Hackers Target Sports Training Clinic, N.C. State; Alabama and Oklahoma Accidentally Leak Security-Sensitive Data

In case you missed our coverage this week in ThreatWatch, Nextgov’s regularly updated index of cyber breaches:

Sports Clinic Owner Alleges MLB Hacked His Social Media Presence

DNA Sports Labs, a training and sports science lab in Florida, relied on social media, including YouTube and Facebook for advertising, and depended on PayPal for sales transactions.

The lab’s owner Neiman Nix now alleges in a lawsuit filed in federal court July 14 that Major League Baseball attacked him online over a belief that he was “selling illegal substances to MLB players” and in so doing, ruined his business.

A computer expert Nix hired traced attacks on his YouTube page and his Facebook page to an IP address in New York "where MLB is located," Nix’s suit states. 

Nix also claims Neil Boland — currently the league’s vice president of information security — personally directed the hack attack. 

MLB released a statement saying, in part, “the allegations in this lawsuit, including the allegations relating to the hacking of DNA Sport Lab’s social media accounts, to be sanctionable under New York law.” 

Improperly Set Up Database Exposed Oklahoma Police, Bank to Physical Intruders

The goof was discovered by security researcher Chris Vickery.

But not before the leaky database potentially compromised the physical security of multiple Oklahoma Department of Public Safety facilities and at least one Oklahoma bank, the Daily Dot reports.

Vickery said he discovered the flawed system one day before the July 7 Dallas police shooting, which claimed the lives of five officers. He initially was concerned about publicly disclosing a vulnerability that could affect law enforcement.

“I was very cautious at first about it,” he said, “but I decided the risk of doing harm with the information I was putting out there wasn’t that great.”

Vickery provided the Daily Dot with images from the database, which were accessible without a username or password. The photos show various doors, locks, RFID access panels and the controller board of an alarm system -- a device typically obscured for security purposes.

The database also contained “details on the make, model, location, warranty coverage and even whether or not the unit was still functional,” Vickery said.  

The security risk persisted for at least a week. Vickery said he notified an executive at the company that manages the database, Automation Integrated, on July 9. Reached July 12, however, an Automation Integrated employee said “no one” in the office was aware of the problem.

The Daily Dot contacted Oklahoma’s statewide law enforcement agency, the Oklahoma Highway Patrol, to give notice of the breach, which specifically affected the building housing Troop A.

"An official became hostile with the reporter during the call, responding with disbelief and insisting that the reporter did not know what he was talking about," according to the Daily Dot.

MidFirst Bank of Oklahoma City also was affected. “I was even able to get images from within the bank's safe deposit box vault,” Vickery said. 

Hack Impacted 38,000 Current, Former N.C. State Students

North Carolina State University says tens of thousands of past and present students may have had some of their personal information compromised.

A hacker breached a university email account using a "sophisticated phishing scam,” N.C. State says.

Inside the account, the attacker found a 2013 file that included names, mailing addresses, university ID numbers and Social Security numbers. 

University officials say they learned of the hack June 3 and took steps to identify and notify potentially affected students. 

Officials say there is no evidence any of the personal information has been retrieved or misused yet.

Government Accidentally Leaves Alabama State Retirees at Risk of ID Theft

A flawed website for the Public Education Employees Health Insurance Plan publicly displayed the personal information of plan members.

A Mobile, Alabama, woman who was helping her parents with their insurance coverage saw names, dependent's names, dates of birth and Social Security numbers of other members on the site.

Amanda Murdick called a Teachers Retirement System counselor, who told her the website was undergoing maintenance and that the agency was aware of problems.

The counselor told Murdick she would report her concerns to the IT department.

By July 11, the problem was fixed, according to Murdick. Leura Canary, general counsel for the Retirement Systems of Alabama, said the agency still is trying to find out exactly what happened.