71–80 of 164 posts
EasyJet was the one hacked, the customers got their information stolen from the hack but were not themselves hacked.
Earlier quoted context omitted.
This reminds me of "identity theft". Someone didn't steal my identity, someone stole from the bank using my identity. It should really be called "bank fraud".
A great sketch about this https://www.youtube.com/watch?v=CS9ptA3Ya9E
stories like this make me so sad. its so clearly a result of the race-to-the-bottom system for journalism. theres a single word quoted from an unlisted source. how did we all get here? this is out of the BBC for christs sake. who's more foolish? the fool, or the fool who follows him?
The official incident notice is here [0]. > Following discussions with the Information Commissioner's Office ("ICO"), the Board of easyJet announces that it has been the target of an attack from a highly sophisticated source. [0] https://otp.investis.com/clients/uk/easyjet1/rns/regulatory-...
I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
vs
> The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.
So either EasyJet was delayed in their reporting of the breach, or the ICO didn't feel it was urgent to notify 9 million people that their data had been compromised. But it is now 4 months later?
I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
How much you wanna bet they weren't salting passwords in the backend?
Given the disallowed chars that's suggestive that the form used to be implemented as a GET, so it's possible passwords were in log files for a long time.
Earlier quoted context omitted.
A great sketch about this https://www.youtube.com/watch?v=CS9ptA3Ya9E
Weird how i just assumed this would be Michell & Webb. I've not seen much of there stuff, but it just felt like it was going to be skit of theres
EasyJet was the one hacked, the customers got their information stolen from the hack but were not themselves hacked.
This reminds me of "identity theft". Someone didn't steal my identity, someone stole from the bank using my identity. It should really be called "bank fraud".
> EasyJet said it first became aware of the attack in January. vs > The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible. So either EasyJet was delayed in their reporting of the breach, or the ICO didn't feel it was urgent to notify 9 million people that th…
(edit)Ah no, no mention of passwords being stolen, so I guess it's from somewhere else.
Earlier quoted context omitted.
How much you wanna bet they weren't salting passwords in the backend?
Possible, maybe not even hashed? Given the disallowed chars that's suggestive that the form used to be implemented as a GET, so it's possible passwords were in log files for a long time.