The New York Times has warned some freelance workers that their data may have been stolen in a recent attack on GitHub repositories.
Recently, news broke about a hacker who posted the source code of the New York Times Company on the anonymous image board 4chan.
The archive contained some 5,000 repositories and 3.6 million files, which were available for download via peer-to-peer networks. Among the files were Wordle blueprints, email marketing campaign information, advertising reports, and more.
Phishing with vacancies
At this time we don’t know how many freelancers were affected by the breach, but we do know that the hackers stole their full names, along with a combination of phone numbers, email addresses, postal addresses, nationalities, biographies, website URLs, and social media accounts. handles.
In some cases, the attackers also obtained information relevant to different missions, such as diving or drone certifications, or access to specialized equipment.
“The New York Times recently communicated with several of our employees about an incident that resulted in the disclosure of some of their personal information,” a Times spokesperson said. BleepingComputer. “We sent this message to freelance visual workers who have worked for The Times in recent years. We have no indication that the data exposure has extended to full-time editorial staff or other employees.”
Cybercriminals could use such data to launch highly disruptive phishing attacks. For example, North Korea’s state-sponsored hackers, the Lazarus Group, were seen creating fake job ads and distributing infostealers disguised as job requirements documents. One of these attacks resulted in the theft of over half a billion dollars from a cryptocurrency company.
Freelancers are always looking for new job opportunities, which can make them more susceptible to phishing emails compared to the average consumer. Especially when the new gig apparently comes from the New York Times.