By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

The data for approximately 7 million Robinhood customers stolen in a recent data breach are being sold on a popular hacking forum and marketplace. Last week, Robinhood disclosed a data breach after one of its employees was hacked, and the threat actor used their account to access the information for approximately 7 million users through customer support systems. In addition to stealing the data, Robinhood stated that the hacker attempted to extort the company to prevent the data from being released. Stolen email addresses, especially those for financial services, are particularly popular among threat actors as they can be used in targeted phishing attacks to steal more sensitive data. Two days after Robinhood disclosed the attack, a threat actor named 'pompompurin' announced that they were selling the data on a hacking forum. In a forum post, pompompurin said he was selling 7 million Robinhood customers' stolen information for at least five figures, which is $10,000 or higher. The sold data includes 5 million email addresses, and for another batch of Robinhood customers, 2 million email addresses and their full names. However, pompompurin said they were not selling the data for 310 customers who had more sensitive information stolen, including identification cards for some users. Robinhood did not initially disclose the theft of ID cards, and the threat actor states that they downloaded them from SendSafely, a secure file transfer service used by the trading platform when performing Know Your Customer (KYC) requirements. "As we disclosed on November 8, we experienced a data security incident and a subset of approximately 10 customers had more extensive personal information and account details revealed," Robinhood told BleepingComputer after we contacted them regarding the sale of their data. "These more extensive account details included identification images for some of those 10 people. Like other financial services companies, we collect and retain identification images for some customers as part of our regulatory-required Know Your Customer checks." pompompurin told BleepingComputer that he gained access to the Robinhood customer support systems after tricking a help desk employee into installing a remote access software on their computer. Once remote access software is installed on a device, a threat actor can monitor their activities, take screenshots, and remotely access the computer. Additionally, while remotely controlling a device, the attackers can also use the employee's saved login credentials to log in to internal Robinhood systems that they had access to. "I was able to see all account information on people. I saw a few people while the support agent did work," pompompurin told BleepingComputer. In response to further questions regarding how the employee's device was breached, Robinhood referred us back to their original statement stating that the threat actor "socially engineered a customer support employee by phone." However, they did confirm to BleepingComputer that malware was not used in the attack. As proof that they conducted the attack, pompompurin posted screenshots seen by BleepingComputer of the attackers accessing internal Robinhood systems. These screenshots included an internal help desk system used to lookup Robinhood member information by email address, an internal knowledge base page about a "Project Oliver Twister" initiative designed to protect high-risk customers, and an "annotations" page showing notes for a particular customer. This threat actor, pompompurin, was also responsible for abusing FBI's email servers to send threatening emails over the weekend. This weekend, US entities began to receive emails sent from FBI infrastructure warning recipients that their "virtualized clusters " were being targeted in a "sophisticated chain attack," as shown in the email below. To learn more direct your focus to OUR FORUM.

You think there are limits to what your employer can see you do online? Some new Microsoft updates may make you think a little more about that. I feel sure there are many American workers who have put the whistle in their mouths, like former Facebook employee Frances Haugen but have been too afraid to blow it. I feel equally sure that, after telling you what's coming, you'll be more reluctant even to put the whistle in your mouth. It may be that you think your employer is doing evil, unspeakable or merely unpleasant or illegal things. But it may equally be that you're less a whistleblower and more tending toward the unpleasant, untrustworthy, or even illegal yourself. With blessed coincidence, Microsoft is preparing a couple of little updates that may curb employee rulebreaking enthusiasm. Yes, this news again comes courtesy of Microsoft's roadmap service, where Redmond prepares you for the joys to come. This time, there are a couple of joys. The first is headlined: "Microsoft 365 compliance center: Insider risk management -- Increased visibility on browsers." It all sounded wonderful until you those last four words, didn't it? For this is the roadmap for administrators. And when you give a kindly administrator "increased visibility on browsers," you can feel sure this means an elevated level of surveillance of what employees are typing into those browsers. In this case, Microsoft is targeting "risky activity." Which, presumably, has some sort of definition. It offers a link to its compliance center, where the very first sentence has whistleblower built-in: "Web browsers are often used by users to access both sensitive and non-sensitive files within an organization." And what is the compliance center monitoring? Why, "files copied to personal cloud storage, files printed to local or network devices, files transferred or copied to a network share, files copied to USB devices." You always assumed this was the case? Perhaps. But now there will be mysteriously increased visibility. "How might this visibility be increased?," I hear you shudder. Well, there's another little roadmap update that may just may, offer a clue. This one proclaims: "Microsoft 365 compliance center: Insider risk management -- New ML detectors." Yes, your company will soon have extra-special robots to crawl along after you and observe your every "risky" action. It's not enough to have increased visibility on browsers. You must also have Machine Learning constantly alert for someone revealing your lunch schedule. Microsoft offers a link to its Insider Risk Management page. This enjoys some delicious phrasing: "Customers acknowledge insights related to the individual user's behavior, character, or performance materially related to employment can be calculated by the administrator and made available to others in the organization." Yes, even your character is being examined here. In one sense, this is all understandable. The easier it gets for employees to behave in even marginally nefarious ways, the more there has to be secured to prevent them from doing it. The more that cyber weaknesses exist, the more someone might want to exploit them. Ultimately, of course, it's another small representation of the complete lack of trust among humans -- and especially between management and employees. Technology, because of its immediacy and ubiquity, has exacerbated that. The more companies descend spy software upon their employees -- especially employees working from home -- the less trust can exist between those who work and those who manage. Stay up to date by visiting OUR FORUM.

FACEBOOK IS BROKEN, says whistleblower Frances Haugen, who worked on the company’s civic integrity team. In testimony before Congress and in the media, Haugen has argued that the social giant’s algorithms contribute to maladies that range from teen mental health issues to ethnic violence in Ethiopia. There’s no one solution that will fix all that’s wrong with Facebook—no, not even a new name—but one of Haugen’s suggestions stood out. “I’m a strong proponent of chronological ranking, ordering by time with a little bit of spam demotion,” she told the Senate earlier this month. “We should have software that is human-scaled, where humans have conversations together, not computers facilitating who we get to hear from.” Imagine that! Humans … having conversations together. Haugen essentially recommends a Facebook News Feed where items appear as people post them, rather than in an order divined by the company’s algorithmic wizardry. In this world, likes and comments wouldn’t dictate what you see. It’s all a matter of timing—which would also prevent the algorithm from tossing logs onto the platform’s most inflammatory posts. It’s not that radical a notion. Instagram only handed the algorithm the reins to your feed in 2016. Twitter took away chronology altogether that same year, only to reintroduce it as an option in 2018. And you can also ditch the algorithm in the Facebook News Feed right now, today. I know, because I’ve been doing it for the past two weeks. In fairness, it’s not like Facebook hides the option. On desktop, you just click Most Recent in the lefthand pane. On mobile, you’ll find Most Recent under the hamburger menu in the upper-right corner. As Facebook itself warns, though, the experience is fleeting. “You can sort your News Feed to see recent posts,” a company help page says, “but News Feed will eventually return to its default setting.” (Or you can just use this link instead of facebook dot com, and load a ranking-free experience every time.) To get a possibly obvious caveat out of the way: I am by no means a Facebook power user. I’ve posted three or four times a year since 2019, all of which were either WIRED stories or attempts to drum up business for my daughter’s Girl Scout cookie side hustle. My account is private, and while I’m somehow a member of 14 groups, more than half of those haven’t posted anything in the past year, I sporadically check in on three, and had forgotten the rest existed. Still, any honest accounting would put me on Facebook a few times a week. Call it a force of habit, call it Marketplace voyeurism. Regardless, I am familiar with how the News Feed typically functions—and was struck by just how different an experience a healthy dose of chronology imparted. I also don’t want to overstate things. The ills that Haugen proposes chronology may fix are largely not present in my social media bubble, to begin with, at least that I’ve seen. Facebook also uses a multitude of algorithms; here it's referring only to the platform's News Feed ranking. And I hesitate to say whether the experience is necessarily better, at least for me than what Facebook currently has on offer. Far more interesting, anyway, is what it says about Facebook itself. I have 975 Facebook friends, accumulated over the past 13 years or so. I “like” 15 pages, a list that primarily comprises news outlets, plus a few friends who converted their profiles into Pages, and Cheez-Its, for some reason. (The reason is that Cheez-Its are delicious.) You might imagine that in a healthy social network, even in chronological mode, the ratio of posts from friends to brands would roughly reflect the proportion in which you follow them. You don’t even have to imagine, actually; chronological Twitter functions basically like this, with ebbs and flows throughout the day that map the real human activity of the people you follow. More in-depth details can be found on OUR FORUM.