AT&T Reveals Data Breach, Outlook Zero-Click Vulnerability: Your Cybersecurity Roundup
AT&T Reveals Massive Data Breach Exposing Call and Text Records
AT&T, a major telecommunications company, has disclosed a significant data breach that exposed call and text message records of nearly all its cellular network customers. While the content of these communications remained secure, the breach compromised metadata, including phone numbers, which could potentially be used to identify individuals and reveal sensitive patterns of behaviour.
The breach occurred in April 2024 when hackers unlawfully accessed AT&T call logs stored on a third-party cloud platform. The stolen data spans from May 1 to October 31, 2022, and includes records from January 2, 2023. Although AT&T claims no personal information was accessed, experts warn that the stolen metadata could still be used to identify individuals and expose their activities.
The Justice Department, FBI, and FCC have launched investigations into the breach. Cybersecurity experts have raised concerns about the potential national security implications of this massive data leak, comparing it to the Edward Snowden revelations about the NSA’s bulk collection of metadata.
Evolve Bank & Trust Hit by Ransomware, Millions of Customers Affected
Evolve Bank & Trust, a major U.S. banking provider suffered a ransomware attack in February that compromised the personal data of over 7.6 million customers. The attack, attributed to the Russia-linked LockBit gang, exposed names, social security numbers, bank account details, and contact information. Evolve discovered the breach in May but refused to pay the ransom, leading to the data being published on the dark web. The incident has also impacted customers of Evolve’s fintech partners, including Affirm, Wise, and Mercury.
Microsoft Outlook Zero-Click Vulnerability CVE-2024-38021 Patched
Microsoft has recently addressed a critical zero-click remote code execution (RCE) vulnerability, CVE-2024-38021, affecting various Microsoft Outlook applications. This flaw, discovered by Morphisec, allowed attackers to execute commands without user authentication, making it a high-risk vulnerability. While Microsoft classified it as “Important,” Morphisec urged a “Critical” rating due to its potential impact.
Though complex, this vulnerability could be exploited alongside others to compromise systems. The vulnerability was reported in April and patched in July, highlighting the importance of timely updates.
To mitigate risks, organizations are advised to install the latest Microsoft Outlook and Office patches immediately and implement robust email security practices. This includes disabling automatic previews and educating users about the dangers of opening emails from unknown sources.
