CITIGROUP HACKED, ACCOUNTS COMPROMISED

On Thursday Citigroup announced that hackers had breached its systems in May and accessed personal data from 200,000 accounts — about 1% of its customers. The hackers managed to steal customer email addresses, contact information and account numbers, but Reuters reported that other information such as birth dates, Social Security Numbers and credit card expiration dates were not accessed. “We are contacting customers whose information was impacted. Citi has implemented enhanced procedures to prevent a recurrence of this type of event,” Citigroup spokesperson Sean Kevelighan, said. “For the security of these customers, we are not disclosing further details.”

SONY PICTURES WEBSITE HACKED; 1 MILLION ACCOUNTS COMPROMISED

Hackers from a group called LulzSec announced on Thursday that they had breached sonypictures.com, the website belonging to Sony-owned studio Sony Pictures. The group claims to have compromised personal information belonging to over 1 million users, including user names, passwords, home addresses, dates of birth and other sensitive data.

The group also claims to have accessed 75,000 “music codes” and 3.5 million “music coupons.” LulzSec says it employed a simple SQL injection technique to access the data, and that Sony Pictures’ site was not secure and was therefore easy to breach.

The hackers did not have the resources to download all of the exposed data, but they say they did obtain samples in order to prove the authenticity of the attack.

This is the fourth breach of a Sony owned property in the last two months. The most famous being the Sony Playstation Network. Sony was forced to bring the site down while additional security measures were put in place.

GOOGLE ADMITS SOME SENSITIVE EMAILS HACKED; BLAMES CHINA

The Contagio security blog posted evidence back in February of targeted attacks against government and military officials on Gmail. Today, nearly four months later, Google has finally admitted this is true: hundreds of personal accounts have been compromised by hackers it believes to be working out of Jinan, the capital of China's Shandong province.

The accounts include those of "senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists." The hijackers' aim appears to have been to spy on their targets using Google's automatic forwarding function. But unlike the PSN fiasco, Google insists its internal systems "have not been affected." Instead it seems the hackers used a phishing scam, possibly directing users to a spoof Gmail website before requesting their credentials.

Google says its own "abuse detection systems" disrupted the campaign -- but in a footnote right down at the bottom of their official blog page they also credit Contagio and user reports.

China's Foreign Minister, Hong Lei responded with a statement saying "Allegations that the Chinese government supports hacking activities are completely unfounded and made with ulterior motives."

SONY'S PLAYSTATION NETWORK PASSWORD RESET PAGE HACKED

According to reports from numerous gaming sites, the password reset page for Sony’s PlayStation Network has been exploited. Sony built the page in an effort to allow users, whose accounts were already compromised during a major security breach last month, to reset their security credentials.

However, hackers who stole the information from Sony can reset users’ passwords by knowing an account holder’s email address and birthday — information they’ve already stolen. Forum members on Nyleveia have suggested that PSN users create a new email address specifically for use with PSN.

Sony has taken the website offline, and said: “Unfortunately this also means that those who are still trying to change their password via PlayStation.com or Qriocity.com will still be unable to do so for the time being.”

MCDONALDS WEBSITE HACKED; RONALD NOT HAPPY

According to Reuters, McDonald’s Corp has just announced that hackers gained access to a database containing an unidentified number of email address and birthdates for the strange breed of person who goes to McDonald’s’ websites and decides to subscribe.

On the one hand, the hack is less invasive than the Gawker hack, because it doesn’t appear that passwords were compromised. On the other hand, McDonald’s is being cagey about the actual numbers of customers involved… and while credit card numbers, passwords and social security numbers were not compromised, birthdays were… making it possible on some sites for those email addresses to be paired with birthday security questions.

Gawker and McDonald’s aren’t the only huge breaches in the last week. On Friday, Walgreens admitted that one of their databases containing customer email addresses had been breached as well. [Geek]