Data Privacy Weekly: Your Industry News Series

02. US Govt Contractor Maximus Hit by Data Breach: 8 Million People Affected

Around 8 million people were affected by a data breach at US government contractor Maximus. The breach occurred through a zero-day flaw in the MOVEit Transfer application, used by the Clop ransomware gang to steal personal data.

The company found no evidence of further network intrusion, but the hackers accessed sensitive information, including social security numbers and health data. Maximus plans to spend around $15 million on investigation and remediation. The hackers have not yet leaked the stolen data, but they are known for aggressive extortion tactics, targeting multiple companies.

04. Security Alert: Google AMP Exploited for Evasive Phishing Attacks

Threat actors are misusing Google AMP for evasive phishing attacks, allowing them to bypass email security measures and target enterprise employees. Google AMP, designed to enhance mobile web loading speeds, is being abused to host phishing pages and evade detection. The attackers use Google AMP URLs in phishing emails to exploit the reputation of Google’s domain, making it less likely for emails to be flagged as suspicious. To avoid detection, they also employ techniques like image-based HTML emails, extra redirection steps, and CAPTCHA services. This surge in AMP-based phishing attacks calls for increased vigilance and caution among recipients.