Reference no: EM133432533

Assignment:

Discussion:

Respond to these two discussions. Use your own opinion.

1.) In November 2022, T-Mobile had a data breach of 37 million customers through an API vulnerability. The data accessed includes customer names, addresses, phone numbers, email addresses, and birth dates. No sensitive information like passwords or SSNs were accessed. They first knew about it on January 5, 2023, and put a stop to it within a day. Source: Strangely, the official T-Mobile press release about the data breach doesn't include the day that they learned about the attack, but instead they put it in their SEC filing.

In December 2022, an Activision HR employee fell for an SMS phishing attack that exposed employee names, work email and phone numbers, pay, work addresses, etc. What I find interesting is that Activision's official statement on the data breach claims that no sensitive data was compromised, but to me, the data that was accessed seems a bit sensitive to me. Also, the way they worded it makes the breach seem less impactful than it actually is.

On February 5, 2023, a Coinbase employee fell for a phishing attack that gave away their login credentials. However, 2FA thwarted the plan and (I think?) prevented the attacker from gaining access to the employee's account. The only data accessed was employee names, email address, and phone numbers.

2.) I use one of these myself- not LastPass though. LastPass has suffered successful attacks before, which crushed their reputation as far back as August. This newest attack featuring a keylogger allowed for the attacker to record an admin's password, get into the cloud database, and steal mass amounts of information, compromising innumerable passwords.