___________________________________________________________________________________________________

https://www.dailymail.co.uk/news/article-12915375/Crowds-gather-Times-Square-New-Years-Eve-countdown-man-reveals-pees-pants-waiting-line.html#v-1388314732580683266

_________________________________________________________________________________________________

______________________________________________________________________________________________________

Xfinity internet users may want a refund and a new service provider after reports of an October security breach involving customer data were recently made public.

This includes “names, contact information, last four digits of social security numbers, dates of birth and/or secret questions and answers” of some customers, according to Xfinity. Users are urged to monitor their credit reports and potential fraud or identity theft using the three major credit agencies, Equifax, Experian and TransUnion.

Some customers received an email about the “data security incident” at around 5 am on December 29.

CBS News reports,

New Deals At The Gateway Pundit MyPillow Discounts Page – Plus Free Shipping With Promo Code TGP!

A security breach at Comcast-owned Xfinity has exposed the personal data of nearly all the internet provider’s customers, including account usernames, passwords and answers to their security questions.

Comcast said in a filing with Maine’s attorney general’s office that the hack affected 35.8 million people, with the media and technology giant notifying customers of the attack through its website and by email, the company said Monday. The intrusion stems from a vulnerability in software from cloud computing company Citrix, according to Comcast.

Although Citrix patched the vulnerability in October, Xfinity learned that unauthorized users gained access to its internal systems between Oct. 16 and Oct. 19, revealing customer data. For some people, that included their names, contact information, account usernames and passwords, birthdates, parts of their Social Security numbers and answers to their security questions.

In addition to Xfinity, Citrix provides software to thousands of companies around the world. The previously-announced vulnerability, dubbed “Citrix Bleed,” has also been linked to hacks targeting the Industrial and Commercial Bank of China’sNew York arm and a Boeing subsidiary, among others.

It is unclear what ramifications this incident may have on users of the internet service provider and American national security.

Xfinity sent the following email to customers:

Xfinity Data Security Incident

Notice of Data Security Incident
We are notifying you of a recent data security incident involving your personal information. This notice explains the incident, steps Xfinity has taken to address it, and guidance on what you can do to protect your personal information.

What Happened? On October 10, 2023, one of Xfinity’s software providers, Citrix, announced a vulnerability in one of its products used by Xfinity and thousands of other companies worldwide. At the time Citrix made this announcement, it released a patch to fix the vulnerability. Citrix issued additional mitigation guidance on October 23, 2023. We promptly patched and mitigated our systems.
However, we subsequently discovered that prior to mitigation, between October 16 and October 19, 2023, there was unauthorized access to some of our internal systems that we concluded was a result of this vulnerability. We notified federal law enforcement and conducted an investigation into the nature and scope of the incident. On November 16, 2023, it was determined that information was likely acquired.
What Information Was Involved? On December 6, 2023, we concluded that the information included usernames and hashed passwords; for some customers, other information was also included, such as names, contact information, last four digits of social security numbers, dates of birth and/or secret questions and answers. However, our data analysis is continuing, and we will provide additional notices as appropriate.

What We Are Doing. To protect your account, we have proactively asked you to reset your password. The next time you login to your Xfinity account, you will be prompted to change your password, if you haven’t been asked to do so already.
What You Can Do. We strongly encourage you to enroll in two-factor or multi-factor authentication. While we advise customers not to re-use passwords across multiple accounts, if you do use the same information elsewhere, we recommend that you change the information on those other accounts, as well. You can review the “Additional Information” section below for information on how you can further protect your personal information.
More Information. If you have additional questions, please contact IDX, Xfinity’s incident response provider managing customer notifications and call center support, at 888-799-2560 toll-free, 24 hours a day, 7 days a week. More information is available on the Xfinity website at http://www.xfinity.com/dataincident.

We know that you trust Xfinity to protect your information, and we can’t emphasize enough how seriously we are taking this matter. We remain committed to continue investing in technology, protocols and experts dedicated to helping to protect your data and keeping you, our customer, safe.
Sincerely,
Xfinity
Additional Information
In general, you should remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring your credit reports. You are entitled to a free copy of your credit report annually. To obtain your credit report, visit http://www.annualcreditreport.com, call toll-free 1-877-322-8228, or mail an Annual Credit Report Request Form (available at http://www.annualcreditreport.com) to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA, 30348-5281. You can also purchase a copy of your credit report or contact the three major credit reporting bureaus at:
Trending: VIDEO SURFACES – Hidden from Public: Q Shaman Stands Outside Doors of US Capitol and Tells Everyone to Go Home – Reads Trump Tweet to Stay Peaceful and Go Home #Insurrection

Equifax
PO Box 740241
Atlanta, GA 30374
www.equifax.com
888-378-4329
Experian
PO Box 2002
Allen, TX 75013
www.experian.com
888-397-3742
TransUnion
PO Box 1000
Chester, PA 19016
www.transunion.com
800-888-4213

You should report any actual or suspected identity theft to the Federal Trade Commission and law enforcement. You can obtain information from the Federal Trade Commission and the three major credit bureaus about additional steps you can take to protect yourself against identity theft and fraud, as well as information on placing security freezes and fraud alerts on your credit report. You can contact the Federal Trade Commission at: 600 Pennsylvania Avenue NW, Washington, DC 20580; http://www.identitytheft.gov; and 1-877-ID-THEFT (1-877-438-4338). This notice was not delayed as a result of a law enforcement investigation.

You may place a security freeze on your credit reports, free of charge. A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing, or other services. You will need to place a security freeze separately with each of the three major credit bureaus if you wish to place a freeze on all of your credit files. In order to request a security freeze, you will need to supply your full name, address, date of birth, Social Security number, current address, all addresses for up to five previous years, email address, a copy of your state identification card or driver’s license, and a copy of a utility bill, bank or insurance statement, or other statement proving residence. To find out more on how to place a security freeze, contact the credit reporting agencies:

Equifax
P.O. Box 105788
Atlanta, GA 30348
888-298-0045
equifax.com/personal/credit-report-services/credit-freeze/
Experian
P.O. Box 9554
Allen, TX 75013
888-397-3742
experian.com/freeze/center.html
TransUnion
P.O. Box 160
Woodlyn, PA 19094
800-916-8800
transunion.com/credit-freeze

At no charge, you can also have the three major credit bureaus place a fraud alert on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact the credit reporting agencies:

Equifax
P.O. Box 105069
Atlanta, GA 30348
888-836-6351
equifax.com/personal/credit-report-services/credit-fraud-alerts/
Experian
P.O. Box 9554
Allen, TX 75013
888-397-3742
experian.com/fraud/center.html
TransUnion
P.O. Box 2000
Chester, PA 19106
800-916-8800
transunion.com/fraud-alerts

For New York residents, the New York Office of the Attorney General can be contacted at The Capitol, Albany, NY, 12224, ag.ny.gov, or 1-800-771-7755.

For North Carolina residents, the North Carolina Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699, ncdoj.gov, or 919-716-6000.

_____________________________________________________________________________________________________

____________________________________________________________________________________________________

Albania’s National Authority for Electronic Certification and Cyber Security (AKCESK) revealed that cyber attacks hit the Assembly of the Republic of Albania and telecom company One Albania.

The telecom carrier disclosed the cyber attack with a post published on Facebook, the company also added that the cyber attack did not interrupt its services.

“Today, we identified and handled with full capacity and actively a cyber security incident. Despite this attack, One Albania services were unaffected and operated normally throughout the day, including services for customers such as mobile, landline and IPTV. In close cooperation with the state institutions AKEP and AKCESK, we continue to work to fully provide services and data. Appreciating your support and understanding, we remain committed to maintaining transparency throughout the process.“

AKCESK revealed that it is helping targeted institutions in managing the cyber attacks, the Albanese agency reported that the targeted entities are critical infrastructure.

“Yesterday, on December 25, AKCESK was notified of cyber attacks that occurred on the ONE telephone company and the Assembly of the Republic of Albania.” reads the announcement published by AKCESK.

“AKCESK is also coordinating the work with international partners to support the institutions in performing an in-depth analysis on the evidence of the consequences that the attack may have caused in these infrastructures in the fastest possible time. At the same time, the findings so far have been shared in real time with all critical and important information infrastructures from the traces of the attack actors identified in order to prevent similar cyber attacks on these infrastructures.”

The investigation initiated by the AKCESK is still ongoing; however, the government agency has determined that the origin of the attack is from abroad.

“Our analysis has pointed out that the attacks do not originate from Albanian IP, helping us better understand the international dimensions of the threat. This incident has prompted AKCESK to review and strengthen its cyber security strategies, including developing specialized training for responsible staff and strengthening international cooperation.” adds AKCESK.

The Hacker News reported that the Iranian hacker group Homeland Justice claimed responsibility for this attacks on its Telegram channel.

The group also claimed to have hacked Air Albania.

In September 2022, Albania blamed Iran for another cyberattack that hit computer systems used by the state police.

Albania interrupted diplomatic ties with Iran and expelled the country’s embassy staff over the massive cyber attack that hit the country in mid-July 2022.

The cyberattack hit the servers of the National Agency for Information Society (AKSHI), which handles many government services. Most of the desk services for the population were interrupted, and only several important services, such as online tax filing, were working because they are provided by servers not targeted in the attack. Albania reported the attack to the NATO Member States and other allies.

The relations between Albania and Iran have deteriorated since the government of Tirana offered asylum to thousands of Iranian dissidents.

The United States government issued a statement condemning Iran for attacking Albania.

“The United States strongly condemns Iran’s cyberattack against our NATO Ally, Albania. We join in Prime Minister Rama’s call for Iran to be held accountable for this unprecedented cyber incident. The United States will take further action to hold Iran accountable for actions that threaten the security of a U.S. ally and set a troubling precedent for cyberspace.” U.S. National Security Council spokesperson Adrienne Watson said. “We have concluded that the Government of Iran conducted this reckless and irresponsible cyberattack and that it is responsible for subsequent hack and leak operations.”

NATO, and the U.K. also formally blamed the Iranian government for the cyberattacks against Albania.

The U.S. Treasury Department announced sanctions against Iran ‘s Ministry of Intelligence and Security (MOIS) and its Minister of Intelligence over the cyber attack that hit Albania in July.

MOIS is the primary intelligence agency of the Islamic Republic of Iran and a member of the Iran Intelligence Community. It is also known as VAJA and previously as VEVAK (Vezarat-e Ettela’at va Amniyat-e Keshvar) or alternatively MOIS.

The Iranian government denied it was behind the cyberattack and labeled Albania’s decision to sever diplomatic ties “an ill-considered and short-sighted action”.

“Iran as one of the target countries of cyberattacks on its critical infrastructure rejects and condemns any use of cyber space as a tool to attack the critical infrastructure of other countries,” the Iranian foreign ministry said.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

_______________________________________________________________________________________________________

Bayer has been ordered by a jury to pay $857 million to a group of former students and parent volunteers at a school in the Seattle area who suffered from ailments such as brain damage as a result of their exposure to toxic PCBs, a court has ordered.

Polychlorinated biphenyls, or PCBs, were found to exceed safe levels at the Sky Valley Education Center. Five students and two parents who volunteered there participated in the suit after suffering from health problems linked to these chemicals in the school’s fluorescent light fixtures.

After a two-month trial in the King County Superior Court, the jury reached the verdict, which includes $784 million in punitive damages and $73 million in compensatory damages.

It is the eighth time that a jury in Washington has found Bayer must be held liable for children becoming ill due to exposure at the school, with a total of more than $1.5 billion being awarded so far in damages in such cases.

In 2021, a group of three teachers were awarded a sum of $185 million, while a $275 million verdict was handed down last year to a group of 10 students and parents. Another jury determined Monsanto owed a group of employees of the school $165 million last month. There are an additional 19 cases awaiting trial in King County Superior Court.

When the school was constructed in 1950, around 95 percent of its light ballasts contained PCBs. Students and teachers observed a brown and oily liquid coming from the light fixtures for many years, and staff reportedly instructed children to stay away and placed trash cans there to collect the liquid.

One of the plaintiffs said she believed the school was “poisoning” her and her children. One of her daughters reportedly passed out while at school, while another had to start using a mask because she had become so sensitive to chemicals and scents after starting school there.

All of the seven plaintiffs in this case have experienced nervous system dysfunction in connection with time spent teaching or learning at the school. Some also experienced endocrine system problems and other health concerns. They all spent time there between 7 and 18 years ago.

Not surprisingly, Bayer is appealing the decision. The German pharmaceutical giant purchased Monsanto, who manufactured the chemicals, for $63 billion in 2018 and has been dealing with a slew of lawsuits related to the company’s toxic herbicides.

Monsanto knew PCBs were toxic and covered up the risks

Monsanto knew that the chemical was toxic and covered up the risks of exposure, which include cancer and other illnesses, for many years. Internal communications show that Monsanto was aware that their PCBs, also known as “aroclors,” were toxic as far back as 1955, but they did not stop producing them until 1977, when they were faced with strong regulatory pressure.

The chemicals were widely used at the time for insulating electrical equipment. They were also found in paint, floor finishing products, caulking and carbon copy paper. Known as “forever chemicals,” they break down very slowly in the environment and can seep from caulk and paint into the air. They were banned by the federal government in 1979 on account of their links to cancer.

Monsanto and Bayer are also facing legal scrutiny over PCBs found in Vermont schools. The state’s legislature has ordered a search for PCBs in all schools in the state that were constructed before the toxic chemicals were banned. Several schools have already closed down parts of their property in response to the findings.

Burlington High School shut down in 2020 after high levels of PCBs were found there, and students have been learning in makeshift classrooms at a former Macy’s department store situated nearby for the last three years.

_______________________________________________________________________________________________________

_______________________________________________________________________________________________________

_______________________________________________________________________________________________________