Last month, we wrote about how the band Death Grips, an indie sensation who had signed with Epic Records (owned by Sony Music), had decided to release their latest album for free all over the internet, after some sort of dispute with Epic over the release date. The band was already considered one of the top authorized downloaded bands on BitTorrent due to earlier releases it had put online for free itself. However, with Epic trying to take a standard "slow down and wait" approach, the band posted its new album to various file lockers and started tweeting out links, noting that "the label will be hearing the album for the first time with you."

Last week, the band posted a screenshot of an irate email from the label about this. Epic notes not only that is it absolutely furious about the leak, but that (1) the release is a breach of contract; (2) since Epic owns the copyright, the label considers the leak to be infringing; (3) the band's decisions have "financially damaged Epic"; (4) even though Epic still intended to release the album, the album would not count towards the recording commitment in the band's contract and (5) while Epic still intended to collect money for the sale of the album (which, again, would not count towards the recording commitment), Epic would not cover the cost of recording the album. Those last two points are the really interesting ones to me. If it's not counting the album towards the recording commitment, and it now refuses to pay for the cost of the album, it seems wrong to then still consider it something that Epic gets to sell and to keep all the revenue from.

Either way, it appears that won't be an issue, because just a few weeks after that email was sent, Epic officially began the process of dropping Death Grips from the contract. This probably won't surprise many people, though it will be interesting to see if Epic retains "ownership" of the work in question or if Death Grips is able to get back control of its masters. That said, Epic's "statement" about this move is absolutely hilarious for being obviously, blatantly, false:

Epic Records is a music first company that breaks new artists. That is our mission and our mandate. Unfortunately, when marketing and publicity stunts trump the actual music, we must remind ourselves of our core values. To that end, effective immediately, we are working to dissolve our relationship with Death Grips. We wish them well.

First of all, Death Grips had already "broken" without Epic's help. Second, since when has a major label ever really cared about "the actual music" as compared to the ability to make money off of it with marketing and publicity stunts? And, really, if it were just about "the music," then why would it have freaked out so much when the band made "the music" available for free?

Over the weekend, TorrentFreak reported that the company that French "three strikes and you're off the internet" agency Hadopi had hired to help it track down infringers, Trident Media Guard, had been hacked, though, in reality it appears to be much more of a simple data breach caused by TMG poor setup. The breach left open a lot of details of the tracking system, including IP addresses linked to the whole 3 strikes process. In response, it appears that Hadopi has "temporarily suspended" its work with TMG, perhaps to measure the damage and see if it can actually learn to lock down its computers. In the meantime, however, as TorrentFreak points out, there are no other providers doing this monitoring -- meaning that (at least for a little while), it appears 3 strikes monitoring has stopped in France.

Apparently Sony has decided to pick on an easy target for its latest data breach: Anonymous. Sony is claiming it found a file named "Anonymous" on the server, with the non-group's phrase "We are Legion" in the file:

"The attacks were coordinated against Sony for exercising its rights in a civil action in the United States District Court in San Francisco against a hacker," Sony chairman Kazuo Hirai said in the letter.

"What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes."

Of course, those two sentences don't seem to match. Anonymous isn't known (at all) for trying to steal credit card information for criminal purposes. Its entire purpose is more along the lines of vigilante protests. Also, Anonymous may be the easiest "group" in the world to frame. Because it's not a group and anyone and everyone can be a part of it, you just put a file named "Anonymous" somewhere along with the phrase "We are Legion" and clueless dupes assume it was "the" Anonymous rather than a bunch of organized crime hackers searching for credit card details. It very well could have been an Anonymous operation, but it seems like Sony should have a bit more proof before making such a definitive statement on the matter.

For the few of you left who still trusted Sony, now comes news of yet another massive data breach, this time for Sony Online Entertainment (SOE) users. SOE is their online multiplayer games offering. It sounds like a similar issue to the PSN hack, again with lots of data being taken. Making matters worse, apparently for players outside the US, Sony kept credit card numbers and/or bank details in an "outdated database" (read, one not properly secured or encrypted, apparently). And... Sony is now admitting that the breach occurred a few weeks ago, so this info has probably already been put to use. So, we've got the rootkit, the PSN and now the SOE issue. Who actually willingly pays Sony for anything any more?

Insurance firm Wellpoint apparently left its medical records easily exposed on its servers from last October until March, exposing 470,000 users' medical records, credit card numbers and "other sensitive info." The company discovered the breach in February, but apparently waited until June to tell users. The company has now been fined $300,000 for not promptly notifying users, though that does seem like a rather low number considering how many records were apparently exposed...

Remember Heartland Payment Systems? It's the giant credit card clearinghouse that was involved in the largest ever security breach in terms of the number of credit card numbers exposed. They were successfully targeted by the same guys who had also set the previous record for largest credit card data breach, so you could question whether the issue was just a sophisticated group of hackers or poor security at Heartland (or, possibly, a combination of both). Either way, it looks like Heartland may still have some issues. Carlo sends over the news that a new security breach has been discovered at a restaurant in Austin, Texas that appears to involve someone hacking into the network between the restaurant and Heartland. It's not yet clear if this goes beyond that one restaurant, but this can't look good for Heartland.

Update: Heartland got in touch to let us know that this appears to be an issue outside of Heartland's system, and that Heartland is not the target of the investigation into the breach. Heartland's press release is basically pointing out that the weakness was with the restaurant's credit card security, not its own.

Last week, we wrote about the security glitch by AT&T, that allowed hackers to figure out the email addresses of 114,000 iPad users. A few people in the comments mocked this news, claiming that such info was pretty much meaningless, as email addresses are hardly private info these days. Of course, that ignored the connection of the email address to the fact that you bought an iPad. But now, some are realizing the potential security problems with this may be significantly worse. Slashdot point us to a story where someone walks through how poor security choices by the various mobile operators means that knowing the information revealed by the glitch can actually reveal much, much more. As the blog post walks through the details, it concludes that potentially, the data from the breach in some cases (though, not all) could then be used to figure out a lot more:

So yeah, knowing someone's ICCID can give you their full unpublished billing name, their cellular phone number (and hence their home address), their current location on a realtime basis, their voicemail, and if you're prepared to follow them around (within a few miles) then you get all their phone calls and SMS messages too.

There is a later edit, when he realizes that the voicemail/phone calls/SMS stuff might not be that big of a deal, since the iPad is not a phone device, but it's still instructive of how a "simple" data breach can lead to much more in certain circumstances.

The BBC has a story about how the operators of one of the larger botnets that was recently shut down showed up at the offices of a security researcher who helped bring them down... asking for a job. The article highlights how the researcher, Luis Corrons, basically had figured out who was running the botnet after one of the operators made a mistake and revealed his home computer... which actually was not far from where Corrons worked. It was shut down at the end of last year, but a few months later, Corrons had an interesting experience:

In late March Mr Corrons was preparing for a meeting at Panda's Bilbao lab with a journalist and took a moment to dodge downstairs to get a drink. On the way down he passed two young men coming up.

One asked if he was Luis Corrons. He said yes while wondering who they were.

They introduced themselves which left him no wiser. Then, one of them said; "I'm Ostiator and this is Netkairo."

"It was then I realised these guys were the ones that were arrested in the Mariposa case," he told the BBC. "I thought they wanted to teach me a lesson."

Instead, they asked him for a job, saying that the shutdown of the botnet had "robbed them of their livelihood." Apparently, the two guys started following Corrons on Twitter, sending messages his way and commenting on his blog, before asking for work again. They finally brought in one of the guys for an interview, noting that they wouldn't hire anyone involved in criminal activity. The guy responded that he hadn't been charged with anything. However, Corrons also quickly realized that the guy barely had any technical skills -- pointing out that he didn't write the bot, he just ran it:

"He got really annoyed at that moment, when we told him he was not good enough," said Mr Corrons. Subsequent discussion revealed just how poor their skills were.

"They were given the botnet with all the stuff they needed," said Mr Corrons. "Using it was like using any other program."

So, for the script kiddies out there, perhaps before asking for a job from the security researchers who bring your botnet down, you do a bit of work to make sure you have the actual skills.

Way back in 2006, we noted a series of cases where people had brought lawsuits over claimed "privacy" breaches, involving lost or leaked data, where the courts repeatedly ruled that if there was no evidence that the leaked data was used for nefarious purposes, there was no case. Odd that this applies to things like privacy, but when you see a similar situation with copyright, no one ever has to show any actual harm. Either way, it looks like courts are continuing to follow this particular line of thought, as a lawsuit against Gap for losing private data has been rejected under the same line of thinking. This also almost certainly means that all those class action lawsuits against Google for possibly collecting some WiFi data, are completely dead in the water. In those cases, the plaintiffs don't even show any evidence that their data was collected, let alone give any proof of harm.

Back in January, we noted that it looked like there might be a new winner in the battle to see who was responsible for the largest ever credit card breach. Until that time, the honor had gone to a series of department stores owned by TJX (TJ Maxx, Marshalls, etc.). That involved info on 94 million credit card holders. Not bad. But the newer deal, involving Heartland Payment Systems appeared to effect well over 100 million. Now, you may have seen the news reports this week that have upped that total to 130 million, as part of the announcement of indictments against three individuals for illegally accessing the data. But, what's fascinating is that the one guy in custody, Albert Gonzalez, was already in custody for his role in the TJX hack (along with some other retailers). Oh, and there's also the tidbit about how he was a government informant, handing over info on (you guessed it) the underworld involved in stolen credit card numbers.