Connect with us

Press Release

Winners receive the Monopoly VIP database password from McDonald’s.

Published

on

Winners receive the Monopoly VIP database password from McDonald's.

The login names and passwords for the game’s database were provided to all winners of the McDonald’s Monopoly VIP game in the UK due to an error.

After missing a year due to COVID-19, McDonald’s UK resumed operations on August 25th with the debut of their well-known Monopoly VIP game, which allows customers to enter codes found on their food purchases for a chance to win a gift. These rewards range from Lay-Z Spa hot tubs to £100,000 in cash, as well as an Ibiza property or UK hideaway vacation.

The game unfortunately ran into trouble over the weekend when a problem resulted in prize winners receiving emails including their user name and password for both the production and staging database servers.

Troy Hunt provided BleepingComputer with an unredacted snapshot of the prize winners’ email that displays an exception error and sensitive data for the online application.

This data included hostnames for Azure SQL databases as well as the login names and passwords for those databases, as shown in the redacted email that was sent to a Monopoly VIP winner and is shown below.

Troy Hunt received an email from the contestant who indicated that although the production server was firewalled, they could still access the staging server by using the provided credentials.

In an email sent to Troy Hunt and obtained by BleepingComputer, the individual said, “I tried to connect to production to judge the severity of the issue and whether or not getting in touch was an urgent concern, but luckily for them they had a set of firewall restrictions installed.”

I was able to enter staging, though, and I promptly disconnected for obvious reasons.

These databases might have held winning reward codes, making it possible for a dishonest person to download unused game codes and win the prizes.

Fortunately for McDonald’s, the issue was responsibly reported to McDonald’s, and although they did not hear back, they later discovered that the password for the staging server had been changed.

Unfortunately, this was not a unique problem; other users also claimed to have seen the credentials and even went so far as to document their encounter in a TikTok video.

McDonald’s told BleepingComputer that just the staging server’s credentials were exposed, despite the error plainly stating that both a production and staging server’s credentials were compromised.

“A limited number of consumers received information for a staging website by email as a result of an administrative error. No personal information was hacked or disclosed to outside parties, McDonald’s said in a statement to BleepingComputer.

“Those who were impacted will be contacted to reassure them that this was a mistake on the part of a human and that their information is still secure. We take protecting user data extremely seriously, and we apologise if this oversight has led to unwarranted worry.

 

Continue Reading

Press Release

Review of Bleeping Computer

Published

on

Review of Bleeping Computer

ComboFix is a tool made by sUBs that checks your computer for known malware and tries to automatically remove infestations when it finds any. In addition to being able to get rid of a lot of the most popular and up-to-date malware, ComboFix also shows a report that skilled assistants may use to get rid of malware that isn’t already eradicated by the programme.

Please be aware that executing this programme without supervision may result in improper operation of your computer. Run this programme only at the direction of a knowledgeable assistant.

At the moment, Windows 8.1 is not compatible with this programme, just Windows 8!

The author is collecting PayPal donations from people who want to support his work. By selecting the following picture, you may contribute:

Continue Reading

Press Release

Microsoft provides a fix for persistent Outlook login issues.

Published

on

Microsoft provides a fix for persistent Outlook login issues.

Microsoft is attempting to resolve ongoing sign-in issues that are preventing certain users of Outlook for Microsoft 365 from accessing their accounts.

Users who attempt to enter into Outlook using their Outlook.com accounts or those who have already added the accounts to their Outlook profiles are affected by the login issues.

The users will get the following error messages instructing them to use a work or school account rather than signing in: “You are unable to log in using a personal account here. Use your account from work or school instead.”

Although Microsoft claims that the Outlook Team is working on a patch for this known problem, users can access their accounts using an official workaround until a fix is released.

“You can get around the problem by disabling Support Diagnostics, which disables the ability to contact support through the In App Help menu by choosing Contact Support. The fault is connected to how Outlook is authenticating for the diagnostics in some cases, “explained Microsoft.

You must enable the DisableSupportDiagnostics policy setting in Outlook to turn off support diagnostics and stop it from informing support services about client failure.

According to the Group Policy Administrative Templates Catalog, “This policy setting determines whether Outlook can communicate client information on failure to support services with the intent of diagnosing the issue or making the information available to support to help with the diagnosis/resolution of the issue and/or provide contextual error messaging to the user.”

A different flaw that can prohibit users from configuring Exchange Online mailboxes in Outlook for Windows is something Redmond claimed it was attempting to fix last week.

Early in October, the company started releasing a remedy for a different problem that has been causing Outlook for Microsoft 365 to freeze and crash after opening since August.

Continue Reading

Press Release

After discovering a credit card skimmer, Costco admits a data breach.

Published

on

After discovering a credit card skimmer, Costco admits a data breach.

Customers who recently made purchases at one of Costco Wholesale Corporation’s stores have received notification letters informing them that their credit card information may have been stolen.

According to Fortune 500 rankings, the retail giant—also known as Costco Wholesale and Costco—is an American multinational that runs a sizable chain of membership-only retail locations. It is the fifth-largest retailer in the world and the tenth-largest firm in the US by total revenue.

It runs e-commerce websites with 737 warehouses across the world that cater to the Americas, Europe, and Asia, among other global regions.

planted skimmer in the Costco warehouse
During a regular check by Costco staff, a credit card skimming device was found in one of the company’s warehouses, leading to the discovery of the breach.

The business got rid of the gadget, let the authorities know, and is now assisting the police in their investigation.

In breach notification letters, Costco informed possibly impacted customers that they had recently visited a Costco facility where a payment card skimming device had been found.

“Our member records show that throughout the possible operational period of the device, you swiped your payment card to make a purchase at the impacted terminal.”

probable theft of customer financial information
Costco said that if those who placed the card theft device had been successful in accessing the data prior to the skimmer being discovered and taken out, then consumers affected by the incident may have had their payment information stolen.

The magnetic stripe of your credit card, which contains your name, card number, card expiration date, and CVV, may have been obtained by unauthorised individuals if they were able to remove information from the device before it was identified, according to Costco.

Customers were given advice by the retailer to check their bank and credit card statements for fraudulent payments and alert the appropriate financial institutions to any suspect activities.

The total number of customers who were impacted or the warehouse where the skimmer device was discovered were not disclosed in the data breach notification letters sent to affected consumers.

Although the business withheld details on the incident’s exact timing, Costco customers have been complaining about fraudulent charges on their credit cards at least since February.

Continue Reading

Trending