2/10/21

LP, AP & IT Security's #1 News Source

Top 10 Action Items for 2021: The California Privacy Rights Act (CPRA)
How can your business prepare for the California Privacy Rights Act (CPRA) ramp-up in 2021? The CPRA is scheduled to become effective in January 2023. Preparations will occur over the next two years, including establishing the new California Privacy Protection Agency, which will take over rulemaking from the California Attorney General. With an impact on most medium to large businesses located in California or doing business in California, even companies that have already taken steps to comply with the CCPA will need to plan carefully for successful CPRA compliance.

Here are 10 essential steps that companies can consider taking now to prepare for the CPRA:

1. Determine whether the CPRA applies to your organization.

2. Advise senior management of coming changes to privacy law and impact on your organization.

3. Designate a CPRA compliance team with an appointed team leader, schedule monthly check-ins and ensure CPRA compliance costs are built into this year's budgets.

4. Determine if software development work is required and ensure software development teams update this year's development roadmap.

5. Update your data map to include new CPRA-specific details, including sensitive personal information designations and data retention periods.

6. Inventory your company contracts to determine contracts that will need to be updated for compliance with the CPRA.

7. Identify privacy notices that will need to be updated.

8. Watch out for updates on the timing of additional CPRA regulations.

9. Review your company's current security posture and identify potential security enhancements to be implemented this year.

10. Develop a CPRA compliance roadmap. jdsupra.com

Massive spike in fraud across all industries - 4.3B attacks detected
since Black Friday
Arkose Labs, provider of online fraud and abuse prevention technology, released new data on the latest fraud trends that reveal a massive spike in fraud across all industries from Black Friday onwards. As consumers continue to flock online in droves greater than ever before, credential stuffing, account takeover (ATO) attacks and gift card fraud are poised to be top attack vectors in 2021.

"2021 remains full of unknowns, however what's certain is the frequency and severity of fraud will never return to pre-pandemic levels," said Vanita Pandey, VP of Marketing and Strategy at Arkose Labs. "With digital channels serving as an invaluable lifeline for much of the world, the Arkose Labs network saw 4 times as many transactions compared to the year prior. This increased activity has created an ideal breeding ground for attacks as fraudsters work to blend in with trusted users, rendering typical models of good versus bad user behavior obsolete."

The Black Friday Effect and Gift Card Fraud
As in previous years, the Arkose Labs network recorded a sustained increase in fraud in the ecommerce industry from Black Friday through the end of the year. This year, however, this sustained increase in fraud occurred across all industries -- even those not typically associated with Black Friday, such as social media, online dating and financial services.

Credential Stuffing and New Attack Types
The influx of new digital accounts created in Q4 of 2020 led to a drastic increase in credential stuffing attacks, which power account takeover attacks. Credential stuffing attacks more than doubled in Q4 compared to Q3, and increased by nearly 90% compared to Q1.

To access the full Q1 2021 Fraud and Abuse Report, please click here. securitymagazine.com

Insider Threat Unleashed a $100M Cryptocurrency Theft
Authorities arrest SIM swapping gang that targeted celebrities
Eight men were arrested in England and Scotland as part of an investigation into a series of SIM swapping attacks targeting US celebrities.

Eight men were arrested across England and Scotland this week as part of a coordinated crackdown against a SIM swapping gang that has hijacked the identities and social media profiles of US celebrities.

The UK National Crime Agency, which made the arrests on Tuesday, said the gang targeted well-known sports stars, musicians, and influencers, primarily located in the US. Officials said this gang engaged in SIM swapping attacks, where they tricked US mobile operators into assigning a celebrity's phone number to a new SIM card under the attacker's control.

While they had access to the victim's phone number, the SIM swappers would reset passwords and bypass two-factor authentication on the victim's accounts. "This enabled them to steal money, bitcoin and personal information, including contacts synced with online accounts," the NCA said.

Europol said the gang stole more than $100 million worth of cryptocurrency using this method.

The practice usually relies on tricking telco call center staff into assigning a phone number to a new SIM card, but it often also relies on rogue employees inside telephone companies willing to cooperate with criminal gangs.

One such employee was charged in the US on Monday. The US Department of Justice indicted Stephen Daniel Defiore for his role in helping SIM swappers steal the identities of at least 19 people while working as an employee for an unnamed US phone company between August 2017 and November 2018.

US authorities said Defiore received $2,325 in a series of twelve payments for his role in the scheme. If found guilty, he now faces a prison sentence of up to five years and a fine of up to $250,000. zdnet.com

Most zoombombing incidents are inside jobs
Most zoombombing incidents are "inside jobs" according to a study featuring researchers at Binghamton University, State University of New York.

The videoconferencing app Zoom became an online home for many of these activities, but the migration also led to incidents of zoombombing. Similar apps such as Google Meet and Skype also saw problems.

Attackers don't just stumble upon meeting invitations

They found that the vast majority of zoombombing are not caused by attackers stumbling upon meeting invitations or "bruteforcing" their ID numbers, but rather by insiders who have legitimate access to these meetings, particularly students in high school and college classes. Authorized users share links, passwords and other information on sites such as Twitter and 4chan, along with a call to stir up trouble.

"Some of the measures that people would think stops zoombombing - such as requiring a password to enter a class or meeting - did not deter anybody," Blackburn said. "Posters just post the password online as well.

"Even the waiting rooms in Zoom aren't a deterrent if zoombombers name themselves after people who are actually in the class to confuse the teacher. These strategies that circumvent the technical measures in place are interesting. It's not like they're hacking anything - they're taking advantage of the weaknesses of people that we can't do anything about." helpnetsecurity.com

NIST Publishes NISTIR 8301: Blockchain Networks-Token Design and Management Overview
NIST announces the publication of NISTIR 8301, Blockchain Networks: Token Design and Management Overview, which provides a high-level technical overview and conceptual framework of token designs and management methods. The document highlights the different types of tokens and how they are held in custody. It then examines transaction management under three fundamental aspects: validation, submission, and viewability. Infrastructure tools used to develop applications that integrate blockchain networks and second layer protocols are also reviewed.  Finally, the paper presents deployment scenarios and use cases for tokens before concluding with potential breakthroughs in privacy-preserving verifiable data exchange. csrc.nist.gov

'The Rumors Became Real'
Former Nygard employees, intern say fear, intimidation, even sexual harassment commonplace at the company
Thirteen years after leaving a job at Nygard International Partnership, Brenda Bourns finally feels safe enough to share her story. Bourns worked as the special events manager at the company's head office on Inkster Boulevard in the fall of 2007. She quit 10 months later.

Peter Nygard, 79, was arrested in Winnipeg in December and is currently awaiting extradition to the U.S. for allegations he sexually trafficked women and girls over a 25-year period. Nygard denies all the allegations and says they are part of a conspiracy to tarnish his reputation.

Bourns said what she witnessed during a trip to Burnaby, B.C., for a Nygard store opening made her realize the job wasn't for her.

"The rumours became real ... all the things that I've heard for decades of rumours, innuendo, allegations, hearsay, all of the things ... they were real and I'm done," recalled Bourns. cbc.ca

Racial Bias in the U.S. is Spilling Into Canada
The retail sector has a racial bias problem - and this Sephora survey suggests it's costing it customers
A study commissioned by beauty giant Sephora on racial bias in the U.S. retail sector is having reverberations in Canada - at Sephora's Canadian stores and for those in the beauty industry. The Racial Bias in Retail Study, released in January, aimed to quantify how common it is to experience racial bias, and identify opportunities to eliminate it.

"I absolutely saw myself in that study," said Canadian beauty brand creator, Tomi Gbeleyi-Curtis. "I've had experiences where people follow me around the store."

"It was the first of its kind study to really glean insights into the disparate experiences that many U.S. BIPOC shoppers and employees actually face today," said Debbie McDowell, director of social impact for Sephora Canada.

Sephora Canada doesn't plan to do a Canadian version of the survey; instead, it will build off of the U.S. findings. cbc.ca

J.Crew has officially closed all of its Canadian stores
J. Crew has exited Canada for good. After 10 years in the country, the American fashion retailer has closed its last remaining stores. The company has been experiencing a years-long decline worldwide, largely attributed to the brand's failure to keep up with fast fashion and athleisure trends. blogto.com

Big Changes Coming for Canadian Grocery in 2021 and Beyond: Expert

Nordstrom Appoints New Canadian Head of Stores

Air Canada to temporarily cut 1,500 jobs, suspend 17 routes

Robberies & Burglaries

● C-Store - Waterloo, ON - Robbery/Employee Assaulted
● CIBC- Halifax, NS - Robbery
● Dog Store - Halifax, NS - Robbery
● Drug Store - London, ON - Burglary (2x)
● Pharmacy - Halifax, NS - Robbery
● Roots - Halifax, NS - Robbery

How are we doing? We need your input & suggestions. Send to lpnews@d-ddaily.net

View Canadian Connections Archives
 

Buffalo, MN: 1 Person Killed and 4 Injured in Shooting at Minnesota Health Clinic
A man was in custody after a shooting at a health clinic outside of Minneapolis on Tuesday that left one person dead and four more injured, the authorities in Buffalo, Minn., said. The shooting sent a wave of panic through residents of the tight-knit community, who were devastated that health care workers - already under siege over 11 months of a pandemic - were now contending with violence at work. By midafternoon, a suspect was in custody, a man with a history of grievances that authorities said they had known of for years. At the news conference, the sheriff announced that the suspected gunman was Gregory P. Ulrich, 67. The police said they have had many contacts with Mr. Ulrich dating back to 2003, and Chief Pat Budke of the Buffalo Police Department indicated that Mr. Ulrich had been treated at Buffalo clinics and may have been targeting someone there. In an interview, Mr. Ulrich's younger brother Richard said Gregory Ulrich had back surgery about two years ago, after which he became dependent on opioids and frequently grew frustrated when doctors refused to prescribe them to him. nytimes.com

Madeira, OH: 68-year-old C-store owner shot dead
A store owner was shot in Madeira Tuesday night. Police responded to Madeira Beverage on Kenwood Road at 7:45 p.m. There they found the owner of the store, Rupp Gupta, with a single gunshot wound. Gupta was taken to the hospital where he died from his injuries. He was 68-years-old. Police are looking for a 6-foot tall, 240-pound black man wearing black pants, a black jacket with a hood, and a red face mask. local12.com

Inglewood, CA: LAPD standoff at Inglewood shopping center over as police determine suspect escaped
A lengthy apparent barricade outside an Inglewood shopping center ended after several hours Tuesday evening when police were able to determine the suspect had actually fled the area before they arrived. The incident started around 4:30 p.m. with a traffic stop at Manchester Boulevard and Figueroa Street. Los Angeles Police Department officials say the driver failed to comply with orders and instead backed the vehicle toward officers. They opened fired at the vehicle but no injuries were reported. The vehicle fled but an LAPD helicopter spotted it a short time later. The suspect abandoned the vehicle in the shopping center's parking lot and fled into a store. Dozens of officers surrounded the complex at Imperial Highway and Crenshaw Boulevard after the short chase. Police said later there was no indication the suspect held anyone hostage inside the store. After about three hours, officials say they were able to confirm the suspect had changed clothes inside the store and had fled the scene before officers arrived. abc7.com

Robberies, Incidents & Thefts

Mattoon, IL: Police seek help identifying JCPenney jewelry burglars
The Mattoon Police Department is seeking the public's assistance in identifying suspects in connection with a recent break-in and jewelry theft at the JCPenney store at the Cross County Mall. Detective Lt. Ryan Hurst said officers responded to an alarm at 1:30 a.m. Feb. 2 at JCPenney and found that the glass in the north door had been broken. He said officers ensured the store was clear and then discovered that the glass case in the jewelry department had been smashed. Hurst said an unknown amount of jewelry had been taken. Hurst said evidence indicates two suspects perpetrated the burglary. jg-tc.com

Michigan: FBI helps bust man wanted for Walgreens, CVS, Rite Aid armed robberies in Oakland, Genesee Counties

Woodbridge, NJ: Gas Station clerk stabbed in the neck by a fleeing Shoplifter

Pikeville, KY: Walmart shoplifter searched in LP Office has .25 caliber pistol with 1 in the chamber

Madison, WI: Shoplifter pulls knife on Grocery store employee

Killeen, TX: Walmart theft ends with felon arrest; possession of a firearm

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights
 

	Regional LP & Safety Manager Denver, CO - posted Feb. 9 The Regional Loss Prevention & Safety Manager implements Risk Management and Loss Prevention objectives within assigned region. The position will provide assistance and training to the field operations teams to address specific Risk Management and Loss Prevention issues within an assigned span of control.  Read job description here
	Manager of Asset Protection & Safety Operations Rockaway, NJ - posted Feb. 4 The Manager of Asset Protection & Safety Operations is responsible for the control and reduction of shrinkage and safety compliance for Party City Holdings, by successfully managing Asset Protection (AP) Safety programs and reporting...
	Loss Prevention Auditor and Fraud Detection Analyst Raleigh, NC - posted Dec. 14 As a Loss Prevention Auditor and Fraud Detection Analyst for Staples, you will conduct LP operational field audits remote, virtual and in person, within a base of 60 retail stores to ensure compliance to operational standards to drive operational excellence and preserve profitability...
	Leader, Asset & Profit Protection San Fran/Chicago/NY/West Palm Beach - posted Dec. 14 As the leader of the Data/Analytics & Investigations strategy, you should have strong analytical/investigation skills, the drive to innovate, and the ability to build strong partnerships to lead through the influence of others. They will be personable, open to learning, collaborating with others...
	Customer Success Specialists Multiple Locations - posted Oct. 9 The role of the Customer Success Specialist is to engage, empower, and excite our community. As a Customer Success Specialist, your primary responsibility is to ensure both retailers and law enforcement, who make up our community, have great experiences and achieve real crime reduction outcomes from using our platform. Apply Here
	Sales Representatives NuTech National - posted Oct. 13 NuTech National, an established and rapidly growing 40+ year electronic security company is expanding our National Sales Team. Seeking motivated, driven and successful sales reps to expand our national retail and governmental vertical markets. Top pay, benefits and signing bonus available. Please apply to melissa@nutechnational.com

Latest Top Jobs
	Vice President, Loss Prevention San Francisco, CA The Vice President of Loss Prevention reports to the Company's General Counsel and is responsible for leading the organization's global asset protection and security efforts. You will collaborate effectively across the Company.  linkedin.com
	Executive Director, Asset Protection Rosemead, CA The Executive Director, AP is responsible for the company's AP function, protecting the company's integrity, people, processes, and assets from harm and loss. This position serves as the subject matter expert on a broad range of security standards and disciplines.  pandarg.referrals.selectminds.com
	Senior Director, Loss Prevention Calabasas, CA The Senior Director of Loss Prevention is responsible for setting and championing the Loss Prevention strategy for the enterprise, including retail stores, distribution centers, corporate offices and quality assurance labs.  sjobs.brassring.com
	Director, Asset Protection Solutions Deerfield, IL Responsible for developing and implementing department strategies and integrating efforts with division and company strategies, emphasizing product availability, inventory productivity, and cost productivity.  jobs.walgreens.com
	Senior Manager, Asset Protection Atlanta, GA The Sr Manager Asset Protection is responsible for ensuring that Asset Protection programs are fully implemented and are being executed per expectations within assigned distribution centers.  careers.homedepot.com
	BJ's Wholesale Regional AP Rollout - 8 New Positions The Regional AP Manager oversees AP, security, theft, fraud, investigations, and related procedures within the field. The RAPM supports and continuously interacts with club management to analyze shrink, identify profitability gaps and address issues related to protecting company assets. See all the job listings

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

FEEDBACK    /    downing-downing.com    /    Advertise with The D&D Daily