Category: Data Breaches

The Dell 2024 Data Breach

If you have a Dell computer, you may have recently received an email notification of a data breach. Millions of customer records were recently stolen from Dell. Here’s what you need to know about the Dell 2024 Data Breach:

What Was Stolen

49 million customer records walked out the door. Each record may contain:

  • Purchaser’s Full Name
  • Physical Address
  • Unique Service Tag from the computer/hardware
  • System Ship Date
  • Warranty Plan Details
  • Serial Number (for monitors)
  • Dell Customer Number
  • Order Number

At this time, Dell claims that no payment info or phone numbers were taken. We can be grateful that there’s no worry about any financial accounts being invaded. But this breach is still a big deal, far bigger than Dell is letting on in their blanket email. The potential for phishing scams, using this stolen info, is high.

What To Expect

We’ve been through this before. It is generally known in the tech community that Dell has had other data breaches, and just not fessed up about them. How is that, you ask? Over the past several years, various Dell scams have been reported on or discussed, and those scammers used inside info, like Dell Service Tags and PII. The customer data they used was specific enough to have only come from Dell’s records.

These scams work well, and here’s an example of how it plays out:

Joe Scammer runs some quick searches against pubic information databases, and finds phone numbers to go with the names and addresses he’s holding. Then he starts cold-calling those numbers, with a plausible story.

“Hello, Ms. Vanderbluth! I am John Snordwrangler from Dell and I see that your Inspiron 3450 is overdue for a BIOS security update. If your service tag is BXT459A54, then I am authorized to perform this fix, free of charge for you! Do you have 2 minutes for me to remote-in and secure your system?”

This is often their schtick. And it is very believable, because the scammer already has all the answers. He’s not asking for sensitive info, he already has it, and many people would not think twice about saying Yes to a free fix. But anyone duped by this scheme will soon be taken for a horrible ride and bilked out of significant money. Or have their computer ruined after they refuse to pay up.

Based on past scam attempts, we might expect these to come via phone calls, email messages and even postal mail! Yes, you might even get a letter in the mail; it has happened before in other schemes.

How to Protect Yourself

This is a tough one to guard against. Again, the scammers will come armed with a lot of your personal information. They may employ the Dell logo on their printed materials. They have the ability to falsify their CallerID. Their email address may be spoofed to show “” or the like.

I have to prescribe extreme dubiousness for any Dell communications you receive. Maybe this should also apply to any unexpected contact from big tech companies. If you didn’t initiate that surprise call or email, mistrust is a good first option.

But there is always the slight chance that you will receive a legitimate Dell notice. So we’ll want to be suspicious but not impolite. Don’t respond to any Dell emails directly. Don’t interact with a Dell rep who called you on the phone. Never dial a number shown in an unexpected email.

If Dell is asking you to take any particular action, end the call or step away from that particular email. Next, you are safe to reach out to Dell, using trusted means, as shown on their website. The various phone numbers and chat methods on that site are safe. Using them will help you verify a real request, as well as reveal a phishing attempt.

Please also discuss anything strange with your friends, family or other trusted people. Remember: scams reveal themselves and fall apart when you talk about them with others!

Also, Dell asks that you report their impersonators to them. They have a page for reporting phone scams, and you are welcome to forward phishing emails to .

The Dell 2024 Data Breach
screencap of bad actor selling Dell’s stolen data

Xfinity’s 2023 Data Breach

xfinity's 2023 data breach

Has Xfinity contacted you recently to change your password? This was probably a legitimate request, and prompted by Xfinity’s 2023 data breach.

(I’ll call it the 2023 data breach, because they also had one in 2022!)

It looks like cybercriminals exploited and intruded upon Xfinity’s systems in October of this year, and we’re just now hearing about it. Xfinity has put out a generic statement about the matter. But government websites provide more important details, such as: 35 million customer records are involved. What kind of data was stolen? It could include usernames, passwords, last-four digits of SSNs, DOBs and security questions/answers.

If you are an Xfinity customer, it’s not important whether or not they notified you. Change your Xfinity password now. And if you are willing, consider using additional 2FA protection on your Xfinity account. Update your account security questions. And anything else that Xfinity reps suggest to you (if you call them).

If you want to call in about Xfinity’s 2023 data breach, start with this dedicated number: 888-799-2560. But that number may be swamped, and sometimes rings busy. If you cannot get that phoneline to work, try any other support number you may find on your Xfinity billing.


Even though Xfinity customers are quickly securing their accounts, this data breach will likely result in other hazards, down the road. Cybercriminals will study the stolen customer records to see how to use them creatively.

If I had to guess, I’d say we’ll see an uptick in bogus Xfinity phone calls, where scammers promise big discounts or collect money for receiver updates. They can repurpose the data from this breach, to make them sound more legitimate to their victims!

Credential Stuffing

The recent compromise of the Seesaw Learning website and app has a lot of people asking me: What is credential stuffing? It’s a good question to know the answer to. Once you get it, you will also know how to keep your online accounts safer.

How Credential Stuffing Works

It begins with cybercriminals attacking and hacking an online website or company. When they gain access, they steal the login info for as many accounts as they can, for that site. They’re looking for a list of email addresses, and the corresponding passwords that are used on that site.

While this starts with the hack of one company, the stuffing happens elsewhere. These thieves are counting on one common tech mistake: People tend to use the same password for all of their online accounts. So if they steal login info from one site, the crooks are hoping those credentials will work on other websites.

These cybercriminals actually have a bit of programming skill. They take their stolen credentials and write a program (bot) to try each email/password combination at the login screen of another website. If they’ve stolen 500 logins or a million, it doesn’t matter. They can set their bots to stuff all of those logins into various other websites, until they get lucky access with someone’s stolen credentials.

What You Need To Do

You cannot predict or prevent this kind of attack, because it is launched against the companies you use. You are not the initial target. But you can protect your other accounts from collateral damage. It’s very simple: Always use a different password with each account you create.

OK, maybe it’s not that simple to do, but it is simple to state. No one likes this advice, because passwords are such a tedious burden to most internet users. But if you can improve your habits and avoid password re-use, then credential stuffing attacks will not affect you as much as other people. If your password is stolen from one website, it will not do the crooks any good when they try to use it elsewhere!

Additionally, turning on 2FA can further protect your accounts against password theft. But not all sites offer 2FA. Using unique passwords remains the best defense.

Coping with Too Many Passwords

Maintaining unique passwords is about as fun as remembering to floss. But it could make a big difference someday. There’s always another big hack about to happen, and you’re going to wake up one morning to find that your bank or your favorite store is involved in the latest tech debacle. That awful cybercrime news won’t affect you as much, if you have good security practices in place.

As you set passwords to online accounts, your browser may recommend unique passwords, and offer to Save them for you. This is a solid tool and fairly reliable. And if you need to know a particular password, you can find it by going into your browser’s options menu and searching for the Passwords List. This is how I manage my 700+ passwords, in Google Chrome and Microsoft Edge.

You might also consider using a Password Manager program, and there are many of them out there. Some are free, some have an annual fee. LastPass, Roboform, Keepass and Bitwarden are some trustworthy password managers.

Using an Excel spreadsheet or a “little black book” is also acceptable. I see plenty of folks using these methods, and I don’t criticize it if it is working well for them.

Have I Been Pwned?

Data breaches are so frequent, that it’s quite likely your email or phone number has been involved in one. It’s usually not your fault. When hackers get through a big company’s security, they may take a copy of whatever valuable account data they can. That can include your name, email, phone number, password…

Even worse, many companies don’t report their data breaches. It would be considerate of them to do so, but they often don’t want to draw attention to their failure. Some examples: Facebook had a data breach not too long ago, where 500M+ user accounts were violated, and they don’t have any plans to notify those users. Apple was compromised in 2015, and they only discussed notifying the 128M affected customers. But they dropped the ball and never reached out to their end-users.

To help you know when your account info has been leaked or stolen, use the Have I Been Pwned website. Created and maintained by a respectable Microsoft employee, HIBP is a free resource that will tell you if your info has been compromised anywhere on the web. Simply enter an email address or a phone number. HIBP will then tell you in which data breaches that info was involved.

If/when you find out where your info was violated, HIBP will recommend the use of a password management program (1Password). You can try that or stick with another method of managing passwords, it’s up to you. What’s important is that you have a system where you use a unique password for each website you log into.

And once HIBP tells you of any companies and their relevant data breaches, go to those websites and CHANGE YOUR PASSWORD! Or, if you are sure you won’t use that website again, you might look for a way to close your account there.

Lastly, you can also subscribe on the HIBP website, to receive notifications of future data breaches involving you. If your email or phone number turns up in next month’s big data breach, HIBP will shoot you an email, even if the problem fails to make the morning news.

© 2024 BlueScreen Computer

Theme by Anders NorenUp ↑