Connect with us

Technology

Massive Dell data breach hits 49 million users; what this means for your privacy and security

Published

on

Massive Dell data breach hits 49 million users; what this means for your privacy and security

Computer maker Dell faced a huge security challenge after a cyberattack stole information for approximately 49 million customers. 

Dell confirmed that the type of information stolen includes people’s names, postal addresses, and Dell hardware and order information, such as service tags, item descriptions, order dates and different warranty information.

What happened: a breakdown of the incidents

Menelik, the threat actor behind the attack, openly told told TechCrunch how he extracted such a huge amount of data from Dell without being detected.

CLICK HERE TO GET KURT’S FREE NEWSLETTER, THE CYBERGUY REPORT

Advertisement

Menelik set up several partner accounts within the Dell company portal which, when approved, allowed the hacker to use a brute-force attack to access customer data. A brute-force attack consists of an attacker submitting many passwords or passphrases hoping to eventually guess correctly.

The hacker sent more than 5,000 requests per minute to the page for nearly three weeks, and Dell did not notice anything. After sending nearly 50 million requests and scraping enough data, Menelik sent multiple emails to Dell, notifying the company of the vulnerability. It took Dell nearly a week to patch it all up, according to the hacker. Dell confirmed to TechCrunch that it received the hacker’s email notification of the vulnerability.

MASSIVE FREE VPN DATA BREACH EXPOSES 360 MILLION RECORDS

How Dell responded to the data breach

Dell sits as the No. 3 PC vendor in the world behind Lenovo and HP, and the affected accounts represent a small fraction of its user base. The company communicated this statement to affected users:

Advertisement

“We are currently investigating an incident involving a Dell portal, which contains a database with limited types of customer information related to purchases from Dell. We believe there is not a significant risk to our customers given the type of information involved.”

We reached out to Dell and a representative for the company provided us with this statement:

GET SECURITY ALERTS, EXPERT TIPS — SIGN UP FOR KURT’S NEWSLETTER — THE CYBERGUY REPORT HERE

“Dell Technologies has a cybersecurity program designed to limit risk to our environments, including those used by our customers and partners. Our program includes prompt assessment and response to identified threats and risks. We recently identified an incident involving a Dell portal with access to a database containing limited types of customer information including name, physical address, and certain Dell hardware and order information. It did not include financial or payment information, email address, telephone number or any highly sensitive customer data. 

“Upon discovering this incident, we promptly implemented our incident response procedures, applied containment measures, began investigating, and notified law enforcement. Our investigation is supported by external forensic specialists. We continue to monitor the situation and take steps to protect our customers’ information.  Although we don’t believe there is significant risk to our customers given the type of information involved, we are taking proactive steps to notify them as appropriate.”

Advertisement

WHAT A MASSIVE HEALTHCARE CYBERATTACK AT ASCENSION MEANS FOR YOUR PRIVACY AND SECURITY

What this means for your privacy and security

There’s no immediate aftermath of this data leak. Dell believes the risk to its customers is not significant since financial and payment information, email addresses and phone numbers were not stolen in this attack. However, the risk of phishing or even major malware and ransomware attacks still exists. The threat actors might try sending personalized letters with infected drives, a tactic seen before.

ASK OUR TECH EXPERT ANY QUESTION, AND GET KURT’S FREE CYBERGUY REPORT NEWSLETTER HERE

There’s a good chance this data leak has already been sold on the dark web. The hacker posted the information for sale on the dark web and then took it down quickly, which often happens when someone buys the whole database. If you’re a Dell customer who bought hardware between 2017 and 2024, be very careful about any messages you get in the mail claiming to be from Dell, especially if they ask for personal information.

Advertisement

OVER HALF A MILLION ROKU ACCOUNTS COMPROMISED IN SECOND CYBER SECURITY BREACH

7 proactive measures to take to protect your data

In the wake of the cyberattack on Dell, consider taking several proactive steps to protect your personal information:

1. Change your passwords: Although Dell says your personal details like phone number and email address haven’t been leaked, it’s still advisable to change the password of your Dell account if you have one. Consider using a password manager to generate and store complex passwords.

Advertisement

2. Avoid tech support phone scams: Since the hackers have your data, they may try to get in touch with you, posing as a Dell employee. Always verify if the tech support person you’re talking to actually works for Dell. Be skeptical about all unsolicited phone calls, and don’t provide any personal information.

3. Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions and security alerts.

4. Report any suspicious activity: If you notice any suspicious activity related to your Dell accounts or purchases, report them to security@dell.com. This may include unauthorized purchases, unusual login attempts, or changes in account information.

QUICK TIPS. EXPERT INSIGHTS. CLICK TO GET THE FREE CYBERGUY REPORT NEWSLETTER

5. Monitor your accounts and transactions

Advertisement

You should check your online accounts and transactions regularly for any suspicious or unauthorized activity. If you notice anything unusual, report it to the service provider or the authorities as soon as possible. You should also review your credit reports and scores to see if there are any signs of identity theft or fraud.

6. Use identity theft protection

Identity Theft protection companies can monitor personal information like your home title, Social Security Number (SSN), phone number and email address and alert you if it is being used to open an account.  They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.

7.  Invest in personal data removal services: While no service guarantees complete data removal from the internet, utilizing a removal service can be beneficial for those seeking to monitor and automate the deletion of their personal information from numerous sites over time. Check out my top recommendations for removal services here.

Kurt’s key takeaways

Dell’s recent data leak highlights the lapse in the computer maker’s security infrastructure. The attackers being inside the network for an extended period is especially troubling. Given Dell’s role in providing hardware and software solutions, including backup and recovery tools, for critical infrastructure, a thorough investigation into its code and supply chain for signs of tampering is crucial. Dell is working with law enforcement and third-party security experts to investigate the incident, so that’s a step in the right direction.

Advertisement

Have you adjusted your online behavior or preferences due to concerns about data privacy and security breaches? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on Facebook, YouTube and Instagram

Advertisement

Answers to the most-asked CyberGuy questions:

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement

Technology

OpenClaw founder Peter Steinberger is joining OpenAI

Published

on

OpenClaw founder Peter Steinberger is joining OpenAI

I could totally see how OpenClaw could become a huge company. And no, it’s not really exciting for me. I’m a builder at heart. I did the whole creating-a-company game already, poured 13 years of my life into it and learned a lot. What I want is to change the world, not build a large company and teaming up with OpenAI is the fastest way to bring this to everyone.

Continue Reading

Technology

Why physical ID theft is harder to fix than credit card fraud

Published

on

Why physical ID theft is harder to fix than credit card fraud

NEWYou can now listen to Fox News articles!

It started with a voicemail from a Hertz rental car location in Miami, Florida. A 57-year-old woman in Los Alamitos, California, was asked when she planned to return a Mercedes-Benz she had never rented. A thief had stolen her driver’s license, replaced the photo with their own and used it to rent the vehicle. The same identity was used to open a credit card account, book airline tickets and reserve hotel stays. By the time she learned what happened, the fraud involved businesses in multiple states.

Clearing her name required police reports in two jurisdictions, written disputes with the credit card issuer and repeated contact with the rental company and hotels. Her accounts were frozen while she submitted notarized copies of her identification and signed fraud affidavits. The process lasted more than a week. She reported losing $78,500 and spent nearly 10 days dealing with the fallout from one stolen ID.

Credit card fraud is usually limited to a single account number. Physical ID theft gives someone the ability to act as you in the real world. As a result, the cleanup process is longer, more intrusive and often tied to your legal record.

Sign up for my FREE CyberGuy Report

Advertisement

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

5 MYTHS ABOUT IDENTITY THEFT THAT PUT YOUR DATA AT RISK

A stolen driver’s license can allow someone to rent cars, open accounts and sign contracts in your name. (Photo by Silas Stein/picture alliance via Getty Images)

How credit card fraud recovery works

Under the Fair Credit Billing Act, you report unauthorized charges to the card issuer within 60 days of the statement date. Federal law limits your liability to $50, and most major issuers waive that entirely. The bank cancels the compromised card number, issues a replacement and removes the disputed charges after an investigation. You may need to confirm transactions and sign a fraud affidavit. The account number changes. Your name, driver’s license and Social Security number stay the same. In most cases, fraud is resolved within one or two billing cycles. That structure gives consumers clarity. There is one issuer, one investigation and one account to correct.

Why physical ID theft recovery is more complicated

Physical ID theft creates problems that go far beyond one financial account. When someone uses your driver’s license, they step into your legal identity. Start with reporting requirements. Most states require you to file a police report before the DMV will issue a replacement linked to fraud. That report number becomes part of your official record. If the misuse happened in another state, you may need to file a second report there.

Advertisement

Next, understand what replacing the card actually does. A new physical card does not erase prior activity. Rental contracts, utility accounts, hotel stays, or police interactions tied to the stolen license still carry your name and license number. Fixing those records takes work. You must contact each business directly and submit documentation. No central agency reverses everything at once. Each company sets its own rules and timeline.

The stakes can rise quickly. For example, if someone abandons a rental car or commits a crime using your stolen ID, law enforcement databases may record your name. At that point, the situation shifts from financial inconvenience to legal exposure.

HOW TO PROTECT A LOVED ONE’S IDENTITY AFTER DEATH

Police reports and formal disputes are often required before businesses will remove fraudulent records.  (Kurt “Cyberguy” Knutsson)

How to prove physical ID theft was not yours

With credit card fraud, the issuer investigates the charge. With physical ID theft, businesses and agencies often require you to prove that you did not authorize the activity. That process usually starts at IdentityTheft.gov. The FTC generates an Identity Theft Report, which serves as an official statement of fraud. Most banks, collection agencies and rental companies will not proceed without it.

Advertisement

You may also need:

  • A local police report
  • A copy of your driver’s license
  • A notarized identity affidavit
  • Proof of residence tied to the date of the fraud

When thieves open fraudulent accounts in your name, dispute each one separately. Act quickly. Send a written response within 30 days of the first collection notice to protect your rights under federal law. Fraud that appears on your credit report requires another step. Contact Equifax, Experian and TransUnion individually and submit formal disputes with supporting documentation. The credit bureaus then have up to 30 days to complete their investigations. No central agency manages these corrections for you. Instead, every company sets its own documentation rules and timeline. Therefore, you must track deadlines, follow up consistently and keep detailed records of every communication.

You cannot simply replace your driver’s license number after identity theft

When a credit card number is stolen, the bank issues a new one. When a driver’s license is stolen, the number usually remains the same. In California, if your driver’s license is lost or stolen, you can request a replacement card through the DMV online system or at a field office. The official process gets you a new physical card. No new license number is automatically assigned when the card is stolen.

If there is identity misuse tied to the license number, the DMV fraud review process allows you to submit documentation, including police reports, to support an identity theft claim before they take further action. A Social Security number is even harder to change. The Social Security Administration approves new numbers only in cases involving continued harm. Applicants must provide extensive documentation and appear in person.

A stolen physical ID, such as your license, includes:

  • Full legal name
  • Date of birth
  • Address
  • Driver’s license number
  • Signature

That information is sufficient for in-person identity checks, rental contracts, certain loan applications and travel-related transactions.

Credit monitoring alerts can help you detect identity misuse before it spreads across multiple accounts. (Kurt “CyberGuy” Knutsson)

Advertisement

Why ongoing identity protection matters

There is no single agency that tracks misuse of your driver’s license across rental companies, lenders, collection agencies and law enforcement systems. That burden falls on you.

Identity theft services monitor your identity across all three credit bureaus and alert you to new credit inquiries, account openings and changes to your credit file. If fraud appears, you are assigned a dedicated U.S.-based case manager who helps:

  • File disputes with Equifax, Experian and TransUnion
  • Prepare and submit FTC Identity Theft Reports
  • Contact creditors and collection agencies
  • Track documentation deadlines and responses
  • Assist with reimbursement claims when eligible

Plans can include identity theft insurance of up to $1 million per adult to cover eligible expenses such as lost wages, legal fees and document replacement costs related to identity theft recovery.

No service can prevent every misuse of a stolen ID. But when the issue involves police reports, credit bureaus, tax agencies and collection accounts, having structured support can make all the difference.

The California woman in this case was not enrolled in an identity theft protection service. Some businesses may reverse fraudulent charges, but it is unclear whether she recovered the full $78,500.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

Credit card fraud follows a defined path. You report the charge, the issuer investigates and your account number changes. In most cases, the disruption ends there. Physical ID theft moves differently. It spreads across rental companies, hotels, credit bureaus and sometimes law enforcement databases. Instead of one dispute, you may face several. Instead of replacing a number, you must protect a permanent identity marker tied to your name. That shift matters. A stolen driver’s license carries your legal identity into the real world. Therefore, recovery demands documentation, patience and persistence. Each business sets its own rules. Each agency runs its own timeline. You coordinate the process. The lesson is clear. Protecting your financial accounts is critical. However, protecting your physical identification may be even more important. Once someone uses it in person, the cleanup becomes personal, procedural and time-consuming. Layered monitoring, early alerts and fast reporting reduce long-term damage. The faster you respond, the more control you keep.

Have you ever dealt with physical ID theft, and did the recovery process take longer than you expected? Let us know your thoughts by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Advertisement
Continue Reading

Technology

AI can’t make good video game worlds yet, and it might never be able to

Published

on

AI can’t make good video game worlds yet, and it might never be able to

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more news about video game industry’s pushback against generative AI, follow Jay Peters. The Stepback arrives in our subscribers’ inboxes at 8AM ET. Opt in for The Stepback here.

Long before the generative AI explosion, video game developers made games that could generate their own worlds. Think of titles like Minecraft or even the original 1980 Rogue that is the basis for the term “roguelike”; these games and many others create worlds on the fly with certain rules and parameters. Human developers painstakingly work to make sure the worlds their games can create are engaging to explore and filled with things to do, and at their best, these types of games can be replayable for years because of how the environments and experiences can feel novel every single time you play.

But just as other creative industries are pushing back against an AI slop future, generative AI is coming for video games, too. Though it may never catch up with the best of what humans can make now.

Generative AI in video games has become a lightning rod, with gamers getting mad about in-game slop and half of developers thinking that generative AI is bad for the industry.

Big video game companies are jumping into the murky waters of AI anyway. PUBG maker Krafton is turning into an “AI First” game company, EA is partnering with Stability AI for “transformative” game-making tools, and Ubisoft, as part of a major reorganization, is promising that it would be making “accelerated investments behind player-facing Generative AI.” The CEO of Nexon, which owns the company that made last year’s mega-hit Arc Raiders, put it perhaps the most ominously: “I think it’s important to assume that every game company is now using AI.” (Some indie developers disagree.)

Advertisement

The bigger game companies often pitch their commitments as a way to streamline and assist with game development, which is getting increasingly expensive. But adoption of generative AI tools is a potential threat to jobs in an industry already infamous for waves of layoffs.

Last month, Google launched Project Genie, an “early research prototype” that lets users generate sandbox worlds using text or image prompts that they can explore for 60 seconds. Right now, the tool is only available in the US to people who subscribe to Google’s $249.99-per-month AI Ultra plan.

Project Genie is powered by Google’s Genie 3 AI world model, which the company pitches as a “key stepping stone on the path to AGI” that can enable “AI agents capable of reasoning, problem solving, and real-world actions,” and Google says the model’s potential uses go “well beyond gaming.” But it got a lot of attention in the industry: It was the first real indication of how generative AI tools could be used for video game development, just as tools like DALL-E and OpenAI’s Sora showed what might be possible with AI-generated images and video.

In my testing, Project Genie was barely able to generate even remotely interesting experiences. The “worlds” don’t let users do much except wander around using arrow keys. When the 60 seconds are over, you can’t do anything with what you generated except download a recording of what you did, meaning you also can’t plug in what you generated into a traditional video game engine.

Sure, Project Genie did let me generate terrible unauthorized Nintendo knockoffs (seemingly based off of the online videos Genie 3 is trained on), which raised a lot of familiar concerns about copyright and AI tools. But they weren’t even in the same universe of quality as the worlds in a handcrafted Nintendo game. The worlds were silent, the physics were sloppy, and the environments felt rudimentary.

Advertisement

The day after Project Genie’s announcement, stock prices of some of the biggest video game companies, including Take-Two, Roblox, and Unity, took a dip. That resulted in a little damage control. Take-Two president Karl Slatoff, for example, pushed back strongly on Genie in an earnings call a few days later, arguing that Genie isn’t a threat to traditional games yet. “Genie is not a game engine,” he said, noting that technology like it “certainly doesn’t replace the creative process,” and that, to him, the tool looks more like “procedurally generated interactive video at this point.” (The stock prices ticked back up in the days after.)

Google will almost certainly continue improving its Genie world models and tools to generate interactive experiences. It’s unclear if it will want to improve the experiences as games or if it will instead focus on finding ways for Genie to assist with its aspirational march toward AGI.

However, other leaders of AI companies are already pushing for interactive AI experiences. xAI’s Elon Musk recently claimed that “real-time” and “high-quality” video games that are “customized to the individual” will be available “next year,” and in December, he said that building an “AI gaming studio” is a “major project” for xAI. (Like with many of Musk’s claims, take his predictions and timelines with a grain of salt.) Meta’s Mark Zuckerberg, who is now pushing AI as the new social media after the company cut jobs in its metaverse group, envisions a future where people create a game from a prompt and share it to people in their feeds. Even Roblox, a gaming company, is pitching how creators will be able to use AI world models and prompts to generate and change in-game worlds in real time, something that it calls “real-time dreaming.”

But even in the most ambitious view where AI technology is feasibly able to generate worlds that are as responsive and interesting to explore as a video game that runs locally on a home console, PC, or your smartphone, there’s a lot more that goes into making a video game than just creating a world. The best games have engaging gameplay, include interesting things to do, and feature original art, sound, writing, and characters. And it takes human developers sometimes years to make sure all of the elements work together just right.

AI technology isn’t yet ready to generate games, and whoever thinks it might be is fooling themselves. But AI-generated video is still bad, and it was still used to make a bunch of bad ads for the Super Bowl, so tech companies are probably still going to put a lot of effort toward games made with generative AI. In an already unstable industry, even the idea that AI tools could rival what humans can make might have massive ramifications down the line.

Advertisement

But the complexity of games is different from AI video, which has improved considerably in a short period of time but has fewer variables to account for. AI game-making tools will almost certainly improve, but the results might never close the gap from what humans can make.

  • In a long X post, Unity CEO Matthew Bromberg argues that world models aren’t a risk, but a “powerful accelerator.”
  • While the video game industry probably shouldn’t feel threatened by AI world models just yet, generative AI tools will continue to be controversial in game development. Even Larian Studios, beloved for games like Baldur’s Gate 3, isn’t immune to backlash.
  • Steam requires that developers disclose when their games use generative AI to generate content, but in a recent change, developers don’t have to disclose if they used “AI powered tools” in their game development environments.
  • Some games, like the text-based Hidden Door and Amazon’s Snoop Dogg game on its Luna cloud gaming service, are embracing generative AI as a core aspect of the game.
  • NYU games professor Joost van Dreunen has a take on the situation around Project Genie.
  • Scientific American has a great explanation of how world models work.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading
Advertisement

Trending