New answers tagged

1

From the linked article: BioStar 2 is a web-based biometric security smart lock platform. A centralized application, it allows admins to control access to secure areas of facilities, manage user permissions, integrate with 3rd party security apps, and record activity logs. It seems that unless you have access to somewhere that uses biometrics for that (...


1

It sounds like you've created a document-template & saved it to the template-gallery in google-docs. This would make your template public. If you're using & paying for g-suite, you can (likely, I haven't tested this) make private templates. But if you're using the public/free google-docs, your templates will be made public. That's not to say your ...


0

First, suggest you to change credentials of everything you know of. There are hackers who love this kind of data and use this for their own usage like cyber attack, ransom ware and etc. Also same time initiate the complain to take down the site and stop spread of data on internet. These are important. First protect your business. Later you can go for ...


1

This is an addition to the other answer from the top (currently). I understand it's been 3 days already and we won't see an answer from OP, but I strongly suggest to anyone that will have this happen to them to consider the following. Understand how data leaks usually happen: third party contractors are targeted first. I will tell you that even the lowest, ...


2

I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome. Let the owner/COO/corporate counsel contact law enforcement. ...


17

If you are a regular member of staff at the company, your correct escalation should be through the Infosec team, and fall back to the Legal and IT departments if your company isn't big enough to have a dedicated Infosec team. I would also copy HR on any communication. This is an extremely serious scenario. If you don't know what to do (and the fact that ...


8

For getting it taken down, you could have a US lawyer issue a DMCA takedown notice to the hosting provider, asserting that you own the content and have not consented to it being distributed - this should get an immediate reaction if the hosting provider honours DMCA notices, to which the contractor can respond.


83

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data and avoid data that is not yours. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal ...


20

It should go without saying, but make sure that those login credentials are not working on your system. If they weren't deactivated when he left your organization (when they should have been), you'll want to audit your access logs to make sure they haven't been used since he left -- if they were on a public website where anyone could find them, you should ...


26

You typically want to contact the hosting company to take it down and hold all data and logs under a legal hold. You could also contact the other companies affected. Legally, you will need to contact a lawyer and the law enforcement in your jurisdition.


0

Waterhole intelligence is probably as good as you will get without an agent on the inside. Is it possible for someone outside of the search giants to determine what the people at AwSemCo are searching for on Google? Selling ads or ranking based on knowing what people are searching for is pretty much the primary business activity of a search engine. Search ...


0

Someone inside the company could: there are user behaviour analytics tools that will help with this. Given that search terms and the identity of who is searching for what is of massive importance to Google and therefore has a cash value, I expect their security and privacy engineers have burned many a brain cell to stop third parties getting that data


5

Viable? Probably not.... Years ago, I read an article proposing placing ads for a topic and targeting them to a geographic location. Then the mere fact that you got billed suggests that someone at the target location was googling your topic. I'm not sure it's very viable, as the author seemed mostly concerned about buying ads for their own name and limiting ...


1

It will depend on the specific implementation of the specific product and the specific message traffic. Data Loss Prevention tools tend to work in one of two ways: they sit on the network and look at logs, read emails, read file shares; or they are installed as a desktop agent which, the vendors assert, has full access to every keystroke, window, file and ...


Top 50 recent answers are included