Social scams (or social engineering) are designed to trick someone into releasing sensitive information. Social scammers look for access to company information like financial data, intellectual property, personnel records, customer databases and personal or financial information that can be used to steal people’s identities. Unlike phishing, these scams can be highly personalized, and often involve a telephone call, contact through social media platforms, and even in-person interactions.
A partner you can trust
According to open source tracker Ransomware Live, the El Dorado ransomware group claimed responsibility for the attack in November. Transform how you manage cyber risk with the CRPM platform that unifies risk across your entire organization. Adam Levin, chairman and founder of IDT911, told Infosecurity that while ADP isn’t saying much about who the victims are, the overall number of people affected is likely to be significant. Welcome to Daily Security Review, the premier source for news and information on security threats, Ransomware and vulnerabilities. Norton Rose Fulbright is currently helping multiple companies investigate and respond to these types of incidents.
According to BuzzFeed News, sellers on two dark web stores are hawking information from 278,531 InstaCart accounts. South African branch of consumer credit reporting agency Experian discloses data breach. It says it gave personal details of South African customers to a fraudster posing as a client.
US Federal Authorities Indict Hacker Behind LockerGoga and MegaCortex Ransomware Attacks
Fortra is creating a simpler, stronger, and more straightforward future for cybersecurity by offering a portfolio of integrated and scalable solutions. The only Broadcom company listed among the various file directories on BlackLock’s leak site is VMware, although Broadcom has not confirmed the scope of the incident. The El Dorado leak blog has been unavailable since March, and BSH appears as a victim on BlackLock’s site, which remains online.
Broadcom itself was not alerted to the details until May 12, 2025—almost eight months after the initial intrusion. Broadcom serves some of the world’s largest companies across key industries such as technology, finance, and telecommunications—its clients include Apple, Samsung, Cisco, and British Airways, among others. While The Register notes that ADP itself has not been publicly tied to any direct data loss in this incident, its partner’s breach still raises questions about supply chain cybersecurity risks. Broadcom responded to the breach by urging affected individuals to enable multi-factor authentication (MFA) on all financial accounts and to monitor financial activity closely. The company emphasized the need for elevated personal security precautions in light of the data exposed. We’re committed to keeping our products and services running smoothly so you can serve your employees.
Ransomware Incident Involving ADP Partner Compromises Broadcom Employee Data
We deliver advanced services and technology for data security, privacy, fraud, and crisis management—all so you can stay focused on your business. This firm is a business partner of payroll company ADP adp security breach which, in turn, worked with Broadcom. In fact, the chip giant was in the process of switching payroll providers when the incident happened, meaning it almost dodged that bullet. According to internal communications cited by The Register, BSH/ADP discovered the breach in late September 2024. However, it was not until December 2024 that they realized employee data had been made accessible on the internet. Because the stolen information was in an “unstructured format,” as noted in the company’s notification to affected staff, BSH and ADP faced significant delays in identifying the full scope of impacted data and individuals.
- Similarly, earlier this year the University of Virginia reported that hackers broke into a component of their HR system and attained access to sensitive employee information such as W2s and banking details.
- I can only hope some tax anticipation loan company is out the value of my fake return, and will improve their screening in the future.
- The website with the most passwords stolen was Facebook with 318,000, however the hacked company that possesses the biggest risk to businesses is ADP, which is a popular payroll management app.
Protecting our clients and their data from malicious activity is a top priority for ADP. Some sites ask personal questions like how you met you spouse, the color of your first car or your favorite pizza topping to validate your password. These answers are often found on social media or have very common answers that are easily guessed. The best way to use these questions are to choose a random selection (if multiple choice) or enter a wacky response if open text (you can say that your favorite pizza topping is basketballs!). We share 4 of the most common fraud practices and what you can do to protect your business against them.
Cybercrime is now using a process called “Flowjacking”, and are able to determine the work and data flow of ADP’s internal processes. They found out that setting up a user account with the company was a two-step process. The first step involves setting up the account, which requires social security numbers and other personal data that is easily available in the underground internet economy. A ransomware attack at a Middle Eastern business partner of payroll company ADP has led to customer data theft at Broadcom, The Register has learned. The episode highlights the growing imperative for real-time information sharing among vendors, clients, and authorities when sensitive data is involved.
of US Companies Hit by Insider Data Breaches
A similar breach once happened to UltiPro, another payroll and HR management provider. If you have questions about how to address potential phishing scams, system vulnerabilities or fraudulent activity, the following FAQs may help. In this blog I have warned for years that cybercrime has gone pro, and that the sophistication of their attacks is only going up. The last few months they have targeted HR and Accounting, trying to social engineer employees in those departments to respecitvely get W-2 information and large wire transfers done. It’s truly a measure of the challenges ahead in improving online authentication that so many organizations are still looking backwards to obsolete and insecure approaches. ADP’s logo includes the clever slogan, “A more human resource.” It’s hard to think of a more apt mission statement for the company.
Canadian Financial Regulator Hacked, Exposing Personal Data from Member Organizations
Be wary of anyone who requests any sort of personal information in any unsolicited form of communication. Verify the legitimacy of the person with the company directly before providing any information. Do not click on any links or attachments within the message and do not respond to the sender.
ADP said the breach did not involve payroll data, and the information that was at risk was part of a product ADP’s benefits administration business no longer sells. Office of the Comptroller of the Currency fines Capital One $80 million for data breach that resulted in the unauthorized access to the data of 100 million current and potential customers. “The HPOU was notified that ADP had a security breach in relation to the City’s online W-2s. This breach is extremely low risk but does potentially affect approximately 1,300 classified HPD employees. ADP is sending letters to all employees affected and offering a free year of ID theft protection,” the entry said.
- Verify the legitimacy of the person with the company directly before providing any information.
- According to BuzzFeed News, sellers on two dark web stores are hawking information from 278,531 InstaCart accounts.
- It’s understood Broadcom’s HR department has begun the process of informing current and former staff who are affected by the September ransomware attack at Business Systems House (BSH).
- Such data, according to the ADP, were not harvested from its systems, but must have already been in the hands of the crooks.
- A serial entrepreneur and data security expert with 30 years in the IT industry, Stu was the co-founder of Inc. 500 company Sunbelt Software, a multiple award-winning anti-malware software company that was acquired in 2010.
“In late September, 2024, BSH/ADP became aware of the ransomware attack,” reads an email to affected individuals. It’s understood Broadcom’s HR department has begun the process of informing current and former staff who are affected by the September ransomware attack at Business Systems House (BSH). If you use ADP, your best move from here is to contact them directly to find out if any of your employee records were impacted. It is also probably a good idea to have your networked scanned and evaluated for security risks.
In addition, a dedicated global team monitors round-the-clock using additional comprehensive controls, including data analytics, to detect, investigate and respond to anomalies and incidents. This team addresses any reported or detected issues by following a defined incident lifecycle. This lifecycle is governed by policies and procedures, and uses an incident management system to record facts, impact and remedial actions taken. Armed with a stolen social security number and a code grabbed from some public domain source, hackers can inject themselves into ADP’s normal process, and make off with thousands, and perhaps even millions of people’s personal information. HR giant ADP, which provides payroll, tax and benefits administration for more than 640,000 companies, was hit hard by identity thieves this week. The perps made off with tax and salary data, according to a report from Brian Krebs—although the actual number of people affected has yet to be revealed.
Products & Services
ADP emphasized that the fraudsters needed to have the victim’s personal data — including name, date of birth and Social Security number — to successfully create an account in someone’s name. ADP also stressed that this personal data did not come from its systems, and that thieves appeared to already possess that data when they created the unauthorized accounts at ADP’s portal. The incident’s timeline underscores the challenges organizations face in monitoring and securing extended vendor ecosystems. Broadcom, a multinational semiconductor and infrastructure software company, had utilized ADP for payroll processing, with BSH functioning as ADP’s regional provider in the Middle East. At the time of the breach, Broadcom was already in the process of transitioning away from both ADP and BSH, but crucially, the switch had not been finalized when attackers struck. Companies are urged to reassess their cybersecurity protocols and incident response strategies to mitigate the risks posed by such attacks.