Owner Judith Papo featured in Jewish Newsletter

We were honored to be featured in the High Holiday Edition of The Voice-the Jewish newspaper of Dutchess County and surrounding areas published by the Jewish Federation of Dutchess County.

Debbie Silbergleit interviewed Judith and wonderfully captured the backstory of Judith’s childhood and how it has informed her launch of HV Shred, Inc.  Growing up in the 70s and 80s in Dutchess County was integral to giving Schwartz-Papo the self confidence and courage to team up with her family to create a business with strong values and a goal of helping businesses and the community at large securely and efficiently dispose confidential records as well as implement sustainable business practices by recycling the shredded material.

Voice Article Features Judith Papo of Legal Shred

Judith feels strongly the fostering and supportive environment of her nuclear family echoed by the larger community around her has been integral to her success.

Judith wishes all a sweet and happy Jewish New Year–enjoy lots of apples and honey.

For more on how Legal Shred can be of service for your office or community please visit www.hvshred.com

FBI Urges Victims of Ransomware to Report Incidents

This week’s blog begins a several week series on Ransomware adapted from the Internet Crime Complaint Center. The mission of the Internet Crime Complaint Center is to provide the public with a reliable and convenient reporting mechanism to submit information to the Federal Bureau of Investigation concerning suspected Internet-facilitated criminal activity and to develop effective alliances with law enforcement and industry partners. Information is analyzed and disseminated for investigative and intelligence purposes to law enforcement and for public awareness.

In it’s most recent post, the FBI is urging victims of ransomware to report their experiences to federal law enforcement to help the Agency gain a more comprehensive view of the current threat and its impact on U.S. victims.

Ransomware is a type of malware installed on a computer or server that encrypts the files, making them inaccessible until a specified ransom is paid. Ransomware is typically installed when a user clicks on a malicious link, opens a file in an e-mail that installs the malware, or through drive-by downloads (which does not require user-initiation) from a compromised Web site.
Ransomware infections impact individual users and businesses regardless of size or industry by causing service disruptions, financial loss, and in some cases, permanent loss of valuable data. While ransomware infection statistics are often highlighted in the media and by computer security companies, it has been challenging for the FBI to ascertain the true number of ransomware victims as many infections go unreported to law enforcement.

The FBI is urging victims to report ransomware incidents regardless of the outcome. Victim reporting provides law enforcement with a greater understanding of the threat, provides justification for ransomware investigations, and contributes relevant information to ongoing ransomware cases. Knowing more about victims and their experiences with ransomware will help the FBI to determine who is behind the attacks and how they are identifying or targeting victims.

What to Report to Law Enforcement
The FBI is requesting victims reach out to their local FBI office and/or file a complaint with the Internet Crime Complaint Center, at www.IC3.gov, with the following ransomware infection details (as applicable):
1. Date of Infection
2. Ransomware Variant (identified on the ransom page or by the encrypted file extension)
3. Victim Company Information (industry type, business size, etc.)
4. How the Infection Occurred (link in e-mail, browsing the Internet, etc.)
5. Requested Ransom Amount
6. Actor’s Bitcoin Wallet Address (may be listed on the ransom page)
7. Ransom Amount Paid (if any)
8. Overall Losses Associated with a Ransomware Infection (including the ransom amount)
9. Victim Impact Statement

More on the impact of ransomware in upcoming weeks.

For more information on identity theft best practices, please visit www.legalshred.com

Another Attempt to Use IRS to Scam

This week we again adapt a post from a favorite resource–The FTC Identity Theft Blog.  In a September 1st blog, Andrew Johnson Division of Consumer and Business Education warns about the latest scammers posing as IRS agents calling with an issue.

Johnson’s advice–Don’t panic. And don’t return the call. It’s a scam.

Here are a few facts about the IRS to keep in mind if you get a similar call:

(1) If the IRS needs to contact you, they’ll do it by mail first.
(2) The IRS won’t demand personal information like credit card or Social Security numbers over the phone.
(3) The IRS won’t threaten to arrest or sue you, or demand that you pay right away.

(4)The IRS also won’t tell you to use a specific form of payment like a money transfer from MoneyGram or Western Union, a cash reload from MoneyPak or Reloadit, or a gift card from iTunes or Amazon. Scammers ask you to use those ways to pay because they’re hard to track or cancel payments.

If you or someone you know receives a call like this, report it the FTC and the Treasury Inspector General for Tax Administration (TIGTA). Include the caller’s phone number, along with any details you have. If you’re not sure whether a call is really from the IRS, you can double-check by calling the IRS directly at 1-800-829-1040. For more, check out this IRS imposter scams infographic.

Share with friends and family. They may get the call next.

For more on best practices to deter Identity theft, please visit www.legalshred.com

Tips To Avoid Medical Identity Theft

The recent issue of Consumer Reports provided valuable tips on Medical Identity Theft.  According to the Ponemon Institute, a private security research firm, an estimated 481,657 new cases of medical identity theft were reported between 2013 and 2014, an increase of almost 22 percent.

To lower your risk, here are a few tips:

(1) Get copies of your medical records and add new information each time you receive treatment.  If your records are corrupted by a thief, you’ll have proof they were altered.

(2) Check your medical records at least once annually.

(3) Read every explanation of benefits (EOB).  If you notice anything fishy, call about it right away.

(4) Be careful with your Social Security Numer and Insurance ID number.  Only share when absolutely necessary.

(5) Never share your health data or personal information over the phone or via email unless you’re sure who you are communicating with.

(6) Ask your healthcare providers how they safeguard your information.

For more on identity theft protection best practices please visit www.legalshred.com

Be Mindful of Back to School Scams

This week’s blog is adapted from a great resource we recommend–The Identity Theft Resource Center.  The days are getting shorter and Labor Day is 2 weeks away, so we turn our attention to the start of a new school year as a very busy time for both students and families and a perfect time for scammers to catch us off guard. With so much to do—registration forms, back to school supply shopping, even moving into a college dorm or apartment—it’s easy for something less than honest to slip in.

For younger students, one of the main culprits at this time of year is identity theft. Child identity theft has been rising steadily in the past few years because their credit scores are “clean slates,” and most parents never think to check their kids’ credit reports for signs of unusual activity. At the same time, everywhere you look, someone is requesting your child’s Social Security number, whether it’s a doctor’s office for a school checkup, a sports physical form for activities, or even the registration forms for the school itself.

No matter who is requesting your child’s personal identifiable information, you have to stop and ask yourself some key questions. Why do they need the SSN? How will they safeguard it, and who else can see it? How will it be stored so that no one in the school or doctor’s office can access it? If you don’t get solid information on those questions, think twice about handing it over.

Many of the back to school scams actually target older students, though, simply because they’re an easy target. College students who’ve left home for the first time might not be as prepared to spot a fraud attempt, and they have very specific needs now that they’re on their own. Scammers are prepared to act in a variety of ways, including:

  1. Work from home scams – College students are often broke, but with limited time on their hands and the demands of an academic schedule to shoulder, work from home opportunities might sound ideal. But most of these offers are not genuine. It’s that old “if it sounds too good to be true, it probably is”.
  1. Textbook rental scams – As sad as it is to say, there are people waiting to steal money from students who already don’t have much to spare. One prime example are textbook rental scams. These scams work because many schools and retailers do offer the option to pay to use your textbooks instead of buying them at full cost. Unfortunately, there are also scammers who set up fake websites or send out mailers, offering you every possible textbook but requiring a “registration fee,” money to secure the rental, or some other plausible fee.
  1. Online selling scams – Websites like eBay and Craig’s List are very helpful when it comes to buying or selling items that you no longer need. Unfortunately, there are a lot of scammers ready to cash in on the fact that college students might have a sudden need for an entire household of products: furniture, a bicycle to get around campus, a refrigerator for the dorm, and more.

Whenever you’re shopping through a legitimate used goods or direct-buy website or app, do your homework, be smart about your physical safety, and make sure you’re not being scammed. Never pay up front for the items or via money transfer, and only meet the seller in a public location; if in doubt about the offer, walk away.

No matter what time of year it is–the message is we need to stay on guard.

For more on identity theft protection, please visit www.legalshred.com

Defenses Against Smishing

This week’s blog is adapted from a recent blog posted by The Identity Theft Resource Center(ITRC).  The ITRC is a non-profit organization established to support victims of identity theft in resolving their cases, and to broaden public education and awareness in the understanding of identity theft, data breaches, cyber security, scams/fraud and privacy issues.

Hackers and scammers are top innovators.  They are finding new ways to attach data every day.  With every new platform, software, or app that comes out, someone invariably finds a way to use it to their advantage. The end result can be a breach in your personal security and a loss of your identity.

But with every new form of attack—spoofing, phishing, hacking, and more—the public has to learn about the threat and learn how to protect themselves from it. That’s why staying on top of a new form of security threat is critical to protecting yourself.

There’s a new form of security danger out there, and this one specifically targets your smartphone. Smishing, as the attack is called, uses the hackers’ old favorite—phishing, or sending out emails that entice you to click a link that actually downloads malicious software—to install a Trojan or virus on your phone. As its name implies, smishing comes from “SMS phishing,” as SMS is the acronym that applies to text messages.

Obviously, a smishing attack goes after your device via text message, and it happens when you get a message from an unknown number that offers you some sort of incentive. It might be telling you about a free offer, a coupon, something wrong with your account, or even more likely, it might claim that “your friend” has sent you a game request or message. Unfortunately, the weblink in the text will install malicious software on your phone once you press it.

Unlike viruses of the “olden days” that sought to lock up your computer or disable your files, smishing attacks generally don’t even want you to know they’re there. They want to exist inside your device and continue to feed information back to the hacker, information like your contacts list, your email address book, and any passwords you enter for apps or accounts you use.

While there are antivirus apps available for smartphones, it can be difficult to completely remove malicious software from a smartphone once it’s infected. Depending on the virus, the only available option may be to reset the phone to its factory settings, which will remove all of your content out of the phone. By far, the better option is to avoid installing this type of threat in the first place. Just remember the rule that goes for emails and social media messages, and apply the same smart practice to your mobile device: never click a link that you weren’t expecting.

For more on best practices for identity theft protection, please visit www.hvshred.com

Financial Readiness in the Face of a Natural Disaster

A recent blog on the FTC’s Consumer Advocacy website reminds us not just to be mindful of protecting our confidential information from hackers, but also from being lost in the midst of a natural disaster. While home is where most people feel safe and comfortable- when a hurricane, flood, tornado, wildfire, or other disaster strikes — it’s safest to pack up and go to another location.

When it comes to preparing for situations like weather emergencies, financial readiness is as important as a flashlight with fully charged batteries. Leaving your home can be stressful, but knowing that your financial documents are up-to-date, in one place, and portable can make a big difference at a tense time.

Steps to take to ensure financial readiness in case of an emergency include:

Conduct a Household Inventory-

Make a list of emergency contacts including family members who live outside your area; copies of current prescriptions; health insurance cards; policy #s for insurance companies as well as contact information; copies of important documents including the deed to the house, birth certificates, social security cards, passports and the like. Make a list of phone numbers or email addresses of your creditors, financial institutions, landlords, and utility companies (sewer, water, gas, electric, telephone, cable) a list of bank, loan, credit card, mortgage, lease, debit and ATM, investment account numbers, SS cards and backups of financial data your keep on your computer; also a good idea to have an extra set of keys for your house, your car, and your safe deposit box, and a small amount of cash.

Consider renting a safe deposit box for originals of deeds, titles, and other ownership records for your home, cars, RVs, or boats credit, lease, and other financial and payment agreements birth certificates, naturalization papers, and Social Security cards marriage license/divorce papers and child custody papers passports and military papers (if you need these regularly, you could place the originals in your fireproof box and a copy in your safe deposit box). Also include investment papers and your living will and health proxy.

Choose an Out-of-Town Contact

Ask an out-of-town friend or relative to be the point of contact for your family, and make sure everyone in your family has the information. After some emergencies, it can be easier to make a long distance call than a local one.

Update Your Information

Review the contents of your household inventory, your fireproof box, safe deposit box, and the information for your out-of-town contact at least once a year.

For more on best practices for maintaining and protecting confidential information, please visit www.hvshred.com

Be Wary of Inside Hackers as much as Outside Hackers

This week’s blog is adapted from an article posted by Maggie Overfelt as a special to CNBC.com.  It reminds us that the small things matter.  When it comes to identity theft protection, we myst be vigilant at the individual and institutional level.
While systems are vulnerable and measures should be taken to secure systems from outside hackers, businesses must be wary of the inside hacker. Smart entities perform enterprise-wide risk assessments to find where their systems are most vulnerable and to spot aberrations in user behavior.

But sophisticated analytics does little to assuage situations where employees are using low-tech methods to capture information. Most systems will not handle the single bank employee just writing down on paper all the bank numbers they see that day — that’s difficult to track–and that is happening.

 Communication with employees in a position to turn rogue is key. A big deterrent in identity theft cases; if an employee feels like the company cares for them, they’re less likely to take advantage of the situation.

Experts recommend preventing the display of sensitive data in plain sight.  Company should institute a clean desk policy ensuring workers file away papers containing data before they leaver their desks, implement inactivity time outs for any tech devices, and switch to an e-faxing system which eliminates exposure of sensitive patient data on paper that’s pile up around traditional fax machines.

Experts also say that tougher penalties for and more prosecution of inside hackers would also be a disincentive for such crimes. On a general level, there can be practical barriers to pursuit of a criminal case, such as the victim company’s fear of embarrassment, reputational damage, or the perceived risk — real or not — that their trade secrets will be exposed in a court proceeding.

The Department of Justice and local authorities prosecute these cases all the time, despite what are seen as common barriers. The barriers are low when the actions are clearly wrong, such as a hospital employee stealing electronic medical records and selling them on the black market.

While the price tag for stolen information on the black market can translate to a lucrative sales career for some crooked employees, it’s a costly phenomenon for organizations once they have realized it has occurred, which is often during forensic examination of user devices after individuals left a company.

That’s usually too late to enact damage control. According to the Ponemon Institute, the average cost of a breach is $217 per record.

That’s just the hard costs, what you have to pay for notifying customers or any type of remediation services.  The bigger picture is the reputational damage that shows itself not just to the entity that suffers the damage, but to the industry.

Our efforts must be local and global–individual and system wide–it’s a lot of work–but it is an invaluable investment.

For more on identity theft best practices, please visit www.legalshred.com

MidYear Review of the basics for Identity Theft best practices

Repetition it key to education.  That in mind, as we embark on the second half of 2016, we’d like to use this week’s blog to review the basics on identity theft protection best practices:

  1. Mobile device security – In our connected world, mobile devices account for a lot of our daily activities. Unfortunately, our smartphones and tablets are also wide-open gateways for a hacker to steal our identities. Make sure the apps you use are coming from trusted sources, not unregistered content publishers from third-party or aftermarket app vendors. When you’re out in public, protect your identity and conserve your battery by turning off the wifi to your device;  it will keep you from accidentally connecting to a network without intending to. If you do need to get online while away from home, remember to save the sensitive activity—like online banking—for a time when you’re connected to a trusted network.
  1. Privacy at home – Your home technology is every bit as vulnerable as it’s always been, which is why it’s important to install software that will protect you from malware and viruses. It’s also crucial that you password protect your home internet connection to keep outsiders from accessing it. If someone accesses your network without authorization, (s)he could do damage within your connected computers as well as use your internet address to break the law.
  1. Be scam-savvy – One of the easiest ways to steal someone’s identity with very little technological know-how is to get them to fall for a scam. That’s why it’s important to make sure you, your family members, and your coworkers are up-to-date on the latest scams.
  1. Be on the lookout – One of the most important steps you can take to prevent identity theft damage is to monitor your credit reports regularly. You are entitled to one free report each year from each of the top three credit reporting agencies. If you stagger those requests—receive on in January, one in May, and on in September, for example—you’ll get an ongoing look at the state of your credit. Be sure to report any suspicious activity as soon as you discover it, and place fraud alerts and freezes on any accounts that may have been compromised.
  1. Safeguard yourself old school – Remember, high-tech hacking and data breaches are only part of the problem. The old methods that don’t require anything more than a willingness to steal are still viable. That means dumpster diving is a still a threat, as is mailing bills from your home address. Be sure to shred all of your important, identifying documents before you discard them, and mail your bills from the nearest post office drop box instead of leaving them at the curb with the flag up.

It’s not a fail safe but taking these steps will help.  To stay up on identity theft best practices, please keep checking for our updates on www.hvshred.com

Understand and Protect Yourself from Online Tracking

What follows is the low-down of how you are being targeted on line.

How do websites remember you? For years, the answer has been by using “cookies” – pieces of information saved by your web browser, then used to remember you and customize your browsing experience.

Now, it’s about more than cookies. Without using cookies, companies can use “device fingerprinting” to track you, based on your browser’s unique configurations and settings. Plus, mobile app developers can use “device identifiers” to monitor different applications used on your device. Tracking can also occur on smart devices, like smart TVs.

How can you control online tracking? Here are some ways to get started:

  • Delete or limit cookies. Check your browser’s settings for tools under Help, Tools, Options or Privacy.
  • Reset identifiers on your mobile devices. That makes it harder to associate your device with your past activity. iOS users can do this by following Settings > Privacy > Advertising > Reset Advertising Identifier. For Android, the path is Google settings > Ads > Reset advertising ID. Remember that this will only prevent tracking based on past activity – it won’t prevent tracking going forward.
  • Learn about tracker blockers. There are tools that allow you to block ads called tracker blockers. They prevent companies from using cookies or fingerprinting to track your internet behavior. To find tracker blocking plug-ins, type “tracker blocker” in your search engine. Then, compare features to decide which tracker blocker is best for you.

For more resources for best practices in Identity theft protection, please visit www.legalshred.com