A Welsh Data Unit Used Password1 + Calendar Invites Became Phishing + Spyware Delivered Through Ads

A test account created in 2012 with the password Password1 led to the ICO reprimanding a Welsh local government data unit and its IT supplier. Recruitment platform Bullhorn went offline for days after a cyber incident, cutting agencies off from candidate records and, in some cases, the systems used to pay people. Malicious calendar invites grew from a few thousand a month in April to 740,000 in the first two weeks of October. Spyware vendors found a way to infect targeted devices through ads, with no click needed. And 23andMe's successor company agreed to pay California $6 million over the 2023 breach, while the DNA data itself now sits with a nonprofit set up by the co-founder.

This week on Click Happens, episode four, with guest Bora back in the passenger seat. We get into who owns a forgotten test account, what Bullhorn's warning about impersonators says about breach notifications, how a calendar invite can reach you even when the email is blocked, what Citizen Lab found about ads delivering spyware, and what happens to your DNA data when the company that collected it goes bankrupt.

00:00 Intro

01:04 Bora is back, and so are the moths

03:45 Password1 and the Welsh data unit

19:22 Bullhorn goes dark

31:20 Malicious calendar invites

39:14 AdFection, spyware delivered through ads

46:53 23andMe's $6 million settlement and who owns the DNA data

55:59 Wrap up and the bonus episode

Subscribe for weekly cybersecurity news made simple, so even your mum gets it.

Click Happens is an independent podcast hosted by Ant Davis, with a different guest joining each week.

Instagram: @antdaviscyber

TikTok: @antdaviscyber

LinkedIn: @antdaviscyber

YouTube: @antdaviscyber

Website: www.antdavis.com

This week's guest:

Bora Seker: https://www.linkedin.com/in/bora-seker-45761715/

Dumb Ways to Get Hacked: https://www.youtube.com/channel/UC8kLkjxLw8-_VnC7XpNXY6A