Threat actors are giving consumers another reason why they would rather fill a cavity than contact customer service.

Last month, LastPass warned its customers about a social engineering campaign that uses fake reviews to circulate a phony customer service number operated by threat actors. The password manager application company said in the Oct. 31 blog post that the reviews follow a similar format, each encouraging users to either go online or dial the trick number to get customer service assistance.

Users who have attempted to dial the bogus number, found across multiple five-star reviews on LastPass’s Chrome Web Store app page, have been greeted by a bad actor who has attempted to direct them to a malicious website.

Not the only one. But LastPass is not the only company that has been leveraged in the fake number scheme. According to BleepingComputer, the dud number has been advertised as a customer service number on Chrome extension reviews, company forums, and Reddit for several companies, such as Roku, Paypal, Netflix, and Verizon.

Threat actors have also been using fake customer service numbers to haggle victims for their information directly. Last month, a user on social media platform Bluesky recalled a time when his partner dialed what was thought to be United Airlines’ customer service number, but was instead a number controlled by a scammer who was on the hunt for banking information. The number was allegedly retrieved from Google’s AI-generated summaries.

Read the rest here.—BM

One in three small or medium-sized businesses has been hit by a cyberattack, you say? No worries…

The average cost of data breach jumped to $4.88 million? Everything’s fine...

Over one-third of employees share sensitive work data with AI tools and don’t tell their employers about it? No problemo, team…

The chill vibes in response to today’s data threats just might be coming from the C-suite.

A survey from Protiviti and Oxford University found that 86% of executives are “confident or extremely confident that their company is doing everything it possibly can to protect customer data.” The study, which polled 250 CEOs, board members, CFOs, and other business leaders, also found that only 8% of respondents are “concerned or extremely concerned about their company’s ability to protect customer and client data over the next five years.”

While the survey creators noted that CEOs are the type to hype and would likely not want to bring attention to poor data-protection practices, Sameer Ansari, managing director and leader of Protiviti’s Security and Privacy Practice at global consulting firm Protiviti, sees some breach-free CEOs as more lucky than good, and some of the security close calls, or “near misses,” don’t reach the execs.

“You may have data that may have been exposed accidentally, through a manual mistake that maybe had a really small impact…It wasn’t a big list of individuals that got released,” Ansari told IT Brew.

Read more here.—BH

Call it a breach, call it a leak, call it whatever—when it comes to third-party vendors and services, misconfiguration presents challenges.

A recent report from Aaron Costello, chief of SaaS security research at AppOmni, revealed that millions of records were left open to the internet through an API misconfiguration of Microsoft Power Pages. Companies and organizations use the SaaS platform to easily work within Microsoft’s systems to build websites.

The data exposures Costello found “are occurring due to a misunderstanding of access controls within Power Pages, and insecure custom code implementations,” he wrote.

Public health. Costello detailed how that misunderstanding led to the leak of millions of records from the UK National Health Service in an interview with IT Brew.

“Over 1.1 million individuals’ private data was exposed,” Costello said. “That includes email addresses, phone numbers, and, in many cases, their home addresses as well.”

Costello added that he hadn’t seen any evidence that the leak was exploited by threat actors or other hostile figures. The central concern, he said, is that vendors and SaaS providers aren’t always on top of making sure that their products are configured correctly. In this case, Microsoft did provide that guidance—but that doesn’t necessarily translate to people taking it to heart.

Keep reading here.—EH