data breaches

Criminals offer no proof of Federal Reserve breach claim

“At least 79.7% of the accounts leveraged by the threat actor in this campaign had prior credential exposure

"This appears to be a targeted campaign directed at users with single-factor authentication"

"The user must be left in the disabled state for 6 hours to fully invalidate any possible unauthorized access via this ID token feature."

"No impact or compromise to our customer, production and corporate environments" -- but were credentials stolen?

"We did not detect… lateral movement into our VMware infrastructure. At the time we believed we took all the necessary actions to mitigate the vulnerability, but these actions were clearly insufficient.”

"They have direct access to JDBC connections, to SSH, and to SaaS platforms... This is a worst case scenario"

It takes a special kind of stupid to export a LastPass vault and dump it into a public bucket along with a bunch of AWS keys. How do these people win critical government contracts again, please?

SolarWinds’ poor controls... false and misleading statements and omissions, and the other misconduct... would have violated the federal securities laws even if SolarWinds had not experienced a major, targeted cybersecurity attack"