CITIGROUP HACKED, ACCOUNTS COMPROMISED

On Thursday Citigroup announced that hackers had breached its systems in May and accessed personal data from 200,000 accounts — about 1% of its customers. The hackers managed to steal customer email addresses, contact information and account numbers, but Reuters reported that other information such as birth dates, Social Security Numbers and credit card expiration dates were not accessed. “We are contacting customers whose information was impacted. Citi has implemented enhanced procedures to prevent a recurrence of this type of event,” Citigroup spokesperson Sean Kevelighan, said. “For the security of these customers, we are not disclosing further details.”

RSA HACKED, EFFECTIVENESS OF SECUREID TOKENS QUESTIONED

RSA, the security division of EMC and producer of the SecurID systems used by countless corporations (and the Department of Defense), has been hacked. Yesterday it sent out messages to its clients and posted an open letter stating that it's been the victim of an "advanced" attack that "resulted in certain information being extracted from RSA's systems" -- information "specifically related to RSA's SecurID two-factor authentication products."

The company assures that the system hasn't been totally compromised, but the information retrieved "could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack." RSA is recommending its customers beef up security in other ways, including a suggestion that TSA's customers "enforce strong password and pin policies." Of course, if security admins wanted to rely on those they wouldn't have made everyone carry around SecurID tokens in the first place.

MCDONALDS WEBSITE HACKED; RONALD NOT HAPPY

According to Reuters, McDonald’s Corp has just announced that hackers gained access to a database containing an unidentified number of email address and birthdates for the strange breed of person who goes to McDonald’s’ websites and decides to subscribe.

On the one hand, the hack is less invasive than the Gawker hack, because it doesn’t appear that passwords were compromised. On the other hand, McDonald’s is being cagey about the actual numbers of customers involved… and while credit card numbers, passwords and social security numbers were not compromised, birthdays were… making it possible on some sites for those email addresses to be paired with birthday security questions.

Gawker and McDonald’s aren’t the only huge breaches in the last week. On Friday, Walgreens admitted that one of their databases containing customer email addresses had been breached as well. [Geek]