FTC Sues Sendit Over Kid’s Data Collection

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, FTC sued Sendit over children’s data collection, another Harrods breach, Allianz data breach and a cyberattack disrupted Asahi’s Japan operations. WestJet disclosed data theft. Hackers targeted Kido Nursery chain, a VMware privilege escalation flaw was exploited as zero-day, DarkCloud infostealer resurfaced.

See Also: Why Cyberattackers Love ‘Living Off the Land’

The U.S. Federal Trade Commission filed a lawsuit against Iconic Hearts Holdings Inc., the developer of the teen-focused app Sendit, and its CEO Hunter Rice. The agency accused them of illegally collecting children’s data and misleading users with deceptive practices.

Sendit is an “icebreaker” companion app for Snapchat and Instagram and is highly popular among teens, with more than 25 million claimed users and five million Google Play ratings. FTC investigators found that in 2022 alone, 116,000 U.S. users under age 13 were registered on the platform.

The complaint alleges multiple violations of the Children’s Online Privacy Protection Act, including collection of minors’ personal details – such as phone numbers, photos, birthdates and social media handles – without parental notice or consent.

The FTC also said Sendit deceived users by generating fake anonymous responses, some with provocative or sexual content, while misrepresenting them as genuine messages from friends. The app allegedly misled users into purchasing a premium “Diamond Membership” by claiming it would reveal the identity of message senders. Instead, customers often received false, generic, or no information.

Latest Harrods Breach Exposes Personal Records of 430,000

U.K. luxury retailer Harrods disclosed a new data breach after hackers gained system access to a third-party supplier.

The breach, discovered Sept. 29, exposed the personal information of roughly 430,000 online customers. Hackers stole names, contact details and marketing tags associated with Harrods’ loyalty programs but not passwords, payment data or order history records. Harrods said the incident is being treated as an isolated occurrence and said there’s no connection between this breach and a May cyberattack by Scattered Spider that impacted it, Marks & Spencer and Co-op all within the same week.

Harrods said its latest hacker attempted to make direct contact, likely an attempt at extortion. “We have received communications from the threat actor and will not be engaging with them,” a spokesperson said. The third-party supplier has yet to be disclosed.

“Negotiating with cybercriminals does not result in any guarantees as to what they may do with the information they have accessed,” the spokesman also said.

Allianz Life Insurance Company of North America reported Tuesday a data breach from July 16, impacting the majority of its 1.4 million U.S. customers. The breach was caused by a social engineering attack on a third-party, cloud-based Customer Relationship Management system. Attackers impersonated IT personnel to gain unauthorized access, compromising sensitive personal information such as names, addresses, phone numbers and email addresses.

The breach was discovered on July 17 and Allianz Life notified the FBI on the same day. The company said that its internal systems, including the policy administration platform, remained secure during the incident. The breach was limited to Allianz Life’s operations and did not extend to other parts of the Allianz Group network.

Japanese brewing giant Asahi Group Holdings said Monday it suffered a cyberattack that disrupted operations across its domestic subsidiaries, affecting orders, shipments and customer service centers.

The company confirmed system failures had forced production suspensions at some of its 30 factories in Japan, reported Reuters. Call center operations and service desks were also impacted. Asahi is still investigating but said there is no evidence so far of customer or personal data leaks.

The system failure is limited to our operations within Japan, Asahi said, adding that it could not provide a recovery timeline.

Asahi, which accounts for nearly 40% of Japan’s beer market, owns well-known global brands including Grolsch, Peroni, Pilsner Urquell and Fuller’s London Pride.

WestJet Issues Data Breach Notice, Citing June Attack

Canadian airline WestJet said Monday the personal data of 1.2 million passengers was exposed in a data breach earlier this year.

WestJet, Canada’s second largest airline, said stolen data includes passenger names, date of birth, addresses and travel-related documents like passports and government-issued ID cards. The airline said no payment or financial information was compromised.

WestJet said it first detected suspicious activity on June 13. It later determined that a threat actor gained access into WestJet’s system by using social engineering tactics to acquire credentials and reset an undisclosed employee’s account password.

The Canadian airline currently operates a fleet of 153 aircraft, transporting roughly 25 million travelers to 104 different destinations annually.

Hackers stole the personal details of around 8,000 children from Kido, an international preschool chain. Attackers demanding extortion money claim to have accessed names, photos and addresses of children across Kido’s 18 nurseries in London, as well as additional sites in the United States, India and China, reported BBC. They also say they stole data on parents and have directly contacted some families as part of their extortion attempts.

Kido has not issued a public statement confirming the hackers’ claims, though one employee told the BBC they had been informed of a data breach.

London’s Metropolitan Police confirmed they were alerted on Thursday to “a ransomware attack on a London-based organization” and that its cybercrime unit is investigating. No arrests have been made so far.

Hackers have exploited a newly patched security flaw in Broadcom VMware Tools and VMware Aria Operations since mid-October 2024, according to Nviso Labs. The vulnerability, tracked as CVE-2025-41244 with a CVSS score of 7.8, is a local privilege escalation bug affecting multiple VMware products.

The flaw enables a local, non-administrative attacker with access to a virtual machine running VMware Tools and Aria Operations with SDMP enabled to escalate privileges to root. VMware said that attackers must first gain initial access through other means.

A Nviso researcher found the flaw during an incident response engagement in May. The bug stems from insecure regex patterns in the get_version() function, which can mistakenly execute non-system binaries placed in writable directories like /tmp. By staging a fake binary – e.g., /tmp/httpd, attackers can trigger privilege escalation when the VMware metrics collection service runs.

Nviso observed China-linked threat actor UNC5174, tracked by Mandiant as Uteus/Uetus, exploiting the flaw to spawn root shells, though the payload details remain undisclosed. The group has a history of abusing vulnerabilities in Ivanti and SAP NetWeaver for initial access.

Broadcom released fixes, including VMware Tools 12.4.9 for Windows 32-bit, with Linux patches coming via open-vm-tools. Nviso warned that the trivial nature of the bug suggests other malware may have unknowingly used similar privilege escalations in the past.

Researchers at eSentire’s Threat Response Unit uncovered a surge in attacks involving DarkCloud Infostealer, malware designed to steal sensitive personal and corporate data. The team identified version 4.2 of DarkCloud during an attempted phishing attack in September against a manufacturing client.

DarkCloud, once sold on the now-disrupted Russian forum XSS, is currently distributed via its own website and Telegram by a seller known as @BluCoder.

The September attack began with a phishing email disguised as a financial message, sent from procure@bmuxitq.shop with the subject “Swift Message MT103 Addiko Bank ad: FT2521935SVT.” The attached file, a malicious ZIP archive, attempted to deliver the infostealer.

DarkCloud is capable of stealing browser credentials, credit card data, cookies, FTP logins, keystrokes and clipboard content, as well as files like documents, PDFs and spreadsheets. It also harvests cryptocurrency wallets and extracts contact details from popular email clients such as Thunderbird, MailMaster and eM Client. Stolen information is exfiltrated via Telegram, FTP, email, or web panels.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey.