IoT Teddy Bear Leaks Millions of Voice Recordings from Children and Parents


CloudPets’ connected stuffed animals leaked more than 2 million voice recordings of parents and children because of their poor database security. This is only the latest compromise happening with children’s toys.

The breach was first reported on Tuesday in a blog post by Troy Hunt, a Microsoft guru who specializes in cloud and online security. Hunt informs that CloudPets’ data was saved to a MongoDB database on an Amazon-hosted service that was publicly available and required no authentication, not even a password. Hunt goes on to say that the database was filed by Shodan, a search engine known for finding connected things, and evidence shows that since December 25, 2016 the stored data had been accessed multiple times by multiple people. CloudPets’ parent company, Spiral Toys, was notified at least four times about the breach, however, Hunt explains that some attempts to contact the company failed due to dead email addresses. In any event, there is no way Spiral Toys was not aware of the leak due to evidence left from criminal ransom demands.

Although this is a wake-up call to parents, businesses can take a lot away from the CloudPets breach, explains cybersecurity expert, Vinny Troia, CEO of NightLion Security. “Many businesses have not taken cybersecurity as seriously as they should be, until it’s too late,” Troia continues, “they take shortcuts that do not properly protect them against cyber criminals, and then are floored when their system becomes compromised.” Troia goes onto to explain that today cybersecurity needs to be at the forefront of businesses’ minds or they are going to be the next Spiral Toys.

The CloudPets incident is only the most recent compromise involving IoT toys, but they are certainly not the last. Both businesses and parents need to take the proper steps to protect the user data and their children from the darker side of the cyber world.


2017 Phishing Scam is the Most Dangerous the IRS has Seen in Years


Tax season is upon, which means time for the Internal Revenue Service (IRS) to release its “Dirty Dozen” scam list for 2017. This annual list features numerous schemes taxpayers may encounter throughout the year, but mostly occur during tax season.

It is no surprise that phishing scams are at the top of the list. Earlier this month, the IRS warned about a very refined and evolving W-2 scam that is targeting school districts, corporations, hospitals, nonprofits and regular taxpayers. According to the IRS, this particular phishing scam is not an IRS impersonation, but instead scammers are sending an email to a company’s payroll department as a company executive. The email requests a list of employees and their W-2 information, which gives the scammer access to the employees’ personal and tax information.

IRS Commissioner, John Koskinen, commented, “this is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns. We need everyone’s help to turn the tide against this scheme.’’

To view the rest of the “Dirty Dozen”, click here.

Koskinen advises people to avoid opening emails or clicking on websites stating to be from the IRS. He goes on to remind that if it sounds too good to be true it probably is. In addition to Koskinen’s advice, cybersecurity expert, Vinny Troia, CEO of NightLion Security adds, “cyber criminals are getting smarter. Make sure you’re using strong, tricky passwords to protect your personal information and networks. All sensitive information should be backed up with two-step authentication, which helps prevent cyber criminals from hacking into a system. Be completely sure your network has no vulnerabilities these hackers can exploit; my team offers 24/7 emergency service to companies who have been exploited.”

Being aware of the latest scams is half the battle, good luck out there.

Banks Infected with Invisible Malware, World-Wide


Banks around the world are being infected with a new form of fileless malware. This type of malware is invisible, as it lies undetected within the memory of a bank’s network gathering passwords and administrative information. The malware then feeds this data back to the hackers, who use it to control the bank’s computer system remotely.

According to Kaspersky Lab, who discovered the new form of malware, there have been reports of this malware at 140 different enterprises in 40 different countries throughout the globe, including: banks, telecoms and government institutions. The United States being hit the hardest with 21 reported incidents.

“What is interesting here is that these attacks are ongoing globally against banks themselves,” said Kaspersky Lab expert Kurt Baumgartner to Ars Technica late last week. Baumgartner went on to explain, “the banks have not been adequately prepared in many cases to deal with this.”

Kaspersky Lab is unsure who is behind the attack or if it is more than one group using the same tools. They plan on releasing their findings later today.

Whoever is behind these attacks is focusing on computers that run automatic teller machines and “pushing money out of the banks from within the banks,” explains Baumgartner. He goes on to say that many of these attacks varied in the way they were executed, which is why they think numerous groups could be involved.

Fileless malware attacks are becoming more common than anyone imagined, which is why cyber security has become such an important tool. Digital Forensic Firms, such as, NightLion Security, offer malware detection and removal with 24/7 service. Vinny Troia, CEO of the St. Louis Digital Forensics Firm, commented that banks are being targeted because they do not have the proper security in place to protect them against this type of invisible malware distribution.

Biggest Cyber Security Risks of 2016



Hackers are getting worse and worse as years go by. In 2015, 34.2 percent of computer users experienced at least one Web attack. That is a large number of people and it’s only going to increase. The biggest cyber security threats of 2016 are data breaches, ransomware and browser plug-ins, as indicated in an article on Fox News.

Vinny Troia, Hacking Forensic Investigator and CEO of Night Lion Security, a St. Louis cyber security and digital forensics firm, states that companies are beginning to use data breaching as an annual expense. Troia states that it is better to acquire the proper digital security than to allow these data breaches to happen. This year, it is expected that data breaches will occur in the hotel industry, medical insurance agency and unexpected industries, like the high-tech toy industry. Hackers are going for more unexpected industries because people are becoming more cautious.

Make sure you are always watching out for what you click on when on the Internet. Also it is important to check everything you purchase, including health insurance. This may seem overwhelming to check every little thing but it is better to be safe than sorry. Read the whole article here to learn more about the 3 biggest security threats of 2016.

Cyber Forensics Expert discusses JP Morgan data breach


10 banks, including JP Morgan experienced a data breach and customer information was stolen. There was no money actually taken from their accounts but they were effected by their credit cards. The Apple pay system is a way around this credit card problem. Vinny Troia, Hacking Forensic Investigator and CEO of Night Lion Security, a St. Louis Cyber Security and digital forensics firm, discusses this topic on Fox Business.

The Apple pay system was created to revolutionize things because there is no potential to intercept the credit card number. Troia explains that the next big thing to happen will be for hackers to match usernames and passwords of people’s bank accounts and drain all of their money out. When this eventually happens, banks will have to make sure all of the people affected get their money back.

Cyber Security Expert discusses JP Morgan Breach


The JP Morgan data breach is known as one of the worst data breaches ever. A hacker had gotten in through one of the personal computers at JP Morgan. An Illinois attorney general expressed that this breach is the most troubling because of not only its magnitude, but also it proves hackers can get into anything and people cannot assume their information is safe anymore.

Vinny Troia, Certified Hacking Forensic Investigator and CEO of Night Lion Security, discusses this issue with Kevin O’Leary, Michelle Caruso-Cabrera and the staff of CNBC’s Closing Bell. Troia explains how the hackers did not take the passwords to people’s usernames because JP Morgan would notify everyone to change their passwords immediately. The hackers calculated their exact move and are experts in data breaching. Companies are now expecting breaches to happen and should be better prepared in the future.

Criminals using the Dark Net to sell stolen credit cards


During the holidays people are swiping their credit cards more than any other time of year. This is why people need to be more conscientious of what they’re spending their money on. There is a system called the dark net, which is an underground system of anonymous websites that are untraceable. One of the things this dark net consists of is hacked credit card numbers that are sold in bulk.

Vinny Troia, cyber security expert and CEO of Night Lion Security, explains how people will micro fraud, or make small transactions at a time. These small transactions will eventually add up to huge numbers. Usually, people don’t notice it until it adds up to a huge amount.

To avoid this from happening to you, make sure you are always checking your credit card statements daily!