When on holiday in Berwick the artist often gave his work away. Now a new exhibition reveals the value of drawings that survived in a shoebox

A 1958 drawing of a family with their dogs by LS Lowry from one of his many holidays in Berwick-upon-Tweed is to go on public display for the first time. But the sketch is lucky to have survived: it was kept in a shoe box for 43 years, emerging somewhat creased because its recipient had little idea of Lowry’s significance.

The signed and dated drawing on headed notepaper from the Castle Hotel, where the artist stayed for most summers from the 1930s until the 1970s, was given to hotel receptionist, Anne Mather. “I didn’t think much about it, and only after he died did I remember it,” Mather told the Berwick Advertiser in 2001 when she put the sketch up for auction. “He was quiet and reclusive, but I can still visualise him in the lounge. He would sit and doodle, with his glasses at the end of his nose.”

The novelist on the continuing relevance of Ibsen, the joyful quilt art of Faith Ringgold and where to find British scotch eggs in New York

Born in Greenwich, Connecticut in 1966, author Claire Messud studied at Yale University and the University of Cambridge. Her first novel, 1995’s When the World Was Steady, and her book of novellas, The Hunters, were finalists for the PEN/Faulkner award; her 2006 novel The Emperor’s Children was longlisted for the Booker prize. Messud is a senior lecturer on fiction at Harvard University and has been awarded Guggenheim and Radcliffe fellowships. She lives in Cambridge, Massachusetts with her husband, literary critic James Wood; they have two children. Her latest novel, This Strange Eventful History, is published on 23 May by Fleet.

Jonathan Yeo’s divisive painting of the king raises the question of whether paintings of the monarchy have become irrelevant and anachronisitic

Why do reports always say that a portrait of someone great and good has been “unveiled”? The word is an empty metaphor that turns the first viewing into a ceremony; it also mystifies the entire procedure and makes it somewhat morbid.

Portraits of kings, presidents, prime ministers and the like are effigies, meant to replace the mortal being. Once the official image has been fixed in place, the living subject can be sent off to die. The unveiled portrait draws a veil over another ceremonial occasion: what we are looking at is posterity’s verdict, so in effect we are attending a funeral.

From female art trailblazers to playful performance fests, a ridiculous funk wannabe to a clubby Argentinian dance spectacular, our critics pick the arts events that will light up your summer

National Treasures
Twelve museums across the UK, closing dates vary
Turner’s The Fighting Temeraire visits Tyneside, Artemisia Gentileschi shows at the Ikon in Birmingham and Caravaggio goes to Belfast in this epic tour of paintings from the National Gallery. The revered London museum has collected art for the nation since 1824 and this celebration sees its masterpieces more widely spread than ever. Jonathan Jones

The photographer and her husband came across an abandoned boat while out walking and took the opportunity to float a surreal idea

Every September, Carla Vermeend and her husband go on holiday to Terschelling island, in the Netherlands.

“It has lots of nature, right in the middle of the Wadden Sea, which is listed by Unesco as a world heritage site,” says Vermeend, a Dutch photographer. During their visit in 2014, the couple were walking by the sea together.

John Krasinski and Ryan Reynolds go family-friendly in their new imaginary-friends comedy, while the singer swaps introspection for lust on her long-awaited new album

If
Out now
In what has to be one of the more enviable showbiz lives, John Krasinski has played Jim in The Office, married Emily Blunt, and written and directed acclaimed horror franchise A Quiet Place. Now he turns his hand to family entertainment, writing and directing this part-animated fantasy about imaginary friends made visible with a little help from Ryan Reynolds and Steve Carell.

Enlarge / A kitty named Clover prepares to play with a robot arm in the Cat Royale "multi-species" science/art installation . (credit: Blast Theory - Stephen Daly)

Cats and robots are a winning combination, as evidenced by all those videos of kitties riding on Roombas. And now we have Cat Royale, a "multispecies" live installation in which three cats regularly "played" with a robot over 12 days, carefully monitored by human operators. Created by computer scientists from the University of Nottingham in collaboration with artists from a group called Blast Theory, the installation debuted at the World Science Festival in Brisbane, Australia, last year and is now a touring exhibit. The accompanying YouTube video series recently won a Webby Award, and a paper outlining the insights gleaned from the experience was similarly voted best paper at the recent Computer-Human Conference (CHI’24).

"At first glance, the project is about designing a robot to enrich the lives of a family of cats by playing with them," said co-author Steve Benford of the University of Nottingham, who led the research, "Under the surface, however, it explores the question of what it takes to trust a robot to look after our loved ones and potentially ourselves." While cats might love Roombas, not all animal encounters with robots are positive: Guide dogs for the visually impaired can get confused by delivery robots, for example, while the rise of lawn mowing robots can have a negative impact on hedgehogs, per Benford et al.

Blast Theory and the scientists first held a series of exploratory workshops to ensure the installation and robotic design would take into account the welfare of the cats. "Creating a multispecies system—where cats, robots, and humans are all accounted for—takes more than just designing the robot," said co-author Eike Schneiders of Nottingham's Mixed Reality Lab about the primary takeaway from the project. "We had to ensure animal well-being at all times, while simultaneously ensuring that the interactive installation engaged the (human) audiences around the world. This involved consideration of many elements, including the design of the enclosure, the robot, and its underlying systems, the various roles of the humans-in-the-loop, and, of course, the selection of the cats.”

Read 9 remaining paragraphs | Comments

Museum chair George Osborne hails ‘remarkable result’ as recovery effort continues with leads on another 100

The British Museum has located another 268 items that went missing or were stolen from its storerooms, bringing the total number recovered to 626.

About 2,000 items were found last year to be missing or lost, some of which had been sold on eBay.

Swimming Queensland chief Kevin Hasemann says ‘I’ve never been to a gallery’ and furore has ‘evolved into something I could never have imagined’

• Follow our Australia news live blog for latest updates
• Get our morning and afternoon news emails, free app or daily news podcast

The head of Swimming Queensland has defended a campaign that saw Olympic champions lobby the National Gallery of Australia to take down portraits of their patron, Gina Rinehart, because they were deemed “offensive”.

An acrylic colour portrait by Vincent Namatjira of Australia’s richest woman was the target of the campaign along with a second black and white portrait by Namatjira in ink and pencil.

Benediktas Gylys admits he was surprised by the rowdy behavior that came from the exhibit connecting people in the two cities

The artist behind the controversial “Portal” art exhibit that visually linked New York and Dublin in real time, but was then closed due to rowdy and extreme behavior by the public using it, has admitted he was surprised by the reaction.

Benediktas Gylys also vowed to continue with his project, which has the aim of connecting people and communities all over the world and is hoped to reopen soon.

Studio Voltaire, London
From Tom’s pert-bottomed hunks to Cook’s curvacious ladies, both artists wanted to give pleasure

‘Hate the politics, love the uniform,” would pretty much sum up Touko Valio Laaksonen’s attitude towards the Wehrmacht soldiers he encountered as a young, conscripted anti-aircraft officer in the Finnish army, fighting alongside the Germans in the second world war. After the war, Laaksonen began signing his commercial drawings for physique magazines with the moniker Tom of Finland, and the very different uniform of the sexual outlaw, inspired by American biker culture (and in particular by Marlon Brando in the 1953 movie The Wild One), replaced field grey with leather and denim, a hyper-masculine look that developed in gay culture from the 1950s onward.

Pert-bottomed and conspicuously well hung, six-packed and nipples erected, poured into their jeans and their leather trousers, Tom of Finland’s groups of hunks and Muscle Marys indulge in all sorts of horseplay. They suck, they rim, they fist, they fuck. They pose and they cruise, they watch and, given half a chance, they join in. There’s a bit of lighthearted BDSM, but not much else to vary the routine. What a tiring round their days must be. Away from the magazine page or beyond the edge of the drawing they might complain, if they had the time, about their onerous moisturising regimes, the daily workouts and depilation routines. Never mind the same old outfits every day, or that as soon as one scene has ended another’s begun. Even when they’re tied to a tree and being thrashed with a belt they seem happy enough, and no one ever screams their safe word.

Les Distractions de Dagobert was the surrealist’s ‘definitive masterpiece’, says Sotheby’s expert in New York

She was worshipped as a muse by renowned surrealists including André Breton and Max Ernst, but the Lancashire-born artist Leonora Carrington quickly shrugged off the label to achieve an unprecedented level of mastery and freedom in her own painting.

Now, on the 100th anniversary of Breton’s publication of the Surrealist Manifesto, Carrington has become the most valuable British-born female artist at auction after one of her paintings sold for more than £22.5m.

Le Corbusier called grain silos ‘the magnificent first fruits of the new age’. But what can be done with these soaring industrial cathedrals when they’re redundant? A Norwegian tycoon has the answer

If you’ve ever wondered what it would feel like to be as insignificant as a kernel of corn, you can now get a good idea in Kristiansand, a city in southern Norway. Standing on the fourth floor of its new Kunstsilo art museum, carved out of an old 1930s grain silo, you can peer down a vertiginous concrete tube that plunges towards huddles of ant-like people below. Or you can look up, through more concrete shafts, towards tiny circles of sky. You can mimic the journey of a grain by climbing a spiral staircase inside one of the cylinders, or test your nerves by walking on a glass-floored terrace suspended over another shaft, floating above a tubular abyss. It’s a dramatic spatial spectacle – and we haven’t even got to the art yet.

Once home to 15,000 tonnes of grain, this mighty concrete mountain is now a repository of the most important collection of Nordic modern art in the world. It is a 5,500-strong haul spanning paintings, drawings, ceramics, sculpture and full-size architectural installations, telling the story of the past century of abstraction, surrealism and expressionism across Norway, Sweden, Finland and Denmark – inside one of the ultimate symbols of modernity itself.

Mining tycoon Gina Rinehart has asked the National Gallery of Australia to remove her portrait, painted by Vincent Namatjira. Others have gone much further

• Follow our Australia news live blog for latest updates
• Get our morning and afternoon news emails, free app or daily news podcast

Vincent Namatjira’s portrait of Gina Rinehart has found no favour with the subject, with the mining tycoon asking the National Gallery of Australia to remove the painting from an exhibition. But Australia’s richest woman is not the first person to take a painting of their likeness to task.

Here we take a look at seven notable examples.

A few months after 14 May 2022, a curator sought out three local artists. The resulting exhibition, Before and After Again, is thought to be the first of its kind

Two years ago, a white supremacist drove 200 miles to Buffalo, New York, and opened fire in a grocery store in the city’s predominantly Black East Side neighborhood, killing 10 people and injuring three.

Though the Tops Friendly Markets where the racist mass shooting took place has been remodeled, and most of the country has forgotten about the violence that occurred on 14 May 2022, Buffalo’s East Side is forever changed.

A psychedelic sea of lurid reds and a clunking monarch butterfly cannot save this superficially observed and carelessly executed bland banality

It’s hard to be objective about an artist you like as a person. I recently met the painter Jonathan Yeo – whose portrait of King Charles has been unveiled in a storm of crimson hype – on a radio show and was instantly charmed. It’s easy to see why famous people enjoy being portrayed by Yeo. He’s intelligent, relaxed, unassuming. We talked about a studio visit. But then I had a look at his works online and cringed. And that was before I saw this right royal banality.

Yeo’s portrait of the king is replete with all his vices. It is technically superficial and unfelt. There’s no insight into the king’s personality here, just a weird allegory about a monarch butterfly that Yeo says is a symbol of his metamorphosis from prince to king.

Dia Beacon, New York State
Defying narrative, the artist mixes LED lights and colour with ricocheting music inspired by West Africa, resulting in a throbbing show that sucks the air from your lungs

There are neither images nor narrative in Steve McQueen’s newest work, Bass, at the Dia Art Foundation at Beacon, about an hour up the Hudson valley from New York. Nothing but three stacks of speakers standing in the low-lit gloom of a concrete basement, and a grid of 60 flat LED light boxes sitting flush with the ceiling, measuring out the space between the rows of pillars and providing the only illumination in the large, echoing space. The light boxes glow red then tangerine, through yellows and green, blues and magenta and back to red, slowly drifting round the spectrum like a dial being turned.

Along with the light, sounds hang in the air. Sometimes the reverb goes right through you, then it’s a ghost. Slick with dulled reflections, the concrete floor is scored with old cracks and worn-away markings. The throb of bass notes ricochet from the walls and pillars, an underground shooting gallery of dub. Aching and surging, tailing off and picking up again, the music creates a space in which riffs and licks come and go are lost in reverb and harmonics, like snatches of language being dragged out of nowhere. Notes pulse like a human heart or a rudder in a current. Enormous tonal weights slide like so much unmoored ballast, blues phrases shimmer in complaint and there’s a constant sense of the impending. At one point a low hollow sound tunnels through the air like disaster looming.

Pastel cities trapped in a timeless future-past. Empty apartments drenched in nostalgia. Classic convertibles speeding into a low-res sunset. Femme fatales and mutated monsters doing battle. Deep, dark dungeons and glittering star ships floating in space. All captured in a eerie palette of 4096 colours and somehow, you're sure, from some alternate 1980s world you can't quite remember... Drawn painstakingly one pixel at a time, with a palette of 4096 possible colours, pushing the limits of these 80's era machines memory, these early graphic artists and hackers alike have left an indelible mark on the world of digital art and internet culture, only to be forgotten in the passing of time. But what made this boring business computer from Japan so special?

The French photographer has been crowned Master of Photography at this year’s Photo London thanks to three decades of work exploring femininity and the body

One of the largest healthcare systems in the United States is scrambling to contain a hack that's causing disruption and “downtime procedures” at hospitals around the country.

The post Healthcare Giant Ascension Hacked, Hospitals Diverting Emergency Service appeared first on SecurityWeek.

The U.S. Federal Communications Commission (FCC) today levied fines totaling nearly $200 million against the four major carriers — including AT&T, Sprint, T-Mobile and Verizon — for illegally sharing access to customers’ location information without consent.

The fines mark the culmination of a more than four-year investigation into the actions of the major carriers. In February 2020, the FCC put all four wireless providers on notice that their practices of sharing access to customer location data were likely violating the law.

The FCC said it found the carriers each sold access to its customers’ location information to ‘aggregators,’ who then resold access to the information to third-party location-based service providers.

“In doing so, each carrier attempted to offload its obligations to obtain customer consent onto downstream recipients of location information, which in many instances meant that no valid customer consent was obtained,” an FCC statement on the action reads. “This initial failure was compounded when, after becoming aware that their safeguards were ineffective, the carriers continued to sell access to location information without taking reasonable measures to protect it from unauthorized access.”

The FCC’s findings against AT&T, for example, show that AT&T sold customer location data directly or indirectly to at least 88 third-party entities. The FCC found Verizon sold access to customer location data (indirectly or directly) to 67 third-party entities. Location data for Sprint customers found its way to 86 third-party entities, and to 75 third-parties in the case of T-Mobile customers.

The commission said it took action after Sen. Ron Wyden (D-Ore.) sent a letter to the FCC detailing how a company called Securus Technologies had been selling location data on customers of virtually any major mobile provider to law enforcement officials.

That same month, KrebsOnSecurity broke the news that LocationSmart — a data aggregation firm working with the major wireless carriers — had a free, unsecured demo of its service online that anyone could abuse to find the near-exact location of virtually any mobile phone in North America.

The carriers promised to “wind down” location data sharing agreements with third-party companies. But in 2019, reporting at Vice.com showed that little had changed, detailing how reporters were able to locate a test phone after paying $300 to a bounty hunter who simply bought the data through a little-known third-party service.

Sen. Wyden said no one who signed up for a cell plan thought they were giving permission for their phone company to sell a detailed record of their movements to anyone with a credit card.

“I applaud the FCC for following through on my investigation and holding these companies accountable for putting customers’ lives and privacy at risk,” Wyden said in a statement today.

The FCC fined Sprint and T-Mobile $12 million and $80 million respectively. AT&T was fined more than $57 million, while Verizon received a $47 million penalty. Still, these fines represent a tiny fraction of each carrier’s annual revenues. For example, $47 million is less than one percent of Verizon’s total wireless service revenue in 2023, which was nearly $77 billion.

The fine amounts vary because they were calculated based in part on the number of days that the carriers continued sharing customer location data after being notified that doing so was illegal (the agency also considered the number of active third-party location data sharing agreements). The FCC notes that AT&T and Verizon each took more than 320 days from the publication of the Times story to wind down their data sharing agreements; T-Mobile took 275 days; Sprint kept sharing customer location data for 386 days.

Update, 6:25 p.m. ET: Clarified that the FCC launched its investigation at the request of Sen. Wyden.

It’s not unusual for the data brokers behind people-search websites to use pseudonyms in their day-to-day lives (you would, too). Some of these personal data purveyors even try to reinvent their online identities in a bid to hide their conflicts of interest. But it’s not every day you run across a US-focused people-search network based in China whose principal owners all appear to be completely fabricated identities.

Responding to a reader inquiry concerning the trustworthiness of a site called TruePeopleSearch[.]net, KrebsOnSecurity began poking around. The site offers to sell reports containing photos, police records, background checks, civil judgments, contact information “and much more!” According to LinkedIn and numerous profiles on websites that accept paid article submissions, the founder of TruePeopleSearch is Marilyn Gaskell from Phoenix, Ariz.

The saucy yet studious LinkedIn profile for Marilyn Gaskell.

Ms. Gaskell has been quoted in multiple “articles” about random subjects, such as this article at HRDailyAdvisor about the pros and cons of joining a company-led fantasy football team.

“Marilyn Gaskell, founder of TruePeopleSearch, agrees that not everyone in the office is likely to be a football fan and might feel intimidated by joining a company league or left out if they don’t join; however, her company looked for ways to make the activity more inclusive,” this paid story notes.

Also quoted in this article is Sally Stevens, who is cited as HR Manager at FastPeopleSearch[.]io.

Sally Stevens, the phantom HR Manager for FastPeopleSearch.

“Fantasy football provides one way for employees to set aside work matters for some time and have fun,” Stevens contributed. “Employees can set a special league for themselves and regularly check and compare their scores against one another.”

Imagine that: Two different people-search companies mentioned in the same story about fantasy football. What are the odds?

Both TruePeopleSearch and FastPeopleSearch allow users to search for reports by first and last name, but proceeding to order a report prompts the visitor to purchase the file from one of several established people-finder services, including BeenVerified, Intelius, and Spokeo.

DomainTools.com shows that both TruePeopleSearch and FastPeopleSearch appeared around 2020 and were registered through Alibaba Cloud, in Beijing, China. No other information is available about these domains in their registration records, although both domains appear to use email servers based in China.

Sally Stevens’ LinkedIn profile photo is identical to a stock image titled “beautiful girl” from Adobe.com. Ms. Stevens is also quoted in a paid blog post at ecogreenequipment.com, as is Alina Clark, co-founder and marketing director of CocoDoc, an online service for editing and managing PDF documents.

The profile photo for Alina Clark is a stock photo appearing on more than 100 websites.

Scouring multiple image search sites reveals Ms. Clark’s profile photo on LinkedIn is another stock image that is currently on more than 100 different websites, including Adobe.com. Cocodoc[.]com was registered in June 2020 via Alibaba Cloud Beijing in China.

The same Alina Clark and photo materialized in a paid article at the website Ceoblognation, which in 2021 included her at #11 in a piece called “30 Entrepreneurs Describe The Big Hairy Audacious Goals (BHAGs) for Their Business.” It’s also worth noting that Ms. Clark is currently listed as a “former Forbes Council member” at the media outlet Forbes.com.

Entrepreneur #6 is Stephen Curry, who is quoted as CEO of CocoSign[.]com, a website that claims to offer an “easier, quicker, safer eSignature solution for small and medium-sized businesses.” Incidentally, the same photo for Stephen Curry #6 is also used in this “article” for #22 Jake Smith, who is named as the owner of a different company.

Stephen Curry, aka Jake Smith, aka no such person.

Mr. Curry’s LinkedIn profile shows a young man seated at a table in front of a laptop, but an online image search shows this is another stock photo. Cocosign[.]com was registered in June 2020 via Alibaba Cloud Beijing. No ownership details are available in the domain registration records.

Listed at #13 in that 30 Entrepreneurs article is Eden Cheng, who is cited as co-founder of PeopleFinderFree[.]com. KrebsOnSecurity could not find a LinkedIn profile for Ms. Cheng, but a search on her profile image from that Entrepreneurs article shows the same photo for sale at Shutterstock and other stock photo sites.

DomainTools says PeopleFinderFree was registered through Alibaba Cloud, Beijing. Attempts to purchase reports through PeopleFinderFree produce a notice saying the full report is only available via Spokeo.com.

Lynda Fairly is Entrepreneur #24, and she is quoted as co-founder of Numlooker[.]com, a domain registered in April 2021 through Alibaba in China. Searches for people on Numlooker forward visitors to Spokeo.

The photo next to Ms. Fairly’s quote in Entrepreneurs matches that of a LinkedIn profile for Lynda Fairly. But a search on that photo shows this same portrait has been used by many other identities and names, including a woman from the United Kingdom who’s a cancer survivor and mother of five; a licensed marriage and family therapist in Canada; a software security engineer at Quora; a journalist on Twitter/X; and a marketing expert in Canada.

Cocofinder[.]com is a people-search service that launched in Sept. 2019, through Alibaba in China. Cocofinder lists its market officer as Harriet Chan, but Ms. Chan’s LinkedIn profile is just as sparse on work history as the other people-search owners mentioned already. An image search online shows that outside of LinkedIn, the profile photo for Ms. Chan has only ever appeared in articles at pay-to-play media sites, like this one from outbackteambuilding.com.

Perhaps because Cocodoc and Cocosign both sell software services, they are actually tied to a physical presence in the real world — in Singapore (15 Scotts Rd. #03-12 15, Singapore). But it’s difficult to discern much from this address alone.

Who’s behind all this people-search chicanery? A January 2024 review of various people-search services at the website techjury.com states that Cocofinder is a wholly-owned subsidiary of a Chinese company called Shenzhen Duiyun Technology Co.

“Though it only finds results from the United States, users can choose between four main search methods,” Techjury explains. Those include people search, phone, address and email lookup. This claim is supported by a Reddit post from three years ago, wherein the Reddit user “ProtectionAdvanced” named the same Chinese company.

Is Shenzhen Duiyun Technology Co. responsible for all these phony profiles? How many more fake companies and profiles are connected to this scheme? KrebsOnSecurity found other examples that didn’t appear directly tied to other fake executives listed here, but which nevertheless are registered through Alibaba and seek to drive traffic to Spokeo and other data brokers. For example, there’s the winsome Daniela Sawyer, founder of FindPeopleFast[.]net, whose profile is flogged in paid stories at entrepreneur.org.

Google currently turns up nothing else for in a search for Shenzhen Duiyun Technology Co. Please feel free to sound off in the comments if you have any more information about this entity, such as how to contact it. Or reach out directly at krebsonsecurity @ gmail.com.

A mind map highlighting the key points of research in this story. Click to enlarge. Image: KrebsOnSecurity.com

ANALYSIS

It appears the purpose of this network is to conceal the location of people in China who are seeking to generate affiliate commissions when someone visits one of their sites and purchases a people-search report at Spokeo, for example. And it is clear that Spokeo and others have created incentives wherein anyone can effectively white-label their reports, and thereby make money brokering access to peoples’ personal information.

Spokeo’s Wikipedia page says the company was founded in 2006 by four graduates from Stanford University. Spokeo co-founder and current CEO Harrison Tang has not yet responded to requests for comment.

Intelius is owned by San Diego based PeopleConnect Inc., which also owns Classmates.com, USSearch, TruthFinder and Instant Checkmate. PeopleConnect Inc. in turn is owned by H.I.G. Capital, a $60 billion private equity firm. Requests for comment were sent to H.I.G. Capital. This story will be updated if they respond.

BeenVerified is owned by a New York City based holding company called The Lifetime Value Co., a marketing and advertising firm whose brands include PeopleLooker, NeighborWho, Ownerly, PeopleSmart, NumberGuru, and Bumper, a car history site.

Ross Cohen, chief operating officer at The Lifetime Value Co., said it’s likely the network of suspicious people-finder sites was set up by an affiliate. Cohen said Lifetime Value would investigate to determine if this particular affiliate was driving them any sign-ups.

All of the above people-search services operate similarly. When you find the person you’re looking for, you are put through a lengthy (often 10-20 minute) series of splash screens that require you to agree that these reports won’t be used for employment screening or in evaluating new tenant applications. Still more prompts ask if you are okay with seeing “potentially shocking” details about the subject of the report, including arrest histories and photos.

Only at the end of this process does the site disclose that viewing the report in question requires signing up for a monthly subscription, which is typically priced around $35. Exactly how and from where these major people-search websites are getting their consumer data — and customers — will be the subject of further reporting here.

The main reason these various people-search sites require you to affirm that you won’t use their reports for hiring or vetting potential tenants is that selling reports for those purposes would classify these firms as consumer reporting agencies (CRAs) and expose them to regulations under the Fair Credit Reporting Act (FCRA).

These data brokers do not want to be treated as CRAs, and for this reason their people search reports typically don’t include detailed credit histories, financial information, or full Social Security Numbers (Radaris reports include the first six digits of one’s SSN).

But in September 2023, the U.S. Federal Trade Commission found that TruthFinder and Instant Checkmate were trying to have it both ways. The FTC levied a $5.8 million penalty against the companies for allegedly acting as CRAs because they assembled and compiled information on consumers into background reports that were marketed and sold for employment and tenant screening purposes.

The FTC also found TruthFinder and Instant Checkmate deceived users about background report accuracy. The FTC alleges these companies made millions from their monthly subscriptions using push notifications and marketing emails that claimed that the subject of a background report had a criminal or arrest record, when the record was merely a traffic ticket.

The FTC said both companies deceived customers by providing “Remove” and “Flag as Inaccurate” buttons that did not work as advertised. Rather, the “Remove” button removed the disputed information only from the report as displayed to that customer; however, the same item of information remained visible to other customers who searched for the same person.

The FTC also said that when a customer flagged an item in the background report as inaccurate, the companies never took any steps to investigate those claims, to modify the reports, or to flag to other customers that the information had been disputed.

There are a growing number of online reputation management companies that offer to help customers remove their personal information from people-search sites and data broker databases. There are, no doubt, plenty of honest and well-meaning companies operating in this space, but it has been my experience that a great many people involved in that industry have a background in marketing or advertising — not privacy.

Also, some so-called data privacy companies may be wolves in sheep’s clothing. On March 14, KrebsOnSecurity published an abundance of evidence indicating that the CEO and founder of the data privacy company OneRep.com was responsible for launching dozens of people-search services over the years.

Finally, some of the more popular people-search websites are notorious for ignoring requests from consumers seeking to remove their information, regardless of which reputation or removal service you use. Some force you to create an account and provide more information before you can remove your data. Even then, the information you worked hard to remove may simply reappear a few months later.

This aptly describes countless complaints lodged against the data broker and people search giant Radaris. On March 8, KrebsOnSecurity profiled the co-founders of Radaris, two Russian brothers in Massachusetts who also operate multiple Russian-language dating services and affiliate programs.

The truth is that these people-search companies will continue to thrive unless and until Congress begins to realize it’s time for some consumer privacy and data protection laws that are relevant to life in the 21st century. Duke University adjunct professor Justin Sherman says virtually all state privacy laws exempt records that might be considered “public” or “government” documents, including voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, bankruptcy filings, and more.

“Consumer privacy laws in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia all contain highly similar or completely identical carve-outs for ‘publicly available information’ or government records,” Sherman said.

Last week on Malwarebytes Labs:

• Patch now! VMWare escape flaws are so serious even end-of-life software gets a fix
• Update now! JetBrains TeamCity vulnerability abused at scale
• PetSmart warns customers of credential stuffing attack
• Predator spyware vendor banned in US
• ALPHV ransomware gang fakes own death, fools no one
• Update your iPhones and iPads now: Apple patches security vulnerabilities in iOS and iPadOS
• Check your DNS! Abandoned domains used to bypass spam checks
• American Express warns customers about third party data breach
• No “Apple magic” as 11% of macOS detections last year came from malware
• Pegasus spyware creator ordered to reveal code used to spy on WhatsApp users

Stay safe!

Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

Pet retail company PetSmart has emailed customers to alert them to a recent credential stuffing attack.

Credential stuffing relies on the re-use of passwords. Take this example: User of Site A uses the same email and password to login to Site B. Site A gets compromised and those login details are exposed. People with access to the credentials from Site A try them on Site B, often via automation, and gain access to the user’s account.

If the user had different passwords on Site A and Site B, the attacker would have been stopped before they got in to Site B. This is why we are continuously telling people to not reuse their passwords. If all your logins are hard to remember (and they should be), you can use a password manager to help you.

We’d like to like to praise PetSmart for the way in which it handled the attack, setting a good example by warning customers.

“Dear Pet Parent,

We want to assure you that there is no indication that petsmart.com or any of our systems have been compromised. Instead, our security tools saw an increase in password guessing attacks on petsmart.com and during this time your account was logged into. While the log in may have been valid, we wanted you to know.

In an abundance of caution to protect you and your account, we have inactivated your password on petsmart.com. The next time you visit petsmart.com, simply click the “Forgot password” link to rest your password. You can also reset your password by visiting www.petsmart.com/account/.

Across the internet, fraudsters are constantly trying to obtain user names and passwords and they often try and test the credentials they find on various websites, like ours. To help keep your accounts secure, remember to use strong passwords for each of your important accounts.

Thank you for your understanding. If you have any questions about this, or any other issue, please feel free to contact us at customercare@petsmart.com or 888-839-9638.

Sincerely,

The PetSmart Data Security Team”

While we don’t agree with everything in the email—a strong password would not have made a difference here—it is informative, to the point, and helpful.

Digital Footprint scan

If you were one of those customers and the login was not you, that means the attacker knew your email and password. Maybe they found them in the proceeds of a previous data breach.

Malwarebytes has a tool that can help you find out how much of your own data is currently exposed online. Our free Digital Footprint scan scours the internet to find your exposed passwords and much more. Fill in your email address (it’s best to submit the one you most frequently use) and we’ll send you a report.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using Malwarebytes Identity Theft Protection.

A Canadian man who says he’s been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve “triangulation fraud,” which occurs when a consumer purchases something online — from a seller on Amazon or eBay, for example — but the seller doesn’t actually own the item for sale. Instead, the seller purchases the item from an online retailer using stolen payment card data. In this scam, the unwitting buyer pays the scammer and receives what they ordered, and very often the only party left to dispute the transaction is the owner of the stolen payment card.

Triangulation fraud. Image: eBay Enterprise.

Timothy Barker, 56, was until recently a Band Manager at Duncan’s First Nation, a First Nation in northwestern Alberta, Canada. A Band Manager is responsible for overseeing the delivery of all Band programs, including community health services, education, housing, social assistance, and administration.

Barker told KrebsOnSecurity that during the week of March 31, 2023 he and the director of the Band’s daycare program discussed the need to purchase items for the community before the program’s budget expired for the year.

“There was a rush to purchase items on the Fiscal Year 2023 timeline as the year ended on March 31,” Barker recalled.

Barker said he bought seven “Step2 All Around Playtime Patio with Canopy” sets from a seller on Amazon.ca, using his payment card on file to pay nearly $2,000 for the items.

On the morning of April 7, Barker’s Facebook account received several nasty messages from an Ontario woman he’d never met. She demanded to know why he’d hacked her Walmart account and used it to buy things that were being shipped to his residence. Barker shared a follow-up message from the woman, who later apologized for losing her temper.

One of several messages from the Ontario woman whose Walmart account was used to purchase the goods that Barker ordered from Amazon.

“If this is not the person who did this to me, I’m sorry, I’m pissed,” the lady from Ontario said. “This order is being delivered April 14th to the address above. If not you, then someone who has the same name. Now I feel foolish.”

On April 12, 2023, before the Amazon purchases had even arrived at his home, Barker received a call from an investigator with the Royal Canadian Mounted Police (RCMP), who said Barker urgently needed to come down to the local RCMP office for an interview related to “an investigation.” Barker said the officer wouldn’t elaborate at the time on the nature of the investigation, and that he told the officer he was in Halifax for several days but could meet after his return home.

According to Barker, the investigator visited his home anyway the following day and began questioning his wife, asking about his whereabouts, his work, and when he might return home.

On April 14, six boxes arrived to partially fulfill his Amazon order; another box was delayed, and the Amazon.ca seller he’d purchased from said the remaining box was expected to ship the following week. Barker said he was confused because all six boxes came from Walmart instead of Amazon, and the shipping labels had his name and address on them but carried a contact phone number in Mexico.

Three days later, the investigator called again, demanding he submit to an interview.

“He then asked where my wife was and what her name is,” Barker said. “He wanted to know her itinerary for the day. I am now alarmed and frightened — this doesn’t feel right.”

Barker said he inquired with a local attorney about a consultation, but that the RCMP investigator showed up at his house before he could speak to the lawyer. The investigator began taking pictures of the boxes from his Amazon order.

“The [investigator] derisively asked why would anyone order so many play sets?” Barker said. “I started to give the very logical answer that we are helping families improve their children’s home life and learning for toddlers when he cut me off and gave the little speech about giving a statement after my arrest. He finally told me that he believes that I used someone’s credit card in Ontario to purchase the Walmart products.”

Eager to clear his name, Barker said he shared with the police copies of his credit card bills and purchase history at Amazon. But on April 21, the investigator called again to say he was coming to arrest Barker for theft.

“He said that if I was home at five o’clock then he would serve the papers at the house and it would go easy and I wouldn’t have to go to the station,” Barker recalled. “If I wasn’t home, then he would send a search team to locate me and drag me to the station. He said he would kick the door down if I didn’t answer my phone. He said he had every right to break our door down.”

Barker said he briefly conferred with an attorney about how to handle the arrest. Later that evening, the RCMP arrived with five squad cars and six officers.

“I asked if handcuffs were necessary – there is no danger of violence,” Barker said. “I was going to cooperate. His response was to turn me around and cuff me. He walked me outside and stood me beside the car for a full 4 or 5 minutes in full view of all the neighbors.”

Barker believes he and the Ontario woman are both victims of triangulation fraud, and that someone likely hacked the Ontario woman’s Walmart account and added his name and address as a recipient.

But he says he has since lost his job as a result of the arrest, and now he can’t find new employment because he has a criminal record. Barker’s former employer — Duncan’s First Nation — did not respond to requests for comment.

“In Canada, a criminal record is not a record of conviction, it’s a record of charges and that’s why I can’t work now,” Barker said. “Potential employers never find out what the nature of it is, they just find out that I have a criminal arrest record.”

Barker said that right after his arrest, the RCMP called the Ontario woman and told her they’d solved the crime and arrested the perpetrator.

“They even told her my employer had put me on administrative leave,” he said. “Surely, they’re not allowed to do that.”

Contacted by KrebsOnSecurity, the woman whose Walmart account was used to fraudulently purchase the child play sets said she’s not convinced this was a case of triangulation fraud. She declined to elaborate on why she believed this, other than to say the police told her Barker was a bad guy.

“I don’t think triangulation fraud was used in this case,” she said. “My actual Walmart.ca account was hacked and an order was placed on my account, using my credit card. The only thing Mr. Barker did was to order the item to be delivered to his address in Alberta.”

Barker shared with this author all of the documentation he gave to the RCMP, including screenshots of his Amazon.ca account showing that the items in dispute were sold by a seller named “Adavio,” and that the merchant behind this name was based in Turkey.

That Adavio account belongs to a young computer engineering student and “SEO expert” based in Adana, Turkey who did not respond to requests for comment.

Amazon.ca said it conducted an investigation and found that Mr. Barker never filed a complaint about the seller or transaction in question. The company noted that Adavio currently has a feedback rating of 4.5 stars out of 5.

“Amazon works hard to provide customers with a great experience and it’s our commitment to go above and beyond to make things right for customers,” Amazon.ca said in a written statement. “If a customer has an issue with an order, they may flag to Amazon through our Customer Service page.”

Barker said when he went to file a complaint with Amazon last year he could no longer find the Adavio account on the website, and that the site didn’t have a category for the type of complaint he wanted to file.

When he first approached KrebsOnSecurity about his plight last summer, Barker said he didn’t want any media attention to derail the chances of having his day in court, and confronting the RCMP investigator with evidence proving that he was being wrongfully prosecuted and maligned.

But a week before his court date arrived at the end of November 2023, prosecutors announced the charges against him would be stayed, meaning they had no immediate plans to prosecute the case further but that the investigation could still be reopened at some point in the future.

The RCMP declined to comment for this story, other than to confirm they had issued a stay of proceedings in the case.

Barker says the stay has left him in legal limbo — denying him the ability to clear his name, while giving the RCMP a free pass for a botched investigation. He says he has considered suing the investigating officer for defamation, but has been told by his attorney that the bar for success in such cases against the government is extremely high.

“I’m a 56-year-old law-abiding citizen, and I haven’t broken any laws,” Barker said, wondering aloud who would be stupid enough to use someone else’s credit card and have the stolen items shipped directly to their home.

“Their putting a stay on the proceedings without giving any evidence or explanation allows them to cover up bad police work,” he said. “It’s all so stupid.”

Triangulation fraud is hardly a new thing. KrebsOnSecurity first wrote about it from an e-commerce vendor’s perspective in 2015, but the scam predates that story by many years and is now a well-understood problem. The Canadian authorities should either let Mr. Barker have his day in court, or drop the charges altogether.