Connect with us

Technology

Massive criminal records leak exposes 70M Americans' personal information

Published

on

Massive criminal records leak exposes 70M Americans' personal information

A group of cybercriminals leaked a database containing criminal records of 70 million Americans, according to cybersecurity company Malwarebytes. 

The leak contained people’s full names, dates of birth, known aliases, postal addresses, dates of arrest, dates of conviction, sentences and more. 

This is bad news for anyone who has been convicted in the past.

GET SECURITY ALERTS, EXPERT TIPS — SIGN UP FOR KURT’S NEWSLETTER — THE CYBERGUY REPORT HERE

Hacker typing on a keyboard. (Kurt “CyberGuy” Knutsson)

Advertisement

What happened: Detailed analysis of the incident

Malwarebytes posted the news of this data leak on its its blog. The wording suggests the company didn’t have direct access to the leaked database. Still, the post revealed plenty of information about the incident and the threat actors behind the attack.

The hacking groups EquationCorp and USDoD are reportedly responsible for a major data breach involving the criminal record database. The breach, which resulted in the online leak of the database, contains 70 million entries. It includes the full names, dates of birth, known aliases, addresses, arrest and conviction dates, sentences and other information of millions of Americans who had encounters with the U.S. justice system between 2020 and 2024.

We contacted Malwarebytes and spoke with Pieter Arntz, a security researcher at the company, who informed us that they were able to obtain a small sample of the criminal records, which are specific to individual incidents. Each entry represents either an arrest or a case rather than a comprehensive compilation of all crimes committed by a single person. In other words, these records provide a snapshot of discrete legal events rather than a comprehensive overview of an individual’s criminal history. 

The exact source of this database is unknown. However, the hacker group USDoD, a major player in the field, is closely linked to “Pompompurin,” the operator of the original data leak site BreachForums. According to Malwarebytes, USDoD plans to create a successor to the second version of BreachForums, which was recently shut down by law enforcement. By releasing this database, USDoD might be trying to attract new users.

The same hacker is also believed to be involved in a breach at TransUnion, the data from which was partly dumped in September 2023.

Advertisement
Handcuffs

A man with handcuffs on. (Kurt “CyberGuy” Knutsson)

MASSIVE DELL DATA BREACH HITS 49 MILLION USERS — WHAT THIS MEANS FOR YOUR PRIVACY AND SECURITY

What does this data leak mean for you?

If you’ve had a run-in with the law before, there’s a good chance that a bunch of the info you shared with law enforcement is now out there on the web. The exposure of such a comprehensive criminal database could have significant implications for law enforcement, judicial proceedings and the individuals mentioned within the dataset.

The hackers who pulled off the leak might be looking to make a quick buck by selling your data to shady characters on the dark web. They might also try to con you by pretending to be someone you trust or a legit company, aiming to get their hands on some cash.

This much bulk data can also be used by bad actors to threaten, harass and blackmail people with records similar to the Ashley Madison breach. For the unaware, In July 2015, a hacker group calling itself “The Impact Team” stole the user data of Ashley Madison, a commercial website billed as enabling extramarital affairs. These hackers copied personal information from the user base and threatened to expose users’ names and personal details unless Ashley Madison shut down right away.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

Advertisement
WOMAN on laptop

A woman working on her laptop. (Kurt “CyberGuy” Knutsson)

SNEAKY SPYWARE IS AFTER YOUR MOST SENSITIVE DATA

6 measures to take to protect yourself from a data breach

If you suspect you’ve been impacted by this data breach, follow these steps to protect your personal data and privacy.

1. Invest in identity theft protection: If you think your personal data has been leaked, scammers may try to impersonate you to gain access to your private information. The best thing you can do to protect yourself from this type of fraud is to subscribe to an identity theft service.

Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft. 

2. Place a fraud alert: Contact one of the three major credit reporting agencies (Equifax, Experian or TransUnion) and request a fraud alert to be placed on your credit file. This will make it more difficult for identity thieves to open new accounts in your name without verification. 

Advertisement

3. Be cautious of phishing attempts: Be vigilant about emails, phone calls or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request.

The best way to protect yourself from clicking malicious links that install malware that may get access to your private information is to have antivirus protection installed on all your devices. This can also alert you of any phishing emails or ransomware scams. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android & iOS devices

4. Check Social Security benefits: It is crucial to periodically check your Social Security benefits to ensure they have not been tampered with or altered in any way, safeguarding your financial security and preventing potential fraud. 

5. Invest in removal services: While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for removal services here.

Advertisement

6. Change your password: You can render a stolen password useless to thieves simply by changing it. Opt for a strong password — one you don’t use elsewhere. Even better, consider letting a password manager generate one for you.

AT&T DATA LEAK FROM 73 MILLION CUSTOMERS — WHAT YOU NEED TO DO NEXT

Kurt’s key takeaway

The fact that threat actors were able to leak such a comprehensive amount of data suggests serious loopholes in government systems. These issues need to be addressed to prevent data breaches like this from exposing people’s personal information. As there is currently no advisory from the government, you’ll have to take matters into your own hands. Stay extra vigilant against identity theft and targeted phishing attacks.

Have you ever been a victim of a data breach? If yes, what steps did you take to protect your personal data? Let us know by writing us at Cyberguy.com/Contact

Advertisement

For more of my tech tips & security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement

Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

What does Mark Zuckerberg want from Donald Trump?

Published

on

What does Mark Zuckerberg want from Donald Trump?

At this point, it’s pretty clear what Donald Trump wants from Mark Zuckerberg. But what does Zuckerberg, who has now gone to Mar-a-Lago twice since the November election, want from the President-elect?

That’s the question I’ve been asking sources in and around Meta over the last several days. They all described Meta’s relationship with the outgoing Biden administration as incredibly hostile. It’s safe to assume that Zuckerberg wants a reset for the MAGA regime, especially since Trump threatened not that long ago to imprison him for life. 

In Trump’s America, removing tampons from the mens’ restrooms on Meta’s campuses, — a real thing that just happened — is as much a business decision as a political one. Destroying ‘woke’ ideology is a key pillar of Trump’s stated mandate. Others who know they need to play the game, like Amazon, are also starting to fall in line. Even still, Zuckerberg is transforming Meta for this new political reality at a speed that’s unusual for a company of its size and influence. Founder mode.

In his conversation with Joe Rogan and his video on Instagram, Zuckerberg shares a laundry list of issues that Trump could help him with: fighting other countries that are ratcheting up their policing of his platforms, stopping Apple from dictating how he builds mobile apps and smart glasses (the latter is increasingly important to Meta’s future), and, perhaps most importantly, keeping domestic AI regulation from slowing his efforts to crush OpenAI. Elon Musk has bought Trump’s ear. But the more time Zuckerberg spends in Mar-a-Lago, the more Sam Altman and Tim Cook should be worried.

Then there’s the US government’s case to break up Meta that’s set to go to trial in a few months. After the blur that was the last four years, it’s easy to forget that this lawsuit was filed at the end of Trump’s first term by a Republican FTC chair, not Lina Khan

Advertisement

Most of the headline reactions from the past week have focused on Zuckerberg’s decision to end Meta’s third-party fact check program. It was a convenient scapegoat for company executives that, frankly, never lived up to the goal of bringing more neutrality to Facebook and Instagram. The Community Notes alternative Meta is cribbing from X was not on the product roadmap before this week, so it will probably be awhile before everyone sees it in the wild. 

The announcement that US moderators would be moved from California to Texas is perhaps the most cynical of them all; talk to anyone who knows and they’ll tell you the vast majority of moderators are already based in Austin.

The hateful speech that is now allowed on Meta’s is eye-popping on its face and will be deserving of more scrutiny in the coming weeks. The decision to start recommending political content again is a 180-degree turn for Zuckerberg. But insiders believe that the most impactful change for users of Meta’s apps will be the softening of its systems that remove content for potential policy violations. 

Out of all the announcements Meta made last week, this is the one I believe is the least connected to Trump. Meta execs have been signaling for a while that they know they are mistakenly removing too much content that doesn’t actually break the rules; I’m told it’s one of, if not the, biggest complaint in user surveys. If done correctly, dialing back on moderation mistakes may be the only thing Zuckerberg announced that makes everyone happy.

Advertisement

Elsewhere

  • CES is for dealmaking now: Each year, the official CES show — the sprawling show floor and flashy keynotes — feels more like an advertising exercise and no longer a place to launch real products. Most of the energy has moved to private meeting rooms and happy hours at the Wynn, Aria, and Cosmopolitan, where tech execs are schmoozing CMOs and getting deals done with partners all week. At this shadow CES, everyone seems to agree that the show is more alive than ever. Booths on the show floor have become marketing tools to show clients before you take them to a steak dinner. The challenge for the organizers of CES will be figuring out how to bridge the growing influence of this part of the show with their current business model of charging people to walk around booths filled with smart toasters and concept cars.
  • TikTok may just get banned: Imagine an alternate world in which the Chinese government is about to ban Instagram from operating in the country and Mark Zuckerberg is in hiding. That’s the situation with ByteDance and its founder Zhang Yiming, who stepped down from the CEO role after the last US ban attempt but still controls the company. He let TikTok be banned in India and seemingly has no interest in the app surviving this time, so why wouldn’t he let the same thing happen again?
  • Google and OpenAI flick at what’s next: Google’s DeepMind unit is starting “an ambitious project to build generative models that simulate the physical world,” which it believes “is on the critical path to artificial general intelligence.” Meanwhile, OpenAI is returning to its early roots by starting a “general-purpose robotics” team that will build hardware and push “towards AGI-level intelligence in dynamic, real-world settings.” We may have hit a scaling wall on text data but the big labs clearly see an opportunity in 3D. (See also what Nvidia announced last week.)
  • Other headlines you may have missed: Tencent (a large investor in Epic Games, Snap, and US tech companies) was put on the Pentagon’s blacklist for being allegedly under the influence of the Chinese military. Tim Cook’s total compensation rose 18 percent last year to $74.6 million. Elon Musk is hosting an inauguration party for Trump in DC with Uber and The Free Press. Sam Altman’s sister filed a sexual abuse lawsuit against him.

Job board

Some recent, noteworthy job changes in the tech world:

  • A bunch of changes at Meta: UFC CEO Dana White, Exor CEO John Elkann, and Charlie Songhurst joined the board. Joel Kaplan is running policy and comms now. After a stint at Google, I’m told Michael Levinson is coming back as VP of product for the Integrity org. (Good luck!) Head of civil rights, Roy Austin, is leaving. And former DEI chief Maxine Williams is now head of “accessibility and engagement.”
  • Elon Musk’s X named a couple of new leaders: Romina Khananisho is the new head of government affairs and John Nitti is head of “ad innovation.”
  • Calista Redmon joined Nvidia as VP of “global AI initiatives,” where she’ll “drive adoption of the NVIDIA platform for national and regional AI initiatives.”
  • Sophia Dominguez, Snap’s director of AR platform, is leaving.

More links

If you haven’t already, don’t forget to subscribe to The Verge, which includes unlimited access to Command Line, all of our reporting, and an improved ad experience on the web.

As always, I want to hear from you, especially if you work at Meta. Respond here, and I’ll get back to you, or ping me securely on Signal.

Advertisement
Continue Reading

Technology

PowerSchool data breach exposes millions of student and teacher records

Published

on

PowerSchool data breach exposes millions of student and teacher records

Cybercriminals spare no industry, targeting sectors like health care, insurance, automotive and education. Health care has been a frequent target, with attacks like the Ascension breach last year and the CVR incident in late 2024. 

Now, education technology giant PowerSchool has become the latest target, with records of millions of students and teachers stolen.

While the exact number of affected individuals remains unknown, the scale of the breach is alarming.

PowerSchool serves 18,000 customers worldwide, including schools in the U.S. and Canada, managing grading, attendance and personal information for over 60 million K-12 students and teachers.

I’M GIVING AWAY THE LATEST & GREATEST AIRPODS PRO 2

Advertisement

Kids working on their laptops  (Kurt “CyberGuy” Knutsson)

How did hackers target PowerSchool

PowerSchool revealed a cybersecurity breach to its customers Jan. 7, as reported by BleepingComputer. The company said it discovered the breach Dec. 28, after customer data from its PowerSchool SIS platform was stolen through the PowerSource support portal.

PowerSchool SIS is a student information system used for managing grades, attendance, enrollment and other student records. Hackers accessed the PowerSource portal using stolen credentials and used an “export data manager” tool to steal information.

The company said this wasn’t a ransomware attack or a result of software flaws, but rather a straightforward network break-in. The company has hired a third-party cybersecurity firm to investigate the breach, figure out what happened and determine who was affected.

power school 2

Illustration of a hacker at work  (Kurt “CyberGuy” Knutsson)

UNDERSTANDING BRUSHING SCAMS AND HOW TO PROTECT YOURSELF

Advertisement

What data got stolen

The PowerSource portal includes a feature that allows PowerSchool engineers to access customer systems for support and troubleshooting. The attacker exploited this feature to export the PowerSchool SIS “students” and “teachers” database tables to a CSV file, which was then stolen.

PowerSchool confirmed the stolen data primarily includes contact details like names and addresses. However, for some districts, the data may also include sensitive information such as Social Security numbers, personally identifiable information, medical records and grades.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

The company said customer support tickets, credentials and forum data were not accessed or stolen during the breach. PowerSchool also emphasized that not all SIS customers were affected and expects only a subset of customers will need to notify those affected.

“We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination,” the developer told customers in a notice.

Advertisement

“We have also deactivated the compromised credential and restricted all access to the affected portal. Lastly, we have conducted a full password reset and further tightened password and access control for all PowerSource customer support portal accounts.”

PowerSchool said affected adults will be offered free credit monitoring, while minors will receive subscriptions to an unspecified identity protection service.

power school 3

Illustration of a hacker at work  (Kurt “CyberGuy” Knutsson)

MASSIVE DATA BREACH EXPOSES 3 MILLION AMERICANS’ PERSONAL INFORMATION TO CYBERCRIMINALS

5 ways you can stay safe from PowerSchool data breach

The PowerSchool data breach has highlighted the importance of staying vigilant about your personal information. Here are five steps you can take to protect yourself:

1. Monitor your accounts regularly: Keep a close eye on your bank accounts, credit cards and any online services linked to your personal information. Watch for unauthorized transactions or changes to your accounts that could signal misuse of your data.

Advertisement

2. Freeze your credit: If your Social Security number or other sensitive details were compromised, consider placing a credit freeze with major credit bureaus like Equifax, Experian and TransUnion. This prevents potential identity thieves from opening new accounts in your name.

3. Use identity theft protection services: Take advantage of any identity protection services offered by PowerSchool as part of its breach response. These services can alert you to suspicious activity and provide support if your identity is stolen.

One of the best parts of some identity protection services is that they have identity theft insurance of up to $1 million to cover losses and legal fees and a white glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft.

4. Enable two-factor authentication (2FA): Wherever possible, enable 2FA for your online accounts. This adds an extra layer of security by requiring a second form of verification, such as a text code or app-generated token, to access your accounts.

Advertisement

5. Be aware of phishing links and use strong antivirus software: Cybercriminals often use phishing scams to exploit data breaches. Avoid clicking on suspicious links in emails or text messages, especially those claiming to be from PowerSchool or your school district.

The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

WINDOWS FLAW LETS HACKERS SNEAK INTO YOUR PC OVER WI-FI

Kurt’s key takeaway

You can blame hackers for this breach, but PowerSchool shares the responsibility for failing to adequately protect sensitive data. The company may also be in violation of data privacy agreements it signed with school districts, as well as federal and state laws designed to safeguard student privacy. What’s more concerning is that PowerSchool took nearly two weeks to notify its customers about the breach. Schools are now left scrambling to assess the full extent of the intrusion. This delay is not just irresponsible; it puts students, parents and teachers at heightened risk of cyberattacks and identity theft.

Advertisement

Do you think companies like PowerSchool should face stricter regulations for handling sensitive data? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

Advertisement

New from Kurt:

Copyright 2025 CyberGuy.com.  All rights reserved.

Advertisement
Continue Reading

Technology

L’Oréal’s new skincare gadget told me I should try retinol

Published

on

L’Oréal’s new skincare gadget told me I should try retinol

Las Vegas is punishingly dry. The arid winter air means I woke up on Day 3 of CES 2025 with a nosebleed, chapped lips, and ashy legs. This in spite of the fact I slathered myself with two pumps of a fermented bean essence, eye cream, moisturizer, and a lip mask. Staring at my face in the hotel mirror, I wonder if any of those products were doing what they’re supposed to — and if maybe, I should try something different.

This is why I was so eager to try L’Oréal’s Cell BioPrint.

For anyone who’s struggled with their complexion, the Cell BioPrint feels like a holy grail gadget. The device is a mini-lab setup that analyzes a skin sample to generate a report about your skin’s current condition. It’ll also “grade” your skin with regard to oiliness, wrinkles, skin barrier function, pore size, and uneven skin tone. Based on the proteins in your skin, you’ll also see whether you’re more likely to be susceptible to those issues down the line — even if they aren’t issues now. The test also determines whether you’re responsive to retinol, a popular and well-studied skincare ingredient that nevertheless causes a ton of confusion online.

My results. I’m happy to say my skin’s biological and chronological age were aligned.
Photo by Victoria Song / The Verge

In my demo, using the Cell BioPrint was simple. Mainly because I didn’t have to do a thing. While L’Oréal hopes to one day make Cell BioPrint an at-home device, it’ll first be aimed at retail, dermatology offices, and skincare clinics. As in, the actual test will be done by a professional to ensure accuracy. A L’Oréal staffer collected a sample from both my cheeks using a special kind of sticker. I watched as he then dissolved it in a buffer liquid, placed the resulting solution into a cartridge, and fed that cartridge into a machine. I also had my cheeks and forehead scanned with an imaging wand before answering two questions about my age and demographic data.

Advertisement

After a few minutes, I got to see my results. Apparently, I’m doing something right because the report said that my chronological and biological age were aligned. But it also said that while my skin barrier function is currently good, I’m biologically prone to have issues with that as I get older. My report also said that I don’t have to be concerned with pore size — either now or in the future, and that I am highly responsive to retinol, meaning my skin is likely to tolerate it well.

There were several other insights I won’t bore you with, but after going over my results, I have a better sense of what I need to focus on. For instance, I should continue using moisturizers with ceramides, button up my sun care habits outside of sunscreen, add a vitamin C to help with my skin tone, and add a retinol. I also know what I don’t need or can remove from my routine. For example, I don’t need to buy products targeted toward shrinking pores.

Most of this wasn’t surprising. My results aligned with the concerns I’ve noticed and where I tend to concentrate my skincare routine. For example, the few times I’ve tried retinol, I’ve never had an hint of the sensitivities other people seem to experience.

Of course, this kind of personalized recommendation is only as good as the science behind it. After all, lots of health and beauty tech companies promise the moon, but are intentionally coy when it comes to explaining why you should trust them. Barring regulatory certification (which isn’t generally required for wellness and beauty tech), it’s left up to the individual to try to discern whether an explanation passes the smell test.

With that in mind, I asked L’Oréal to dive deep into the science — which Guive Balooch, global vice president of L’Oréal’s Technology Incubator, happily obliged.

Advertisement

Balooch says the company had 800 biologists working (and publishing clinical studies) to discover whether there are specific proteins expressed in skin cells that could determine your risk factors for certain skin conditions. The challenge, he says, is that there are a lot of proteins produced by the body. Finding the few out of the thousands that can give actionable skincare insights is like finding a handful of needles in a giant haystack. It required L’Oréal’s researchers to sequence all of them and then find the relevant biomarkers.

This particular branch of research, Balooch says, is called proteomics — or the study of how proteins are expressed in the body. “It’s understanding that our cells every day are making proteins. Depending on our lifestyle, our geography, and our genes, they will make more or less of these proteins. It changes over time and habits can change it as well.”

Balooch says L’Oréal tested 4,000 people over 10 years across the US, Europe, South America and Asia, and found five proteins related to skin health, including two that are related to how well a person’s skin will respond to retinol. And while the Cell BioPrint can only currently analyze responsiveness to retinol, other ingredients like niacinamide and hyaluronic acid are also in the works.

“In some ways, it’s meant to tell people what not to buy.”

Cynically speaking, a device like this could also be viewed as a pseudoscientific way to sell more products to a group of people already prone to reach for their wallets. But Balooch argues the Cell BioPrint isn’t meant to encourage people to buy more.

Advertisement

“In some ways, it’s meant to tell people what not to buy,” he says. “Of course, we would love to sell more products, but not by overconsumption. That’s not actually good for your skin. It’s about helping people find the right products based on science.”

To that end, Balooch has a point. The skincare market right now is rife with misinformation and influencers pushing expensive 10-step routines that sometimes do more harm than good. I know better, and yet I’m as guilty as the next skincare nerd. (I’m still haunted by the full bottle of snail mucin influencers claimed would fix all my problems. It broke me out instead.) Even now, I know that I’ll probably get influenced again. The difference is at least I can choose to be influenced towards a retinol cream or vitamin C serum — things that have a higher chance of helping me — rather than throwing my money to the wind.

Continue Reading
Advertisement

Trending