Data breach at US debt collector exposes over a million users
NCB Management Services exposed sensitive payment data to an unknown threat actor
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
NCB Management Services, a debt collecting company from the United States, has suffered what appears to be aransomwareattack in early February 2023 that left the data of over a million people exposed.
Based on breach notification letters sent to affected parties, as well as the filing it submitted with the Maine Attorney General, some 1.1 million people were affected by the breach.
“Recently, confidential client account information maintained by NCB was accessed by an unauthorized party. To date, we are unaware of any misuse of your information as a result of this incident,” NCB said in the letter to its users.
Paying the ransom
It took the company some three days to realize they had been breached. From that point, until April 19, NCB was engaged in forensic analysis, trying to understand which types of data were accessed. It later learned that the attackers stole financial account numbers or payment card numbers “in combination with security code, access code, password or PIN for the account.”
The company also hints that it paid the ransom, as it stated that it “obtained assurances that the unauthorized third party no longer has access to any of NCB’s data.”
Regardless, NCB said it will provide its users with up to two years of freeidentity theftmonitoring services.
T-Mobile to fork out $350m penalty over infamous data breach>Data breaches actually fell in the first part of 2023>Here’s our rundown of the best firewalls
“In addition to activating the complimentary services offered, we recommend you review your credit reports and account statements over the next 12 to 24 months and notify your financial institution of any unauthorized transactions or incidents of suspected identity theft,” NCB said.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Cybercriminals usually steal sensitive data in order to sell it on the black market, or use it to run phishing campaigns, identity theft, wire fraud, and other forms of cybercrime. Companies are urged not to pay the ransom demand, as there are no guarantees they’ll remain safe, or get their data back. The only thing they can be sure of is that they’ll fund another round of cybercrime.
Via:Cybernews
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
Quordle today – hints and answers for Saturday, November 9 (game #1020)
