Security researchers have found a major breach that exposed the details of over three million US seniors.

According to WizCase, the data breach affected SeniorAdvisor, “one of the largest consumer ratings and reviews websites for senior care and services across the US and Canada.” Among the exposed details were users’ names, surnames, phone numbers, and more.

Researchers at WizCase discovered a misconfigured Amazon S3 bucket belonging to the website containing over 1 million files and 182GB of data. Contact dates from the files suggest they are from 2002 to 2013, though the files had a 2017 timestamp.

“The majority of data exposed was in the form of leads, a list of potential customers whose details were collected by SeniorAdvisor presumably via their email or phone call campaigns,” said researchers.

Researchers also unearthed  2,000 “scrubbed” reviews. These are reviews where the user’s sensitive information has been wiped or redacted.

“However, this scrubbing process is useless if you have the corresponding information. The scrubbed reviews had a lead id which could be used to trace the review back to who originally wrote it,” researchers said. As both lead data and these scrubbed reviews were in the same database, supposedly anonymous reviewers could have their identity revealed with a simple search operation.

WizCase researchers said since the breach contained data from a section of the public more vulnerable to scams, the risks were higher. In a 2018-2019 report, the Federal Trade Commission (FTC) noted that people who filed a fraud complaint between 60 and 69 years old lost $600 per scam on average. The amount rose in older groups, culminating in $1700 on average per scam for people between 80 and 89.

“In particular, the report found senior citizens were more likely to fall for digital scams such as tech support scams, prize/sweepstakes scams, online shopping scams, and especially phone scams,” said researchers. “As shown, senior citizens are at greater risk for online fraud than the rest of the population, and therefore should be even more careful in their online behavior.”

Researchers urged people using such services to input the bare minimum of information when making a purchase or setting up an online account.

“The less information hackers have to work with, the less vulnerable you are,” warned researchers. Researchers have since contacted the company, and the bucket has since been secured.

Microsoft has released a new ransomware detection feature for Azure that uses machine learning to spot potential attacks.

‘Fusion Detection for Ransomware’ will send an alert to customers when it observes actions that are «potentially associated with ransomware activities».

The alerts will inform users of what was detected, and on which device, with the system correlating data from other Azure services, such as Azure Defender, Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Cloud App Security, and Azure Sentinel scheduled analytics rules.

Once ransomware activities are detected and correlated by the Fusion’s machine learning model, a high severity incident with the label «Multiple alerts possibly related to Ransomware activity detected» will be triggered in the customer’s Azure Sentinel workspace (shown in the image below).

After an alert has been sent, Microsoft recommends users check the device/host in question to see if its behaviour is «unexpected». If so, the user should treat the machine as «potentially compromised» and take immediate actions, such as isolating the machine from the network, running full anti-virus scans, and investigating the rest of the network for similar signs.

Ransomware has become a lucrative occupation, according to a recent report from Unit 42, with average payouts almost doubling over the past year. Since 2020, payouts for successful ransomware attacks have increased 82% to a record $570,000 in the first half of 2021. The increase followed the previous year’s 171% jump to more than $312,000.

«Preventing such attacks in the first place would be the ideal solution but with the new trend of ‘ransomware as a service’ and human operated ransomware, the scope and the sophistication of attacks are increasing – attackers are using slow and stealth techniques to compromise network, which makes it harder to detect them in the first place,» Microsoft security researcher Sylvie Liu wrote in a blog post.

Charlie Bell, one of Amazon’s top executives in its cloud business, is leaving the company after 23 years.

AWS senior vice president Peter DeSantis, who worked on global infrastructure, is set to become the new leader for utility computing which Bell was managing, according to CNBC. Prasad Kalyanaraman, a vice president at the company, will assume responsibility for infrastructure and network services.

Bell’s departure is the latest in a string of high-level personnel moves at AWS. Bell was reportedly considered a candidate to replace AWS CEO Andy Jassy when he became Amazon CEO last month, but Tableau CEO and former Amazon employee Adam Selipsky was chosen instead.

Bell has been with the company since 1998 when his business, Server Technologies Group, was acquired by the company, according to his LinkedIn. Before that, he was a manager at Oracle between 1989 and 1996, and a space shuttle flight interface engineer at Boeing between 1979 and 1989.

In a video posted by Amazon Science, he revealed he started at the company when it was “just selling books”. Bell initially led infrastructure before moving to the AWS business in 2006 as it began developing core EC2 and S3 computing and storage services.

In February, the head of AWS Andy Jassy was announced as the successor to Jeff Bezos – seen as a logical next step given Jassy joined Amazon in 1997 and would go on to found AWS in 2002.

Following this, in March, Salesforce executive Adam Selipsky was appointed AWS CEO. This saw Selipsky return to AWS after leaving the company in 2016 to become the CEO of Tableau. He spent the previous 11 years as AWS vice president of sales, marketing and support.

Selipsky’s time at Tableau saw the company’s value quadruple as he led its move from licenses to subscriptions. It was eventually acquired by Salesforce in 2019, where Selipsky became a member of its executive leadership board in addition to his role as Tableau CEO.

Salesforce has expanded Health Cloud, its cloud-based service for health care organisations, with several new features targeting remote patient management and data protection. 

The company has added four enhancements to Health Cloud. The first addition, remote patient exception monitoring, harvests data from connected health care devices and presents it in a single dashboard interface targeting care coordinators. 

​Metrics displayable in the dashboard include heart rate and blood glucose levels. This will enable health care workers to better understand patient conditions without needing physical visits, Salesforce said. 

Salesforce’s new appointment management feature suggests remote and in-person appointment times for patients. Users can select available appointment types and times via any device, and the system can also offer pre-appointment questionnaires to help gather the necessary data ahead of the appointment. 

The cloud service provider says this will reduce no-shows and administrative costs incurred through manual back and forth with human schedulers. 

The third new feature, medication management, tackles the management of medication lists. Many clinics still use manual, paper-based systems to track patient medication, making it difficult to monitor medication adherence, Salesforce said. 

Targeting pharmacies, small clinics, and retail outlets, medication management will reduce the administrative overhead of tracking patient medication lists. The service will also integrate with RXNorm, a system that standardises naming conventions for generic and brand name drugs in the US. 

The final enhancement focuses on regulatory compliance and helps in-home patient care companies protect patients’ health information. Salesforce is certifying Salesforce Maps, B2C Commerce, and Order Management services as compliant with the US government’s HIPAA health care privacy regulations. 

This certification gives mobile health care workers access to sensitive patient data on the move via Salesforce Maps while staying compliant with regulations, the company said. It also enables companies, including retail health locations and pharmacies, to set up e-commerce stores dealing with sensitive patient orders via HIPAA support in Salesforce B2C Commerce and Salesforce Order Management. 

Google is reportedly planning to build a new campus in Silicon Valley which will be situated next to a new facility partly devoted to hardware, at a time where more employees are asking to work from home.

Since 2018, Google has bought $389 million in land in San Jose, California, and recently filed preliminary building proposals show a centre for hardware operations as well as a publicly accessible new tech campus. These will be situated between its current headquarters in Mountain View and its recently approved town-like megacampus in San Jose, as reported by CNBC.

The tech campus, dubbed “Midpoint”, will include five office buildings, reportedly accommodating up to 3,500 employees, and will be built using landscaping and construction updates to existing offices, rather than completely new developments. Currently, there is no timeline for when the project will be completed.

The campus will sit adjacent to three industrial buildings that will house some operations for its hardware division including an «R&D» centre. Google has filed plans to make updates to these buildings, including adding meeting rooms, kitchens, equipment platforms, and a shipping warehouse. The plans reportedly mention «Google Hardware» and «Nest«, and the buildings will also house general supplies and store items like furniture for local campuses, a spokesperson told CNBC.

“The goal of the proposed project is to enhance pedestrian and bicycle safety and connectivity between the buildings and the surrounding community,” Vini Bhargava, a Google real estate and workplace services project executive, said in a preliminary review request.

The campus complies with Google’s aim of opening itself up to its “non-tech” neighbours as concerns of displacement in the San Francisco region continue to grow. The office upgrades also come in line with Google’s plans for more employees to work in offices once the pandemic has ended.

The campus plans also show it will include a new “transit hub” with shuttles, bike parking, and transit passes for employees to reduce single-occupant vehicle trips. It will also contain showers, lockers, and changing rooms to encourage commuting.

There will also be a commuter shuttle service that will cater for employees from the Bay Area, which Bhargava said is “proven to significantly reduce the number of employees that drive alone to work compared to the regional average”.

Last week, Google reportedly approved 85% of 10,000 staff requests to work remotely or relocate when its offices open again. It’s believed the tech giant will ask most of its staff to return to work in their previous office locations but will allow others to carry out their duties elsewhere.

Microsoft has suspended its Windows 365 trial just a day after launch due to heavy demand. 

In a tweet, the company said it was experiencing «significant demand» for the service, which offers easy-access virtual desktops in the cloud accessible via a browser or Microsoft’s Remote Desktop application. It added it reached capacity for Windows 365 trials. 

This morning, Scott Manchester, director of program management for Windows 365, added that the company saw an «unbelievable response.» People should still sign up for the service to be notified when it resumes, he added. 

Microsoft announced Windows 365 on July 14 and took it live Monday, August 2, providing an easy way for smaller businesses to access virtual Windows desktops in the cloud. The service runs on a virtual machine Microsoft calls a Cloud PC, which is available in various configurations up to eight cores with 32GB of RAM. 

Windows 365’s Business Edition is configurable using a self-service portal, and the Enterprise Edition is configurable using Microsoft’s Endpoint Manager tool. The latter also features integrations with Azure Active Directory and Defender for Endpoint. 

Microsoft already offers a desktop as a service (DaaS) option in Azure Virtual Desktop, which the company used to call Windows Virtual Desktop. However, Microsoft sells this on a consumption-based pricing model, plus it’s more complex to administer. Windows 365 is available for a flat monthly fee.

Initial reactions to the service were mixed. «I’ve just had it for a day but it’s already been useful,» tweeted one user in response to Manchester. «Full coding on my iPad.» 

Another user was less impressed. «Is this why my Cloud PC refuses to reset? I’ve been waiting 30 hours for it to reset and no one from support has answered me,» they said. 

It’s still early days for Windows 365, which will receive more features over time. Microsoft promised support for offline working, along with potential GPU options for Cloud PC power users.

Google has reportedly approved 85% of staff requests to work remotely or relocate when its offices open again, as the firm and other companies try to better accommodate employee demands in a post-pandemic working world.

The tech giant is set to ask most of its staff to return to work in their previous office locations, but will let others carry out their duties elsewhere, according to Bloomberg. An internal email to staff highlighted that around 10,000 employees applied to transfer to a new office or work from home.

Fiona Cicconi, Google’s head of human resources, stated in the email that the company rejected around 15% of applicants as their jobs required specialised equipment or face-time with customers.

“And some organisations have made a commitment to invest in key growth sites and are working to build their teams and critical mass in those particular hubs,” Cicconi added. She also said that applicants who were rejected could reapply for remote work or a transfer.

Google’s return to the office policies have angered some of its employees, with CNET reporting last month that Google executive Urs Hölzle told employees he would be working remotely from New Zealand. This reportedly upset some workers as they claimed he had been unsupportive of remote work in the past.

Last week, Google and Facebook announced their employees in the US would need to be fully vaccinated before they return to the office. Google CEO Sundar Pichai said in an email to employees that the implementation of the policy would vary depending on local conditions and regulations. The new rule is set to be implemented in the US soon before expanding to other regions in the coming months. The company also announced it would push back its office reopening from 1 September to 18 October.

In February, Google warned that the new “hybrid working” model could affect its productivity and finances. The company was concerned that social distancing measures and hybrid work models would increase costs and potentially impact its “corporate culture”.

Welcome to issue 19 of IT Pro 20/20, our sister title’s digital magazine that distils the most important themes of the previous month into an easy-to-read package.

Maintaining robust cyber security is a difficult task for anyone, but smaller companies are increasingly finding themselves on the front line. At a time when almost a third of cyber attacks now involve a small business, we consider the dangers that this weak link could pose to the wider technology industry, and what steps SMBs and startups need to take to plug the gap.

Keeping with the theme of SMBs and startups, we also look at the tech startups that have thrived during lockdown, using their agility and flexibility to reshape business models and exploit unprecedented demand for services – something that every business can learn from.

The next IT Pro 20/20 will be available on 31 August – previous issues can be found here. If you would like to receive each issue in your inbox as they release, you can subscribe to our mailing list here.

Earlier this year, Google revealed it was testing pre-installed Meet and Chat web apps on Chrome OS and planned to release them to the public. Delivering on that promise, Google announced Meet is now a progressive web app (PWA).

PWAs are responsive websites that look and feel like native mobile apps.

Google further stated the PWA version of Meet has the same features as its app counterpart, except it is easier to use and far more accessible. The Meet icon will now appear on users’ shelves and launchers, providing easy access to video chat. As with other PWAs, Google Meet will update automatically during Chrome updates.

“We’ve launched a new Google Meet standalone web app. This Progressive Web Application (PWA) has all the same features as Google Meet on the web, but as a standalone app it’s easier to find and use, and it streamlines your workflow by eliminating the need to switch between tabs,” explained Google.

Users can find the PWA installation prompt on the top-right corner of Chrome’s address or URL bar. Once downloaded, Meet will load into a standalone window. Users can run Google Meets PWA on Windows, macOS, Chrome OS 73 and up, and Linux.

The Google Meets service is available to anyone with a Google account, including G Suite Basic and Business customers. Administrators can manage PWA access or automatically install progressive web apps for users.

Among the Meet software updates are cross-domain live streaming, live stream captions, and hand raise updates for desktops and laptops.

Google has confirmed the Google Meets PWA will arrive starting today, but some features could take up to 15 business days to appear.

Salesforce-owned MuleSoft has announced it will buy robotic process automation (RPA) company Servicetrace for an undisclosed amount.

The acquisition will complement MuleSoft’s application composition platform, explained executives.

MuleSoft sells Anypoint, an application programming interface (API) development platform for building reusable connections between applications and data so developers can compose applications more easily. Salesforce acquired MuleSoft in 2018.

Servicetrace offers the XceleratorOne RPA tool. RPA helps companies to automate manual processes by copying human activities, cutting down on manual labour and human error.

The Servicetrace tool enables companies to identify processes that would benefit from RPA and model them for automation. Servicetrace says that the tool can automate long, complex processes and connect artificial intelligence (AI) solutions for automated decisions. It also organises those automations across a company and enables managers to assess the return on investment from automated processes.

The RPA product will integrate with Salesforce’s Einstein Automate solution, which already handles automation tasks for the company’s clients.

«Our platform makes it easy to unlock and integrate data from anywhere — wherever it resides — and manage, monitor, secure, and govern that data at scale,» said MuleSoft CEO Brent Hayward in an announcement.

«MuleSoft will now also make it easy for line of business and knowledge workers to automate business processes and dramatically increase efficiency and speed.»

Servicetrace also offers automated software testing tools and application performance monitoring tools that use bots to monitor users’ experience across complex software architectures.

The acquisition will close by the third quarter of Salesforce’s fiscal year, ending October 31, 2021.