Since 2018, together with colleagues first at VICE Motherboard, and now at TechCrunch, I’ve been publishing an inventory on the finish of the yr highlighting the very best cybersecurity tales reported by different retailers. Cybersecurity, surveillance, and privateness are enormous matters that nobody single publication can cowl successfully by itself. Journalism is by definition aggressive, but additionally a extremely collaborative discipline. That’s why it generally is sensible to level our readers to different publications and their work to study extra about these difficult and sprawling beats.
Without additional ado, listed below are our favourite cybersecurity tales of this yr written by our buddies at rival retailers. — Lorenzo Franceschi-Bicchierai.
In one of many largest and most brazen mass-hacks in latest historical past, hackers this yr raided a whole lot of insecure cloud storage accounts hosted by cloud computing firm Snowflake, relied on by a few of the world’s largest tech and telecom corporations. The hackers then held the large troves of stolen information for ransom. One sufferer of the hacks, AT&T, confirmed that it misplaced the decision and textual content data of “almost all” of AT&T’s 110 million prospects within the breach, accounting for greater than 50 billion name and textual content data.
Days after AT&T went public with information of its breach, unbiased safety reporter Kim Zetter broke the information that AT&T had weeks earlier paid a hacker $370,000 to delete the large cache of stolen telephone data and never publicly launch the info. Zetter’s reporting uncovered a significant piece within the puzzle of who was behind the intrusions — on the time recognized solely as UNC5537 by Mandiant — and who had been later recognized as Connor Moucka and John Binns and indicted for his or her function within the mass-thefts from Snowflake’s buyer accounts. — Zack Whittaker.
Kashmir Hill’s newest investigative report in The New York Times revealed that automakers are sharing shoppers’ driving conduct and habits with information brokers and insurance coverage corporations, which use the info to hike buyer charges and premiums, a dystopian use of a driver’s personal info towards them. For GM car homeowners, drivers are sometimes not knowledgeable that enrolling in its Smart Driver function would routinely end in autos sharing their driving habits with third-parties. The story prompted a congressional inquiry, which revealed that the carmakers bought shoppers’ information in some instances for mere pennies. — Zack Whittaker.
This is only a wild story. If this story was a film — heck, it must be — it might nonetheless be surprising. But the truth that this really occurred is simply unbelievable. Zach Dorfman pulled off an unbelievable feat of reporting right here. Writing about intelligence operations is just not straightforward; by definition, these are supposed to remain secret without end. And this isn’t a type of tales that the intelligence group would secretly be completely satisfied to see on the market. There’s nothing to be proud or completely satisfied right here. I don’t need to spoil this story in any approach, you simply need to learn it. It’s that good. — Lorenzo Franceschi-Bicchierai.
This is just not purely a cybersecurity story, however in some methods crypto has all the time been a part of hacking tradition. Born as a libertarian pipe dream, it’s been clear for a number of years that Bitcoin and all its crypto offshoots don’t have anything to do with what Satoshi Nakamoto, the mysterious inventor of the cryptocurrency and blockchain expertise, imagined again in 2008 in his founding paper on Bitcoin. Now, crypto has change into a device for the far-right to wield their energy, as Charlie Warzel explains very nicely on this piece. — Lorenzo Franceschi-Bicchierai.
Bloomberg’s Katrina Manson received the news that no one else may: drug distributor Cencora paid a $75 million ransom to an extortion gang to not launch delicate private and medical-related information on upwards of round 18 million individuals following an earlier cyberattack. Cencora was hacked in February, however steadfastly and frequently refused to say what number of people had their info stolen — although public filings confirmed upwards of 1.4 million affected people and rising. TechCrunch had been chasing this story concerning the alleged ransom fee for a while (and we weren’t the one ones!) after listening to rumblings that Cencora had paid what’s believed to be the most important ransomware fee thus far. Bloomberg’s Manson received the main points on the bitcoin transactions and confirmed the ransom funds. — Zack Whittaker.
I’ve lined ransomware for years, and whereas the hackers behind these data-theft assaults are sometimes keen to speak, the victims of those assaults usually aren’t so eager to open up. Bloomberg’s Ryan Gallagher achieved the near-impossible by getting the U.Ok.-based supply firm Knights of Old to disclose all a couple of ransomware assault that resulted within the firm shuttering after 158 years in enterprise. Paul Abbott, Knights’ co-owner, spoke frankly concerning the assault, giving readers a glimpse into the devastation attributable to the Russia-linked hacking gang. Abbott revealed how — and why — the corporate determined to not negotiate, ensuing within the publication of greater than 10,000 inner paperwork. This leak, Abbot disclosed, meant the corporate couldn’t safe a mortgage or promote the corporate, forcing it to shut its doorways for good. — Carly Page.
404 Media has completely been killing it within the yr or so after it launched. There have been loads of nice tales however this one stood out for me. Here, Joseph Cox and different journalists obtained the identical dataset, and he neatly determined to concentrate on one main subject in his story: How cellphone location may assist establish individuals visiting abortion clinics. With Donald Trump returning to the White House, and the Republican Party controlling all branches of presidency, it’s seemingly that we are going to see additional challenges to abortion rights and entry, making this sort of surveillance particularly harmful. — Lorenzo Franceschi-Bicchierai.
I’ve been protecting crypto hacks and heists on and off for a number of years now. It is an enchanting world filled with grifters, scammers, hackers — and dogged investigators. One of essentially the most intriguing characters is a person who goes by the deal with ZachXBT. For years, he has been unraveling a few of the most intricate crypto mysteries, hacks, heists, scams and cash laundering operations. This yr, Andy Greenberg at Wired did an incredible job profiling ZachXBT. And even when Greenberg couldn’t reveal the detective’s real-world identification and withheld numerous figuring out info, the story painted a vivid image of the investigator and his motivations. — Lorenzo Franceschi-Bicchierai.
Wired’s Andy Greenberg received the news on one other main China backed-hacking marketing campaign. The eye-opening report, printed in October, reveals how researchers working for Chengdu-based cybersecurity agency at Sichuan Silence and the University of Electronic Science and Technology of China spent years researching vulnerabilities in Sophos firewalls. The vulnerabilities subsequently utilized by Chinese-government backed hacking teams, akin to APT41 and Volt Typhoon, to plant backdoors in Sophos firewalls utilized by organizations around the globe and steal their delicate information. The five-year-long marketing campaign, as additionally detailed by Sophos itself, resulted within the compromise of greater than 80,000 firewall gadgets globally — together with some used within the U.S. authorities. Following Greenberg’s reporting, the U.S. authorities sanctioned the Chinese cybersecurity firm and considered one of its staff for his or her function within the widespread hacking marketing campaign. — Carly Page.
The Salt Typhoon hack of U.S. telephone and web giants won’t solely go down as one of many largest cybersecurity tales of 2024, but additionally as one of many largest hacks in historical past. The Wall Street Journal impressively received the news on this story, reporting in October that Salt Typhoon, a Chinese government-backed hacking group, had penetrated the networks of a swath of U.S. telecom suppliers to entry info from methods the federal authorities makes use of for court-authorized community wiretapping requests. The WSJ’s glorious reporting kickstarted months of follow-ups and prompted motion from the U.S. authorities, which has since urged Americans to change to encrypted messaging apps, akin to Signal, to reduce the danger of getting their communications intercepted. — Carly Page.
KYC, or “know your buyer” checks, are a few of the most relied upon methods that banks and tech corporations use to attempt to affirm it’s in actual fact you they’re coping with. KYC entails your driver’s license, passport, or different type of ID, and checking — to the best diploma doable — the authenticity of the doc. But whereas fakes and forgeries are inevitable, generative AI fashions are rendering these KYC checks solely ineffective. 404 Media explored the underground website the place “neural networks” churn out pretend IDs at velocity, which was an excellent solution to expose how straightforward it’s to generate pretend IDs on the fly which might be able to enabling financial institution fraud and felony cash laundering. The website went offline following 404 Media’s reporting. — Zack Whittaker.
