With 23andMe filing for bankruptcy, here's how to remove your data from the company and protect yourself from the 2023 breach.

The genetic testing company 23andMe filed for bankruptcy on Sunday, announcing that, in searching for financial stability through its sale to a new owner, the business will continue operating as normal, including in how customer data is handled.

“The company intends to continue operating its business in the ordinary course throughout the sale process,” 23andMe wrote in a news statement. “There are no changes to the way the company stores, manages, or protects customer data.”

For some customers, that’s exactly the problem.

In 2023, not only did the company suffer a major data breach, it also placed some of the blame on the victims who, according to 23andMe, “negligently recycled and failed to update their passwords.”  With concerns now swirling about exactly who will become the new steward of 23andMe’s data following its bankruptcy, customers are asking how they can secure their most private genetic information, if at all.

Here are two big steps that 23andMe customers can take right now:

1.  Request that the company delete your data.
2.  Discover whether your data was included in the 2023 breach.

These are two, separate actions that will not impact one another and should be both taken for separate reasons—the first, to ask that the company remove your data from its possession; the second, to know how to protect yourself if your data was leaked in the past.

****What is happening?****

Over the weekend, 23andMe announced that it would file for bankruptcy after months of financial decline. Though the company was valued at a reported $6 billion in 2021, its genetic testing business—in which customers can have their saliva tested for insights into their genealogy and potential health risks—has faltered. Just last week, the company was reportedly valued at $50 million.

To save the company and its operations, 23andMe’s leadership is now on the hunt for a new owner (and that new owner’s cash infusion). One potential bidder has already made their intent abundantly clear: Former CEO Anne Wojcicki, who resigned the same day that the company announced its bankruptcy.

“I have resigned as CEO of the company so I can be in the best position to pursue the company as an independent bidder,” Wojcicki wrote on LinkedIn.

Wojcicki faces an uphill battle, though—her earlier proposal to take the company private was rejected last year.

Whoever becomes the new owner of 23andMe, however, could also become the new owner of 23andMe customer data. According to the company’s own privacy statement:

> “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”

That has worried some experts who have pointed out that a new owner could, for instance, hand over customer data to insurance companies to hike up monthly premiums, or to data brokers to power increasingly invasive, targeted advertising.

For 23andMe customers who want to delete their data from 23andMe:

*   Log into your account and navigate to **Settings**.
*   Under **Settings**, scroll to the section titled **23andMe data**. Select **View**.
*   You will be asked to enter your date of birth for extra security. 
*   In the next section, you’ll be asked which, if there is any, personal data you’d like to download from the company (onto a personal, not public, computer). Once you’re finished, scroll to the bottom and select **Permanently delete data**.
*   You should then receive an email from 23andMe detailing its account deletion policy and requesting that you confirm your request. Once you confirm you’d like your data to be deleted, the deletion will begin automatically, and you’ll immediately lose access to your account. 

****How to find your 23andMe data in the 2023 breac**h**

In 2023, 23andMe suffered a data breach that impacted up to seven million people. Found being sold on the dark web, the data reportedly included “profile and account ID numbers, names, gender, birth year, maternal and paternal genetic markers, ancestral heritage results, and data on whether or not each user has opted into 23AndMe’s health data.”

With the data, cybercriminals could learn about a person’s genealogy and potentially use some of the information to aid them in committing identity fraud.

There is no meaningful way to _remove_ this data from the dark web. Instead, we recommend that you run a scan using our free Digital Footprint Portal to see if your data was exposed in the 2023 breach, and then to take additional steps to protect yourself.

If your data was exposed in the 23andMe breach, here is what you can do:

*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

 23andMe bankruptcy: How to delete your data and stay safe from the 2023 breach 

Google has admitted it accidentally deleted some Maps Timeline user data after what it calls a "technical issue".

Google has admitted it accidentally deleted some users’ Google Maps Timeline data after a “technical issue”.

As reported by Forbes on March 11, users started noticing that their Google Maps Timelines had completely disappeared. At the time, we didn’t know anything about the cause of this issue.

However, now we do, after some of the impacted users received a email from Google on March 21. Not with an apology, mind you, but with an explanation.

Google wrote that it had:

> “Briefly experienced a technical issue that caused the deletion of Timeline data for some people. If you have encrypted backups enabled, you may be able to restore your data.”

If you’re among those affected and you did have backups enabled, here’s how you can attempt to restore your data:

*   Make sure you have the latest version of the Google Maps app installed on your device.
*   Open Google Maps, tap on your profile picture in the top right corner, and select **Your Timeline**.
*   Look for a cloud icon at the top of the Timeline screen and tap it. Choose a backup to import your data.

This doesn’t seem to work for everyone though, with some users commenting that this method didn’t work for them.

If you didn’t have backups enabled, it might not be possible to recover your lost Timeline data.

**Planned deletion**

For those interested in keeping their Timeline, bear in mind that if you don’t take action soon, your visits and routes might be erased, and your Timeline settings disabled. Earlier this month, Google announced that it will begin deleting the last three months of Timeline data unless you take action to back it up, as part of a roll out of significant changes to Maps Timeline.

After you receive the notification from Google, you have about six months to save or transfer your Timeline data before deletion takes place. The sender of the email is “Google Location History,” with the subject line: “Keep your Timeline? Decide by \[date\].”

When you get the prompt, follow the instructions on how to adjust your settings on your device. If you don’t, your visits and routes will be erased, and your Timeline settings will be disabled.

**How to back up your Google Maps Timeline data**

Here’s how back up your Timeline data to prevent any future losses, and help preserve your data during the planned deletion:

*   Open the Google Maps app.
*   Tap your profile picture, then **Your Timeline**.
*   At the top right, tap the cloud icon.
*   If auto-delete is turned on, turn it off.
*   On the Backup screen, turn on **Backup**.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 Oops! Google accidentally deletes some users&#8217; Maps Timeline data 

A list of topics we covered in the week of March 17 to March 23 of 2025

March 21, 2025 - The release of the JFK assassination records also resulted in the leak of hundreds of Social Security Numbers

March 20, 2025 - The phishing campaign for valuable Google accounts continues with a new twist, going after the customers of a SasS platform.

March 20, 2025 - Experts are warning about the proliferating market for targeted spyware and espionage. Why should we be concerned?

March 19, 2025 - With financial stress at an all-time high, people are desperately seeking relief. Sadly, scammers know this all too well.

March 19, 2025 - Sperm donor giant California Cryobank has announced it has suffered a data breach that exposed customers' personal information.

 A week in security (March 17 &#8211; March 23) 

This week on the Lock and Code podcast, we speak with Carey Parker about what Google Chrome knows about you.

_This week on the Lock and Code podcast…_

Google Chrome is, by far, the most popular web browser in the world.

According to several metrics, Chrome accounts for anywhere between 52% and 66% of the current global market share for web browser use. At that higher estimate, that means that, if the 5.5 billion internet users around the world were to open up a web browser right now, 3.6 billion of them would open up Google Chrome.

And because the browser is the most common portal to our daily universe of online activity—searching for answers to questions, looking up recipes, applying for jobs, posting on forums, accessing cloud applications, reading the news, comparing prices, recording Lock and Code, buying concert tickets, signing up for newsletters—then the company that controls that browser likely knows a lot about its users.

In the case of Google Chrome, that’s entirely true.

Google Chrome knows the websites you visit, the searches you make (through Google), the links you click, and the device model you use, along with the version of Chrome you run. That may sound benign, but when collected over long periods of time, and when coupled with the mountains of data that other Google products collect about you, this wealth of data can paint a deeply intimate portrait of your life.

Today, on the Lock and Code podcast with host David Ruiz, we speak with author, podcast host, and privacy advocate Carey Parker about what Google Chrome knows about you, why that data is sensitive, what “Incognito mode” really does, and what you can do in response.

We also explain exactly why Google would want this money, and that’s to help it run as an ad company.

> “That’s what \[Google is\]. Full stop. Google is an ad company who just happens to make a web browser, and a search engine, and an email app, and a whole lot more than that.”

Tune in today to listen to the full conversation.

_Show notes and credits:_

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)  
Licensed under Creative Commons: By Attribution 4.0 License  
http://creativecommons.org/licenses/by/4.0/  
Outro Music: “Good God” by Wowa (unminus.com)

**Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.**

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

 What Google Chrome knows about you, with Carey Parker (Lock and Code S06E06) 

The release of the JFK assassination records also resulted in the leak of hundreds of Social Security Numbers

Over 60,000 pages related to the 1963 assassination of US President John F. Kennedy were released as part of President Donald Trump’s directive on March 17, 2025, and while readers will not find a conclusive answer to the main question—nor will the files put an end to surrounding conspiracy theories—one unplanned consequence was the disclosure of 400 Social Security Numbers (SSNs) and other privacy sensitive information amongst the rest of the records.

The records, which belong to the President John F. Kennedy (JFK) Assassination Records Collection, were previously withheld for classification but are now available to access online or at the National Archives at College Park, Maryland. The hard copy contains more data since the records have not been completely digitized yet. Some of the records had been made available previously but were redacted. Many, although not all redactions have been removed. And while the documents reveal new information, some of the records are not even directly related to the assassination but rather deal with covert CIA operations.

What has also drawn attention, however, is the leak of SSNs and private info.

This information mostly belongs to former congressional staffers. After a report by The  Washington Post of this oversight, the National Archives started screening the documents for Social Security numbers so that the Social Security Administration could identify living individuals and issue them new numbers. And according to an anonymous source those affected will receive free credit monitoring.

In total, the Post reportedly found 3,500 instances of SSNs, but many of them were mentioned more than once. Up to dozens of times.

With 100 staff members of the Senate Church Committee, established in 1975 to investigate abuses by America’s intelligence agencies and government, and 100 staff members of the House Select Committee on Assassinations, which investigated the killing of JFK, many of the affected have since become high-ranking officials in Washington.

For example, a former assistant secretary of state, a former US ambassador, and several prominent figures in the intelligence and legal fields are included in the leak.  

The release of the personal information in the JFK files is a major oversight caused by the sudden urgency put behind the release. The procedure has been called anything from “sloppy” to “incredibly irresponsible,” according to a former lawyer for the Trump campaign, Joseph diGenova.

We feel it certainly qualifies as a data breach when SSNs are leaked. Your Social Security Number is a key to many aspects of your life—financial, medical, and personal, especially when it concerns public figures that are already in the spotlight and in danger of harassment.

Or, as diGenova described it:

> “It not only means identity theft, but I’ve had threats against me.”

****Protecting yourself after a data breach****

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

*   **Check the vendor’s advice.** Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Malwarebytes has a free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.

 Personal data revealed in released JFK files 

The phishing campaign for valuable Google accounts continues with a new twist, going after the customers of a Sass platform.

_This blog post was co-authored with_ _Elie Berreby, Senior SEO Strategist_

Criminals are highly interested in online marketing and advertising tools that they can leverage as part of their ongoing malware campaigns.

In particular, we have previously detailed how Google advertiser accounts can be hijacked to create new malicious ads and perpetuate a vicious cycle leading to more compromised accounts.

As part of our investigations, we uncovered a new operation going after Semrush, a visibility management SaaS platform that offers SEO, advertising, and market research, amongst other things.

With 40% of Fortune 500 companies and 117,000 paying customers relying on Semrush, the platform presents a highly attractive target for online criminals.

In this blog post, we detail how fraudsters are taking an indirect approach to hacking Google advertisers and by the same token likely gaining access to Semrush accounts.

We have diligently reported the malicious ads to Google. We would like to stress that we are not referring to any vulnerability or data breach with Semrush or its platform in this post. They are simply being targeted because of their growing popularity.

****Google Ads crew pivots****

Back in January, we documented a large phishing campaign targeting Google accounts via Google Ads using a very specific technique that abused Google Sites.

We believe the criminals behind it likely regrouped and switched to a less direct approach, yet one that might deliver just as much.

We observed this transition with a malicious ad for “Google Ads” that oddly enough redirected to a fraudulent login page for Semrush. While the phishing page uses the Semrush brand, only the “Log in with Google” option is enabled, forcing victims to authenticate with their Google account username and password.

****Semrush phishing campaign****

Barely a day later, the campaign was starting to take shape with Google ads now fully moving away from the “Google Ads” brand to fully impersonating Semrush.

The infrastructure for this new wave was deployed recently and the domain names registered for it are all variations on the Semrush name.

Each ad uses a unique domain name which does a redirect to more static domains dedicated to the fake Semrush and Google account login pages.

Once again, the landing page here shows two different types of login but only the Google method is enabled. We believe this is because the threat actors are primarily interested in harvesting Google accounts.

This is confirmed by the malicious sign in page for Google which sends those credentials to the criminals. We should note that victims that arrive at this page are most likely Semrush users, given the path they took to get here.

****Google Analytics and Search Console Data Theft****

_Disclaimer: The following is not taken from a real compromise but rather is meant to illustrate the importance and extent of owning the credentials for a valuable Google account._

Google Analytics (GA) and Google Search Console (GSC) contain critical and confidential information for businesses, revealing detailed perspectives on website performance, user behavioral patterns, and strategic business focuses.

If a Google account is compromised, the malicious actors can access the raw data directly without having to log into Semrush.

E-commerce tracking in GA shows revenue, transaction volumes, average order values, and conversion rates by channel (organic search, paid ads).

Here’s a local shop selling products to a niche audience in a major U.S. city.

When malicious actors access the Google Analytics account, they can see a wealth of confidential information belonging to the publisher. For companies, this is a direct peek into financial performance.

The GSC account below is connected to Semrush. In GSC, the bad actors could see historical data for the past 16 months, including but not limited to search queries, pages, countries, devices, search appearance and dates.

**Semrush Fraud and spear-phishing**

_Disclaimer: Similarly, the following screenshots were not taken from an actual compromise, but highlight the interconnectivity between Google and Semrush accounts._

As mentioned earlier, Google Analytics and Google Search Console data is often integrated with tools like Semrush for enhanced analysis.

For new projects, the SaaS platform requests validation from a Google account to allow Semrush to see and download GA and GSC data.

Once this is done, we can export behavioral data and KPIs coming directly from Google Search Console (GSC) without direct access to the Google account.

There is additional information stored in a Semrush account (name, phone, business name, address, email and the last 4 digits of a Visa card) that a threat actor could leverage to impersonate an individual or business.

Posing as the business, a threat actor could deceive vendors or partners into sending payments to fraudulent accounts, exploiting the trust tied to the business’s identity.

The combination of billing information and card details could be used to mount a more comprehensive attack. Someone posing as Semrush support, referencing an upcoming payment or the billing update process, could trick the victim into providing full credit card details.

****Conclusion****

Brand impersonation continues to be a popular attack vector used by online criminals to get access to valuable account credentials.

As Google Search is a central part of the SEO and ad ecosystems, individuals and businesses who inadvertently click on a malicious ad are at a major risk of losing extremely sensitive data and feel the impact of fraud on many levels. 

This should be a wakeup call to take steps to prevent such exposure by enforcing guard rails to anyone who manages an account for themselves or a company.

If you are a Malwarebytes customer, you are already protected against the malicious ads and sites used in this campaign. All these incidents have also been reported directly to Google.

_We would like to thank the folks at Silent Push for giving us access to their platform, enabling us to uncover additional infrastructure._

****Malicious** Semrush domains**

adsense-word\[.\]com  
auth\[.\]semrush\[.\]help  
sem-russhh\[.\]com  
sem-rushhh\[.\]com  
sem-rushh\[.\]com  
semrush\[.\]click  
semrussh\[.\]sbs  
semrush\[.\]tech  
seemruush\[.\]com  
semrush-auth\[.\]com  
auth.seem-rush\[.\]com  
ads-semrush\[.\]com  
semrush-pro\[.\]co  
semrush-pro\[.\]click  
auth.sem-ruush\[.\]com  
semrush\[.\]works

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Semrush impersonation scam hits Google Ads 

Experts are warning about the proliferating market for targeted spyware and espionage. Why should we be concerned?

Experts are again warning about the proliferating market for targeted spyware and espionage.

Before we dive into the world of targeted spyware, it’s worth looking at a few of the main players that are active in and against this industry.

**Paragon Solutions** is an Israeli company which sells high-end surveillance technology primarily to government clients, positioning its products as essential for combating crime and national security. The name of Paragon’s spyware is Graphite.

However, a lot of controversy arose when it faced allegations over the targeting of specific WhatsApp users, including journalists and civil society members, leading to a cease-and-desist notice from WhatsApp. Following these allegations, Paragon Solutions ended its contract with Italy after Italian citizens were found to have been targeted.

The **NSO group** creates the high-level spyware known as Pegasus, and has also been caught spying on WhatsApp users. The NSO Group justifies the use of Pegasus by saying it’s a beneficial tool for investigating and preventing terrorist attacks and maintaining the safety of the public.

On the opposite side of the fence, **CitizenLab** is an interdisciplinary laboratory based in Toronto, Canada. CitizenLab focuses on studying information controls that impact the openness and security of the internet and pose threats to human rights.

The work done by CitizenLab has led to greater understanding of the global digital surveillance landscape and its implications for human rights.

Often, we will see newly found vulnerabilities in iOS, WhatsApp and other software credited to CitizenLab or one of its associates. They often find these vulnerabilities by analyzing devices of individuals infected with high-level spyware.

In an interview with TheRecord, founder Ronald Deibert said CitizenLab routinely checks people’s phones for spyware. Over time, the researchers at CitizenLab have honed their forensic skills to the level that they can pinpoint the moment of infection for the device right down to the second.

In a recent article, CitizenLab explained in great detail how it cooperated with Meta on uncovering a WhatsApp zero-day vulnerability and how it traced it back to Paragon and the Italian government.

While most of us will, hopefully, never have to deal or worry about getting infected with high-level spyware, we may end up falling victim to the vulnerabilities that are used to infect targets.

Both Paragon and the NSO group have brought many zero-day vulnerabilities to light in browsers and other online applications by using them to compromise mobile devices.

Zero-day vulnerabilities are hard to come by and therefore expensive. But once they are used against victims, there is a good chance that at some point they will be discovered and patched.

But small-time criminals will pick them up and try to use them against people who haven’t had a chance or the time to update their device yet.

Which is why we, on this blog, and through Malwarebytes’ Trusted Advisor, always urge people to keep their devices up-to-date.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 Targeted spyware and why it&#8217;s a concern to us 

With financial stress at an all-time high, people are desperately seeking relief. Sadly, scammers know this all too well.

With financial stress at an all-time high, and many Americans grappling with confusion about social security, Medicaid, and Medicare, people are desperately seeking relief. Scammers know this all too well and have tailored their tactics to exploit these fears, preying on vulnerable individuals with promises of “free money.”

Whether it’s a so-called “subsidy program,” a “government grant,” or a “relief card,” these scams all share the same underlying goal—to manipulate people into giving away their personal information, or—worse—their hard-earned cash. 

**Common free money scams******Too-good-to-be-true claims**:**

*   “Get a $6,400 Subsidy to Pay for Groceries, Rent, and Gas!” 

*   “Only 3 Days Left to Claim Your Government Benefit!” 

*   “482 Spots Remaining! Act Now!” 

Urgency and exclusivity are classic scam tactics. By creating a demand to do something as soon as possible, scammers push people to act before they have time to think critically. 

****Fabricated** **s****ocial** **p****roof** **

*   “Floyd Miles from LA just received his subsidy!” 

*   “Mary T. Pritts from Silsbee, TX qualified 17 seconds ago!” 

*   “Thousands of Americans are getting financial relief!” 

These so called testimonials are almost always fake, designed to create a false sense of trust. The names, locations, and stories are either entirely made up or copied from other scam sites. 

****A push to submit personal information** **

*   “Enter your name, email, and phone number to check eligibility!” 

*   “Claim your subsidy now – just provide your bank details!” 

The goal? To collect personal data that can be used for identity theft, sold to third parties, or leveraged for future scams. 

****Push notification scams** **

After submitting information, users are prompted to “Allow” notifications to receive updates on their application. In reality, enabling notifications results in a flood of unwanted ads and malicious content (malvertising), potentially exposing users to phishing attempts and harmful software. 

*   **Phishing emails and messages**: Scammers send convincing emails or text messages that appear to be from legitimate government agencies or financial institutions, urging users to click on malicious links or provide personal information. 
*   **Impersonation scams**: Fraudsters pose as government officials, representatives from relief organizations, or financial advisors to gain victims’ trust. 
*   **Fake customer support calls**: Victims may receive calls from so-called “support agents” asking for verification details to process their subsidy claim. 
*   **QR code scams**: Increasingly, scammers use QR codes on fake subsidy pages to drive users to phishing sites that steal their credentials.
*   **Malware-infested attachments**: Scammers send downloadable forms for “subsidy applications,” which are actually embedded with malware that steals information from users’ devices. 

****Red flags to watch out for** **

*   **Vague or unverifiable claims:** Legitimate government programs are clearly outlined on official websites (.gov domains). If a subsidy isn’t listed there, it doesn’t exist.
*   **No contact information:** If a website lacks a verifiable phone number, email or office address, it’s likely a scam. 
*   **Unrealistic promises:** Any offer of free money with no strings attached should raise suspicions. 
*   **Pressuring users to act quickly:** Government aid programs don’t work on a first-come, first-served basis with countdown timers. 

****How to protect yourself** from free money scams**

*   **Verify sources**: If an offer sounds too good to be true, check with official government sites like USA.gov or your local state agency. 
*   **Never share personal information**: Avoid entering sensitive information (Social Security Number, bank details, etc.) on unverified websites. 
*   **Report suspicious sites**: If you come across a scam, report it to the Federal Trade Commission (FTC) at reportfraud.ftc.gov. 
*   **Educate others**: Many scam victims are elderly or financially struggling individuals who may not recognize these red flags. Share this knowledge to protect your loved ones. 

****Conclusion** **

Scammers are constantly evolving, but their tactics remain predictable. By staying informed and skeptical of “too-good-to-be-true” offers, we can collectively shut down these fraudulent schemes. The best defense is awareness—because in reality, there’s no such thing as free money. 

****IOCs** **

34\[.\]123\[.\]196\[.\]68 

34\[.\]132\[.\]227\[.\]60 

34\[.\]31\[.\]92\[.\]173 

aidforhealthcare\[.\]org 

americansubsidy\[.\]com 

assistanceadvocate\[.\]org 

assistanceadvocates\[.\]org 

communitycareaid\[.\]org 

grabsubsidy\[.\]com 

healthaidhub\[.\]org 

healthaidnetwork\[.\]org 

improveourcredit\[.\]com 

justhealthbenefits\[.\]com 

local-subsidy\[.\]com 

localaid\[.\]co 

nationaid\[.\]org 

nationwidesubsidy\[.\]com 

qualifyaca\[.\]com 

subsidyacrossnation\[.\]com 

subsidyaid\[.\]com 

subsidysupport\[.\]org 

subsidysupportnetwork\[.\]org 

timeforacahelp\[.\]com 

us-debtassistance\[.\]org 

wellnesssubsidyhub\[.\]org

 The &#8220;free money&#8221; trap: How scammers exploit financial anxiety  

Sperm donor giant California Cryobank has announced it has suffered a data breach that exposed customers' personal information.

Sperm donor giant California Cryobank has announced it has suffered a data breach that exposed customers’ personal information.

California Cryobank (CCB) is a sperm donation and cryopreservation firm and one of the US’ top sperm banks. As such, it services all US states and over 30 countries worldwide.

The data breach notification states that the breach occurred on April 20, 2024 and CCB discovered it on October 4, 2024. After an investigation, CCB determined that an unauthorized party gained access to its IT environment and may have accessed and/or acquired files maintained on certain computer systems between April 20, 2024, and April 22, 2024.

The information potentially involved varies by customer but includes names and one or more of the following:

*   Driver’s license numbers
*   Bank account and routing numbers.
*   Social Security Numbers (SSN)
*   Health insurance information

CCB is posting letters—along the lines of this California example—to everyone who may be impacted.

It is unclear whether the CCB considers sperm donors as customers so their personal information may or may not have been breached.

Anonymous sperm donations are mostly a thing of the past. Anonymous donation was considered a method deemed to protect the privacy of the donor and shield them from any legal obligations, but online DNA databases have put an end to any guarantee of anonymity. However, untimely disclosure of sperm donor details might pose a significant privacy concern to those who donated in the past anonymously.

The handling, storage, and sharing of protected health information (PHI) within sperm banks falls under the Health Insurance Portability and Accountability Act (HIPAA):

*   The Privacy Rule requires sperm banks to implement safeguards to protect the privacy of PHI and sets limits and conditions on the uses and disclosures that can be made without patient consent.
*   The Security Rule specifically requires sperm banks to secure electronic PHI (ePHI) appropriately against potential risks to confidentiality, integrity, and availability.
*   The Breach Notification Rule requires the provision of a notification to affected individuals, the Secretary of Health and Human Services, and, in certain circumstances, to the media, in the event of a breach of unsecured PHI.

CCB is offering individuals whose Social Security and/or driver’s license numbers may have been involved in the incident complimentary one-year memberships to credit monitoring services.

For those that receive a notification letter, CCB has set up a dedicated, tollfree call center to answer questions that recipients may have.

**Protecting yourself after a data breach**

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

*   **Check the vendor’s advice.** Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Malwarebytes has a free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.

 Sperm bank breach deposits data into hands of cybercriminals 

Reddit users from trading and crypto subreddits are being lured into installing malware disguised as premium cracked software.

We were alerted to Mac and Windows stealers currently distributed via Reddit posts targeting users engaging in cryptocurrency trading. One of the common lures is a cracked software version of the popular trading platform TradingView.

The crooks are posting links to both Windows and Mac installers which have been laced with Lumma Stealer and Atomic Stealer (AMOS) respectively.

These two malware families have wreaked havoc, pillaging victims’ personal data and enabling their distributors to make substantial gains, mostly by taking over cryptocurrency wallets.

**Reddit posts target crypto enthusiasts**

Scammers are lurking on subreddits visited by cryptocurrency traders and posting about free access to TradingView, a web-based platform and social network that provides charting tools for analyzing financial markets, including stocks, forex, cryptocurrencies, and commodities.

The offer claims that the programs are totally free and have been cracked directly from their official version, unlocking premium features.

While the original post gives a heads-up that you are installing these files at your own risk, further down in the thread we can read comments from the OP such as “_a real virus on a Mac would be wild_“.

We checked both links and noticed that the website hosting the files belongs to a Dubai cleaning company. It’s not totally clear why the scammers didn’t choose a service like Mega or similar, unless they wanted the ability to upload and update their code directly via a server they control.

Upon checking that website, we can see that it leaks its PHP version (7.3.33). It already reached its end of life in December 2021 and no longer receives official security updates, making it prone to exploitation and compromise.

**Double zipped malware**

Both Mac and Windows files are double zipped, with the final zip being password protected. For comparison, a legitimate executable would not need to be distributed in such fashion.

On Mac, the installer is a new variant of AMOS, a popular macOS stealer. In its latest iterations, the malicious code checks for the presence of virtual machines and exits with error code 42 if it detects any.

osascript -e "set memData to do shell script \\"system\_profiler SPMemoryDataType\\"  
if memData contains \\"QEMU\\" or memData contains \\"VMware\\" then  
    do shell script \\"exit 42\\"  
else  
    do shell script \\"exit 0\\"  
end if"

Analysis of the full script shows the function that exfiltrates user data via a POST request to 45.140.13.244, a server hosted in the Seychelles:

On Windows, the payload is loaded via an obfuscated bat file (_Costs.tiff.bat_) that runs a malicious Autoit script (_Sad .com_):

"C:\\Windows\\system32\\cmd.exe" /c expand Costs.tiff Costs.tiff.bat & Costs.tiff.bat

cmd /c copy /b 701617\\Sad.com + Io + Thin + Experiment + Detect + Subsection + Meter + Well + Walls + Substantially + Mcdonald 701617\\Sad.com

The malware command and control server here is _cousidporke\[.\]icu_, registered about a week ago by someone in Russia.

We have heard of victims whose crypto wallets had been emptied, and were subsequently impersonated by the criminals who sent phishing links to their contacts.

**Conclusion**

Cracked software has been prone to containing malware for decades, but clearly the lure of a free lunch is still very appealing. What’s interesting with this particular scheme is how involved the original poster is, going through the thread and being ‘helpful’ to users asking questions or reporting an issue.

Here are some things to look out for and stay safe:

*   instructions to disable security software so the program can run (do not disable the antivirus that’s trying to protect you!)
*   files that are password-protected (this is a common practice to thwart security scanners)
*   files hosted on dubious online platforms

However, it is still easy to fall for these scams, especially if the recommendation came from a friend. Malwarebytes protects from both Mac and Windows payloads.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Source

Malwarebytes