Hi BlackCloak Client,

BlackCloak is here to inform you about a slate of recent data breaches, including ones affecting American Express and Fidelity customers, and a separate incident that resulted in the exposure of dual factor authentication codes.

Fidelity Breach Exposes SSNs, Financial Information

Fidelity Investments Life Insurance disclosed it experienced a data breach where sensitive customer information was exposed. Fidelity said Social Security numbers, bank accounts and routing numbers and credit and debit card numbers were compromised in the breach. Additionally, access codes, passwords and PINs were caught up in the breach as well.

What Should I Do?:

At least 30,000 Fidelity Investment Life Insurance customers have been affected by the breach, but all Fidelity customers should consider taking these steps out of an abundance of caution.

• As Social Security numbers were affected, place a credit freeze and fraud alert on your accounts. Monitor your bank and credit accounts for fraudulent activity.
• Cancel any payment cards tied to your Fidelity account. Consider using a virtual payment card for online transactions.
• Reset your password and change your PIN.
• Be sure that whatever password or passphrase you use is completely unique. Do not reuse any previous passwords. Watch this on-demand webinar to learn about password management best practices.
• Enable dual factor authentication on your account.

Credit Card Numbers Stolen in American Express Breach 

American Express said it too suffered a data breach. Currently, it is unknown how many people have been affected by this breach, but American Express said credit card account numbers, names and card expiration dates were leaked.

What Should I Do?:

Similar to the recommendations for Fidelity customers:

• Cancel your credit card and consider using a virtual payment card for future transactions.

Database Leaks Millions of SMS Dual Factor Codes

A tech company secured a database that leaked millions of SMS text messages that are used for dual factor authentication. The exposed codes could have granted anyone access to users' Facebook, Google, TikTok and other online accounts.

These compromised messages not only contained dual factor codes, but also password reset links as well.

What Should I Do?:

• Use this time to choose a more secure dual factor authentication method. While SMS text messages are a better option than no dual factor at all, there are much more secure options to protect your accounts. Consider using an authenticator app, such as Google Authenticator or Authy. The dual factor codes reside within the app, meaning bad actors would have to be in physical possession of your device to obtain them. A physical security key is also a much stronger dual factor option compared to SMS text messages.