Cyber Risks · Krebs on Security

Fintech Startup Offers $500 for Payroll Passwords

Summary: A New York financial startup called Argyle offered gig workers up to $500, plus $25 a month while the credentials kept working, for the payroll usernames and passwords their employers gave them, according to ads on sites including workplaceunited.com. Argyle's payroll-connect pages listed login screens for Walmart, Starbucks, Amazon, Uber, Chipotle, the FBI, the Federal Reserve and the FTC, and the site checked submitted credentials by sending them directly to the employer.

Bottom line: Security researcher Kevin Beaumont warned that at some companies payroll credentials also work through single sign-on, so an employee selling a payroll password may be handing over far more access than they realize - and Krebs reported that legal departments at affected companies were launching their own investigations.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related