to the Wall Street Journal Tuesday, potentially compromising every single Xfinity account.

Google has made sure that 2023 will go down as the year of privacy washing (new window). It introduced a new “ad privacy feature” for Chrome (new window) in September, and now it’s broadened the release of the beta version of Ad Topics for Android (both part of its misleadingly named Privacy Sandbox initiative). In both instances, Google sold a move to give itself total monopolistic control over the ability to spy on your activity as a “privacy feature”.

…

Unfortunately for us, Google as a business is entirely dependent on advertising. In 2022, Alphabet, Google’s parent company, made roughly $224.5 billion from advertising (new window), or almost 80% of its revenue. Even minimal attempts to introduce true privacy would fundamentally alter the company.

Google wants to have it both ways — it wants to appeal to the global privacy movement that only continues to grow without actually giving up any of its access to your information. Hence it dresses up new surveillance systems as privacy features.