The New York Times notified an unknown number of contributors that some of their sensitive personal information was stolen and leaked after their GitHub in January 2024.
See also: Truist Bank: Data breach affects employees
As the Times reported last week, attackers used exposed credentials to hack the newspaper's GitHub repositories. However, the breach did not affect the newspaper's internal corporate systems or operations.
The information stolen during the incident includes first and last names, as well as various combinations of phone numbers, email addresses, mailing addresses, nationality, resume, website URLs, and social media usernames of affected individuals.
In addition, the compromised New York Times repositories also included job-related information, such as diving and drone certifications or access to specialized equipment.
273 GB of data stolen in GitHub repo hack
A 273GB containing stolen New York Times data was leaked on the 4chan message board last Thursday.
“Basically all of the source code owned by The New York Times Company, 270 GB,” the 4chan forum post said. “There are about 5 thousand repos (of which less than 30 are additionally encrypted), 3.6 million files in total.”
See also: Life360 reports blackmail attempt after Tile data breach
“Around June 6, 2024, a posting on another third-party website made this data, including a file containing some of your personal information,” the Times confirmed in data breach notification letters sent to affected partners.
The folder names indicate that a wide variety of information has been stolen, including IT documentation, infrastructure tools, and source code, which reportedly includes the viral game Wordle.
A “readme” file states that the threat actor used an exposed GitHub token to compromise the New York Times repositories and steal the data.
The New York Times advises anyone affected by this data breach to be wary of unexpected emails, phone calls or messages asking for personal information such as usernames, passwords and dates of birth, which could be used to gain access to their accounts without permission.
The newspaper also warned them to make sure their personal accounts, including email and social media accounts, have strong passwords and two-factor authentication to block unauthorized access attempts.
See also: Cylance: Data breach via third-party hacking
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
A data breach, such as that of The New York Times, is a security incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen by an unauthorized individual or group. These breaches can involve various types of information, such as personally identifiable information, financial records, or proprietary company data. Data breaches can occur due to many factors, including cyberattacks ,insider threats, or even accidental exposure. The consequences of such breaches can be severe, leading to financial loss, reputational damage, and legal consequences for the affected individuals and organizations. It is important to implement strict security measures and policies to protect against data breaches and respond quickly and effectively in the event of a breach.
Source: bleepingcomputer
