FTC accuses Chegg of negligence that led to 40M people being hacked / Y-Combinator grad MedCrypt raises $25M / Stone Panda group is attacking organizations in Japan

Plus: Bed Bath and Beyond was hacked; event is being investigated

Inside.com Part of   Network November 01, 2022

Presented by

The FTC has accused Chegg of negligence in its cybersecurity practices, claiming that its negligence led to over 40 million users having their data breached. The accusations are part of a filed legal complaint. More: The alleged negligence led to the users having their data breached in four different hacking campaigns. These campaigns happened between 2017 and 2020. Information stolen included customer names, email addresses, passwords, religion, sexual orientation, disabilities, and parents' income ranges. According to the legal complaint, the company used one login for all compromised databases and failed to use basic security steps such as 2FA. Chegg reportedly also failed to write an official security policy until January 2021 and failed to provide sufficient security training for its employees. Chegg is an ed-tech company that provides digital and physical textbooks, online tutoring, etc. The publically traded company was founded in 2005 and is based in California.

Y-Combinator graduate MedCrypt has raised a $25M Series B round to protect medical devices from being hacked. The company protects devices such as insulin pumps, heart rate monitors, radiology tools, etc. More: MedCrypt helps medical device companies to reach the security levels that the FDA requires for companies in the field. The company aims to tackle three main issues that it believes are present in the market: outdated software, user authentication, and a lack of good cryptography. MedCrypt believes that the 50% increase in cybersecurity attacks in the healthcare sector has created momentum that will boost the efforts of cybersecurity companies that aim to provide solutions for the market, driven largely by a new approach toward cybersecurity by organizations. Intuitive Ventures and Johnson & Johnson Innovation led the funding round. The company is based in San Diego.

A message from SECURITY COMPASS The only secure developer training that is accredited by (ISC)²  Our role-based, language-specific, secure developer training meets developers where they are in their knowledge and learning style to ensure they successfully develop and apply secure coding skills. Go beyond secure coding training. Retain talent, remain competitive, and stay compliant. We offer over 49 courses covering topics including: ● Defending AWS, .NET, Angular, Java, and more ● DevSecOps Fundamentals and DevSecOps for Managers ● Defending Containers, Kubernetes, Docker ● Secure Software Requirements, Design, Testing Explore language-specific, role-based, (ISC)² accredited secure developer training.  Visit our page to browse our curriculum, try a free course, or speak to the team. Browse our curriculum

Chinese threat actor Stone Panda is attacking Japanese organizations with a new malware variant. The hacker group is targeting diplomatic institutions and political think tanks. More: The threat actor, which specializes in cyber espionage, is targeting the institutions with LODEINFO. This malware has been used since at least 2019 and has been constantly updated. Researchers have stated that they've found at least six versions of the malware being used in 2022. Based on the updated TTPs and improvements in the latest version of LODEINFO, such as the implementation of the Vigenere cipher, complex infection flow with fileless malware, partial XOR encryption, C2 communication packets with a unique data structure and variable length, and password-protected documents, it is safe to assume that the threat actor is focused on strengthening the variants' ability to avoid detection. Stone Panda is also known as APT-10, Potassium, Bronze Riverside, and Cicada. The group is believed to be active since 2009.

Bed Bath and Beyond is investigating a hacking incident that happened due to a phishing hacking campaign that targeted an employee. The breach occurred in October, and the company reported the event to the SEC. More: The company believes that no personal data that belongs to its users or employees has been stolen. According to the filing, hackers targeted an employee with a phishing campaign that led them to gain access to hard drive data and to several shared files. This hacking incident was disclosed to the SEC after the company filed for a $150M stock sale offer.

A message from APIS COR Invest early in an industry disruptor today.  Apis Cor is an American construction technology company revolutionizing construction with advanced robots.  Apis Cor is bringing automation to expand the construction industry, utilizing robotic construction technologies that increase productivity to reach this goal.  With 117 Letters of Intent to lease our fourth-generation 3D printing technology from home builders across the country, we are preparing to scale manufacturing of our machines to meet demand and begin delivering units to builders starting in 2023.   It isn’t sci-fi, it’s happening today. After years of extensive experience, Apis Cor has successfully deployed its proven tech to 3D print the Guinness World Record’s largest 3D-printed building on Earth, America’s first commercially permitted building (in Boca Chica, TX) and won top awards at NASA’s Centennial Challenge.  More than 450 people have already invested in Apis Cor and joined us as we disrupt the construction industry. Will you? Invest Now

An Osaka hospital was forced to shut down its services after being hacked. Its digital system is still offline since the morning hours, while the threat actor responsible for the breach is unknown. More: The cyberattack, which happened around 7 a.m. local time, forced the hospital to use paper sheets as medical records. A hospital representative stated that during their consultation with IT contractors, it has now been understood that they've been hit with ransomware. Hackers are demanding the hospital pay a ransom in Bitcoin. In return, hackers have vowed to send back the stolen data.

Quick Hits: This app makes it easy to learn vocab and phrases with lessons, games, videos, podcasts, and more. Plus, for a limited time you can get 55% off.* The National Cyber Security Centre, the U.K.'s federal cybersecurity agency, has stated that 34 million warnings about hacking campaigns have been sent to citizens by its Early Warning Service. The Office of the National Cyber Director is hosting a number of events with leaders from the public and private sectors that aims to create a common framework that will serve as a guideline for tackling cybersecurity challenges that the EV industry faces and will face in the future. Tel Aviv-based company Cylus has named Shao Fei Huang to its advisory board. Cylus is known for developing cybersecurity solutions for the railway industry. A1 Telekom Austria stated that there were 28 million hacking attempts against the company in August 2022 alone, adding that this trend is only expected to increase in the future for the entire industry. Have you been thinking about changing your pup's daily meals for something better? Science-backed Nom Nom offers 50% off a two-week trial specifically for Inside readers..* *This is sponsored content.

Upcoming events at Inside: November 02 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) November 09 - Synthetic data for more efficient, robust and ethical model development - Live AMA with Yashar Behzadi (CEO and Founder of Synthesis AI)* (Register Here) December 07 - Live AMA with Deividi Silva ( Head of Developer Relations at Gun.io) (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass delivers best-practice, role-based, accredited eLearning solutions.

Want to invest early in the future of a 16 trillion-dollar market?

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.