ChainCatcher news, according to TechCrunch, U.S. Bitcoin ATM operator Byte Federal has stated that in a recent hacking incident, the personal data of thousands of customers may have been compromised.Based in Florida, Byte Federal indicated in documents submitted to the Maine Attorney General that hackers attempted to access the data of 58,000 customers, including names, addresses, phone numbers, government-issued IDs, social security numbers, transaction activity, and user photos.The company reported that the breach occurred on September 30 and was discovered by Byte Federal on November 18. The company stated that an anonymous attacker exploited a vulnerability in third-party software to gain access to the company's network. The company mentioned in a blog post in November that the vulnerability existed in the developer platform GitLab.Byte Federal operates over 1,200 Bitcoin ATMs (electronic kiosks that allow you to buy and sell cryptocurrency) across the United States, and the company stated that it has performed a hard reset on all customer accounts and updated its internal passwords.

ChainCatcher news, Fidelity recently submitted a document to the Maine Attorney General stating that 77,099 of its customers were affected by a data breach, which is just a small portion of its 51.5 million customer base.It stated that between August 17 and 19, an attacker used two recently established customer accounts to gain access to customer names and other personal identifiers. On August 19, when Fidelity first discovered the breach, unauthorized access was terminated.The company stated that it has received assistance from "external security experts" to address the issue. Fidelity emphasized that no third party accessed any Fidelity accounts.Fidelity stated that it will provide affected users with two years of free credit monitoring and identity recovery services, "to detect any unusual activity that may affect users' personal financial status."

ChainCatcher news, according to a report by Sina Finance, the Irish Data Protection Commission (DPC) has fined Meta Platforms (META.US), the parent company of Facebook, €91 million (approximately $102 million) following an investigation into password storage at its Irish subsidiary, according to a statement from the regulatory agency.The owner of Facebook had previously notified the Data Protection Commission that it had inadvertently stored certain passwords of some social media users in "plain text" within its internal systems, without encryption protection or measures, prompting the Commission to begin an investigation into the password leak incident in April 2019.Last year, the European Commission accused the tech giant of transferring user data to the United States and imposed fines of up to €1.2 billion (approximately $1.3 billion), and this fine can be seen as a supplement to the fines imposed by the European Commission last year.

ChainCatcher news, according to Decrypt, a post on a dark web forum claims to have leaked personal data of 12.8 million Binance users, allegedly including sensitive information such as names, email addresses, phone numbers, birthdays, and actual addresses. However, Binance claims this is a scam.A user named "FireBear" claimed on a leak-related forum on Monday that they obtained a database containing Binance users' personal information, which was allegedly leaked in August. The post claims that the leaked data includes Binance users' last names, first names, emails, phone numbers, birthdays, addresses, and postal codes, and the poster provided a blurred sample of the so-called data and offered to sell this information "partially or fully." The poster invited interested parties to contact them directly and warned that this sensitive data could be misused.In response, a Binance spokesperson stated, "This is false. Our security team has investigated these claims, and we can confirm this is not a Binance data breach." Nevertheless, cybersecurity experts warn that such false information could trigger phishing attacks and account takeovers, advising users to enable two-factor authentication and remain vigilant against suspicious communications.

ChainCatcher news, the blockchain identity platform Fractal ID announced that on July 14, 2024, one of its engineers detected a potential data breach in the Fractal ID system. An unauthorized third party accessed an operator's account and ran an API script to access users' personal data. The Fractal ID team noticed the attack and took measures to log the attacker out of the system.The attacker gained access to data from approximately 0.5% of the Fractal ID user base. The potentially affected information includes details from Fractal ID user profiles, which may include names, email addresses, wallet addresses, phone numbers, physical addresses, as well as images and photos of uploaded documents.Fractal ID immediately took steps to mitigate the impact of this breach and implemented additional security measures, and also contacted relevant data protection authorities and cybercrime police departments. The breach was contained within the Fractal ID environment and did not affect any customer systems or products using its services.

ChainCatcher news, according to Cointelegraph, Coinbase denies that its customer data has suffered any breaches in response to the credential leak incident involving compliance platform Au10tix. Au10tix stated that although the credentials were leaked, there is currently no evidence that the data has been misused.Reports indicate that these credentials could allow hackers to access sensitive user information, such as names, birth dates, and driver's license images. Au10tix has removed the relevant credentials and strengthened security measures to prevent similar incidents from occurring again. Coinbase has not confirmed whether it uses Au10tix to store customer data but insists that no data breaches have been found at this time.

ChainCatcher message, hackers are selling the personal information of Hong Kong residents on the dark web and have posted sample data on the forum BreachForums, claiming that the personal data of Hong Kong residents related to the Hong Kong SAR Government's Home Affairs Department and border control has been leaked, including phone numbers, full names, ID card numbers, and addresses, and that the data was leaked by the Home Affairs Department. Each set of 10,000 records is priced at $1,000, while 100,000 records are sold for $5,000, with transactions required to be in virtual currency.The Hong Kong Home Affairs Department stated that there are no signs of any data being hacked or stolen, nor any data leakage, and has reported the matter to the police; the Hong Kong Privacy Commissioner’s Office also indicated that it has not received any reports of data leakage incidents from relevant departments.

ChainCatcher news, according to market news, the cryptocurrency exchange platform Bitfinex has experienced a data breach, including 2.5 TB of data and information on 400,000 customers.

ChainCatcher message, Shenfish stated on social media that cloud input methods with up to one billion users may have leaked input content. If users have entered mnemonic phrases or other sensitive information through any of the following cloud input methods, please take immediate action to reduce risks.This includes nine manufacturers: Baidu, Honor, Huawei, iFlytek, OPPO, Samsung, Tencent, and analyzes whether their process of sending user input content to the cloud contains security flaws.The analysis results indicate that among the nine manufacturers, eight input method software contain serious vulnerabilities, allowing us to fully crack the encryption methods designed by manufacturers to protect user input content. Some manufacturers also did not use any encryption methods to protect user input content.Based on this study and the vulnerabilities found in our previous research on Sogou Input Method, we estimate that up to one billion users are affected by these vulnerabilities.

ChainCatcher news, Spartan Group Managing Partner Kelvin Koh revealed that while trading on a major centralized cryptocurrency exchange, they discovered that the exchange leaked their short position information to certain contacts within the industry.He stated that this is a serious violation of client confidentiality, and therefore they will terminate trading activities on this exchange.Kelvin Koh expressed that what is even more shocking about this incident is that this information was easily shared. If any random employee of the exchange can access client trading positions and share them with random parties, it indicates that the exchange has not implemented appropriate controls. Furthermore, as one of the largest centralized exchanges, he called for stricter regulation of centralized exchanges.

ChainCatcher news, Coinbase has been fined 1 million rubles (nearly $11,000) by a Moscow court for failing to localize data of its Russian customers, citing its non-compliance with regulations protecting the personal information of Russian users.It is reported that this violation is attributed to Coinbase's European branch, Coinbase Ireland Ltd. Additionally, Airbnb was fined 6 million rubles ($65,000) for similar violations, UPS was fined 3 million rubles, and Spotify was fined 6 million rubles. In response, Coinbase's Chief Legal Officer Paul Grewal stated that Coinbase remains firm in its decision not to localize customer data in Russia.

ChainCatcher news, on-chain analyst ZachXBT tweeted that the crypto payment app Strike stated in an email that the data breach was likely caused by a third-party vendor. Previously, ZachXBT indicated that there was a data breach involving Strike-related users, but Strike denied it, stating there is no evidence that Strike was attacked. ZachXBT stated that the leaked data suggests that Strike is misleading people and is not trustworthy.

ChainCatcher news, Nansen stated that if users received a notification email, it would specify what information was leaked, such as only the email address being compromised, rather than password hashes or wallet information. If users did not receive an email, they should not be affected.ChainCatcher previously reported that Nansen claimed a third-party vendor was attacked, resulting in the leakage of some user data, and affected users have been notified via email to reset their passwords.

ChainCatcher message, Nansen stated on its social platform that on September 20, it was attacked due to a vulnerability in a third-party vendor, resulting in a data leak of some Nansen users. Nansen has promptly organized unauthorized access and immediately launched an investigation. According to preliminary investigations, 6.8% of Nansen users were affected, with their email addresses leaked, and a small portion of users had their password hashes leaked. Additionally, on-chain addresses of some groups were also leaked.As a security precaution, Nansen has requested affected users to reset their passwords via the email support@nansen.ai between 5 PM and 9 PM (UTC time) on September 21.

ChainCatcher news, the bankrupt crypto lending platform BlockFi stated on its social media that the attack on the bankruptcy claims agent Kroll also led to the leak of some customer data from BlockFi, but BlockFi's internal systems and customer funds were not affected.BlockFi reminds users to upgrade their security measures and be vigilant against scams such as phishing emails.

ChainCatcher message, friend.tech's official response on social media regarding "data leakage" claims that the situation described in the reports is merely someone scraping its public API, showing the correlation between public wallet addresses and public Twitter usernames. The term "data leakage" is akin to saying that someone can attack users by viewing their public Twitter information, which is irresponsible reporting.

ChainCatcher news, the on-chain data monitoring platform Spot on Chain posted on social media that although friend.tech is developing rapidly, the project generated 2,953 ETH (approximately 5 million USD) in fee revenue in just 11 days, and the total value of current user shares has reached 4,435 ETH (approximately 7.4 million USD).However, the project has issues with API data leaks and the ability to buy and sell shares from the contract without an invitation code. From the contract code perspective, the invitation code and application have no effect on the contract, and users can buy and sell directly on Etherscan by linking MetaMask.

ChainCatcher news, the Federal Bureau of Investigation (FBI) is investigating the 3Commas data breach. A victim group of 3Commas, consisting of about 60 members, had previously contacted the U.S. Secret Service and other law enforcement agencies, with the group's leader stating that their total losses exceed $20 million.It is reported that 100,000 Binance and KuCoin API keys associated with 3Commas were leaked, and a 3Commas spokesperson confirmed this news, emphasizing that during the internal investigation, there was no evidence that 3Commas employees were involved in the attack on the API data. (source link)

ChainCatcher news, at today's NIO DAY 2022 media face-to-face, NIO CEO Li Bin stated that NIO can indeed do better. This data is from before August last year and is not related to recent hacker attacks. A report has been filed, and communication with regulatory authorities has been initiated immediately. He expressed great indignation at such incidents. He said: "I oppose Bitcoin, as it makes such ransomware incidents very easy, and reaching a compromise would set a very bad precedent. The losses incurred by users will be held accountable, even if the company goes bankrupt, we will not compromise."Previously, NIO's Chief Information Security Scientist and Head of the Information Security Committee, Lu Long, announced on December 20 in the official NIO community that on December 11, 2022, NIO received an external email claiming to possess internal NIO data and demanding a ransom of 2.25 million dollars in equivalent Bitcoin for the leaked data. (Source link)

According to Chain Catcher news and reported by The Guardian, Australia's second-largest telecommunications company, Optus, has experienced a massive user data breach. One attacker claims to possess relevant information, including detailed data of 11.2 million Optus customers, such as user names, birth dates, phone numbers, email addresses, home addresses, as well as passport and driver's license numbers. They also released samples of two customers' information and demanded 1 million dollars in Monero. (The Guardian)