Ameritrade reveals data breach involving e-mails
245468
OMAHA, Neb. - Online brokerage TD Ameritrade Holding Corp. said yesterday one of its databases was hacked and contact information for its more than 6.3 million customers was stolen.
446397
A money transfer firm broke EU privacy laws by secretly giving information to the US authorities, an inquiry finds.
640382
A data breach that exposed personal information on more than 6.2 million TD Ameritrade customers may have occurred in 2006, about a year before the brokerage disclosed the incident.
629636
The FDIC on Friday issued an alert  about an increasingly common e-mail scam designed to steal  personal information and money from millions of unwary  consumers.
384843
(InfoWorld) - Stolen bank account numbers are commanding the highest price in an underground trade of personal details stolen by hackers, according to a survey released Monday by security vendor Symantec. Bank account details command prices of up to $400, while credit card details sell for between $0.50 and $5, e-mail passwords from $1 to $350 each, and e-mail addresses from $2 to $4 per megabyte, according to Symantec's Internet Security Threat Report, which covers the first half of the year. The online trade in stolen details highlights the commercialization ofÂ Internet crime, with gangs researching, developing and marketing nefarious software for other criminals, said William Beer, director of security practice for Europe. There has been an increase in the quality and quantity of malicious code sold on the Internet, driven by well-funded international groups of criminals, Beer said. The hackers are obtaining the information through increasingly targeted attacks on computers that often involve collecting personal information about a person from social networks such as MySpace or Facebook, Beer said. With specific personal details, the hacker can construct a personalized e-mail that entices the victim to either click on an attachment containing malicious software or visit a phishing site. Symantec is also seeing multistage attacks where the attacker places a small piece of software on a target computer that then acts as a beachhead for downloading other software. "The end user will not even notice the attacks have taken place because it's a very gradual process," Beer said. On the spam front, Symantec said it has noticed a 30 percent drop in so-called "pump-and-dump" spam, where e-mails touting penny stocks are sent out, causing a rise in the stock price before the perpetrators sell the stock early. The decline can be attributed to aÂ crackdown by the U.S. Securities and Exchange Commission. Also down is the percentage of spam with images, which started as a highly effective way to bypass spam filters but is now less so. About 27 percent of the spam analyzed by Symantec between April and May contained images, down from 50 percent the first week in January, Symantec said. The decrease is due to an improvement in spam filters as well as the decline in pump-and-dump spam, which often used images, the company said.
740230
The breach at TJX Companies occurred almost a full-year earlier than first thought -- and compromised more payment card data than previously believed, the company said.
751203
Gmail Security Flaw Discovered NewsFactor Network
465593
A sophisticated multistage attack by identity thieves appears to have significantly compromised eBay and perhaps PayPal as well.
348960
The huge losses reported by French bank Soci?t? G?n?rale, apparently caused by a rogue trader with inside knowledge of the bank's procedures, don't necessarily point to an IT systems failure but rather to poor management of those systems, analysts say.The bank has accused 31-year-old employee Jerome Kerviel of creating a fraudulent trading position in the bank's computers that ultimately caused it to lose around ?4.9 billion ($7.3 billion).Kerviel achieved this by, among other things, misappropriating computer passwords, the bank said. It has revealed few other technical details of what caused the losses.Management of passwords, including rescinding the old passwords of employees who move to different positions within the bank, or modifying the level of access those passwords allow, is often a task given to the lowest-level IT worker."It's dull and routine 99 percent of the time, but a vital backstop," said Bob McDowall, senior analyst at the TowerGroup. Senior IT managers should conduct more frequent reviews of password policies, he said.In some cases, it may not have been the security of the passwords themselves that posed a problem, but rather the access those passwords allowed, said Ian Walden, professor of information and communications law at Queen Mary, University of London.Organizations tend to think of access as being binary in nature: you get access to it all, or you don't, Walden said. In reality, there are many more levels of access. "In modern, complicated systems, the granularity has to be much more sophisticated."To make the best use of systems with advanced access controls, the IT department must have a thorough understanding of how the business works and where there is risk.IT departments and business managers have yet to find a way to wrap security into business processes so it is not an impediment, Walden said."IT in a company is not given a sufficient status," Walden said. "What's shocking is you would have thought that the financial sector was more sophisticated than this, but it still tends to be the case that security is an add-on and a block, something you've got to live with but you don't have to like, rather than being viewed as an integral part of the business structure."Workers should be able to do their job without having to share passwords when someone goes on holiday, and the IT department should not make it harder for people to perform their duties, Walden said.In one extreme example at telecommunications company BT, one employee didn't have the right to use a computer at all, but he found it helped him do his job, Walden said."By the time he was found, he had 90 passwords of different employees," Walden said.It's possible that financial institutions could use biometric systems, such as fingerprint scanners, to provider an added layer of security, McDowall said. Those systems, however, are expensive. Also, the sometimes-finicky fingerprint scanners may not be appropriate in a frantic trading environment, McDowall said.Questions remain about how Kerviel's losses could be so high given his job as relatively low-level trader. But Kerviel's career progression in 2005 from the bank's back office to the front office -- where he would have had access to client accounts -- is also troubling since he would have gained greater knowledge on the bank's inner controls, McDowall said.As an arbitrage trader, Kerviel made money off price differences between different financial products. Soci?t? G?n?rale said Kerviel balanced real and fake trades in order to avoid setting off internal alarms.Kerviel has been described in some press reports as a computer genius. However, most attackers used unsophisticated methods for exploiting systemic vulnerabilities in applications, processes and procedures, according to the 2005 "Insider Threat Study" by Carnegie Mellon Software Engineering Institute.That report notes that sophisticated tools are also used in some attacks, which would demand that internal financial systems need to be designed on a more defensive footing.Programmers should code under the assumption that a hacker or employee will use every means in order to break in, said Ben Rothke, senior security consultant at BT's International Network Services."The underlying issue is that many systems are designed to stop honest people from making mistakes, but do not take into account those with malicious intent," Rothke said.It makes insider jobs one of the toughest to defend against. The psychological profile of an insider tends to be a disgruntled employee who feels wronged by the company, according to the Insider Threat Report.That in turn can lead to a suspicious behavior such as staying late at work, which paradoxically might only signal a committed employee."It's always the insider," Rothke said. "It's often harder to steal $10,000 from a bank than $10 million."
359132
Hackers got into a database containing the Social Security numbers of
156142
A [major spam outbreak] hit the Internet Wednesday causing the stock it was pumping to jump significantly in trading volume, according to communications security company IronPort.
145844
SociÃ©tÃ© GÃ©nÃ©rale said a junior trader who racked up more than $7 billion in losses misused computer access codes and falsified documents.
304095
TD Ameritrade warned customers Friday that its client database suffered a security breach, potentially putting their social security numbers and trading information at risk.
643896
P2P user hygiene found lacking Social security numbers and other sensitive information belonging to more than 5,000 customers of ABN Amro Mortgage Group have been leaked onto the BearShare file-sharing network by a former employee, according to news reports.â¦
281444
An Eastern European cybercrime gang hacked into seven U.S. brokerages as part of a stock manipulation scheme that netted it millions of dollars.
586830
(InfoWorld) - Three U.S. men and one man living in France have pleaded guilty to charges related to a stock manipulation scheme that included sending out tens of millions of spam messages to pump up the stock value of 15 companies, the U.S. Department of Justice said Thursday. The four men cost investors more than $20 million in their so-called pump-and-dump scheme, the DOJ said. Michael Saquella, also known as Michael Paloma, 47, of Mesa, Arizona., pleaded guilty in U.S. District Court for the Eastern District of Virginia in Alexandria on Aug. 20. Lawrence J. Kaplan, 63, of Scottsdale, Arizona, pleaded guilty on July 25, in Alexandria to similar charges. Henry "Hank" J. Zemla, 38, of Harris Township, Michigan, also pleaded guilty in federal court in Alexandria on July 20. The three defendants are scheduled to be sentenced between late November and early February. Saquella pleaded guilty to a criminal information charging him with one count of conspiracy to commit securities fraud and one count of electronic mail fraud involving 15 publicly traded companies. Kaplan pleaded guilty to a criminal information charging him with one count of conspiracy to commit securities fraud involving 14 of these companies, and Zemla pleaded guilty to a criminal information charging him with one count of conspiracy to commit securities fraud involving one of the companies. The plea agreements for all three defendants were unsealed Thursday. The scheme involved stocks from companies including eDollars, Xtreme Technologies, and PokerBook Gaming. Justin Medlin, 26, of Paris, also pleaded guilty in federal court in Alexandria on Aug. 20 to a criminal information charging him with one count of electronic mail fraud and one count of conspiracy to commit securities fraud and electronic mail fraud involving seven of the companies. Medlin's plea agreement was unsealed Thursday. He will be sentenced on Nov. 30. The maximum penalties for each of the fraud charges is five years in prison and a $250,000 fine. The stock manipulation schemes generally followed a similar pattern, the DOJ said. The defendants generally solicited small, privately held companies that needed to raise money. One of the defendants would offer to help the company raise significant money through the sale of the company's stock, and then the defendants would list the company's shares on the Pink Sheets, a price quotation system primarily used for trading small companies' stocks. The group of defendants would then gain control of a majority of the stock of the company, the DOJ said. The co-conspirators then engaged in deceptive and manipulative trading practices to boost the price and volume of the company's stock, the DOJ said. In some cases, members of the conspiracy encouraged investors to purchase companies' stock by giving the investors free-trading shares in return for buying blocks of shares at agreed-upon prices, thereby creating the illusion of trading volume and active investor interest. In other instances, members of the conspiracy bought and sold shares of the companies' stock between and among themselves to give the appearance of investor interest, the DOJ said. The co-conspirators also falsely manipulated the price and volume of each company's stock by making materially false and misleading statements in news releases and in spam e-mails distributed by Medlin and other spammers to tens of millions of U.S. e-mail addresses, in an effort to create artificial demand for the companies' stock, the DOJ said. In related actions, the U.S. Securities and Exchange Commission has filed civil charges against Saquella and Kaplan for their part in the schemes to manipulate the price and volume of the companies' securities. Three other defendants, Steven P. Luscko, Gregory A. Neu, and Brian G. Brunette, have pleaded guilty and have been sentenced in federal court in Alexandria for their roles in related stock manipulation schemes. Luscko and Neu were each sentenced to five years in prison and Brunette was sentenced to one year in prison.
267592
(InfoWorld) - The Securities and Exchange Commission has taken the drastic step of suspending trading in shares of 35 companies whose stocks have frequently been touted in mass spam campaigns. SEC officials said on Feb. 8 that the firms involved -- none of which are household names -- have been the subject of repeated spam efforts meant to drive up trading of their securities and, subsequently, the value of the companies themselves. The trading bans will last for 10 days, after which shares in the involved companies will be unlocked -- unless the SEC's ongoing investigation proves any of the firms were involved in the e-mail schemes. While the ban might seem unfair to the businesses involved, especially if their names and securities were merely selected by scammers looking for penny stocks to inflate in so-called pump-and-dump operations, SEC officials said that in each business's case, there were sufficient questions raised regarding the "adequacy and accuracy" of information being advertised about the companies. Criminals have increasingly begun using spam to drive up interest in cheap stocks over the last several years. Before sending out mass messages about a specific firm, the individuals buy stock in the companies in the expectation that, with their e-mails, they can convince other people to purchase shares. When prices of the shares involved rise, the schemers sell off their own holdings, thus the pump-and-dump moniker. The spam messages, which often feature subject lines such as "Fast Money," have become one of the types of unwanted e-mail most frequently delivered to inboxes over the last year, alongside advertisements for prescription medications. Whenever misleading information is being widely distributed about a firm whose securities are traded, the SEC takes such actions, an agency representative said. "All we can say is that we suspend trading any time we think misinformation about specific securities is being reported," said Helene Glotzer, an SEC spokeswoman. "We're not making a statement that these companies themselves were behind the misstatements, but if the information is out there we feel it is important to let the investing public know; we'll continue our investigation, and if it is appropriate to take action against any of the companies, that is what we will do." The suspensions are part of an SEC initiative known as Operation Spamalot, which was launched specifically to shield investors from spam e-mail "hyping" small company stocks. SEC officials said that anyone who has received such e-mail will recognize the names of the companies who were suspended, as they are among the most frequently cited businesses in securities-related spam campaigns. The messages typically advertise some new product or impending deal that will increase the value of the companies and encourage investors to buy their low-priced securities, which are usually penny stocks. For instance, among the companies whose shares were suspended is Apparel Manufacturing Associates, a Bloomfield, Conn.-based firm that markets itself as a management and development company focused on the fashion arena. The SEC said that on Friday, Dec. 15, 2006, shares in Apparel Manufacturing closed at 6 cents, on a trading volume of 3,500 shares. After a weekend-long spam campaign using e-mails about the company advertising "huge news" that encouraged investors to "get in before the wire," trading volume in the stock rose to 484,568 shares on Monday, Dec. 18, with the price of the stock rising to more than 19 cents a share. The agency said that two days later the price had climbed to 45 cents per share, but one week after, Apparel Manufacturing's share price had fallen to 10 cents on trading volume of 65,350 shares. Calls to the company seeking comment on the stock suspension were not immediately returned. If the SEC investigation finds no link between the companies involved and the spam campaigns, their shares will be released for trading on March 21, 2007. SEC officials noted that the suspensions were all handed out to companies that are not subject to the SEC reporting requirements and whose shares are not listed on any exchange or on the OTC Bulletin Board. This means that brokers posting quotations for the purchase and sale of the securities are not required to conduct due diligence regarding the issuers, according to the agency. The 35 companies whose trading was suspended by the SEC are: Advanced Powerline Technologies, America Asia Petroleum, Amerossi International Group, Apparel Manufacturing Associates, Asgard Holdings, Biogenerics, China Gold, CTR Investments & Consulting, DC Brands International, Equal Trading, Equitable Mining, Espion International, Goldmark Industries, GroFeed, Healtheuniverse, Interlink Global, Investigative Services Agencies, iPackets International, Koko Petroleum, Leatt Corporation, LOM Logistics, Modern Energy, National Healthcare Logistics, Presidents Financial, Red Truck Entertainment, Relay Capital, Rodedawg International Industries, Rouchon Industries, Software Effective Solutions, Solucorp Industries, Sports-stuff.com, UBA Technology, Wataire Industries, WayPoint Biomedical Holdings, and Wineco Productions.