450K Records Stolen at UK University 🎓 & a Sneaky Email Spoof Flaw 📧
Two stories from today's security news show just how much damage a single overlooked flaw can cause — one already exposed sensitive data on nearly half a million people, and the other could let scammers impersonate your boss with a single command.
Hackers Stole Records on 450,000 University Students
A hacking group called ShinyHunters broke into the University of Nottingham's student records system by exploiting a previously unknown software flaw, making off with 40GB of data on more than 454,000 students. The stolen data includes passport numbers, home addresses, billing records, and even disability information. This wasn't an isolated attack — the same technique was reportedly used against more than 100 organizations worldwide. If you're connected to the university, watch for suspicious emails or calls referencing your personal details, since this kind of data is gold for identity thieves and scammers. For everyone else, it's a reminder that even big institutions with valuable personal data can be brought down by a single unpatched system.
A New Flaw Lets Anyone Send Email That Looks Like It's From Your CEO
Security researchers discovered a trick — nicknamed "Ghost-Sender" — that lets attackers send convincing fake emails appearing to come from a real person's actual email address, complete with their genuine profile photo, to any organization using Microsoft Exchange Online or a hybrid Exchange setup. It takes just one simple command and slips right past the usual spam and spoofing protections (SPF, DKIM, and DMARC) that are supposed to catch this. Worse, it's already being used by attackers, and Microsoft considers it a quirk of how Exchange works rather than a bug it plans to patch — meaning it's up to each organization's IT team to lock it down. If your company uses Microsoft email, this is the kind of thing that could power a very convincing "urgent wire transfer" scam from your "CEO" — worth flagging to your IT or security team now.
Stay ahead of threats with GOCO Security at gocosecurity.com.
.jpg)
Comments
Post a Comment