The D&D Daily Mobile Edition
LP, AP & IT Security's #1 News Source

Chris Hopkins named Director of Asset Protection for Goodwill Industries of Southeast Georgia
Previously, Chris was the Multi-District AP and Safety Manager for Weis Markets for over eleven months before taking this new role. Prior, he held managerial positions in loss prevention/asset protection for Amazon and Giant Foods, and was an LP Coordinator for Hannaford. Chris also served as a Police Officer for Columbia Borough Police Department for over six years. He earned his Bachelors of Science degree in Criminal Justice from Shippensburg University of Pennsylvania. Congratulations Chris!

Courtney Meek promoted to Associate Director, LP Operations for Ross Stores Inc.
Previously, Courtney was the Senior Manager, LP Operations & Initiatives for the retailer for over a year, and before that was their Manager of Merchandise Protection & LP Operations for over three years. Prior, she held various positions at Gap Inc./Old Navy including Project Manager - Best Practices and Common Processes, Market LP Manager, Store Manager, Assistant Store Manager and Customer Service Supervisor. Courtney earned his Bachelors of Arts degree in Interpersonal & Organizational Communications from California State University - Long Beach. Congratulations Courtney!

Jeremy Greenleaf named Director of Asset Protection for StockX
StockX is a live marketplace for buying and selling limited edition sneakers, watches, handbags and streetwear. Previously, Jeremy was the Corporate Manager of ORC Investigations for The Home Depot for over three years. He earned his Bachelors degree in Criminal Justice/Law Enforcement Administration from Saginaw Valley State University. Congratulations Jeremy!

See All the Executives 'Moving Up' Here   

Submit Your New Corporate Hires/Promotions or New Position 
 

[WHITE PAPER] Reducing Total Retail Loss by Integrating Video with Exception-Based Reporting

The concept of ‘total retail loss’ can be ambiguous and holds different meanings for different segments of the retail industry. Within the industry, each retailer has specific needs depending on compliance with specific protocols and ethical business conduct. First, we need to establish and understand the variance in “pain points” that facilitates a better understanding of the difference between outcomes that are the costs of doing business, versus the outcomes that are regarded as losses.

Understanding a common equation to find out a business’s Key Performance Indicators (KPIs) can help determine whether or not a retailer is achieving its goals. However, because losses are often calculated based on an individual company’s formula, it’s difficult to create a universal baseline. Now, there are software and technologies available to help retailers stay ahead of their losses, and, most importantly, understand the differences – dependent upon the particular business – of losses, shrinkage and costs.

Exception-based Reporting and ROI

Exception-based reporting is a method of data analysis that compares an incoming stream of data to a pre-established set of data at the point-of-sale (POS) and flags items that don’t match up. A specific retailer can define and customize any number of ‘normal’ conditions for the incoming data to compare against and, then, these abnormalities will be flagged as suspicious activity. The goal of exception-based reporting is to enable these data streams to identify areas of loss more readily and efficiently than time-consuming inventory audits or in-store security personnel. Many times, single malicious users at the register can have a greater impact on shrinkage; thus, waiting for an inventory audit to be completed can allow for more malicious losses than readily available data streams.

Background: Non-Malicious vs. Malicious Losses

Non-malicious losses include:
Errors
• Not crime related
• Unknown
• Non-malicious losses as part of being in the industry

Accidental issues such as mispricing inventory, delivering damaged goods or having to markdown inventory are just part of everyday business.

Malicious losses include:
Pre-meditated and deliberate crime-related problems
• External or internal theft, burglary or criminal damage
• Loyalty card scams
• Customer frauds

These situations can negatively impact retail profitability and offer no contribution to generating income for the business, but, with the correct video and data analytics, crime-related losses can be uncovered.

Read 3xLOGIC's full white paper here

6 Arrests in the UK and Netherlands in $27.3M Cryptocurrency Theft
Today, the UK's South West Regional Cyber Crime Unit (SW RCCU) in a joint operation with the Dutch police (Politie), Europol, Eurojust and the UK's National Crime Agency (NCA) has arrested 6 individuals after a 14-month long investigation into a 24 million euro cryptocurrency theft. The five men and one woman were arrested in simultaneous warrants this morning at their homes in Charlcombe, Lower Weston and Staverton (UK) and Amsterdam and Rotterdam (the Netherlands).

The theft, which targeted users' Bitcoin tokens, is believed to have affected at least 4 000 victims in 12 countries, with the numbers continuing to grow. The investigation relates to typosquatting, where a well-known online cryptocurrency exchange was 'spoofed' - or recreated to imitate the genuine site - to gain access to victims' Bitcoin wallets, stealing their funds and login details. thetelegraph.com

DDoS-for-Hire Services Doubled in Q1 Despite Major FBI Crackdown

Impact of FBI's takedown of 15 'booter' domains last December appears to have been temporary.

Nexusguard analyzed data gathered from multiple public and proprietary sources on distributed denial-of-service attacks during the first quarter of this year. The security vendor discovered that so-called booter websites offering DDoS services for hire more than doubled that quarter compared to the fourth quarter of 2018 - despite a major law enforcement crackdown on such sites in December.

Nexusguard's analysis also showed a continued trend toward what it calls bit-and-piece DDoS attacks, where threat actors contaminate a large and diverse pool of IP address with almost negligible sizes of junk traffic that converge and block a targeted IP.

In the first quarter of this year, such attacks became more automated and targeted, indicating that attackers have figured out how to launch them optimally, Nexusguard said in its report.

Booter Services Back With a Vengeance

The resurgence of booter sites in particular is notable. Last December, the FBI—in collaboration with international counterparts—seized 15 Internet domains associated with some of the world's largest DDoS-for-hire-services.

The FBI's pre-Christmas 2018 crackdown succeeded in slashing the overall number of DDoS attacks globally by 11%, and average attack size by as much as 85% percent in Q4 last year.

However, Nexusuard and others at that time warned about a rebound in booter services due to the strong and growing demand for them in the cyber underworld. The latest numbers appear to confirm that expectation.

The same pattern has played out numerous times over the years. Law enforcement authorities in the US and other countries have taken down major underground marketplaces and dismantled organized groups engaged illicit activities online, only to see others swiftly replace them.  darkreading.com

Hackers hit over a dozen mobile carriers & could shut down networks
Researchers believe the attacks are backed by China
Hackers have quietly infiltrated more than a dozen mobile carriers around the world, gaining complete control of networks behind the companies' backs. The attackers have been using that access over the last seven years to steal sensitive data, but have so much control they could shut down communications at a moment's notice, according to Cybereason, a security company based in Boston.

On Tuesday, Cybereason said it's been investigating the campaign, dubbed Operation Soft Cell, through which hackers targeted phone providers in Europe, Asia, Africa and the Middle East. The hackers infected multiple mobile carriers since 2012, gaining control and siphoning off hundreds of gigabytes of data on people.

How the attacks happened
Cybereason's researchers found that the attackers gained access to more than a dozen mobile carriers by exploiting old vulnerabilities, like malware hidden in a Microsoft Word file or finding an exposed public server belonging to a given company.

Using that access, the hackers also created accounts for themselves with escalated privileges, essentially hiding among the company's actual staff. Even if the companies take measures to close up their vulnerabilities, the hackers could remain in the network for years after the fix.

Because the attack method was this sophisticated and targeted, Cybereason researchers believe the hackers were backed by a nation-state. All digital forensics signs point to China -- the malware used, the method of attack and the servers the attacks are on are tied to APT10, China's elite hacking group. cnet.com

The C-Suite is Under Attack, Verizon Data Breach Report Finds
C-Level Execs 12 Times More Likely to be a Target
C-level executives such as the (CEO, CFO, COO, and CIO) are a prime target of cybercriminals. They are 12x more like likely to be the target in social engineering attacks than other employees. Financial gain remains the primary goal. In total, 71% of all breaches had a financial motive.

Because senior executives have top-level access and are higher up on the chain of command to make and approve requests, their email login credentials are very attractive to cybercriminals. For attackers, stolen credentials, and compromised email accounts, are like having the key to the city. Criminals can come and go at will, within the company’s network, like a trusted friend. No brute-force needed.

A compromised C-suite email account can be used to send wire transfer requests, then the criminals simply wait for the money to arrive. In recent years, Snapchat, Mattel, and FACC have all fallen victim to BEC scams. Verizon reports that Business Email Compromise (BEC) attacks represented 370 incidents of which 248 were confirmed breaches.

Phishing and vishing are commonly used by attackers to steal credentials. Because of the sheer volume of emails that the C-suite handle, their exposure to phishing is higher than other employees. Each day they routinely respond to multiple issues that demand quick resolution, creating an environment that is conducive to ‘clicking before thinking.’ securityboulevard.com

The Data Breach Case Against Facebook Is Moving Forward
Facebook is still legally on the hook for a September data breach that affected 30 million of their customers. Hackers were reportedly able to exploit several software failings in order to obtain login access to consumer accounts. Facebook had moved to have the case dismissed — but a federal appeals judge has shot down that argument, saying the case against Facebook for negligence and for failing to secure users’ data will proceed.

Discovery should move “with alacrity” for a trial, U.S. District Judge William Alsup said in his ruling. The judge did, however dismiss breach-of-contract and breach-of-confidence claims. Plaintiffs have until the 8th of July to amend their case.

“From a policy standpoint, to hold that Facebook has no duty of care here ‘would create perverse incentives for businesses who profit off the use of consumers’ personal data to turn a blind eye and ignore known security risks,”’ Judge Alsup said, citing a decision in a separate case.

Facebook has argued it is really the victim as the target of highly-sophisticated hack attacks — and that it ought not be liable for thieves gaining access to user names and contact information. Facebook also argued that while logins were compromised, data of real value like card numbers remained protected and unharmed. pymnts.com

U.S. may expand biometric and AI benchmarking as national strategy updated

Press F5 to Refresh or Reload
A Browser Webpage

If you need to refresh or reload a web page quickly, forget using your mouse. All you have to do is press the F5 key on your keyboard.

Fraud prevention: what retailers are doing to beat online scammers
Online fraud is on the rise. According to trade association UK Finance, scams against online retailers totalled £265.1 million in 2018, up 29% on the previous year. However, retailers are increasingly arming themselves in the fight against cybercrime. Last year the sector spent 17% more on cybersecurity, found a recent survey by the British Retail Consortium.

Lessons learnt

For William Scott Forshaw, founder of luxury bag company Maxwell-Scott, falling victim to scammers nearly eight years ago led the company to completely rethink its approach to fraud prevention.

“We got caught out,” he says. “Someone managed to insert a script to our shopping basket. So when customers were typing in their credit card details, it was recording that information and sending it to an Excel sheet on a server in Thailand.”

The company located and removed the script after the bank flagged a problem. But by that time it had been running for a month. Subsequently it had to pay £25,000 in fines to Mastercard and Visa, as well as being forced to pay £5,000 to a security firm to do a sweep of its systems.

Off the back of that experience, it rebuilt everything. “Since then our servers have been immaculate and we’ve put lots of protocols in place” he says.

The right support

Ollie Marshall, IT director at Maplin, agrees that it is crucial that retailers do more than just comply with the minimum standards as “liability for fraud sits with the merchant.”

After the electronics brand relaunched as an online-only retailer earlier this year, the company used the opportunity to bake fraud prevention into its transactional processes. “From day one we had fraud attempts,” says Marshall.

“Being online-only, it was obvious to me fraud was going to play a massive part [in resigning our systems].” The company decided to partner with fraud detection business Signifyd, which aggregates data in real time to determine whether a transaction is fraudulent. Read more: essentialretail.com

‘Human-Proofing’ Marketplace Fraud
Trust is the currency that makes online marketplaces of all shapes and sizes run — but in a world where cybercrime and digital attacks on consumer identity are endemic, it can also be the hardest element to guarantee.

In the good old days of analog physical commerce, Yapstone Chief Information Security Officer Richard Noguera told Karen Webster, proximity did a lot of heavy lifting for guaranteeing everyone in the transaction knew who they were dealing with.

“The challenge is, in digital marketplaces where that trust is especially necessary, it is also totally ethereal,” Noguera said. “The transaction is devoid of the old physical construction — but that doesn’t mean consumers don’t still want to feel the same level of trust.”

The goal for firms like Yapstone that service marketplaces is to be able to imbue those virtual transactions with the same sense of trust consumers and sellers more or less feel in that physical environment, he said. The supplier or seller knows the person they are transacting with is the buyer they think they are, and the seller is actually who they say they are and only who they say they are over the course of the transaction. Read more pymnts.com

Loyalty fraud wave sparks security tech collaboration

Snap alum launches curated online store Verishop

Victoria, TX: 4 towable Welders valued at over $100,000 stolen from Sunbelt Rental
Victoria Crime Stoppers is seeking information regarding a felony theft. During the night, from June 16th to 17th, four towable welding machines were stolen from a business on the 4000 block of us Highway 59 North. The offenders cut the locks from a gate, drove onto the property, hooked up the welders, and then drove away. crossroadstoday.com

Cumberland County, PA: Duo teamed up to distract employee, steal diamond ring at Capital City Mall
Lower Allen Township Police are trying to identify the suspects in a retail theft that occurred at the Capital City Mall in May. Police say the suspects worked together to distract an employee and steal a diamond ring worth several thousand dollars. The incident happened May 20, at about 10:38 a.m., police say. fox43.com

York, PA: Sheet metal cutters used to remove security tags in Kohl's shoe theft
On Monday, West Manchester Township Police released surveillance images, hoping to identify a woman suspected of stealing dresses and shoes from Kohl's earlier this month. ydr.com

Springfield, PA: Shoplifter nabbed after stealing $1k worth of Polo merchandise from Macy's

Rome, GA: Woman charged with Felony Theft for assisting in stealing 2 Flat Screen TV valued at $528 from Walmart

Macon, GA: Burlington’s Loss Prevention recognize 2 shoplifters, arrest warrants issued

Submit Your New Hires/Promotions
or New Position
See all the Industry Movement

Feature Your Job Here For 30 Days -
70% Aren't On the Boards
Post your job listing

Sponsor Today's Internet Jobs

Providing a reference on an executive is a serious commitment and should never be taken or given lightly as references play a critical role in the decision process regarding major investments companies make when they hire a new executive. For example, when a company hires a $100,000 a year executive, they'll spend close to $200,000 on that executive in the first year alone merely to get the executive up and running. And if your recommendation isn't accurate, it could lead to problems not only for the company referencing the executive, but also for the executive themselves and that's the real concern. So when you're asked to give a reference, make sure you understand the position they're looking to fill and give an accurate assessment based on your experience and knowledge of that person and of the needs of that position. Because the last thing anyone wants is to have an executive fail in their new position if it could have been avoided.

Just a Thought,
Gus

Post Your Tip or Advice!
(content subject to approval)

See More Events

Recruiting?
Get your job e-mailed to everyone... everyday
Post on our Featured Jobs Board!

Not getting the Daily?
Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

SUBSCRIBE

FEEDBACK

www.downing-downing.com

Advertise With The D&D Daily

36615 Vine Street, Suite 103
Willoughby, OH 44094
440.942.0671
copyright 2009-2019
all rights reserved globally