Three Recent Incidents Affect Individuals and Businesses

Time Warner Cable (TWC), Cloud hosting provider, Linode, and WordPress all have incident updates this week and two of them may be related.

Time Warner announced that up to 320,000 customers may have had information accessed. It believes they were retrieved via malware from a phishing attack or from a compromised system of one of their customers’ systems that contains TWC customer details. Time Warner said it was notified of the compromise by the FBI. Affected customers have been contacted and should reset their email passwords.

Linode has been fighting a Distributed Denial of Service (DDoS) attack since late December and has recently updated it customers that some of their credentials were found “in the wild.” The company has reset user passwords which followed a security investigation into the unauthorized login of three accounts that were found on an external machine. It is unknown if the DDoS attack and the access of credentials are related.

WordPress announced in December that some customer credentials were exposed from an attack on their WordPress Engine. The company has completed an investigation and determined a criminal was able to access that data via one of their cloud service providers; one of which is Linode. However, WordPress did not positively identify the cloud provider in its notice.

If you have accounts with any of these companies, change your account passwords immediately. Make sure you follow strong password practices:

• At least eight characters
• Combine upper and lower case letters
• At least one number
• At least one special character
• No dictionary words or phrases
• No personal details such as birthdates, addresses, or other identifying information
• Use unique login credentials for each online site (avoid password reuse).

All companies are working with law enforcement agencies to try and track down the criminals. TWC is offering password reset assistance to customers, if needed.

Although WordPress said that it would not have prevented this particular incident, it recommends enabling two factor authentication (2FA) for their WordPress site if you manage a WordPress site. It suggested using one of the following plugins: Google Authenticator or Clef, or use an external authentication system such as Google OAuth.