Page 15 - Threat Intelligence 9-3-2019

Data Breach

Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards - On Tuesday of this
week, one of the more popular underground stores peddling credit and debit card data stolen from
hacked merchants announced a blockbuster new sale: More than 5.3 million new accounts belonging to
cardholders from 35 U.S. states. Multiple sources now tell KrebsOnSecurity that the card data came from
compromised gas pumps, coffee shops and restaurants operated by Hy-Vee, an Iowa-based company that
operates a chain of more than 245 supermarkets throughout the Midwestern United States. The
restaurants affected include Hy-Vee Market Grilles, Market Grille Expresses and Wahlburgers locations
that the company owns and operates. Hy-Vee said it was too early to tell when the breach initially began
or for how long intruders were inside their payment systems.
Source: https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-
of-5m-stolen-credit-debit-cards/

Web host Hostinger says data breach may affect 14 million customers - Hostinger said it has reset user
passwords as a “precautionary measure” after it detected unauthorized access to a database containing
information on millions of its customers. The breach is said to have happened on Thursday. The company
said in a blog post it received an alert that one of its servers was improperly accessed. Using an access
token found on the server, which can give access to systems without needing a username or a password,
the hacker gained further access to the company’s systems, including an API database. That database
contained customer usernames, email addresses and passwords scrambled with the SHA-1 algorithm,
which has been deprecated in favor of stronger algorithms after researchers found SHA-1 was vulnerable
to spoofing. The company has since upgraded its password hashing to the stronger SHA-2 algorithm.
Hostinger said the API database stored about 14 million customers’ records. The company has more than
29 million customers on its books.

Source: https://techcrunch.com/2019/08/25/web-host-hostinger-data-breach/

Cybersecurity Firm Imperva Discloses Breach - Imperva, a leading provider of Internet firewall services
that help Web sites block malicious cyberattacks, alerted customers on Tuesday that a recent data breach
exposed email addresses, scrambled passwords, API keys and SSL certificates for a subset of its firewall
users. Redwood Shores, Calif.-based Imperva sells technology and services designed to detect and block
various types of malicious Web traffic, from denial-of-service attacks to digital probes aimed at
undermining the security of Web-based software applications. Earlier today, Imperva told customers that
it learned on Aug. 20 about a security incident that exposed sensitive information for some users of
Incapsula, the company’s cloud-based Web Application Firewall (WAF) product. “On August 20, 2019, we
learned from a third party of a data exposure that impacts a subset of customers of our Cloud WAF
product who had accounts through September 15, 2017,” wrote Heli Erickson, director of analyst relations
at Imperva.
Source: https://krebsonsecurity.com/2019/08/cybersecurity-firm-imperva-discloses-breach/

www.accumepartners.com
15