Connect with us

Technology

4.3 million Americans exposed in massive health savings account data breach

Published

on

4.3 million Americans exposed in massive health savings account data breach

Health savings account (HSA) provider HealthEquity experienced a massive data breach that has put over 4.3 million Americans’ information at risk. 

The company, which specializes in providing HSAs, flexible spending accounts (FSAs), health reimbursement arrangements (HRAs) and 401(k) retirement plans, confirmed threat actors stole sensitive health data using a partner’s compromised credentials. 

This includes full names, home addresses, telephone numbers, employer and employee IDs, Social Security numbers and more.

GET SECURITY ALERTS, EXPERT TIPS — SIGN UP FOR KURT’S NEWSLETTER — THE CYBERGUY REPORT HERE

Illustration of a hacker at work. (Kurt “CyberGuy” Knutsson)

Advertisement

What you need to know about the HealthEquity data breach

HealthEquity has confirmed that it suffered a data breach in which the personal information of millions of Americans was compromised. In a Form 8-K filing submitted on July 2, the company disclosed that hackers gained access to this sensitive health data after using a partner’s compromised credentials.

HealthEquity became aware of the systems anomaly on March 25, and the investigation continued until June 10.  The company’s data breach notice reads in part:

“We discovered some unauthorized access to and potential disclosure of protected health information and/or personally identifiable information stored in an unstructured data repository outside our core systems. On June 26, 2024, after validating the data, we unfortunately determined that some of your personal information was involved.”

As for notifications, the company tells us that the process for notifying customers — both businesses and individuals — is ongoing. Affected individuals will receive a notification by mail or email based on their account communications preferences.

The company says that the affected data was sign-up information for accounts and benefits that it administers. The data may include information in one or more of the following categories: first name, last name, address, telephone number, employee ID, employer, Social Security number, health card number, health plan member number, dependent information (for general contact information only), HealthEquity benefit type, diagnoses, prescription details, payment card information (but not payment card number) and/or HealthEquity account type. Not all data categories were affected for every member.

Advertisement

HealthEquity says it is not aware of any actual or attempted misuse of the information due to this incident to date. We reached out to HealthEquity, and a representative from the company provided CyberGuy with this statement: 

“The entire Purple Team is committed to educating, assisting and supporting our partners, clients and members through this incident. We have taken immediate, proactive and prudent action since we first discovered an anomaly with our third-party vendor. This included quickly resolving the issue, bringing together a team of outside and internal experts to investigate, and preparing for response. 

“Additionally, we formally filed notification with the Securities and Exchange Commission, which wasn’t required, but represents our concern and commitment to transparent communication. We regret the inconvenience caused by the incident and are working to minimize disruption while also taking steps to help prevent this from happening in the future. Partner and client notifications are underway, and we are thankful for the professionalism and understanding we’re experiencing thus far.” 

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET 

data breach 2

Illustration of hackers at work. (Kurt “CyberGuy” Knutsson)

HERE’S WHAT RUTHLESS HACKERS STOLE FROM 110 MILLION AT&T CUSTOMERS

Advertisement

What is HealthEquity doing about the data breach?

HealthEquity says it has secured the affected data repository. The vendor’s user accounts, which had access to an online data storage location, were compromised, allowing hackers to access data stored in that location. HealthEquity has disabled all potentially compromised vendor accounts, terminated all active sessions and blocked all IP addresses linked to the threat actor’s activity. The company has also implemented a global password reset for the impacted vendor.

The HSA provider has also arranged credit identity monitoring, insurance and restoration services for those impacted. These services will be available for two years, free of charge, through Equifax.

CLICK HERE FOR MORE U.S. NEWS

data breacj 3

Illustration of a hacker. (Kurt “CyberGuy” Knutsson)

WORLD’S LARGEST STOLEN PASSWORD DATABASE UPLOADED TO CRIMINAL FORUM

8 measures to take to protect yourself from a data breach

If you suspect you’ve been impacted by this data breach, follow these steps to protect your personal data and privacy.

Advertisement

1. Invest in identity theft protection: If you have been affected by a data breach, scammers may try to impersonate you to gain access to your private information. The best thing you can do to protect yourself from this type of fraud is to subscribe to an identity theft service.

Identity theft companies can monitor personal information like your Social Security number (SSN), phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.

2. Invest in removal services: Investing in removal services is beneficial, particularly in the wake of data breaches like the recent one experienced by HealthEquity. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here.

3. Place a fraud alert: Contact one of the three major credit reporting agencies (Equifax, Experian or TransUnion) and request a fraud alert to be placed on your credit file. This will make it more difficult for identity thieves to open new accounts in your name without verification.

4. Be cautious of phishing attempts: Be vigilant about emails, phone calls or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request.

Advertisement

The best way to protect yourself from clicking malicious links that install malware that may get access to your private information is to have antivirus protection installed on all your devices. This can also alert you of any phishing emails or ransomware scams Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android & iOS devices.

5. Check Social Security benefits: It is crucial to periodically check your Social Security benefits to ensure they have not been tampered with or altered in any way, safeguarding your financial security and preventing potential fraud.

6. Change your password: You can render a stolen password useless to thieves simply by changing it. Opt for a strong password — one you don’t use elsewhere. Even better, consider letting a password manager generate one for you.

7. Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know and use themes that require urgent attention, such as missed deliveries, account suspensions and security alerts.

Advertisement

8. Contact the U.S. Federal Trade Commission: If you detect any unauthorized transactions in any of your financial accounts, you should immediately notify the appropriate payment card company or financial institution. If you detect any incidents of identity theft or fraud, promptly report it to your local law enforcement authorities, state attorney general and the Federal Trade Commission.

PHARMA GIANT’S DATA BREACH EXPOSES PATIENTS’ SENSITIVE INFORMATION

Kurt’s key takeaway

The HealthEquity data breach highlights the need for strong cybersecurity practices, especially when it comes to protecting personal and health information. If you’re affected by this breach, it’s important to take action. Monitor your accounts and personal information for any unusual activity. Staying vigilant can help protect you from identity theft and financial fraud.

Do you feel confident in the measures HealthEquity is taking to protect your data going forward? Let us know by writing us at Cyberguy.com/Contact

Advertisement

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement

Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Trap backs itself into every corner

Published

on

Trap backs itself into every corner

Trap’s premise sounded tailor-made to play into M. Night Shyamalan’s twisty strengths and maybe even say something about the modern era of superstars turning their concerts into cinematic events. But for all of its promise, the thriller almost immediately runs out of steam. Shyamalan’s latest is a convoluted misfire whose handful of interesting ideas isn’t nearly enough to keep it from feeling like a notable low point in the director’s filmography.

In its first act, Trap introduces mild-mannered father Cooper Adams (Josh Hartnett) and his daughter Riley (​​Ariel Donoghue) as the pair make their way downtown to see superstar Lady Raven (Saleka Shyamalan) perform in concert. Though Cooper himself doesn’t quite get the singer’s appeal, she’s everything to his daughter. And with Riley dealing with some friend drama at school, Cooper’s all too happy to take her mind off things with a few hours of live music.

Almost everyone who meets the Adamses sees them as just another father-daughter duo hyped up to see the show. Cooper has a secret, though — he’s a serial killer who has his next victim trapped in a dungeon. You can feel the influence of series killer dramas like You and Dexter in the way Trap juxtaposes moments of familial banality with shots of Cooper sneaking furtive, twitchy glances at his phone to watch a livestream of the man he plans to murder next. But the Shyamalan twist of it all comes early on as Trap establishes how the Lady Raven concert is actually an elaborate ploy to smoke Cooper out.

Trap takes inspiration from Operation Flagship, the 1985 sting operation in which US marshals and DC police lured wanted criminals to the Washington Convention Center with the promise of free football tickets. Shyamalan riffs on that real history to imagine how a Taylor Swift-like concert filled with thousands of screaming teens could be weaponized against a monster. But as Trap works through that thought exercise, the movie is quickly boxed in by its core conceit.

Part of the problem is how Trap stretches credulity even for a Shyamalan movie as Cooper uses his constant “trips to the merch table” to learn more about how the police plan to catch him. The cops are pulling men out of the audience, and they aren’t letting people leave without being interviewed. But none of those dangers ever feel especially pressing for Cooper because of how effortlessly he’s able to skirt by them thanks to the plot armor Shyamalan piles onto him out of necessity.

Advertisement

You’re meant to read the strangeness of Cooper’s behavior as a part of his sociopathy, repeatedly slipping away from his daughter on the concert floor. Cooper has to slip away in order for the movie to really move. Otherwise, things would come to an end rather abruptly. But Trap becomes harder and harder to take seriously as Cooper’s situation pushes him to take a series of increasingly absurd — but not exactly exciting — chances on ploys to evade capture.

There’s an absurdity to the way Cooper is able to navigate Trap’s game of cat and mouse that almost feels like Shyamalan is trying to say something about what kind of people are seen as threats to society. As Cooper, Hartnett’s utterly devoid of charisma, and there’s an awkwardness to his interactions with Riley that doesn’t entirely feel intentional. But he’s a handsome white guy, and that seems to be enough to keep people from clocking his overt weirdness.

If fewer of Cooper’s tricks to escape — which serve as the film’s set pieces — came by way of convenient happenstance, Trap might work a bit better as a straight thriller about a predator becoming prey. But the movie goes to such absurd lengths to keep its story going that it definitely feels like Shyamalan ran out of solid ideas early on.

Everything about Trap, from its story to the way it also works as a vehicle for his daughter’s career as a musician, makes it feel like exactly the kind of project you might expect from Shyamalan, who has often self-financed his films since 2015. The director himself cameos as Lady Raven’s uncle and becomes part of the story in a way that connects him to Cooper’s search for an exit. But Shyamalan’s presence in the film is somewhat distracting and has a way of drawing attention to how many of Trap’s characters speak to the camera with a cloyingness the director tends to be very fond of.

Conceptually, this is one of Shyamalan’s most intriguing films, but its foundation is so limiting that it winds up feeling like the director set a trap for himself. It’s a testament to his ability to come up with novel ideas — but that alone isn’t always enough to make for a good time at the movies.

Advertisement
Continue Reading

Technology

The HoverAir X1 is the first drone I want to use all the time

Published

on

The HoverAir X1 is the first drone I want to use all the time

I’ve played around with a few DJI drones over the years but always found them to be too cumbersome to master and use spontaneously. The $349 HoverAir X1 from Zero Zero Robotics is different. This so-called “selfie drone” is so easy to use that it’s already an indispensable tool for my work and play, right out of the box.

For example, the HoverAir X1 is responsible for this review photo, this 360-degree GIF, and this overhead shot, as well as all of the follow, orbit, and zoom in / out shots used in this e-bikepacking video and this ID Buzz e-camper review. Each shot was made with just a touch of a button on the top of the drone — no controller required. 

The best drone is the one you have with you and the ultra-lightweight HoverAir X1 can easily fit inside a pocket to be taken everywhere. It launches so quickly that I can impulsively grab a more interesting drone shot instead of just defaulting to my iPhone. It returns automatically to land in your hand.

The HoverAir X1 is not without limitations, and I did manage to break one review unit after falling on it. But I have to admit I love this little guy precisely because of its shortcomings, not in spite of them. 

How we rate and review products

The HoverAir X1’s flying weight is about half that of DJI’s sub-250g Mini drones, so it, too, is exempt from registration and licensing requirements in most countries. It folds up into a 5 x 3.4 x 1.2-inch (127 x 86 x 31mm) package that’s so small and lightweight that I could comfortably carry it in a thigh pocket on long bike rides or trail runs.

The primary user interface for the X1 is two buttons on the drone itself. One turns the unit on, and the other cycles through five presets that lock the camera onto the user as the drone completes a predetermined flight path, shooting video or taking photos along the way:

  • Hover — floats in fixed space and tracks your movement
  • Follow — flies behind or in front of you at different heights and distances
  • Orbit — makes a wide circle overhead around a fixed center spot
  • Zoom out — flies away and up and then back in
  • Bird’s eye — for top-down shots directly over a fixed spot

There’s also a sixth mode that lets you assign a lightly customized flight pattern. The hover and follow modes can record videos or take photos for several minutes at a time, while the other flight modes begin and end at the point of launch and last for about 30 seconds.

The HoverAir app lets you tweak each of its automatic flight modes, including the altitude, distance, swapping between photo or video captures, portrait or landscape, and image quality. After some early experimentation to see what I liked, I rarely had to adjust these again. 

In a metric I like to call “time to drone,” I can pull the X1 out of a pocket, unfold it, turn it on, select a predefined flight path, and set it aloft from an outstretched palm in less than 20 seconds. No DJI drone can come anywhere close. 

The collapsed HoverAir X1 and battery vs. DJI Mini 3 Pro, battery, and controller.

That’s not to say that the HoverAir can compete with DJI’s consumer drones on features or capabilities. The X1’s diminutive size means compromises were made, starting with a max video resolution of 2.7K/30fps. 

Advertisement

Shots also start looking a little shaky in light winds around 10 knots (5.1m/s), and the X1 can’t even fly once winds exceed a moderate 15 knots (7.7m/s). It’s also relatively slow. The X1 can track me fine on a trail run, but it’ll start losing its object lock when I’m road biking at a not-very-fast pace of just 12mph (20km/h). Even when it can keep up, it’ll lose me when the elevation changes rapidly on a steep climb or descent. 

Otherwise, the X1’s computer vision tracking is very good — it’s the main reason you’d buy this drone. But when it does lose track of me for whatever reason, it’ll just stop, hover in place, and then eventually land, even over water or a busy street. There is no return-to-home feature to ensure a safe landing and recovery. It can, however, be configured to play a sound to help find it.

The user interface. Going clockwise starting at six o’clock, you have the big on/off button, then flight presets for Hover, Zoom out, Follow, Orbit, Bird’s eye, and custom. The smaller button in the middle is the flight mode selector.

The gimbal has a controllable pitch of -90 to 15 degrees for the camera that can shoot up to 2704×1520@30fps video or 12-megapixel stills.

The cage protects the props as well as the hands of the user.
Advertisement

The protective cage is built to expand and contract upon impact.

The X1 also lacks any obstacle avoidance. Instead, the drone’s four rotors are encased in a flexible plastic cage to protect the device from collisions. In most flight modes, the lack of avoidance tech isn’t really a problem so long as you give the immediate area a quick survey. It becomes an issue when the drone is in follow-me mode through narrow tree-lined trails, for example, or when walking around a sharp corner inside my home. Usually, it’ll just stop and hover in place if it runs into something, meaning I’ll have to double back to re-engage the tracking lock on my person or to collect it. But if it hits something when going faster — like chasing me on a bike — it’ll crash. My review X1 has already survived a few dozen crashes that sent it plummeting to the ground. It’s fine, other than a few scuff marks. 

I did destroy another X1 when my full weight landed on it while testing some new clipless bike pedals (don’t judge!). The X1 is not indestructible, but it’s surprisingly robust for such a lightweight drone. 

1/10

It takes a licking but it keeps on ticking.
Advertisement

The HoverAir X1 also lacks any kind of advanced GPS positioning. Instead, it opts for a VIO (Visual Inertial Odometry) system to estimate its position in 3D space, indoors or out, so that its preset flight modes can return the drone to its original starting point. It worked very well in my testing, often living up to the HoverAir’s claim of “centimeter-level precision,” even when flying orbits around me with a 20-foot (six-meter) radius. 

The drone also responds to a variety of hand gestures when the user is standing still. For example, you can send the X1 left or right with a wave of an arm or tell it to land with your arms crossed overhead. You can also just grab the drone out of the air and flip it upside down to turn those protected rotors off.

The HoverAir X1 does offer a manual Wi-Fi-connected flight mode whereby your phone becomes the controller. It’s fun, but I found it unresponsive at times, making it difficult to control flight with any real precision. I consider it a bonus feature you might want to use in a pinch.

Advertisement

The X1 is limited to 32GB of built-in storage without any option for microSD expansion. I’m currently using just 8.8GB to store the 113 videos and 60 images I’ve shot at max resolution over the last few months of testing. The footage transfers quickly to a phone over a direct Wi-Fi connection using the HoverAir app or over USB-C to a laptop. That USB-C connection will also charge the X1’s battery in about 55 minutes.

Hover mode selected and recording.

On paper, the X1 is dumb and unremarkable. But the HoverAir is so good at doing what many people actually need from a drone that its shortcomings rarely matter at all.

DJI is still the king of sweeping panoramas, but the HoverAir X1 makes a strong case for being the drone you choose to capture yourself doing things — indoors and out — especially for social media.

I do wish it was more capable so I could trust it to capture action over water when kitesurfing on windy days, keep up with me when road cycling at pace, or maintain its object lock when I’m bombing down a steep hill on a mountain bike. A 4K/60fps shooting mode would also be nice so long as none of these wishes increase the price too much.

Advertisement

The X1 does 90 percent of what I want a drone to do

Still, the X1 does 90 percent of what I want a drone to do without adding GPS, obstacle avoidance sensors, and a physical controller that’ll just make everything more expensive, more complicated, more cumbersome to carry, and slower to launch. Maybe DJI’s rumored Neo will fill in that last 10 percent because it certainly looks like a response to the HoverAir hype.

The HoverAir X1 lists for $429, but it’s nearly always on sale somewhere, often at or below $350. But I’d recommend opting for the $400-ish bundle that adds a dual-battery quick charger and two extra batteries that each only last about 10 to 12 minutes before needing a 35-minute recharge. Like the X1 itself, they’re so small and lightweight that you can easily bring them along to help document your next activity.

All photography by Thomas Ricker / The Verge

Advertisement
Continue Reading

Technology

MrBeast blames terrible Beast Games conditions on the CrowdStrike outage

Published

on

MrBeast blames terrible Beast Games conditions on the CrowdStrike outage

The New York Times is reporting that after 2,000 contestants arrived at Allegiant Stadium this July, they were barely fed and didn’t receive their prescription medication or clean underwear on time — despite providing it to the organizers themselves. (The 1,000 contestants who make it through can return for the Beast Games Amazon show, but this segment is for Donaldson’s YouTube channel.)

The Times’ story is filled with anecdotes from over a dozen contestants who say they were mistreated by organizers, like this:

One contestant said she had initially been denied the food she required to take her medication and had been told by staff members that she didn’t actually need to eat. After asking repeatedly, she was given half a banana.

But MrBeast isn’t apologizing, at least not yet. In fact, he’s not even quoted in the Times. Instead, the NYT received a text message from a spokesperson for MrBeast that blamed external factors, including CrowdStrike, instead of any poor planning on its part:

“In a text message, a spokesperson for MrBeast said the shoot “was unfortunately complicated by the CrowdStrike incident, extreme weather and other unexpected logistical and communications issues.” The spokesperson said MrBeast had started a formal review and had “taken steps to ensure that we learn from this experience.”

Continue Reading

Trending