Latest news with #JakeMoore
Yahoo
10-07-2025
- Business
- Yahoo
Arrests made after M&S, Co-op and Harrods cyber attacks
Four people, including three teenagers and a 20-year-old woman, have been arrested in connection with a wave of cyber attacks that crippled M&S, the Co-op and Harrods. The group allegedly unleashed ransomware that stole millions of customer records, shut down online orders and left supermarket shelves bare. The National Crime Agency (NCA) said the individuals were arrested early on Thursday morning on suspicion of blackmail, money laundering, offences linked to the Computer Misuse Act and participating in the activities of an organised crime group. The arrests included a 17-year-old British man from the West Midlands, a 19-year-old Latvian man from the West Midlands, a 19-year-old British man from London and a 20-year-old British woman from Staffordshire. All four were arrested from their home addresses and remain in custody. The police also seized electronic devices from the properties. These arrests will be a 'massive blow to the gang of cybercriminals involved in these attacks' Jake Moore, cybersecurity advisor at ESET said, adding that while 'it won't eradicate future attacks… it will disrupt criminal networks'. 'It's extremely difficult to catch cybercriminals, primarily due to the tools on offer to obfuscate their involvement.' 'It shows the successes of law enforcement agencies working together in collaboration and how this remains the best way in catching digital criminals,' Moore said. A swathe of UK firms – including M&S, Harrods and the Co-op – have been attacked by cyber criminals this year, with Marks and Spencer taking a £300m loss due to disruption. Meanwhile, Co-op saw payments disrupted and shelves become bare from May because of the fallout of its cyber attack. Hackers also stole Co-op members' personal data, such as names and contact details. Harrods restricted internet access across its websites in May following attempts to gain unauthorised access to its systems. The arrests mark a breakthrough in police efforts to investigate the attacks, which had been linked to the Scattered Spider group of hackers. Moore warned that locating 'enough solid evidence' to produce in court and prosecute is 'the most difficult aspect in any cybercrime investigation… it will be vital that these agencies work thoroughly towards locating outright proof of their involvement.' Paul Foster, head of the NCA's National Cyber Crime Unit, said: 'Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the agency's highest priorities. 'Today's arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice. 'Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process.' An M&S spokeswoman said: 'We welcome this development and thank the NCA for its diligent work on this incident.' A Co-op spokeswoman said: 'Hacking is not a victimless crime. 'Throughout this period, we have engaged fully with the NCA, and relevant authorities and are pleased on behalf of our members to see this had led to these arrests today.' The chair of M&S, Archie Norman, appeared at a select committee earlier this week, calling for mandatory reporting on cyber incidents. 'It's not an overstatement to describe it as traumatic,' Norman said. 'We're still in the rebuild mode, and we will be for some time to come.' M&S has largely restored online services, but doesn't expect to fully return to normal until August. 'It's very rare to have a criminal act in another country or in this country… essentially trying to destroy your business,' Norman said. 'It's like an out of body experience.' Norman called for mandatory reporting on cyber attacks, supported by Professor Ciaran Martin, the founding director of the national cyber security centre (NCSC). 'M&S can and have looked after themselves. They've made their announcements; they're still trading well. But the criminals have given us a playbook here […] that is the worry,' Martin said. One boss described the recent wave of attacks as a 'youth crisis… kids are being groomed online by criminal gangs, drawn in through gaming forums and Discord servers.' It starts with curiosity, and before long, they're doing real harm to real people without fully understanding the consequences. We talk a lot about the damage cybercriminals cause, but we rarely talk about who the criminals are. Behind every major breach is often a teenager, and behind them is a story of missed opportunity,' Fergus Hay, CEO at Hacking Games said. 'Gaming is the gateway… it's where cybercrime culture thrives because no one is offering them an alternative. These kids will either become generational liabilities or generational assets. 'This is a social emergency. If we want to stop this from happening again, we need to meet kids where they are – in games, online, in the community. That means making cybersecurity feel relevant and giving them real opportunities to belong, contribute, and build something meaningful. We want to channel curiosity, not criminalise it.'
Daily Record
04-07-2025
- Daily Record
Google Chrome users warned to heed advice due to high-severity security threat
With hackers attacking the Google Chrome system, the tech giant wants users to take action so they aren't the next victim. Google is urging Chrome users to take action as hackers have once again attacked the system. With the popular web browser being used on over 3.5billion computers across the globe, if hackers manage to attack the system they will have an infinite amount of user data to exploit. Thankfully, for those who favour the Google Chrome browser, there is a simple way to give yourself added protection. The tech giant is urging users to quickly update their browser to help avoid becoming the attackers' next victim. While Google has said that they have patched up a high-severity issue that allowed cyber crooks to target and infiltrate computers, sadly some hackers were able to exploit this flaw and its users, reports the Express. The issue was found in a system called Chrome V8, from which criminals were able to make malicious webpages which could steal passwords and data from those who visited it. On top of this, the webpages were able to send out viruses and ransomware. While Google has confirmed that they fixed the flaw in the system, Chrome users should still update their browser for added security. Jake Moore, global cybersecurity adviser at ESE said: "Updating your devices and apps is vital and browsers are no different and just as essential to fix security holes like this one." Ranked as a high threat issue, Google's security bulletin gave the flaw - dubbed CVE-2025-6554 - a severity score of 8.1 out of 10. The threat was spotted by Clément Lecigne of Google's Threat Analysis Group (TAG) and the tech giant confirmed that cyber crooks had started to attack innocent Chrome users after they spotted the vulnerability in the system. While Google Chrome should normally update automatically, it is advised that users should immediately update to the latest version for added security against scammers. For those who don't update their browser, they will be more vulnerable to things such as arbitrary code execution, which is a serious security vulnerability. Leaving your browser on a lower system level can leave it vulnerable to a variety of risks such as system compromises, data breaches and other harmful outcomes. For those unsure on how to update their Google Chrome browser, simply go to the Google Chrome menu and select 'About Chrome'. There users should see which version is currently installed on their device. To be protected against the latest attack, computer users need to be running: 138.0.7204.96/.97 for Windows 138.0.7204.92/.93 for Mac 138.0.7204.92 for Linux Another way people can protect themselves from scammers is by creating strong passwords. The Federal Trade Commission recommends creating secure and strong passwords, as well as not using the same password for every site. Additionally, you should never leave your devices unattended and unlocked in places where someone may be able to access your details. Join the Daily Record WhatsApp community! Get the latest news sent straight to your messages by joining our WhatsApp community today. You'll receive daily updates on breaking news as well as the top headlines across Scotland. No one will be able to see who is signed up and no one can send messages except the Daily Record team. All you have to do is click here if you're on mobile, select 'Join Community' and you're in! If you're on a desktop, simply scan the QR code above with your phone and click 'Join Community'. We also treat our community members to special offers, promotions, and adverts from us and our partners. If you don't like our community, you can check out any time you like. To leave our community click on the name at the top of your screen and choose 'exit group'.
Daily Mail
03-07-2025
- Daily Mail
Update your browser NOW: Google Chrome is hit by a serious security flaw – and hackers have already exploited it
It is the most popular web browser on the planet and is installed on over 3.5 billion computers. But Google Chrome users have now been warned to update their browser immediately to avoid being targeted by hackers. In a security bulletin, Google says it has now patched a high-severity issue which allowed criminals to infiltrate target computers. And the tech giant says that criminals, even possibly nation states, have already exploited it. The issue was found in a system called Chrome V8, which allows the browser to run code found on websites efficiently. However, the flaw allowed hackers to create malicious webpages which could steal visitors' data, passwords, or even deploy viruses and ransomware. Google says it has now fixed the vulnerability, but you will need to ensure your browser is updated to the latest version to be protected. Jake Moore, global cybersecurity advisor at ESET, told MailOnline: 'Updating your devices and apps is vital and browsers are no different and just as essential to fix security holes like this one.' This bug allowed hackers to execute so-called 'read/write' operations, allowing them direct access to information on the browser. Mr Moore says: 'Criminal hackers could have been able to take advantage of this vulnerability to read anything stored in the browser's memory, which, worryingly, could include sensitive information like passwords. 'If a threat actor were to get into an account with such credentials, they could then target other people in the victim's contacts with relative ease.' Google's security bulletin gave the vulnerability, dubbed CVE-2025-6554, a severity score of 8.1 out of 10 - ranking it as a 'high' threat issue. The flaw is particularly attractive to criminals because it is a 'zero day' exploit, meaning that the flaw wasn't even known to Chrome's developers. These are risky because criminals can often start using zero-day exploits to launch attacks before a security patch is prepared. In this case, Google has confirmed that hackers have already been exploiting the vulnerability to launch attacks. The bulletin says: 'Google is aware that an exploit for CVE-2025-6554 exists in the wild. Google says it won't be releasing any more information until 'a majority of users are updated with a fix.' However, based on the team that spotted the issue, the attacks may have been made by very powerful groups. The vulnerability was spotted by Clément Lecigne of Google's Threat Analysis Group (TAG). This cybersecurity organisation is usually responsible for tracking threats posed by nation-states and so-called advanced persistent threats (APTs). Given that the flaw has already been exploited, it seems likely that it may have been used by nation states in highly targeted attacks. Previous flaws in Chrome V8 have been used in the past to hack journalists, political dissidents, IT admins and other key targets for interference. Mr Moore says: 'A flaw this serious could be used by anyone with the determination and the right knowledge to take advantage of it, which could easily include nation state actors. 'Such groups often look for extremely powerful vulnerabilities to spy on highly targeted people, such as government employees, like with the infamous Pegasus spyware.' Google has already patched the issue, so ensure that you are updated to the latest software version to get protected Google Chrome is usually updated automatically, installing all the latest security patches. However, if you want to ensure you are protected, you can also manually check your software version and update the browser. First, open the browser and select the drop-down menu in the top-right-hand corner. From there, click on Help, and select 'About Google Chrome'. This will show your current software version, which should be updated to 138.0.7204.96/.97 for Windows, 138.0.7204.92/.93 for macOS, and 138.0.7204.96 for Linux. If you are not on the latest version of the software, select 'Relaunch' to restart Chrome and install the update. If the 'Relaunch' button is not visible, this means you are already on the most up-to-date version. Google has been contacted for comment. HOW TO CHECK IF YOUR EMAIL ADDRESS IS COMPROMISED Have I Been Pwned? Cybersecurity expert and Microsoft regional director Tory Hunt runs 'Have I Been Pwned'. The website lets you check whether your email has been compromised as part of any of the data breaches that have happened. If your email address pops up you should change your password. Pwned Passwords To check if your password may have been exposed in a previous data breach, go to the site's homepage and enter your email address. The search tool will check it against the details of historical data breaches that made this information publicly visible. If your password does pop up, you're likely at a greater risk of being exposed to hack attacks, fraud and other cybercrimes. Mr Hunt built the site to help people check whether or not the password they'd like to use was on a list of known breached passwords. The site does not store your password next to any personally identifiable data and every password is encrypted Other Safety Tips Hunt provides three easy-to-follow steps for better online security. First, he recommends using a password manager, such as 1Password, to create and save unique passwords for each service you use. Next, enable two-factor authentication. Lastly, keep abreast of any breaches
Daily Mail
16-06-2025
- Daily Mail
Cybersecurity experts issue urgent warning over clicking the 'unsubscribe' button in emails
Nobody likes to see their email inbox flooded with hundreds of pieces of junk mail and spam. But cybersecurity experts warn that unsubscribing from all those annoying mailing lists could be putting you at serious risk. Experts say that hackers are now using fake 'unsubscribe' buttons to steal your passwords and personal information. At least one in every 644 subscription links can actually lead to a malicious website, according to an analysis by DNSFilter. That might not sound like a large amount, but with spam emails making up around 45 per cent of all emails worldwide, that translates into a lot of dangerous links. Jake Moore, global cybersecurity advisor at ESET, told MailOnline: 'Criminals use links to lure in their victims and will sometimes cleverly place fake unsubscribe links in their emails to trick recipients into clicking on them. 'But not only will this confirm that the email address is active, making it a target for more scams, it could also redirect someone to a fake website in an attempt to collect personal details or login information. 'In extreme cases, it could even automatically download malicious software onto the device without the person's knowledge too.' Since 2003, most businesses sending marketing emails to UK customers have been required by law to tell recipients how to opt out of future messages. Typically, this takes the form of an 'unsubscribe' link at the bottom of the email which redirects the user to a website where they can opt out of the mailing list. What makes this risky from a cybersecurity perspective is that, by clicking the link, you are leaving the protected environment of your email client and entering the open web. Here, you are a lot less protected from malicious attacks and criminals have a lot more ways of getting to your valuable data. In the least dangerous scenario, clicking this link simply tells the sender that your email address is active and that you are checking your messages. Mr Moore says: 'In most cases it will actually increase spam by confirming a live email address and that they actively read their emails. However, in more serious cases, these fake links can have much bigger consequences. As Mr Moore points out, you might be redirected to a 'phishing' website. Experts say that criminals are using these links to lure their victims onto malicious web pages where they can steal their data (stock image) How to unsubscribe safely If spam emails are clogging up your inbox and you don't trust the unsubscribe link, there are safer ways to opt-out. One option is to directly unsubscribe through your email client using a button which should appear at the top of the email. For example, if you open an email in Gmail, you should see a blue 'unsubscribe button' at the top of the page next to the sender's address. Since these links are generated by your email client, they won't contain malicious code and should be safe. If this option doesn't appear you can also use your email filters to avoid getting any more emails from the sender without unsubscribing. These pages can be cleverly designed to look like the websites of legitimate businesses but are entirely designed to harvest your data. For example, you might be asked to 'confirm your identity' by providing details such as your name and phone number, which can help hackers attempt more sophisticated attacks. Alternatively, the hackers might try to steal your passwords by asking you to 'log in' in order to opt out of further emails. In order to avoid these attacks, it is important to bear in mind that you can't trust everything that arrives in your email inbox. Tim Keanini, DNSFilter CTO, told The Wall Street Journal: 'Trust is relative. I trust my email client, but I don't trust what's inside the email.' That means you shouldn't click on any links in an email if you don't 100 per cent trust the person sending it to you. Mr Moore adds: 'Generally, messages that try to create panic or some sort of urgency are deemed ones to look out for as this is still a direct tactic used by criminals to entice a reaction.' 'If the email looks suspicious, it's best to avoid clicking anything in it at all.' But if the spam emails are clogging up your inbox and you don't trust the unsubscribe link, there are safer ways to opt-out. One option is to directly unsubscribe through your email client using a button which should appear at the top of the email. For example, if you open an email in Gmail, you should see a blue 'unsubscribe button' at the top of the page next to the sender's address. Since these links are generated by your email client, they won't contain any malicious code and should be safe to click. If this option doesn't appear you can also use your email filters to avoid getting any more emails from the sender without unsubscribing. Mr Moore says: 'It's generally safer to mark the email as spam or junk using the email provider's tools which helps filter similar messages in the future. 'People can also block the sender entirely too, if they feel that isn't working.' By doing this, you can keep your inbox clear of junk without needing to follow any potentially risky links. Have I Been Pwned? Cybersecurity expert and Microsoft regional director Tory Hunt runs 'Have I Been Pwned'. The website lets you check whether your email has been compromised as part of any of the data breaches that have happened. If your email address pops up you should change your password. Pwned Passwords To check if your password may have been exposed in a previous data breach, go to the site's homepage and enter your email address. The search tool will check it against the details of historical data breaches that made this information publicly visible. If your password does pop up, you're likely at a greater risk of being exposed to hack attacks, fraud and other cybercrimes. Mr Hunt built the site to help people check whether or not the password they'd like to use was on a list of known breached passwords. The site does not store your password next to any personally identifiable data and every password is encrypted Other Safety Tips Hunt provides three easy-to-follow steps for better online security. First, he recommends using a password manager, such as 1Password, to create and save unique passwords for each service you use. Next, enable two-factor authentication. Lastly, keep abreast of any breaches
Daily Mail
15-06-2025
- Business
- Daily Mail
Warning issued to Sainsbury's customers after two years of Nectar points stolen
Experts have issued a fresh warning to Sainsbury's customers after a shopper reported having two years of her Nectar points stolen. This is Money revealed earlier this year that Nectar had introduced a 'lock' feature on its loyalty card scheme, meaning any account can be freezed until the customer decides to spend their reward points. The announcement came after an investigation revealed that 12.5 million Nectar points worth nearly £63,000 had been stolen from our readers over the period of a year. And just last week, another customer reported on social media that 3,000 points had been stolen from her account after they were used in a Twickenham branch. She posted: 'Someone has stolen 3,000 of my Nectar points? 'I have never been to Twickenham in my life and I have been saving these points for two years to help pay for Christmas. Please look into this.' The claims have prompted cybersecurity experts to urge customers to take a fresh look at their accounts in order to prevent potentially criminal activity. 'It's especially important to monitor accounts more often just before Christmas,' Jake Moore, Eset's Global Security Advisor told The Sun. 'This is usually when criminals target accounts with points that have been accumulated over the year.' He added that accounts should be checked 'frequently to detect and report any unauthorised actions promptly'. Only primary users of the account should be able to lock and unlock spending on their Nectar accounts with the new locking feature, while additional collectors will only be able to collect points. It was brought in to allow customers to start saving their points again without fear of them being stolen by fraudsters. Thankfully most of the customers affected in This is Money's investigation were refunded by Sainsbury's, which owns Nectar. A Nectar spokesperson today told MailOnline: 'Nectar is one of the UK's biggest loyalty schemes, with over 23 million members. 'The security of our customer accounts is our highest priority and the proportion of those impacted by fraud each year is very small. 'We have a range of measures which detect, and in many cases prevent fraud, including our Spend Lock feature. 'Our Nectar Helpline team are on hand to support any customer who suspects they may have been a victim of fraud.'
