Thursday 1st August 2024

Good morning everyone, thank you for joining me for today's edition of Cyber Daily. Today we're covering everything from mega settlements to jaw-dropping ransom payments, its anything but ordinary. First up, Meta’s hefty $1.4 billion settlement with Texas over biometric data misuse sets a new precedent in privacy protection. Meanwhile, DigiCert’s race against the clock to revoke flawed security certificates has web admins scrambling. And, if you thought that was wild, a Fortune 50 company just paid a record-breaking $75 million ransom to the Dark Angels gang.

DigiCert's Certificate Revocation Surprise

Tick-tock, DigiCert customers! Some of you have just 24 hours to replace your SSL/TLS security certificates due to a five-year-old backend bug. DigiCert’s issuing process, which verifies domain ownership before providing certificates, was flawed. This resulted in certificates that don’t meet strict security standards, and now they’re being revoked out of an abundance of caution.

DigiCert estimates this affects about 0.4% of domain validations. The error lies in the validation method involving DNS CNAME records, where a crucial underscore was omitted from challenge values, making the certificates technically untrustworthy. Despite the extremely low chance of collision, the rules must be followed to maintain trust.

Affected customers need to log in to CertCentral, generate a new Certificate Signing Request (CSR), and follow the steps to reissue and install new certificates. DigiCert’s rush to fix the issue reflects the importance of maintaining robust security standards in cryptography.

Meta's $1.4B Privacy Settlement in Texas

Texas just scored big in the privacy protection game. Meta has agreed to a whopping $1.4 billion settlement with the Lone Star State over allegations that it used biometric data without user consent. This comes after a similar $650 million settlement in Illinois back in 2021.

Texas Attorney General Ken Paxton, who spearheaded the lawsuit, hailed this as the largest privacy settlement secured by a single state. Paxton stated, “This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights.”

Meta responded positively, expressing a desire to explore future business opportunities in Texas, including potential data center developments.

The lawsuit, filed in 2022, claimed Meta violated Texas law by capturing or selling residents' biometric data without consent. This marks another major hit for Meta, which has now paid over $2 billion in biometric privacy settlements, including a record $5 billion settlement with the FTC in 2019.

The settlement is significant but likely won’t impact Meta’s business heavily. The company reported a $12.37 billion profit in the first quarter of this year, with revenue surging 27% to $36.46 billion.

Texas isn’t done yet. The state has a similar pending lawsuit against Google for similar privacy violations, signaling a continued crackdown on tech giants over biometric data misuse.

Fortune 50 Company Pays $75M Ransom to Dark Angels

$75 million. That’s the staggering ransom payment a Fortune 50 company shelled out to the Dark Angels ransomware gang, setting a new record. The shocking amount was revealed in Zscaler ThreatLabz’s 2024 ransomware report, with crypto intelligence firm Chainalysis confirming the transaction on X (formerly Twitter).

This payout eclipses the previous record of $40 million, paid by CNA after an Evil Corp ransomware attack. While Zscaler didn’t name the company, speculation points to pharmaceutical giant Cencora, which suffered a cyberattack in February 2024. BleepingComputer reached out to Cencora but has yet to receive a response.

Launched in May 2022, Dark Angels employs a targeted approach, breaching networks, stealing data, and demanding hefty ransoms. They’ve evolved from using Babuk ransomware to a Linux encryptor linked to Ragnar Locker, focusing on high-value targets with their “Big Game Hunting” strategy.

Their notoriety surged after a $51 million ransom demand from Johnson Controls, where they claimed to have stolen 27 TB of data. Their data leak site, 'Dunghill Leaks,' is used to extort victims by threatening to release stolen data if ransoms aren’t paid.

The record $75 million payment is a grim milestone, highlighting the escalating stakes in cybersecurity and the growing audacity of ransomware gangs.