Zack Whittaker

Security Editor, TechCrunch

Zack Whittaker is the security editor at TechCrunch. You can send tips securely via Signal and WhatsApp to +1 646-755-8849. He can also be reached by email at zack.whittaker@techcrunch.com.

Zack Whittaker

Featured Article

Two Santa Cruz students uncover security bug that could let millions do their laundry for free

CSC ServiceWorks provides laundry machines to thousands of residential homes and universities, but the company ignored requests to fix a security bug.

3 days ago
Two Santa Cruz students uncover security bug that could let millions do their laundry for free

Featured Article

‘Got that boomer!’: How cybercriminals steal one-time passcodes for SIM swap attacks and raiding bank accounts

Estate is an invite-only website that has helped hundreds of attackers make thousands of phone calls aimed at stealing account passcodes, according to its leaked database.

5:05 am PDT • May 13, 2024
‘Got that boomer!’: How cybercriminals steal one-time passcodes for SIM swap attacks and raiding bank accounts

The federal government agency responsible for granting patents and trademarks is alerting thousands of filers whose private addresses were exposed following a second data spill in as many years. The…

US Patent and Trademark Office confirms another leak of filers’ address data

U.S. realty trust giant Brandywine Realty Trust has confirmed a cyberattack that resulted in the theft of data from its network. In a filing with regulators on Tuesday, the Philadelphia-based…

Brandywine Realty Trust says data stolen in ransomware attack

UnitedHealth’s CEO said in congressional testimony that the portal used by the hackers to break into Change Healthcare was not protected with a basic security feature.

Change Healthcare hackers broke in using stolen credentials — and no MFA, says UHG CEO

Kaiser, one of the largest healthcare organizations in the United States, said it was notifying 13.4 million members of a data breach earlier in April.

Health insurance giant Kaiser will notify millions of a data breach after sharing patients’ data with advertisers

Featured Article

Security bugs in popular phone-tracking app iSharing exposed users’ precise locations

The location-sharing app iSharing, which has 35 million users, fixed vulnerabilities that exposed users’ personal information and precise location data.

7:01 am PDT • April 24, 2024
Security bugs in popular phone-tracking app iSharing exposed users’ precise locations

Featured Article

UnitedHealth says Change hackers stole health data on ‘substantial proportion of people in America’

The health tech giant processes 15 billion health transactions a year, and handles health information for about half of all Americans.

3:35 pm PDT • April 22, 2024
UnitedHealth says Change hackers stole health data on ‘substantial proportion of people in America’

CISA said Chirp Systems ignored the federal agency and the reporting security researcher.

US government downgrades bug in Chirp Systems app that contained hardcoded password

House and Senate lawmakers passed a bill reauthorizing the controversial Section 702 powers under FISA, which allows U.S. spy agencies to conduct warrantless searches of Americans’ communications.

Lawmakers vote to reauthorize US spying law that critics say expands government surveillance

Featured Article

Your Android phone could have stalkerware — here’s how to remove it

This simple guide helps you identify and remove common consumer-grade spyware apps from your Android phone.

2:15 pm PDT • April 19, 2024
Your Android phone could have stalkerware — here’s how to remove it

Featured Article

Hackers are threatening to leak World-Check, a huge sanctions and financial crimes watchlist

The hackers say they have stolen 5.3 million records from the World-Check database, used by companies and banks for screening potential customers.

10:05 am PDT • April 18, 2024
Hackers are threatening to leak World-Check, a huge sanctions and financial crimes watchlist

Organizations are urged to patch their Palo Alto firewalls after researchers discover evidence of malicious exploitation dating back to late March.

Palo Alto Networks’ firewall bug under attack brings fresh havoc to thousands of companies

A ransomware gang called Daixin has taken credit for the breach, and claimed to steal millions of customer records dating back to 2017.

Omni Hotels says customers’ personal data stolen in ransomware attack

This is the second group to demand a ransom payment from Change Healthcare to prevent the release of stolen patient data in as many months.

Change Healthcare stolen patient data leaked by ransomware gang

Spyware makers are reportedly working on targeting individuals with stealthy data-stealing malware using online banner ads.

Government spyware is another reason to use an ad blocker

Roku said it discovered malicious hackers compromised more than half a million user accounts while investigating an earlier spate of account hacks.

Roku says 576,000 user accounts hacked after second security incident

Founded in 1973, the Washington DC-based Heritage Foundation and supports and lobbies on conservative issues.

US think tank Heritage Foundation hit by cyberattack

CISA said the latest theft of government email — blamed on Russian government hackers — presents “a grave and unacceptable risk” to U.S. federal agencies.

US says Russian hackers stole federal government emails during Microsoft cyberattack

The U.S. cybersecurity agency said it was responding to a “recent compromise” at the data analytics giant, which provides business intelligence to critical infrastructure companies.

US government urges Sisense customers to reset credentials after hack

The legally required disclosure came a week after AT&T confirmed a cache containing millions of customers’ data that leaked online was genuine.

AT&T notifies regulators after customer data breach

The tech giant secured a cloud storage server that was inadvertently spilling Microsoft internal data and credentials to the open internet.

Microsoft employees exposed internal passwords in security lapse

Targus’ parent company, B. Riley Financial, said it discovered “a threat actor gained unauthorized access to certain of Targus’ file systems.”

Targus says cyberattack is causing operational outage

Featured Article

‘Reverse’ searches: The sneaky ways that police tap tech companies for your private data

Reverse searches cast a digital dragnet over a tech company’s store of user data to catch the information that police are looking for.

8:05 am PDT • April 2, 2024
‘Reverse’ searches: The sneaky ways that police tap tech companies for your private data

Featured Article

AT&T resets account passcodes after millions of customer records leak online

A security researcher told TechCrunch that leaked AT&T customer data contained encrypted account passcodes that can be easily unscrambled.

7:10 am PDT • March 30, 2024
AT&T resets account passcodes after millions of customer records leak online

The government’s reward for information now extends to ALPHV’s affiliates, which claimed responsibility for a massive weekslong healthcare cyberattack.

US offers $10M to help catch Change Healthcare hackers

It’s the first time the United Kingdom has attributed the massive breach of millions of citizens’ voter data since the cyberattack was first disclosed in 2023.

UK blames China for massive breach of voter data

Customers say their leaked AT&T customer data — names, addresses, phone numbers and Social Security numbers — is accurate.

AT&T won’t say how its customers’ data spilled online

The U.S. Department of Transportation announced its first industry-wide review of data security and privacy policies across the largest U.S. airlines. The DOT said in a press release Thursday that…

DOT to investigate data security and privacy practices of top US airlines

Featured Article

Users say Glassdoor added real names to user profiles without their consent

One user said Glassdoor pulled her full name from an email and added it to her profile. Another user said it wasn’t clear how Glassdoor got his data.

2:45 pm PDT • March 20, 2024
Users say Glassdoor added real names to user profiles without their consent