Here’s the thing about cybersecurity: It never stops, and it never sleeps. So when someone decides to take a few days off to rest and recharge, something is going to happen while you’re not looking. For me, that was last week, when I took a few vacation days, and news broke of a PHP vulnerability so significant that the NSA suggested sites just go offline until they could implement a fix.
Many thanks to my colleague Kim Key for filling in while I was out, and especially for highlighting the massive 11-million-person Burger King Japan breach, which is a great reminder to uninstall those fast food apps on your phone: Sure, they may come with nice discounts and rewards, but the data they ask for in return isn’t worth it. And if you haven’t had a chance to check out Kim’s incredible story on how scams are increasingly draining the savings of older adults, including one nurse who lost more than $400k to a scammer posing as Amazon, go read it now. Scams are the new security frontier, and AI is making it easier to build convincing emails, websites, and entire campaigns.
In other news, a huge Capcom breach affected more than 11 million people. I got hit by this one myself, and when I looked over the notification that Capcom shared, I was struck by how virtually every jurisdiction had email addresses to reach out to with questions (in Japan, there’s even a phone number!). Here in the US? We get a link to an FAQ website; that’s it.
Let’s see what else is going on in the infosec world this week.
Hacktivists Leak Data on 41,000 Department of Homeland Security Employees
It’s been a rough few months for security teams at US government agencies. Last month ShinyHunters hit the FBI, stealing data on, according to the leak, “almost all” agents. This week, according to Cyberscoop, a different group called the Department of Peace, working with a WikiLeaks-style organization called Distributed Denial of Secrets (responsible for the 2020 BlueLeaks dump of 269GB of law enforcement data), just published employee information for thousands of DHS employees, including many working on trying to uncover leakers (including those working on getting to the bottom of BlueLeaks). The data was, as with many breaches like this, obtained by exploiting a vulnerability in a third-party authentication tool, in this case Okta, which has had its own share of security woes.
According to a representative of the Department of Peace who spoke with CyberScoop, the leak was in response to ICE activities and promises from DHS secretary Markwayne Mullin to increase enforcement actions around the country. Meanwhile, the data remains online, and this is another entry in DHS’s history of security breaches affecting employees.
Discord Will Soon Let Anyone Find Public Server Messages Through Google
Buckle up, Discord users: You might want to keep an eye on your privacy settings. This week, the company announced that it would begin allowing messages posted on public servers to be indexed by search engines starting November 16, which also means they’ll appear in AI overviews and LLM responses. Dexerto covered the news and included instructions on how to opt out.
On its face, it’s not necessarily a bad thing: The goal is to make those results more useful as people post news, fixes, and troubleshooting tips for everything from popular video games to commercial software in public Discord servers. The goal, according to the company, is to treat public Discord servers, the kind you can find in Discord’s own server directory or ones you can join without using an invite link, like old web forums, which have always been indexable and full of useful information. On the other hand, those servers offer a valuable trove of personal data, ready for lucrative ventures such as AI training and search engine optimization. So if you don’t particularly want your Discord messages easily searchable, you might want to opt out.
To do so, go to your Discord settings, select Data and Privacy, and under How Discord Uses My Data, toggle off the option labeled Show my message content from discoverable channels on web pages. The option may not be there immediately; it’s rolling out over the next month or so, so if you don’t see it now, check back.
Oh, and something worth noting: If you’re in the EU, you don’t have to worry about it. The feature is opt-out by default there, thanks to the EU’s privacy regulations.
Back in 2016, Meta (Facebook at the time) shared users’ personal data with third parties without their consent, including a marketing and consulting firm called Cambridge Analytica. That data subsequently leaked and generated headlines around the globe. You’ve probably heard the story before, but it was one of the first major data privacy cases in the US. Since then, Facebook changed its name to Meta, and Cambridge Analytica has shut down entirely. Meta has faced several lawsuits over the issue, many of which are ongoing, and this week, according to Security Affairs, one of them ended with a New Mexico judge ordering the company to pay $25 billion in penalties.
Meta has already said it will appeal, but the judgment is noteworthy for being huge by most measures (if potentially insignificant to a company worth close to $2 trillion and earning over $200 billion in annual revenue), but also being an example of how more courts (and juries) want real accountability from companies for data breaches and illegal surveillance. It’s also important to note that New Mexico wasn’t part of the $18 billion settlement announced back in August, so we’ll have to see where the appeals on this one land in the coming years.
Recommended by Our Editors
Ask Our Expert: How Can I Tell If My PC Has Been Hacked?
Do you have a question about online privacy or security? I’m here to help! You can submit your question here, and I may answer it in an upcoming SecurityWatch column and newsletter. If you’re not subscribed to the newsletter, head here to sign up, and check back each week for the latest updates from PCMag’s security team. Now, on to this week’s question!
Aurore asks: “How can I find out if my computer has been hijacked or compromised?”
Hi Aurore, thanks for your question! Often, we wonder whether our computer has been hacked or compromised when we experience performance issues or notice odd behavior. You didn’t mention that part, but if that’s the case and your PC is acting up, it could be your first warning sign that something is amiss. That said, unexpected bugs or app crashes don’t always mean someone’s using your PC without your knowledge.
Thankfully, it’s not too difficult to determine if your PC has been compromised with some kind of malware. We have a list of seven signs your PC might have malware right here, along with tips to get rid of it. So if you’re experiencing strange behavior like random pop-up ads, your web searches getting redirected, or alert messages from apps you don’t recognize, your computer could have malware, or alternatively spyware, which doesn’t aim to take over your PC so much as extract as much information about you and your computer as possible. Some malware goes out of its way to disable or work around your antivirus software, if you have it installed (and you should).
If you’re worried, download a standalone antimalware tool (our favorite for this is Malwarebytes Free) and scan your PC. If there’s anything lurking, it’ll let you know, and it’ll try to fix it. Personally, I like to run a Malwarebytes scan periodically just to make sure my system is clean. It’s not foolproof, but it’s better than nothing. If you still have concerns after a clean scan, combining Malwarebytes with a fresh full antivirus installation should take care of anything lurking in the corners of your system.
About Our Expert
Alan Henry
Managing Editor, Security
Experience
I’ve been writing and editing stories for almost two decades that help people use technology and productivity techniques to work better, live better, and protect their privacy and personal data. As managing editor of PCMag’s security team, it’s my responsibility to ensure that our product advice is evidence-based, lab-tested, and serves our readers.
I’ve been a technology journalist for close to 20 years, and I got my start freelancing here at PCMag before beginning a career that would lead me to become editor-in-chief of Lifehacker, a senior editor at The New York Times, and director of special projects at WIRED. I’m back at PCMag to lead our security team and renew my commitment to service journalism. I’m the author of Seen, Heard, and Paid: The New Work Rules for the Marginalized, a career and productivity book to help people of marginalized groups succeed in the workplace.
Leave a Reply