Say for example you read about a data breach affecting an organization you once associated with years ago. You may think because so much time has passed that your information wouldn’t be at risk.

This is not always the case. Organizations may hold onto sensitive information for years on end, thus, while you may not have associated with the targeted entity for some time, it doesn’t mean you are out of the woods. If cybercriminals can gain access to any stored information, they will do so, regardless of how long it has been held.

In this installment of the BlackCloak Thursday Threat Update, we’ll look at a data breach that may affect individuals over a 16 year period. Additionally, the FBI issued a warning over NFT scammers.

 

Colorado Department of Higher Education breach spans 16 year period

What we know: The Colorado Department of Higher Education disclosed it experienced a data breach affecting an unknown number of current and past students, as well as teachers. Potential victims include anyone who has attended a Colorado public high school from 2004 to 2020, anyone who attended a public institution of higher education in the state from 2007 to 2020 and anyone who obtained a Colorado K-12 public school educator license between 2010 to 2014. Exposed information included names, Social Security numbers, dates of birth, photocopies of government IDs and proof of addresses.

Recommendations: In its notice on the breach, the Colorado Department of Higher Education said it will offer 24 months of complimentary access to Experian IdentityWorks for anyone affected by the breach. The offer is valid until November 30, 2023. The CDHE also advises potentially impacted individuals to monitor their accounts for fraudulent activity, and also set up a designated hotline for anyone to call should they have questions.

 

FBI issues warning over NFT scammers

What we know: The FBI issued a warning over cybercriminals deploying NFT-based scams to try and trick victims into turning over cryptocurrency. In this scam, cybercriminals will either commandeer an NFT developer’s social media account, or create a nearly identical duplicate, and begin to promote exclusive NFT releases. By creating a sense of urgency, cybercriminals hope targets will click the links attached to these posts, which will direct individuals to phishing websites that appear to be similar to those of legitimate NFT developers. The phishing website will ask visitors to connect their cryptocurrency accounts to the page, where the cybercriminal will then steal the victim’s funds.

Recommendations: The FBI advises anyone who sees one of these “opportunities” to research whether the developer has had surprise releases in the past, or if they have previously said they will never do so in past posts. The FBI also advises people to pay close attention to the social media account of these developers to see if there are any suspicious attributes, such as misspellings, number of followers and account creation date. It’s also a good idea to pay attention to the spelling of any website URL. Cybercriminals will set up fake websites with names similar to those of legitimate websites, but may have a slight deviation of spelling, or a different domain ending. This is a practice known as “typosquatting.” The FBI advises anyone who thinks they are a victim of such a scam to report it to the FBI’s Internet Crime Complaint Center.

 

Protect your crypto accounts

Cryptocurrency is popular among cybercriminals, as the nature of the currency allows for malicious actors to easily cover their tracks after a crime has been committed. It’s important for crypto holders to take the proper steps to protect their accounts and funds.

 

Learn how to protect your cryptocurrency accounts using two factor authentication methods beyond SMS text messages, and how cybercriminals leverage SIM hijacking techniques to compromise crypto accounts.