Overnight Cybersecurity: Cyber gangs likely targeted Clinton’s email

Welcome to OVERNIGHT CYBERSECURITY, your daily rundown of the biggest news in the world of hacking and data privacy. We’re here to connect the dots as leaders in government, policy and industry try to counter the rise in cyber threats. What lies ahead for Congress, the administration and the latest company under siege? Whether you’re a consumer, a techie or a D.C. lifer, we’re here to give you …

THE BIG STORIES:

–THE NEXT-GEN SOPRANOS: The hackers who attempted to crack then-Secretary of State Hillary Clinton’s private email server were most likely part of an Eastern European cyber crime syndicate, experts said Thursday. These same syndicates have been known to sell pilfered information to the highest bidder and have increasingly strong ties to the Russian government, the same security researchers added. The Associated Press reported Wednesday night that Russia-linked hackers had targeted the private email account Clinton, who is running for president, used during her time as secretary of State. The discovery has underlined concerns about the security of the private server that hosted Clinton’s email. Clinton’s team has maintained there is no evidence her private system was breached at any point or that any classified information passed through it. “All these emails show is that, like millions of other Americans, she received spam,” Merrill said. And he’s right. According to specialists, the emails in question employ a common Eastern European cyber theft strategy. But in the last few years, these cyber gangs are increasingly acting as patriotic cyber militias, agreed several researchers. Directed or not, these groups are going after intelligence targets on behalf of Moscow and handing over their findings. To read our full piece, click here.

{mosads}–IT’S IN THE MAIL, I SWEAR: The millions of federal employees, contractors and others who have been waiting to find out whether their information was stolen during the Office of Personnel Management (OPM) data breach will soon have answers. The OPM began mailing notification letters to the 21.5 million individuals impacted by the breach this week, alerting them that their data was compromised and describing the suite of identity protection services they will receive for three years. The letters will also indicate whether an individual was one of the 5.6 million whose fingerprint data was taken as part of the heist. The timeline of the notification process has been under intense scrutiny. Because the company tapped to help the victims did not win its contract until two months after the breach was revealed, some people may not find out their data was taken until as late as November. To read our full piece, click here.

–YOU HAD ONE JOB, PHIL: T-Mobile said on Thursday that around 15 million of its U.S. customers may have been exposed in a data breach at one of its vendors. The hackers compromised encrypted data at Experian, which processes the telecom carrier’s credit applications, sometime between Sept. 1, 2013 and Sept. 16 of this year. The stolen data includes Social Security numbers and other ID numbers, such as driver’s licenses or passport numbers. Payment card and banking account information were not compromised because the hackers did not infiltrate T-Mobile’s networks, the company said. CEO John Legere took to the Internet to express his frustration: “Obviously I am incredibly angry about this data breach and we will institute a thorough review of our relationship with Experian, but right now my top concern and first focus is assisting any and all consumers affected,” Legere said in an open letter on the carrier’s Web site. “I take our customer and prospective customer privacy VERY seriously.” To read our full piece, click here.

–BONUS TOP STORY BECAUSE IT’S YOOOOGE: Donald Trump’s hotels have been hit by hackers, the luxury chain confirmed on its Web site. Trump Hotel Collection, owned by the presidential hopeful, has uncovered a data breach at seven of its locations during a period spanning over a year. The affected hotels were in New York, Miami, Chicago, Las Vegas, Waikiki and Toronto. The hotel says that its “independent forensic investigator” did not find any evidence that information was taken from its networks, but that customers’ payment information may have been exposed to malware when it was being punched into the system. Trump’s hotels have been under suspicion of a breach since July. To read our full piece, click here.

UPDATE ON CYBER POLICY:

–CLEAN YOURSELF! Rep. Anna Eshoo (D-Calif.) is urging the government to set voluntary cybersecurity guidelines to help U.S. companies and government agencies defend their networks from hackers. On Thursday, the California lawmaker, who is the top Democrat on the House Subcommittee on Communications and Technology, introduced the Promoting Good Cyber Hygiene Act. The bill would direct the government’s standards-setting body, the National Institute of Standards and Technology, to work with the Department of Homeland Security (DHS) and Federal Trade Commission to create the elective guidelines for securing networks. Some of the pointers might seem basic, such as not using a default password or regularly updating software. But cyber specialists report that the vast majority — up to 90 percent — of successful intrusions occur because of basic cybersecurity lapses. Eshoo called this “the scary truth” in a statement. But the upside, she added, is that “by instituting common sense best practices, system administrators can better protect their networks and consumer data from a majority of known cyber threats.”

Check out our full piece, here.

LIGHTER CLICK:

–VIDEO GAMES WILL SAVE US. Check out here how the UK government is using Minecraft to track down cybersecurity talent.

A MONTH IN FOCUS:

–A TIME OF REFLECTION. It’s National Cybersecurity Awareness Month and Sen. Tom Carper (D-Del.) wants to impart some helpful cyber tips for everyday Americans. 

• Set strong passwords.
• Keep software optimized by installing updates.
• Limit the amount of personal information you post online.

And our favorite: “Maintain an open dialogue with your family, friends, and community about Internet safety.”

Coincidentally, Congress may actually pass a cybersecurity bill during National Cybersecurity Awareness Month.

The Cybersecurity Information Sharing Act (CISA), which would expand the public-private exchange of data on hackers, is expected to come up some time in the next few weeks.

Carper called the month “an important reminder for Congress to meet our responsibility when it comes to securing cyberspace,” and urged his colleagues to pass CISA. “This kind of information sharing bill is critical to our national security, as well as the security of many private companies across our country.”

WHO’S IN THE SPOTLIGHT:

–ARI SCHWARTZ, the White House’s senior director for cybersecurity policy, who stepped down on Wednesday. Schwartz had long planned to leave after a couple of years on the job. Schwartz started at the White House in 2013 as the director for cybersecurity privacy, civil liberties and policy. In March 2014, he became the National Security Council’s senior director for cybersecurity policy. Prior to serving in the government, Schwartz made a name for himself as a leading privacy advocate in Washington, D.C. He was the vice president and chief operating officer of the Center for Democracy and Technology, a digital rights group.

Check out our full piece, here.

IN CASE YOU MISSED IT:

Links from our blog, The Hill, and around the Web.

The chairman of the House Intelligence committee is confident that the beleaguered Cybersecurity Information Sharing Act will eventually clear the Senate. (The Hill)

The online foreign exchange broker FXCM Inc. said Thursday that hackers made a “small number” of unauthorized transfers from customer accounts. (Reuters)

Researchers say a billion Android phones are vulnerable to new versions of Stagefright bugs. (Ars Technica)

The donation portal Patreon announced late Wednesday that it has suffered a security breach, compromising names and email addresses but no payment information. (Ars Technica)

If you’d like to receive our newsletter in your inbox, please sign up here: http://goo.gl/KZ0b4A