Forest Global Training Partners

Cyber Risks · Krebs on Security

Promising Jobs at the U.S. Postal Service, ‘US Job Services’ Leaks Customer Data

Summary: A Georgia-based operation selling USPS job coaching through sites like FederalJobsCenter exposed a database of nearly 900,000 customers, including full credit card records going back to 2016, along with a 2019 log file containing the site administrator's credentials to the back-end database. Constella Intelligence found the administrator's email, tied to a developer in Karachi, Pakistan, appeared in more than a year of Redline infostealer bot logs between 2021 and 2022, during which a Windows device used by him and colleagues uploaded usernames, passwords and authentication cookies to cybercriminals based in Russia.

Bottom line: Nearly 900,000 applicants who paid between $39.99 and $100 for postal job coaching had their full payment records left exposed, and the same backend was reachable by more than 160 users across Pakistan and a Tennessee call center. The FTC has sued over USPS job schemes since 1998 and won a nearly $5 million judgment in 2013, yet the pattern persists.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related