In another tale of why companies can’t let their guards down, the music video site Vevo became the latest entertainment site victimized by hackers. Although the style of the cyber criminals is somewhat unique this time.
This past Friday morning OurMine, a group of hackers who describe themselves as “security assessment providers”, posted more than 3 terabytes of internal files accessed during the breach of Vevo. Over the last few years they have targeted numerous companies and high-profile individuals, in a guerrilla-style marketing effort for its own security services. The music video platform, controlled by Universal and Sony Music, was taken by surprise. But news like this should no longer come as a shock to major companies.
It appears this breach won’t be as publicly troublesome for Vevo, as it was for other victims of high-profile entertainment hacks over the past couple of years. Sony Pictures remembers this all too well. In 2015, Wikileaks released more than 30,000 documents and 173,000 emails from Sony that were obtained in a hack connected to North Korea. HBO also learned the hard way about hackers, when they fell victim to a security breach which saw a reported 1.5 terabytes of data snatched from them, including the email archive of some senior staff members.
OurMine has executed other prominent hacks before including Dropbox, LinkedIn, MySpace, just to name a few breaches. They even hacked the Twitter accounts of Facebook CEO Mark Zuckerberg, Google CEO Sundar Pichai, and former Uber CEO Travis Kalanick. OurMine hackers gained access via a Vevo employee’s LinkedIn account. They were then able to obtain and publicly release exactly 3.12TB worth of Vevo’s sensitive internal data.
It’s a helpless feeling knowing that at any moment your organization could be next. But you don’t have to feel this way. Here are a couple of helpful hints:
- Never download any attachments or click on any suspicious links sent through social media. If you do need to click on the link or attachment, use an open source malware detector.
- Use two-factor authentication on all of your social accounts. That way should a new device or browser connect to your account, you will immediately be sent a code via email or smartphone.
