Connect with us

Business

Massive data breach that includes Social Security numbers may be even worse than suspected

Published

on

Massive data breach that includes Social Security numbers may be even worse than suspected

The company whose data breach potentially exposed every American’s Social Security number to identity thieves finally has acknowledged the data theft — and said hackers obtained even more sensitive information than previously reported.

National Public Data, a Florida-based company that collects personal information for background checks, posted a “Security Incident” notice on its site to report “potential leaks of certain data in April 2024 and summer 2024.” The company said the breach appeared to involve a third party “that was trying to hack into data in late December 2023.”

According to a class-action lawsuit filed in U.S. District Court in Fort Lauderdale, Fla., the hacking group USDoD claimed in April to have stolen personal records of 2.9 billion people from National Public Data. Posting in a forum popular among hackers, the group offered to sell the data, which included records from the United States, Canada and the United Kingdom, for $3.5 million, a cybersecurity expert said in a post on X.

Last week, a purported member of USDoD identified only as Felice told the hacking forum that they were offering “the full NPD database,” according to a screenshot taken by BleepingComputer. The information consists of about 2.7 billion records, each of which includes a person’s full name, address, date of birth, Social Security number and phone number, along with alternate names and birth dates, Felice claimed.

None of the information was encrypted.

Advertisement

Such a release would be problematic enough. But according to National Public Data, the breach also included email addresses — a crucial piece for identity thieves and fraudsters.

Having a person’s email address makes it easier to target them with phishing attacks, which try to dupe people into revealing passwords to financial accounts or downloading malware that can extract sensitive personal information from your devices. In addition, because many people use their email address to log into online accounts, it could be used to try to hijack those accounts through password resets.

It’s not clear what, exactly, has been leaked on the dark web from the breach. In a very small sampling of scans using Google One, email addresses taken during the National Public Data breach did not appear. But a free tool from the cybersecurity company Pentester found that other personal data purportedly exposed by the breach, including Social Security numbers, were on the dark web.

National Public Data said on its website that it will notify individuals if there are “further significant developments” applicable to them. “We have also implemented additional security measures in efforts to prevent the reoccurrence of such a breach and to protect our systems,” it said.

Previously, in an email sent to people who’d sought information about their accounts, the company said that it had “purged the entire database, as a whole, of any and all entries, essentially opting everyone out.” As a result, it said, it has deleted any “non-public personal information” about people, although it added, “We may be required to retain certain records to comply with legal obligations.”

Advertisement

The company did not respond to a request for comment. Under a number of state laws, including California’s, companies must notify any individual whose personal information is reasonably believed to have been taken by an unauthorized person.

At this point, it appears that the only notice provided by National Public Data is the page on its website, which states, “We are notifying you so that you can take action which will assist to minimize or eliminate potential harm. We strongly advise you to take preventive measures to help prevent and detect any misuse of your information.”

The steps recommended by National Public Data include checking your financial accounts for unauthorized activity and placing a free fraud alert on your accounts at the three major credit bureaus, Equifax, Experian and TransUnion. Once you’ve placed a fraud alert on your account, the company advised, ask for a free credit report, then check it for accounts and inquiries that you don’t recognize. “These can be signs of identity theft.”

Security experts also advise putting a freeze on your credit files at the three major credit bureaus. You can do so for free, and it will prevent criminals from taking out loans, signing up for credit cards and opening financial accounts under your name. The catch is that you’ll need to remember to lift the freeze temporarily if you are obtaining or applying for something that requires a credit check.

In the meantime, security experts say, make sure all of your online accounts use two-factor authorization to make them harder to hijack.

Advertisement

It’s also important to look for signs that an email or text is not legitimate, given the spread of “imposter scams.” Using messages disguised to look like an urgent inquiry from your bank or service provider, these scams try to dupe you into giving up keys to your identity and, potentially, your savings. Any request for sensitive personal information is a giant red flag.

Aleksandr Valentij of cybersecurity company Surfshark suggested checking the sender’s email address carefully to see if it doesn’t precisely match the name of the organization they purportedly represent, and looking for typos or grammatical errors — two telltale signs of a scam. And if the message is from someone you’ve never interacted with before, Valentij said, avoid clicking on links, including an “unsubscribe” link or button, because bad actors will use them for malicious purposes.

“If you suspect that you’ve received a phishing email, don’t interact with it and report it to your email provider,” Valentij said. “If it’s someone pretending to be a legitimate organization, you should also report it to that organization. Once that’s done, delete the email and stay vigilant for similar emails in the future.”

Advertisement

Business

Senate committee kills bill mandating insurance coverage for wildfire safe homes

Published

on

Senate committee kills bill mandating insurance coverage for wildfire safe homes

A bill that would have required insurers to offer coverage to homeowners who take steps to reduce wildfire risk on their property died in the Legislature.

The Senate Insurance Committee on Monday voted down the measure, SB 1076, one of the most ambitious bills spurred by the devastating January 2025 wildfires.

The vote came despite fire victims and others rallying at the state Capitol in support of the measure, authored by state Sen. Sasha Renée Pérez (D-Pasadena), whose district includes the Eaton fire zone.

The Insurance Coverage for Fire-Safe Homes Act originally would have required insurers to offer and renew coverage for any home that meets wildfire-safety standards adopted by the insurance commissioner starting Jan. 1, 2028.

Advertisement

It also threatened insurers with a five-year ban from the sale of home or auto insurance if they did not comply, though it allowed for exceptions.

However, faced with strong opposition from the insurance industry, Pérez had agreed to amend the bill so it would have established community-wide pilot projects across the state to better understand the most effective way to limit property and insurance losses from wildfires.

Insurers would have had to offer four years of coverage to homeowners in successful pilot projects.

Denni Ritter, a vice president of the American Property Casualty Insurance Assn., told the committee that her trade group opposed the bill.

“While we appreciate the intent behind those conversations, those concepts do not remove our opposition, because they retain the same core flaw — substituting underwriting judgment and solvency safeguards with a statutory mandate to accept risk,” she said.

Advertisement

In voting against the bill Sen. Laura Richardson, (D-San Pedro), said: “Last I heard, in the United States, we don’t require any company to do anything. That’s the difference between capitalism and communism, frankly.”

The remarks against the measure prompted committee Chair Sen. Steve Padilla, (D-Chula Vista), to chastise committee members in opposition.

“I’m a little perturbed, and I’m a little disappointed, because you have someone who is trying to work with industry, who is trying to get facts and data,” he said.

Monday’s vote was the fourth time a bill that would have required insurers to offer coverage to so-called “fire hardened” homes failed in the Legislature since 2020, according to an analysis by insurance committee staff.

Fire hardening includes measures such as cutting back brush, installing fire resistant roofs and closing eaves to resist fire embers.

Advertisement

Pérez’s legislation was thought to have a better chance of passage because it followed the most catastrophic wildfires in U.S. history, which damaged or destroyed more than 18,000 structures and killed 31 people.

The bill was co-sponsored by the Los Angeles advocacy group Consumer Watchdog and Every Fire Survivor’s Network, a community group founded in Altadena after the fires formerly called the Eaton Fire Survivors Network.

But it also had broad support from groups such as the California Apartment Association, the California Nurses Association and California Environmental Voters.

Leading up to the fires, many insurers, citing heightened fire risk, had dropped policyholders in fire-prone neighorhoods. That forced them onto the California FAIR Plan, the state’s insurer of last resort, which offers limited but costly policies.

A Times analysis found that that in the Palisades and Eaton fire zones, the FAIR Plan’s rolls from 2020 to 2024 nearly doubled from 14,272 to 28,440. Mandating coverage has been seen as a way of reducing FAIR Plan enrollment.

Advertisement

“I’m disappointed this bill died in committee. Fire survivors deserved better,” Pérez said in a statement .

Also failing Monday in the committee was SB 982, a bill authored by Sen. Scott Wiener, (D-San Francisco). It would have authorized California’s attorney general to sue fossil fuel companies to recover losses from climate-induced disasters. It was opposed by the oil and gas industry.

Passing the committee were two other Pérez bills. SB 877 requires insurers to provide more transparency in the claims process. SB 878 imposes a penalty on insurers who don’t make claims payments on time.

Another bill, SB 1301, authored by insurance commissioner candidate Sen. Ben Allen, (D-Pacific Palisades), also passed. It protects policyholders from unexplained and abrupt policy non-renewals.

Advertisement
Continue Reading

Business

How We Cover the White House Correspondents’ Dinner

Published

on

How We Cover the White House Correspondents’ Dinner

Times Insider explains who we are and what we do, and delivers behind-the-scenes insights into how our journalism comes together.

Politicians in Washington and the reporters who cover them have an often adversarial relationship.

But on the last Saturday in April, they gather for an irreverent celebration of press freedom and the First Amendment at the Washington Hilton Hotel: The White House Correspondents’ Association dinner.

Hosted by the association, an organization that helps ensure access for media outlets covering the presidency, the dinner attracts Hollywood stars; politicians from both parties; and representatives of more than 100 networks, newspapers, magazines and wire services.

While The Times will have two reporters in the ballroom covering the event, the company no longer buys seats at the party, said Richard W. Stevenson, the Washington bureau chief. The decision goes back almost two decades; the last dinner The Times attended as an organization was in 2007.

Advertisement

“We made a judgment back then that the event had become too celebrity-focused and was undercutting our need to demonstrate to readers that we always seek to maintain a proper distance from the people we cover, many of whom attend as guests,” he said.

It’s a decision, he added, that “we have stuck by through both Republican and Democratic administrations, although we support the work of the White House Correspondents’ Association.”

Susan Wessling, The Times’s Standards editor, said the policy is a product of the organization’s desire to maintain editorial independence.

“We don’t want to leave readers with any questions about our independence and credibility by seeming to be overly friendly with people whose words and actions we need to report on,” she said.

The celebrity mentalist Oz Pearlman is headlining the evening, in lieu of the usual comedy set by the likes of Stephen Colbert and Hasan Minhaj, but all eyes will be on President Trump, who will make his first appearance at the dinner as president.

Advertisement

Mr. Trump has boycotted the event since 2011, when he was the butt of punchlines delivered by President Barack Obama and the talk show host Seth Meyers mocking his hair, his reality TV show and his preoccupation with the “birther” movement.

Last month, though, Mr. Trump, who has a contentious relationship with the media, announced his intention to attend this year’s dinner, where he will speak to a room full of the same reporters he often derides as “enemies of the people.”

Times reporters will be there to document the highs, the lows and the reactions in the room. A reporter for the Styles desk has also been assigned to cover the robust roster of after-parties around Washington.

Some off-duty reporters from The Times will also be present at this late-night circuit, though everyone remains cognizant of their roles, said Patrick Healy, The Times’s assistant managing editor for Standards and Trust.

“If they’re reporting, there’s a notebook or recorder out as usual,” he said. “If they’re not, they’re pros who know they’re always identifiable as Times journalists.”

Advertisement

For most of The Times’s reporters and editors, though, the evening will be experienced from home.

“The rest of us will be able to follow the coverage,” Mr. Stevenson said, “without having to don our tuxes or gowns.”

Continue Reading

Business

MrBeast company sued over claims of sexual harassment, firing a new mom

Published

on

MrBeast company sued over claims of sexual harassment, firing a new mom

A former female staffer who worked for Beast Industries, the media venture behind the popular YouTube channel MrBeast, is suing the company, alleging she was sexually harassed and fired shortly after she returned from maternity leave.

The employee, Lorrayne Mavromatis, a Brazilian-born social media professional, alleges in a lawsuit she was subjected to sexual harassment by the company’s management and demoted after she complained about her treatment. She said she was urged to join a conference call while in labor and expected to work during her maternity leave in violation of the Family and Medical Leave Act, according to the federal complaint filed Wednesday in the U.S. District Court for the Eastern District of North Carolina.

“This clout-chasing complaint is built on deliberate misrepresentations and categorically false statements, and we have the receipts to prove it. There is extensive evidence — including Slack and WhatsApp messages, company documents, and witness testimony — that unequivocally refutes her claims. We will not submit to opportunistic lawyers looking to manufacture a payday from us,” Gaude Paez, a Beast Industries spokesperson, said in a statement.

Jimmy Donaldson, 27, began MrBeast as a teen gaming channel that soon exploded into a media company worth an estimated $5 billion, with 500 employees and 450 million subscribers who watch its games, stunts and giveaways.

Mavromatis, who was hired in 2022 as its head of Instagram, described a pervasive climate of discrimination and harassment, according to the lawsuit.

Advertisement

In her complaint, she alleges the company’s former CEO James Warren made her meet him at his home for one-on-one meetings while he commented on her looks and dismissed her complaints about a male client’s unwanted advances, telling her “she should be honored that the client was hitting on her.”

When Mavromatis asked Warren why MrBeast, Donaldson, would not work with her, she was told that “she is a beautiful woman and her appearance had a certain sexual effect on Jimmy,” and, “Let’s just say that when you’re around and he goes to the restroom, he’s not actually using the restroom.”

Paez refuted the claim.

“That’s ridiculous. This is an allegation fabricated for the sole purpose of sparking headlines,” Paez said.

Mavromatis said she endured a slate of other indignities such as being told by Donaldson that she “would only participate in her video shoot if she brought him a beer.”

Advertisement

“In this male-centric workplace, Plaintiff, one of the few women in a high-level role, was excluded from otherwise all-male meetings, demeaned in front of colleagues, harassed, and suffered from males be given preferential treatment in employment decisions,” states the complaint.

When Mavromatis raised a question during a staff meeting with her team, she said a male colleague told her to “shut up” or “stop talking.”

At MrBeast headquarters in Greenville, N.C., she said male executives mocked female contestants participating in BeastGames, “who complained they did not have access to feminine hygiene products and clean underwear while participating in the show.”

In November 2023, Mavromatis formally complained about “the sexually inappropriate encounters and harassment, and demeaning and hostile work environment she and other female employees had been living and experiencing working at MrBeast,” to the company’s then head of human resources, Sue Parisher, who is also Donaldson’s mother, according to the suit.

In her complaint, Mavromatis said Beast Industries did not have a method or process for employees to report such issues either anonymously or to a third party, rather employees were expected to follow the company’s handbook, “How to Succeed In MrBeast Production.”

Advertisement

In it, employees were instructed that, “It’s okay for the boys to be childish,” “if talent wants to draw a dick on the white board in the video or do something stupid, let them” and “No does not mean no,” according to the complaint.

Mavromatis alleges that she was demoted and then fired.

Paez said that Mavromatis’s role was eliminated as part of a reorganization of an underperforming group within Beast Industries and that she was made aware of this.

Advertisement
Continue Reading
Advertisement

Trending