An anonymous reader quotes a report from Reuters: The state of New Mexico asked a judge on Thursday to order Meta Platforms to pay between $35 billion and $40 billion in penalties after a jury found the company had misled consumers about the privacy of their data on Facebook in a case that came out of the Cambridge Analytica scandal. Attorneys for New Mexico made the request at a hearing in a lawsuit brought following revelations that the British political consulting firm, which worked on Donald Trump's 2016 presidential campaign, harvested personal data from as many as 87 million Facebook users through a third-party app without their consent. The jury returned its verdict on September 25. Judge Francis Mathew, who oversaw the trial in Santa Fe, will decide how much Meta must pay in financial penalties. [...] State law allows the judge to decide how much to fine Meta per violation, up to $5,000. At the hearing on Thursday, Randi McGinn, a lawyer for New Mexico, said applying the full $5,000 penalty to the number of violations would create too large of a penalty under the US Constitution's protections on due process. But the judge should order a significant payment that will impact the company, McGinn said. "This court should speak to Meta in the only language it understands, which is money, and the value of its stock price," McGinn said. She said $35 billion to $40 billion, which represents about 20% of the possible penalties that could be awarded under state law from the verdict, would impact the stock price while complying with Meta's right to due process under the Constitution. At the hearing on Thursday, Matt Nicholson, a lawyer for Meta, called the state's request an "astronomical penalty that would obviously violate a host of constitutional provisions." In court filings, Meta urged Mathew to cap the penalties at $3.45 billion. The jury may have said it found Meta's statements misleading, but the evidence shows that Meta does not sell user data and New Mexico did not prove that any consumer had actually been misled, the company said in court filings. The judge said he expected to issue a ruling later this month.

Read more of this story at Slashdot.

Are you making cutbacks in light of the price increases?

The average price of diesel in the UK climbed to a record £2 a litre on 2 October.

The price of a litre at UK forecourts has risen 40.5% since late February, when the US-Israel war on Iran began disrupting supplies of crude and refined oil products from the Gulf, leading to cost increases across the economy.

Continue reading...

© Photograph: Dan Kitwood/Getty Images

© Photograph: Dan Kitwood/Getty Images

© Photograph: Dan Kitwood/Getty Images

From a neo-baronial country house with turrets in acres of grounds in Scotland to a modernist tower block in a bustling part of London

Continue reading...

© Photograph: Purple Bricks

© Photograph: Purple Bricks

© Photograph: Purple Bricks

The Naylors’ four-bedroom home in Milton Keynes acts like a mini-power station after retrofitting solar panels, a battery and a heat pump

Clare Naylor paid close attention to how much energy she and her family were using last winter, filling hot-water bottles and bringing out extra blankets to ensure they didn’t go over budget. This year, she won’t have to worry as she is guaranteed not to receive a bill.

While millions of British households face the highest energy charges in three years from this week after a 4% rise in the price cap, and predictions of a 16% increase in January, upgrades to Naylor’s home mean she will not have to pay a thing.

Continue reading...

© Photograph: Teri Pengilley/The Guardian

© Photograph: Teri Pengilley/The Guardian

© Photograph: Teri Pengilley/The Guardian

Manchester City are the most successful (men's) football team in the modern era of the Premier League. But there's a slight problem. They cheated, to the sum of £830,690,000. For 9 seasons, during which they won a number of titles and trophies. After a multi-year investigation, further details.

Last week on Malwarebytes Labs:

• The hidden work of modernizing Malwarebytes
• X Money rollout linked to password-reset attacks
• Free streaming boxes may be routing criminal traffic through your home
• StreamRat Android malware spreads through Meta and TikTok ads
• Your phone or computer may soon ask how old you are
• Tech support scams look different now. Here’s what to watch for
• Scammers are getting smarter about where they target you
• Two critical Chrome flaws put users at risk on malicious websites
• 153M+ driver’s licenses for sale on new dark web platform
• Your AI chats could be used in court
• Fake GTA 6 leaked copy drains your crypto wallet
• TerminalFix looks like ClickFix, but delivers a very different payload
• Infostealers are hijacking Claude accounts at users’ expense
• McKesson confirms cyber incident after ShinyHunters claims patient-data theft

Stay safe!

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

X says attackers may be targeting accounts because its X Money payments service is now more widely available.

The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X says it has found no evidence of a breach or successful account takeovers so far.

X users began reporting unexpected password-reset emails and codes on September 1. In a public post, X product engineer Mridul Singhai said:

“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts.”

Singhai said X was actively investigating, apologized for the repeated emails, and added that the company had found “no evidence of any breaches.”

X Money gives eligible US users access to financial services within X, including interest-bearing accounts, a Visa debit card, and peer-to-peer payments. Cross River Bank provides the banking infrastructure behind the service.

This could make some X accounts more attractive targets, particularly accounts with payment access, high follower counts, business use, or valuable social-engineering potential.

The activity itself appears consistent with attackers submitting password-reset requests in bulk against X accounts. Requesting a password reset is not the same as resetting a password, however, and neither automatically means that an account has been taken over. X’s recovery process requires access to the email address or phone number associated with the account before someone can complete the reset.

There is no evidence that anyone has accessed X Money accounts or funds. Nor has X confirmed that X Money caused the password-reset activity. The timing is notable, but it does not prove a technical connection between the two.

Earlier this year, we saw a flood of Instagram password-reset emails, showing that similar activity can happen on platforms without payment services.

It could be a cover for something more serious. Even if an attacker cannot complete a reset, large volumes of legitimate-looking reset messages can provide useful cover for scams.

Reset flooding can also be a nuisance tactic. Repeated messages may pressure someone into changing their password unnecessarily, obscure more important security notifications, or encourage them to disable security controls in an attempt to stop the alerts.

How to stay safe

If you receive an X password-reset email that you did not request:

• Do not click links or enter codes from unexpected messages. Open the X app or type x.com into your browser yourself if you want to inspect or change account settings.
• Do not share reset codes or two-factor authentication codes. Support staff, advertisers, and “security teams” will not contact you unexpectedly to ask for them.
• Turn on password-reset protection. X says this setting requires additional account information, such as an email address or phone number, before it will send a reset link or code. It is available under Settings and privacy > Account > Security > Password reset protection.
• Use two-factor authentication, preferably an authenticator app or security key where available. This adds another verification step if someone obtains or guesses your password.
• Use a unique, strong password. If you use your X password anywhere else, change it through X’s settings, not through a link in an email.
• Watch for signs of an actual account takeover. These include unfamiliar posts, direct messages, profile changes, login alerts, or unknown apps connected to your account.
• Stay alert for phishing. The strongest immediate consumer risk may not be a flaw in X itself, but phishing that imitates the reset process. A fake message can look especially convincing when genuine reset emails are arriving around the same time.
• Use protection. An up-to-date, real-time anti-malware solution with web protection can warn you about malicious and fraudulent sites.

If you’re unsure whether a message is real, use Malwarebytes Scam Guard to check it and get advice about what to do next.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.