Retail News CRM

Tag: breach

  • SFC Fines UBS Over Regulatory Breaches

    SFC Fines UBS Over Regulatory Breaches

    Hong Kong’s Securities and Futures Commission reprimanded and fined UBS over regulatory breaches covering various areas including transparency client suitability.

    The SFC fined UBS AG and UBS Securities Asia Limited HK$9.8 million ($1.26 million) and $1.75 million, respectively, over various regulatory breaches, according to a statement.

    The issues covered areas ranging from lacking disclosures to client suitability issues.

    The SFC’s probe found that UBS failed to make proper disclosure of its financial interest in some Hong Kong-listed companies covers in its research reports for 14 years, between May 2004 and May 2018.

    The failure was caused by multiple data feed logic errors in a legacy data source used by UBS for tracking its shareholding positions, the securities regulator said.

    The SFC also found that UBS failed to fulfill various processes across client suitability and sales.

    It said the Swiss bank, in various time periods, failed to obtain valid standing authorities from clients who were not qualified as professional investors; record client order instructions; fully assess client derivatives knowledge; and disclose the stop loss event feature in a structured note.

    The SFC considers that UBS failed to act with due skill and care and put in place adequate systems and controls to ensure compliance with the applicable regulatory requirements,» the regulator said in the statement.

    Lees ook:

  • Humans cause 90% of cloud data breaches

    Humans cause 90% of cloud data breaches

    Incidents in public cloud infrastructure are more likely to happen because of a customer’s employees rather than actions carried out by cloud providers, according to a new Kaspersky Lab report.

    Companies expect cloud providers to be responsible for the safety of data stored on their cloud platforms, the report found. However, around 90% of corporate data breaches in the cloud happen due to social engineering techniques targeting customers’ employees, not because of problems caused by the cloud provider.

    Cloud adoption allows organizations to benefit from more agile business processes, reduced capex and faster IT provision. However, they also worry about cloud infrastructure continuity and the security of their data. At least a third of both SMB and enterprise companies are concerned about incidents affecting IT infrastructure hosted by a third party. The consequences of an incident may make the benefits of cloud redundant and instead evoke painful commercial and reputational risks.

    Even though organizations are primarily worried about the integrity of external cloud platforms, they are more likely to be affected by weaknesses far closer to home. A third of incidents (33%) in the cloud are caused by social engineering techniques affecting employee behavior, while only 11% can be blamed on the actions of a cloud provider.

    The survey shows there is still room for improvement to ensure adequate cybersecurity measures are in place when working with third parties. Only 39%  of SMBs and half (47% ) of enterprises have implemented tailored protection for the cloud. This may be the result of businesses largely relying on a cloud infrastructure provider for cybersecurity. Alternatively, they could have false confidence that standard endpoint protection works smoothly within cloud environments without diminishing the benefits of cloud.

    “The first step for any business when migrating to public cloud is to understand who is responsible for their business data and the workloads held in it,” Kaspersky Lab VP of global sales Maxim Frolov said.

    “Cloud providers normally have dedicated cybersecurity measures in place to protect their platforms and customers, but when a threat is on the customer’s side, it is no longer the provider’s responsibility. Our research shows that companies should be more attentive to the cybersecurity hygiene of their employees and take measures that will protect their cloud environment from the inside.”

    Lees ook:

    Lees ook:

  • Uniqlo shoppers Details Leaked Online

    Uniqlo shoppers Details Leaked Online

    Uniqlo parent Fast Retailing announced hackers may have gained access to personal information of 461,091 accounts registered on the company’s Japanese shopping websites.

    The retailer said in a statement Monday the hackers may have accessed customers’ personal information, purchase history and partial credit card numbers of some of the users of its Uniqlo Japan and GU Japan online stores from April 23 to May 10 by means of list type account hacking.

    List type account hacking is when user IDs and passwords are potentially leaked from other services or sites.

    The company said it is still investigating the breach and added the number of incidents and circumstances may change during the course of the investigation.

    In the meantime, the Japanese retailer advised its online store’s customers, the number of which the company has not disclosed, to use unique passwords and to avoid using passwords used from other websites to lower the chances of hackers accessing their accounts.

    “Fast Retailing sincerely apologizes for the trouble and concern this has caused to its customers and all others involved,” the company said.

    “Going forward, the company will further strengthen its security measures and take steps to ensure safety, in order to prevent similar incidents in the future.”

    The retailer said information that was potentially accessed includes:

    • Customer name (last name and first name)
    • The customer address (postal code, address, and apartment number)
    • Customer phone number, mobile phone number, email address, gender, date of birth, purchase history, and clothing measurements
    • Receiver name (last name and first name), address, and phone number
    • Customer partial credit card information (cardholder name, expiration date, and a portion of credit card number). The credit card numbers potentially accessed are hidden, other than the first four and last four digits. In addition, the CVV number (credit card security code) is not displayed or stored.

    In its announcement, Fast Retailing said it has identified the origin of the communication from which the unauthorized logins were attempted and has blocked access. The company added it is strengthening monitoring of other access points.

    The Japanese retailer said it has already disabled the passwords for the 461,091 user IDs that were compromised and is sending individual e-mails to each person affected, requesting that they reset their password.

    Fast Retailing has also filed a report of damages regarding the unauthorized logins with the Tokyo Metropolitan Police.

    Online sales made up 9.9 percent of Uniqlo sales in Japan and 20 percent in China in the company’s first-half report. The company said overall online sales rose 30.3 percent in that report.

    Lees ook:

  • True Move told to consider compensation over data leak

    True Move told to consider compensation over data leak

    Thai telecoms regulator NBTC has instructed mobile operator True Move H to assess the impact of its recent personal data leak and offer compensation to any affected customers.

    The regulator also plans to conduct a formal investigation into the incident and consider imposing punishments, and issue a letter demanding that mobile operators take appropriate steps to prevent similar breaches in the future.

    A security researcher recently revealed that the identity documents of up to 45,736 customers of True subsidiary iTrueMart had been exposed by being stored in a publicly-accessible Amazon S3 data bucket. The company also took more than a month to finally make the cache of files private.

    Researcher Niall Merrigan discovered the cache by scanning certificate transparency logs created when someone creates a new security certificate.

    Yet True Move H and parent True Corp are continuing to characterize the action as a data breach. A True Corp executive told that the company is considering taking legal action for hacking the data from the system, stating that he used “special tools to access data which he has no right to get into.”

    But a cloud expert noted that because the default setting for the AWS S3 service is private, True had to have intentionally set the data to public.

    Lees ook:

    Lees ook: