Hackers breach Environment Protection Agency database

Dan Kaplan  August 06, 2012

Thousands of U.S. Environmental Protection Agency (EPA) employees had their personal information exposed through a database breach.

How many victims? 7,800, comprised of 5,100 current employees and 2,700 others.

What type of personal information? Social Security numbers, bank routing numbers and home addresses.

What happened? The hackers were able to compromise a server that stores data related to the Superfund program. They obtained access by tricking an employee to click on an email that contained a malicious attachment.

What was the response? The EPA is choosing to remain coy about the breach, which happened in March, but only was just reported to victims, due to the sensitivity of the information involved. Officials said they took so long to notify affected individuals because they were trying to identify who they were.

Details: The affected server may have been managed by third-party contractors.  

Source: Washington Business Journal, "EPA breach involved program widely supported by contractors," Aug. 3, 2012.
Source-SCMagazine

Apple responds to journalist's iCloud hack

After a reporter said account breaches occurred when an AppleCare technician fell prey to social engineering, the tech giant says, "our own internal policies were not followed completely."

After former Gizmodo reporter Mat Honan's entire digital presence was hacked via a loophole in AppleCare, Apple now says it is looking into how users can reset their account passwords to ensure that their data is protected.

It all began when Honan took to his Tumblr blog on Friday, detailing the events that led to his online life being sabotaged -- with his Google and Twitter accounts being deleted and his MacBook, iPad, and iPhone being wiped clean. He blamed an AppleCare technician for allowing his accounts to be hacked, as well as the tech blog's official feed.

After deliberating over the ways it could have happened on his blog, Honan heard back from Apple.

"Apple takes customer privacy seriously and requires multiple forms of verification before resetting an Apple ID password," Apple spokesperson Natalie Kerris told Wired, where Honan now works. "In this particular case, the customer's data was compromised by a person who had acquired personal information about the customer. In addition, we found that our own internal policies were not followed completely. We are reviewing all of our processes for resetting account passwords to ensure our customers' data is protected."