Nov 182017

Nick Evans reports:

Sensitive details of many of the ABC’s commercial customers have been exposed in a major data breach, according to a German IT security firm, potentially offering up a “trove of data” on its business activities.

Kromtech Security Centre said yesterday ABC Commercial, the publicly funded broadcaster’s licensing, retail and publishing business, accidentally left sensitive data on its commercial activities exposed for anyone to stumble across.

Read more on The West Australian.

Nov 182017

Rachel Polansky reports:

Dozens of Southwest Floridians are sick and tired of waiting for answers from FEMA after being hit by Hurricane Irma and then, identity thieves.

A month after the NBC2 Investigators exposed a major scheme involving criminals stealing local identities to defraud the federal government, the NBC2 Investigators are finally getting answers from FEMA.

Read more on NBC-2.

Nov 182017

Jan Lee reports:

Ex-students from Xinmin Secondary School received a shock yesterday when they found out that their alma mater had suffered a data breach.

Several told The New Paper they received calls from their former school yesterday, informing them that their names and identity card numbers had been leaked on, self-described as “where you can store any text online for easy sharing”.

When contacted, the school confirmed the incident, saying it was alerted on Sept 28 this year to a data breach of its students’ personal information on the file-sharing website.

Read more on The New Paper.

Nov 172017

Oops. I missed this last week when Xinhua reported:

Police in east China’s Wenzhou City, Zhejiang Province have seized 20 people suspected of stealing more than 300,000 pieces of personal information.

The gang were found to have hacked into servers of over 50 airline company websites since 2016. The leaks included user IDs, passwords and flight information.


Nov 172017

Sam Wildman reports that a Wellingborough, U.K. man who has been linked to TheDarkOverlord has been sentenced to jail for three years, but for crimes that do not unequivocally appear to be the work of the blackhat hacking collective.

“Crafty Cockney,” whose real name is Nathan Wyatt, had pleaded guilty in September to 20 counts of fraud by false representation, two counts of blackmail and one count of possession of an identity document with intent to deceive (a false passport). Among the charges that he confessed to was using his dead stepfather’s credit card for months to make fraudulent purchases.

Selfie of Nathan Wyatt, aka “Crafty Cockney,” taken approximately 5 years ago. Provided by Wyatt.

As I reported last year, on September 24, 2016, Wyatt was arrested on suspicion of Computer Misuse Act offences for allegedly attempting to broker the sale of what he claimed were pictures of Pippa Middleton that had been hacked from her iPhone. He was later released without any charges stemming from that incident, and he never publicly identified who the actual hacker was who had hacked Middleton’s iPhone. He repeatedly denied that he was the hacker.

As Wildman explains, however, once law enforcement seized Wyatt’s computer and other devices, they found evidence of other crimes, including his attempt to extort money from an unnamed law firm for the return of files he had allegedly obtained by using malware. You can read more of Wildman’s coverage on Northamptonshire Telegraph.

The Daily Mail provides some interesting additional details, including that the ransom letter to the law firm was signed “Regards, The Dark Overlords.” It is difficult to imagine the hacking group getting their name wrong, so if that was not a typo by the news outlet, then there may be some reason to wonder whether the extortion attempt really was by the TheDarkOverlord or if it was just Wyatt trying to capitalize on any fear their brand might generate.  Neither Wyatt nor any spokesperson for TheDarkOverlord have ever claimed to this journalist that Wyatt was ever any kind of core member of the hacking collective.

Although Wyatt may or may not have been a core member of TDO, the judge sentencing him seems to have recognized that Wyatt is likely responsible for many more crimes than were charged. According to Richard Spillett’s report in the Daily Mail, Judge Martin Griffiths sounded somewhat skeptical that Wyatt had been held to account for everything: “A rather more sceptical mind would say there was a great deal more to this behaviour than there is in these counts.” He reportedly added: “I consider this was a sophisticated piece of offending by you.”

Wyatt has not been charged criminally in the U.S. (or at least no charges have been made public as yet), but he has been linked to hacks by TheDarkOverlord of one or more Georgia clinics.

At various times, Wyatt told this journalist about a phone call he was supposed to make to a hacking victim to pressure him to pay the ransom demanded by TheDarkOverlord. As best as this journalist could determine, that victim was Athens Orthopedic Clinic. But did Wyatt actually make the phone call or not?

At one point, he claimed to this journalist that although he was supposed to make the call and had told his contact from TheDarkOverlord that he had made it, he hadn’t made it. was never able to obtain any direct communication with the clinic owner, and therefore does not know whether he claimed to have received any corresponding call, but here is the recording of the call that Wyatt informed me was his work. It was uploaded to YouTube on July 10, 2016.

Wyatt had also linked to the recording in a post on a now-defunct AlphaBay forum.

In addition to allegedly making a call to pressure a U.S. hacking victim into paying ransom, Wyatt allegedly served other functions for TheDarkOverlord, including setting up bank accounts in the U.K. where U.S. victims would then wire ransom payments.

Somewhat amazingly, perhaps, information obtained by revealed that Wyatt actually opened at least one of those accounts in 2016 using his real name. He also seems to have used his live-in partner’s real name for another one of the accounts. Although she, too, had been charged criminally in some matters, his partner was later acquitted after no evidence was reportedly produced by prosecutors at trial.

It is not clear whether Wyatt might be eligible for parole at some point or if he will have to serve the entire three years in jail.  Perhaps someone more familiar with the U.K. criminal justice system can address that question. And as to whether he will ever face charges over any U.S. crimes, I guess we’ll all have to just wait and see.

Correction: A previous version of this report indicated that the owner of Athens Orthopedic is named James Kayo. That was an error, and apologizes for the confusion. Kayo Elliott is the CEO of the clinic.