Automobile manufacturer Toyota recently announced a data breach that may have exposed the emails of up to 300,000 customers for a period of nearly five years. 

Toyota says the breach is the result of a subcontractor posting source code for Toyota’s “T-Connect” app on the software development platform GitHub in December 2017. This code included an access key to the data server that hosted the e-mail addresses and customer management numbers of T-Connect users. The publicly available source code was found on September 15th, 2022, at which time Toyota changed the access key. 

Toyota customers affected by this data breach include T-Connect users who registered their email on the Toyota T-Connect site since July 2017. 

According to Toyota’s announcement and apology no other personal information such as customer names, phone numbers, and credit cards were affected. (Note that this announcement was published in Japanese—you can use your browser to translate.) 

The company further could not confirm whether this information was in fact accessed. However, the company could not deny the possibility that it was at some point during that five-year period. 

Toyota said that it will individually send an apology and notification to the registered email address of any customer whose information may have been leaked.   

I’m a Toyota owner. What should I do about the Toyota T-Connect data leak? 

Any time a data breach occurs, it means that your personal information could end up in the hands of a bad actor. Different pieces of personal information can be more useful to them than others. Some are directly useful, such as a Social Security Number or credit card information because they uniquely identify you. Others are indirectly helpful, like device IDs, browsing history, geolocation information, and internet protocol addresses. On their own, such information will not uniquely identify you. Yet with enough indirect information, and in the right combination, a bad actor could use them to piece together your identity. 

In light of this, there are a few steps you can take to protect yourself in the aftermath of a data breach, which involves a combination of preventative steps and some monitoring on your part. 

Keep an eye out for phishing attacks 

Given that email addresses may have been compromised, Toyota specifically warned its customers about the possibility of phishing attacks and other unsolicited emails that may contain malware or links to malicious sites. While it’s always wise to keep a skeptical eye open for unsolicited messages that ask you for information or that contain attachments you weren’t expecting, it’s particularly important after breaches. If you receive such emails, delete them, and don’t click on any links or attachments.  

Also note that bad actors may launch phishing attacks where they pose as Toyota, all with the aim to steal personal information. Such emails can clearly look like a scam, such as when they include typos, grammatical errors, or sloppy graphics. Others can look far more sophisticated, almost like a legitimate email. Learning how to tell the two apart can take a little skill, and you can check out this quick read so you can spot and protect yourself from phishing scams. 

Consider using comprehensive online protection 

A complete suite of online protection software can offer layers of extra security. In addition to more private and secure time online with a VPN, identity monitoring, and password management, it includes web browser protection that can block malicious and suspicious links that could lead you down the road to malware or a phishing scam—which antivirus protection can’t do alone. Additionally, we offer $1M identity theft coverage and support from a recovery pro, just in case. 

Change your passwords and use a password manager 

As far as passwords go, strong and unique passwords are best, which means never reusing your passwords across different sites and platforms. Using a password manager will help you keep on top of it all, while also storing your passwords securely. Moreover, changing your passwords regularly may make a stolen password worthless because it’s out of date. 

Because so many accounts use an email address as the username, and because email addresses were exposed in the Toyota leak, updating your passwords across your accounts can provide an extra level of protection. 

Enable two-factor authentication 

While a strong and unique password is a good first line of defense, enabling two-factor authentication across your accounts will help your cause by providing an added layer of security. It’s increasingly common to see nowadays, where banks and all manner of online services will only allow access to your accounts after you’ve provided a one-time passcode sent to your email or smartphone. If your accounts support two-factor authentication, enable it. 

Consider using identity monitoring 

An identity monitoring service can monitor everything from email addresses to IDs and phone numbers for signs of breaches so you can take action to secure your accounts before they’re used for identity theft.​ Personal information harvested from data breaches can end up on dark web marketplaces where it’s bought by other bad actors so they can launch their own attacks. McAfee’s monitors the dark web for your personal info and provides early alerts if your data is found on there, an average of 10 months ahead of similar services.​ We also provide guidance to help you act if your information is found. 

Clean up your personal data online 

As mentioned earlier, information stolen in a data breach may indirectly identify you. Yet when pieced together with other information, it can then directly identify you. Cad actors can complete this identity picture puzzle with information provided by data brokers that buy and sell personal information online. However, you can take some control over this. Our Personal Data Cleanup service scans high-risk data broker sites for your personal information and then helps you remove it—which denies bad actors the information they may need to commit identity theft. 

Staying Safe in the Wake of the Toyota Data Leak 

If your personal information gets caught up in a data leak or breach, take the steps to protect yourself. Should that information get into the hands of bad actors, it could lead to follow-on attacks such as phishing attempts, account hacks, and, in extreme cases, identity crime. 

Further, as in the case of Toyota, it can take months or even years for companies to discover leaks and breaches. From there, it can take yet longer before a company announces the leak or breach. Together, that leaves bad actors with plenty of opportunity to commit all kinds of identity crime in the meantime.  

Because of this, taking preventative steps to secure and monitor your identity can help protect you from harm—even if your information wasn’t involved in an attack. With data leaks and breaches of all sizes now commonplace, a proactive stance offers far better protection than reactionary measures taken after the fact. 

The post Toyota Data Breach Exposes Customer Data – What You Can Do to Protect Yourself appeared first on McAfee Blog.

Read More

GitGuardian has added infrastructure-as-code (IaC) scanning to its code security platform to enhance the security of software development. The firm said the new feature will help security and development teams write, maintain, and run secure code, protecting the software development lifecycle (SDLC) against risks like tampering, code leakage and hardcoded credentials. The release reflects a growing industry focus on improving the cybersecurity of software development processes to help better protect widely used resources and supply chains from cyberthreats.

Initial IaC focus on Terraform and AWS, Azure and Google Cloud to follow

In a press release, GitGuardian stated that, while software-defined infrastructure unlocks speed and consistency for engineering teams, it is still fraught with risks. Gartner predicts that at least 99% of cloud security failures will be due to user fault and misconfigurations by 2023. Such errors propagate from code to cloud-native environments, exposing critical workloads and resources on the way, it added.

To read this article in full, please click here

Read More

There are at least four business goals that organizations can achieve by scaling their cybersecurity programs through CIS SecureSuite Membership.

Read More

Everyone visiting Qatar for the World Cup needs to install spyware on their phone.

Everyone travelling to Qatar during the football World Cup will be asked to download two apps called Ehteraz and Hayya.

Briefly, Ehteraz is an covid-19 tracking app, while Hayya is an official World Cup app used to keep track of match tickets and to access the free Metro in Qatar.

In particular, the covid-19 app Ehteraz asks for access to several rights on your mobile., like access to read, delete or change all content on the phone, as well as access to connect to WiFi and Bluetooth, override other apps and prevent the phone from switching off to sleep mode.

The Ehteraz app, which everyone over 18 coming to Qatar must download, also gets a number of other accesses such as an overview of your exact location, the ability to make direct calls via your phone and the ability to disable your screen lock.

The Hayya app does not ask for as much, but also has a number of critical aspects. Among other things, the app asks for access to share your personal information with almost no restrictions. In addition, the Hayya app provides access to determine the phone’s exact location, prevent the device from going into sleep mode, and view the phone’s network connections.

Despite what the article says, I don’t know how mandatory this actually is. I know people who visited Saudi Arabia when that country had a similarly sketchy app requirement. Some of them just didn’t bother downloading the apps, and were never asked about it at the border.

Read More

Gang exploited keyless entry systems to steal vehicles

Read More