Stolen Staff Passwords, Fake Event Invites, and the One Setting to Switch On Tonight
The biggest story this week is also the simplest one to understand. French tax authorities have confirmed that taxpayer data was stolen using passwords belonging to staff members, and the intrusion went unnoticed for seven weeks.
There was no clever trick at the heart of it. Someone had real usernames and real passwords, and used them to log in as though they belonged there. That is how a large share of serious breaches actually happen, and it is why your work login deserves the same care as your bank account.
What to do if you work with other people's data
If your employer offers multi-factor authentication on your work accounts, switch it on. If you use a password at work that you have also used on a shopping site, a forum or an old email account, change it. When one of those sites leaks, that reused password becomes a key to your workplace.
Fake invitations are doing real damage
Russia's Star Blizzard group has been targeting more than a hundred organisations with fake event invitations. The emails look like genuine conference or networking invites, and clicking through delivers a backdoor onto the victim's machine.
The targets are largely organisations, think tanks, journalists and defence suppliers, not ordinary households. But the habit worth copying is this: if an invitation asks you to log in somewhere unexpected, go to the organisation's website directly and check the event exists before you type anything.
A note for home Linux users
Researchers have disclosed a new variation of the Spectre attack, called Spectre BTR, which can leak memory on some Linux systems even with existing protections in place. If you run a home server, a NAS box or a small Linux machine, keep your system updated as patches roll out. Your everyday laptop and phone are not the concern here.
Tonight's one action
Open your email account settings and switch on two-factor authentication. That inbox is the recovery route for almost every other account you own, so protecting it protects everything behind it.
Related reading