IT Security Stories to Watch: Was Snapchat Employee Info Compromised?

A Snapchat worker recently fell victim to an email phishing scam and disclosed employee payroll information due to the incident.

And as a result, Snapchat tops this week’s list of IT security newsmakers to watch, followed by Wendy’s (WEN), Verizon (VZ) and Skycure. 

What can managed service providers and their customers learn from these IT security newsmakers? Check out this week’s edition of IT security stories to watch to find out:

1. Snapchat confirms phishing attack

Snapchat last month said its payroll department was targeted by an email phishing scam in which a scammer impersonated its CEO and asked for employee payroll information.

However, the video messaging application provider said none of its internal systems were breached and no user information was accessed during the incident.

“Within four hours of this incident, we confirmed that the phishing attack was an isolated incident and reported it to the FBI,” Snapchat wrote in a blog post. “We began sorting through which employees–current and past–may have been affected. And we have since contacted the affected employees and have offered them two years of free identity-theft insurance and monitoring.”

2. New details emerge about possible Wendy’s credit card breach 

Many credit unions saw an increase in debit card fraud in the weeks before the Wendy’s breach became public.

B. Dan Berger, CEO of the National Association of Federal Credit Unions, told Krebs on Security the fraudulent activity was tied to customers who had visited Wendy’s a month prior to the fast food restaurant’s launch of an investigation into a credit card breach in January. 

“This is what we’ve heard from three different credit union CEOs in Ohio now: It’s more concentrated and the amounts hitting compromised debit accounts is much higher that what they were hit with after Home Depot or Target,” Berger said. “It seems to have been been [the work of] a sophisticated group, in terms of the timing and the accounts they targeted. They were targeting and draining debit accounts with lots of money in them.”

3. Verizon: ‘To us, few breaches are unique.’

Verizon has released its inaugural “Data Breach Digest,” a report that details different types of cyber attacks and how organizations can deal with them effectively. 

The report indicated malware was a factor in over half of data breaches, while 40 percent of breaches involved point-of-sale (POS) system intrusions or payment card skimmers.

“Many data breach victims believe they are in isolation, dealing with sophisticated tactics and zero-day malware never seen before—we see otherwise,” Verizon wrote in its report. “To us, few breaches are unique.”

4. Skycure explains ‘clickjacking’

Mobile security solutions provider Skycure said it has discovered the next evolution in malware that affects Android devices – “clickjacking.”

Skycure noted clickjacking refers to “a malicious UI redressing technique that tricks a victim into clicking on an element that is different than the one the victim believes to be clicking on.” 

In addition, clickjacking may affect more than 500 million Android devices, Skycure said, and remains a viable threat to mobile device users worldwide. 

What are your thoughts on this week’s IT security stories to watch? Share your thoughts about this story in the Comments section below, via Twitter @dkobialka or email me at [email protected].

Send tips and story ideas to [email protected].