Disney launched a new streaming service and in a matter of few hours, user accounts were hacked/stolen and put up for sale on hacking forums

. Prices vary from $3 per account to as much as $11 (strangely, that's more than Disney's $7 offer)

https://www.zdnet.com/article/thousands-of-hacked-disney-accounts-are-already-for-sale-on-hacking-forums

Do you know how cybercriminals steal your personal info? - Here are five common — but unexpected —ways that cybercriminals try to get this information from you, and how to stop them.

1.  Surveys and Games - if you give this information to unknown sites or post it publicly on social media, you’re actually sharing some of your answers to typical security questions used by banks (for example). 
2.  Old Devices - When you get rid of or give away outdated equipment, make sure you delete all your personal information first by wiping it clean. 
3.  Fake Job Postings
4.  Social Media and Dating Sites - Beware of “friend” requests from people you don’t know.
5.  Offline Shenanigans - shoulder surfing, listening, access your mailbox

https://www.getcybersafe.gc.ca/cnt/blg/pst-20181016-en.aspx

What do you do when you are a victim of Identity Theft?

Do you know www.identitytheft.gov can help you report and recover from identity theft.


 https://www.identitytheft.gov/

Fraudsters are purchasing medical records of patients that are already deceased, why?

Medical records are often used in combination with other personal information to conduct  sophisticated fraudulent transactions (other than ID theft and financial transactions).

Besides financial fraud, criminals also use stolen medical information for illegally acquiring medical supplies and obtaining health-insurance. One of the dark web one of our researchers found criminals explaining to a potential customer how they can use a medical ID to get prescribed drugs delivered to them, to order medication and even to book a doctor’s appointment for a check-up.


https://threatpost.com/deceased-patient-data-being-sold-on-dark-web/133871/

If I avoid using the Web to manage various accounts tied to my personal and financial data then I will be safe - WRONG !!!

Scammers can create online accounts in someone’s name at the Internal Revenue Service, the U.S. Postal Service or the Social Security Administration

Kerskie said she recently had a client who had almost a quarter of a million dollars taken from his bank account precisely because he declined to link his bank account to an online identity

Plant your flag online or — as Kerskie puts it — “mark your territory” — before fraudsters do it for you. 

The bad guy can  your vendor/service provider, provide his personal details, and establish an online account,” Once they do that, they will be able to do anything.



https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/

Old but Useful - If you are a victim of Identity theft - What should you do next?

A 12-point checklist for victims of identity theft:

1. Change all account passwords
2. Notify affected creditors or bank
3. Put a fraud alert on your credit report
4. Check your credit reports
5. Consider putting a credit freeze on your reports
6. Contact the FTC - https://www.identitytheft.gov/
7. Go to the police
8. Send creditors a copy of your ID theft report
9. Contact credit reporting agencies
10. Contact the Social Security fraud hot line -  1-800-269-0271 / https://www.socialsecurity.gov/fraudreport/oig/public_fraud_reporting/form.htm
11. Get a new driver’s license
12. Contact your telephone and utility companies

https://www.bankrate.com/finance/credit/steps-for-victims-of-identity-fraud.aspx

Identity Theft - Thieves hack your account(ant) - Here is what one accountant did. (funny for us, not so for his clients)

John composed and distributed to his clients a form letter about their rejected returns, and another letter that clients could use to alert the IRS and New Jersey tax authorities of suspected identity fraud.

Despite receiving notice after notice that the IRS had rejected many of his clients’ tax returns because those returns had already been filed by fraudsters, for at least two weeks John does not appear to have suspected that his compromised computer was likely the source of said fraud inflicted on his clients.


Last month, KrebsOnSecurity was alerted by security expert Alex Holden of Hold Security about a malware gang that appears to have focused on CPAs. The crooks in this case were using a Web-based keylogger that recorded every keystroke typed on the target’s machine, and periodically uploaded screenshots of whatever was being displayed on the victim’s computer screen at the time.

The IRS advises taxpayers in this situation to follow the steps outlined in the Taxpayer Guide to Identity Theft. Those unable to file electronically should mail a paper tax return along with Form 14039 (PDF) — the Identity Theft Affidavit — stating they were victims of a tax preparer data breach.


I’ve long dispensed this advice for people in charge of handling payroll accounts for small- to mid-sized businesses. I continue to stand by this advice not because there isn’t malware that can infect Mac or Linux-based systems, but because the vast majority of malicious software out there today still targets Windows computers

https://krebsonsecurity.com/2018/04/when-identity-thieves-hack-your-accountant/

IMPORTANT - Let's say you are smart and you use your phone for 2 step SMS authentication but, you can still be vulnerable because of "Number Port-out Scams"

“You may not know this has happened until you notice your mobile device has lost service,”. “Then, you may notice loss of access to important accounts as the attacker changes passwords, steals your money, and gains access to other pieces of your personal information.”

Identity thieves can   “port” your mobile number out to another provider.Once in control of the mobile number, thieves can request any second factor that is sent to the newly activated device, such as a one-time code sent via text message or or an automated call that reads the one-time code aloud

Fraudsters can call a customer service specialist at a mobile provider and pose as the target, providing the mark’s static identifiers like name, date of birth, social security number and other information. Often this is enough to have a target’s calls temporarily forwarded to another number, or ported to a different provider’s network.


https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/

How bad can it get - Well, Cybercriminals Selling Social Security Numbers of Infants (for $300 worth of bitcoin )

Why - For those who indulge in fraudulent tax return 

Though a majority of people start thinking about filing their tax returns between March and April or later but for the Dark Web hooligans, the earlier a fraudulent tax return is filed the better would be the outcome.

In order to file a fake tax return, the trickster need to obtain the exact same information that is required to be entered when filing for the real tax return and what they need is easily available on the dark web all they need is to pay in bitcoin

https://www.hackread.com/cybercriminals-selling-social-security-numbers-infants-dark-web/

Some things you may not know about the risks associated with SSN

It’s only the last four digits that separate you from other Americans.

Using social media and other data, researchers found they could identify the first five numbers of 44% of deceased people born between 1988 and 2003 in just one attempt


When you carelessly give your Social Security number like you do your telephone number on Match.com, you are putting more than just your tax records in jeopardy. That number is also tied to your medical records, retirement accounts, and credit history

Contrary to popular belief, a new number is not a “get out of jail free” card. For one, it’s not that easy to secure a different number. According to AARP, only 400 new numbers were issued in 2016, despite having over 15 million people victimized by identity theft.


For More Info:
https://www.cheatsheet.com/money-career/worst-mistake-you-can-make-with-your-social-security-number.html/?a=viewall

Identity Theft via W-2 Phishing Scams

In this digitally connected world, we being smart is not good enough. Our information is stored and managed by many other organizations and all we need is one of them to make the mistake (Guess who suffers?)

Criminals harvesting W-2 information by spear phishing will probably not exploit them directly. These compromised data sets will probably be sold off on underground, Silk Road-like forums to a number of different small operators who will file fraudulent tax returns in the name of the victims.

For More Info:
http://www.infosecurity-magazine.com/news/55-companies-and-counting-fall-to/