Hacking and Risk - Cyber Security Informer

U.S. Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason”

Krebs on Security

FEBRUARY 26, 2025

government officials searched online for non-extradition countries and for an answer to the question “can hacking be treason?” Days after he apparently finished communicating with Country-1s military intelligence service, Wagenius Googled, ‘can hacking be treason.'” million customers. .”

Hacking

Hacking Government Identity Theft Accountability

From Risk Assessment to Action: Improving Your DLP Response

Security Affairs

OCTOBER 25, 2024

DLP is key in cybersecurity; a risk assessment identifies data risks, helping turn findings into real-world security improvements. So, how can you conduct a DLP risk assessment? What is a DLP Risk Assessment? Why Conduct a DLP Risk Assessment? Protecting sensitive data is what cybersecurity is all about.

Risk

Risk Cybersecurity Data breaches Cyber threats

Customs and Border Protection Confirms Its Use of Hacked Signal Clone TeleMessage

WIRED Threat Level

MAY 7, 2025

CBP says it has disabled its use of TeleMessage following reports that the app, which has not cleared the US governments risk assessment program, was hacked.

Hacking

Hacking Government Risk

On the Catastrophic Risk of AI

Schneier on Security

JUNE 1, 2023

Earlier this week, I signed on to a short group statement , coordinated by the Center for AI Safety: Mitigating the risk of extinction from AI should be a global priority alongside other societal-scale risks such as pandemics and nuclear war. Poses ‘Risk of Extinction,’ Industry Leaders Warn.”

Risk

Risk Artificial Intelligence Technology Internet

Digital nomads and risk associated with the threat of infiltred employees

Security Affairs

MARCH 4, 2025

Companies face the risk of insider threats, worsened by remote work. The insider threat, or the risk that an employee could harm the company, is a growing concern. The insider threat, or the risk that an employee could harm the company, is a growing concern. North Korean hackers infiltrate firms via fake IT hires, stealing data.

Risk

Risk Education Scams VPN

Massive Oracle Cloud Breach: 6M Records Exposed, 140k+ Tenants Risked

eSecurity Planet

MARCH 24, 2025

A sophisticated supply chain hack targeting Oracle Cloud has exfiltrated a staggering 6 million records. The initial access was gained by hacking the login endpoint (login.(region-name).oraclecloud.com), Beyond mass data exposure, there are heightened risks of credential compromise, corporate espionage, and potential extortion.

Risk

Risk Passwords Hacking Encryption

AI in the Cloud: The Rising Tide of Security and Privacy Risks

Security Affairs

MAY 16, 2025

Over half of firms adopted AI in 2024, but cloud tools like Azure OpenAI raise growing concerns over data security and privacy risks. While these tools deliver clear productivity gains, they also expose businesses to complex new risks, particularly around data security and privacy. While valuable, these efforts are not enough.

Risk

Risk Artificial Intelligence Government Hacking

FBI arrested former Disney World employee for hacking computer menus and mislabeling allergy info

Security Affairs

NOVEMBER 2, 2024

A former Disney World employee hacked servers after being fired, altering prices, adding profanities, and mislabeling allergy info. A former Walt Disney World employee hacked servers after being fired by the company. He is accused of changing prices, adding profanities, and falsely labeling items as allergy-safe.

Hacking

Hacking Risk Cybercrime Information Security

Ô! China Hacks Canada too, Says CCCS

Security Boulevard

NOVEMBER 1, 2024

China Hacks Canada too, Says CCCS appeared first on Security Boulevard. Plus brillants exploits: Canadian Centre for Cyber Security fingers Chinese state sponsored hackers. The post Ô!

Hacking

Hacking Social Engineering Cyber Attacks Data privacy

Mazda Connect flaws allow to hack some Mazda vehicles

Security Affairs

NOVEMBER 9, 2024

CVE-2024-8357 : Lack of root of trust in App SoC, risking persistent attacker control by bypassing boot security checks. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, Mazda Connect) ” concludes the report.

Hacking

Hacking Firmware Software Manufacturing

U.S. agency cautions employees to limit phone use due to Salt Typhoon hack of telco providers

Security Affairs

NOVEMBER 10, 2024

US CFPB warns employees to avoid work-related mobile calls and texts following China-linked Salt Typhoon hack over security concerns. The hacking campaign, called Salt Typhoon by investigators, hasn’t previously been publicly disclosed and is the latest in a series of incursions that U.S. and its allies for hacking activities in July.

Hacking

Hacking Internet Internet Government

Elon Musk ’s DOGE team granted ‘full access’ to sensitive Treasury systems. What are the risks?

Security Affairs

FEBRUARY 3, 2025

Ron Wyden warns of national security risks after Elon Musk s DOGE was given full access to sensitive Treasury systems. Ron Wyden warned of national security risks after Elon Musk s team, Department of Government Efficiency (DOGE), was granted full access to a sensitive U.S. Treasury payments system poses significant risks.

Risk

Risk Surveillance Cyber threats Marketing

LW ROUNDTABLE — How 2024’s cyber threats will transform the security landscape in 2025

The Last Watchdog

DECEMBER 16, 2024

Meanwhile, while business logic hacks, supply chain holes, and cyber extortion continue to loom large. Businesses must adopt tools and automation capable of invoking immediate action, even at the risk of false positives. Raising security baselines across industries is essential, with risk mitigationnot acceptancebecoming the standard.

Cyber threats

Cyber threats CISO IoT Phishing

Attackers could hack smart solar systems and cause serious damages

Security Affairs

FEBRUARY 28, 2025

Hackers reveal security flaws in smart solar systems, exposing risks to national power grids as global reliance on solar energy grows. DW investigated the risks of cyber attacks exploiting vulnerabilities in smart solar systems while the demand for solar energy grows.

Hacking

Hacking Passwords Risk Cyber threats

Schneider Electric Confirms Ransom Hack — Hellcat Demands French Bread as ‘Joke’

Security Boulevard

NOVEMBER 6, 2024

The post Schneider Electric Confirms Ransom Hack — Hellcat Demands French Bread as ‘Joke’ appeared first on Security Boulevard. That’s a lot of pain: $125,000 ransom seems small—but why do the scrotes want it paid in baguettes?

Hacking

Hacking Cryptocurrency Data privacy Risk

WhatsApp hack: Meta wins payout over NSO Group spyware

Malwarebytes

MAY 8, 2025

Google has an advanced protection program for people like this, while Apple launched lockdown mode for high-risk users. We dont just report on phone securitywe provide it Cybersecurity risks should never spread beyond a headline. Facebook has its own initiative.

Spyware

Spyware Hacking Surveillance Government

LW ROUNDTABLE: Wrist slap or cultural shift? SEC fines cyber firms for disclosure violations

The Last Watchdog

NOVEMBER 12, 2024

Security and Exchange Commission (SEC) recently laid down the hammer charging and fining four prominent cybersecurity vendors for making misleading claims in connection with the SolarWinds hack. But the SEC’s latest actions underscore that failing to inform stakeholders about material risks and breaches is not an option.

CISO

CISO CSO Risk Cyber threats

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

Krebs on Security

DECEMBER 13, 2022

. “InfraGard connects critical infrastructure owners, operators, and stakeholders with the FBI to provide education, networking, and information-sharing on security threats and risks,” the FBI’s InfraGard fact sheet reads.

Hacking

Hacking Energy and Utilities Cybercrime Accountability

Bybit Hack: $1.46 Billion Crypto Heist Points to North Korea's Lazarus Group

SecureWorld News

FEBRUARY 26, 2025

Well-known crypto researcher ZachXBT reached the same conclusion as Elliptic, sharing his analysis on X: Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents. Farronato further emphasized that immediate and decisive action is necessary.

Hacking

Hacking Cryptocurrency Cyber threats Malware

SEC fined 4 companies for misleading disclosures about the impact of the SolarWinds attack

Security Affairs

OCTOBER 23, 2024

The SEC fined Unisys, Avaya, Check Point, and Mimecast for misleading disclosures about the impact of the SolarWinds Orion hack. In two of these cases, the relevant cybersecurity risk factors were framed hypothetically or generically when the companies knew the warned of risks had already materialized.

Hacking

Hacking Risk Cybersecurity Government

The Turmoil Following BreachForums Shutdown: Confusion, Risks, and a New Beginning

Security Affairs

APRIL 28, 2025

In the aftermath, several alternative forums emerged, some demanded entry fees, fueling confusion and raising the risk of scams or government-run honeypots. It served as a marketplace for threat actors to buy and sell stolen data, hacking tools, and compromised credentials.

Risk

Risk Hacking Cybercrime Scams

Experts found rogue devices, including hidden cellular radios, in Chinese-made power inverters used worldwide

Security Affairs

MAY 18, 2025

The DOE said it assesses risks but faces challenges due to manufacturers’ poor disclosure. The DOE said it assesses risks, but faces challenges due to manufacturers’ poor disclosure. The US grid was successfully hacked in November by hackers belonging to foreign governments.

Energy and Utilities

Energy and Utilities Manufacturing Government Hacking

The Biggest Cybersecurity Risk We're Ignoring—And No, It's Not AI

SecureWorld News

FEBRUARY 28, 2025

But amidst all these flashy, futuristic threats, the biggest cybersecurity risk remains the same as it's always beenhumans. it's WAY easier to hack minds than networks. The elephant in the (server) room We've all seen the headlines: AI is taking over, deepfakes are fooling the masses, quantum computing will break encryption!

Cybersecurity

Cybersecurity Risk Social Engineering Phishing

Simson Garfinkel on Spooky Cryptographic Action at a Distance

Schneier on Security

OCTOBER 30, 2024

And because that administrator account can do anything to that server—read the sensitivity data, hack the web server to install malware on people who visit its web pages, or anything else I might care to do—the private key on my laptop represents a security risk for that server. This is true entanglement! Read it all.

Accountability

Accountability Risk Malware Hacking

Arkana Security group claims the hack of US telco provider WideOpenWest (WOW!)

Security Affairs

MARCH 27, 2025

The new ransomware group Arkana Security claims to have hacked US telecom provider WOW!, The Arkana group recently appeared in the threat landscape, claiming to perform post-pentest services, and offering data security, and risk management services. stealing customer data. WideOpenWest (WOW!) million accounts. ” WOW!

Hacking

Hacking Telecommunications Data breaches Internet

SEC Fines Four Companies $7M for Misleading Cybersecurity Disclosures

SecureWorld News

OCTOBER 23, 2024

Securities and Exchange Commission (SEC) announced Tuesday that it has fined four companies $7 million for misleading statements about their cybersecurity incidents, particularly concerning the high-profile 2019 SolarWinds hack. The SEC charged the companies with "materially misleading disclosures regarding cybersecurity risks and intrusions."

Cybersecurity

Cybersecurity Risk Hacking Software

EDR-as-a-Service makes the headlines in the cybercrime landscape

Security Affairs

APRIL 7, 2025

With the help of these documents, even inexperienced operators with limited hacking skills can quickly acquire the necessary expertise to successfully forward counterfeit EDRs. These EDRs, representing the official cooperation channels between law enforcement agencies and social media platforms, are at risk of becoming a double-edged sword.

Cybercrime

Cybercrime Social Engineering Accountability Government

US Treasury Department sanctioned Chinese cybersecurity firm linked to Flax Typhoon APT

Security Affairs

JANUARY 4, 2025

“ Flax Typhoon is a China-linked hacking group that has been active since 2021, it targets critical infrastructure globally, exploiting vulnerabilities for persistent access. According to OFAC, between 2022 and 2023, Flax Typhoon hacked U.S. critical infrastructure sectors.“

Cybersecurity

Cybersecurity IoT Hacking Technology

How Interlock Ransomware Affects the Defense Industrial Base Supply Chain

Security Affairs

MAY 13, 2025

Interlock Ransomware ‘s attack on a defense contractor exposed global defense supply chain details, risking operations of top contractors and their clients. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking,Interlock Ransomware)

Ransomware

Ransomware Cyber Attacks Risk Hacking

CISA’s 11-Month extension ensures continuity of MITRE’s CVE Program

Security Affairs

APRIL 16, 2025

-funded CVE program, a core cybersecurity tool for tracking vulnerabilities, faces funding expiry Wednesday, risking disruption to global security. government funding for MITRE s CVE program , a key global cybersecurity resource for cataloging vulnerabilities, is set to expire Wednesday, risking disruption.

Government

Government Risk Cybersecurity Media

Synology fixed critical flaw impacting millions of DiskStation and BeePhotos NAS devices

Security Affairs

NOVEMBER 6, 2024

Security researcher Rick de Jager demonstrated the vulner ability, called RISK:STATION by cybersecurity firm Midnight Blue, at the Pwn2Own Ireland 2024 hacking contest. Synology quickly addressed the vulnerability within 48 hours after notification, but, given the risk, urged users to apply updates immediately.

Firmware

Firmware Manufacturing Hacking Media

Online food ordering and delivery platform GrubHub discloses a data breach

Security Affairs

FEBRUARY 4, 2025

Then GrubHub locked out the attackers and removed the hacked account. The unauthorized party also accessed hashed passwords for certain legacy systems, and we proactively rotated any passwords that we believed might have been at risk. ” reads a notice of data breach published by the company on its website.

Data breaches

Data breaches Passwords Accountability Hacking

VMware fixed a flaw in Avi Load Balancer

Security Affairs

JANUARY 28, 2025

VMware fixed a high-risk blind SQL injection vulnerability in Avi Load Balancer, allowing attackers to exploit databases via crafted queries. Follow me on Twitter: @securityaffairs and Facebook and Mastodon PierluigiPaganini ( SecurityAffairs hacking,Avi Load Balancer) ” reads the advisory. with security patches now available.

Risk

Risk Hacking Software Information Security

News alert: INE Security shares cyber hygiene guidance for small- and medium-sized businesses

The Last Watchdog

OCTOBER 23, 2024

As small businesses increasingly depend on digital technologies to operate and grow, the risks associated with cyber threats also escalate. LastPass reports that 80% of all hacking-related breaches leveraged either stolen and/or weak passwords. Cary, NC, Oct.

Small Business

Small Business Data breaches Backups Passwords

Security Affairs newsletter Round 494 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

OCTOBER 20, 2024

CISA adds Fortinet products and Ivanti CSA bugs to its Known Exploited Vulnerabilities catalog Nation-state actor exploited three Ivanti CSA zero-days Dutch police dismantled dual dark web market ‘Bohemia/Cannabia’ macOS HM Surf flaw in TCC allows bypass Safari privacy settings Iran-linked actors target critical infrastructure organizations (..)

Data breaches

Data breaches Cybercrime Cyber Insurance Marketing

U.S. CISA adds Microsoft Outlook, Sophos XG Firewall, and other flaws to its Known Exploited Vulnerabilities catalog

Security Affairs

FEBRUARY 6, 2025

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. The vulnerability CVE-2020-15069 (CVSS score of 9.8)

Firewall

Firewall Hacking Cybersecurity Risk

U.S. CISA adds ScienceLogic SL1 flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

OCTOBER 22, 2024

“ According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Encryption

Encryption Hacking Accountability Cybersecurity

U.S. CISA adds CyberPanel flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

DECEMBER 6, 2024

The vulnerability was exploited in a large-scale hacking campaign that targeted more than 22,000 CyberPanel instances. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking,CISA Known Exploited Vulnerabilities catalog ) . “getresetstatus in dns/views.py and ftp/views.py

DNS

DNS Authentication Ransomware Hacking

Akira ransomware gang used an unsecured webcam to bypass EDR

Security Affairs

MARCH 8, 2025

The Akira ransomware attack reveals the risks of overlooked IoT devices, evolving cyber threats, and EDR limitations. ” The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate.

Ransomware

Ransomware IoT Encryption Passwords

A 7-Zip bug allows to bypass the Mark of the Web (MotW) feature

Security Affairs

JANUARY 22, 2025

It helps mitigate security risks by flagging these files for restricted execution. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking,MotW) The 7-Zip users should install the latest version as soon as possible.

Software

Software Internet Internet Hacking

FBI warns of malicious free online document converters spreading malware

Security Affairs

MARCH 24, 2025

The FBI Denver Field Office advises staying cautious online, being aware of potential risks, and keeping antivirus software updated to scan files before opening them. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking, free online document converters)

Malware

Malware Scams Identity Theft Antivirus

Security Affairs newsletter Round 496 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

NOVEMBER 3, 2024

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Cryptocurrency

Cryptocurrency Hacking Phishing Cyber Attacks

U.S. CISA adds Array Networks AG and vxAG ArrayOS flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

NOVEMBER 26, 2024

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. The product could then be exploited through a vulnerable URL.”

VPN

VPN Authentication Hacking Cybersecurity

Why DSPM is Essential for Achieving Data Privacy in 2024

Security Affairs

OCTOBER 23, 2024

It becomes increasingly difficult to gain complete visibility or transparency that could help security and privacy teams discover sensitive data, identify its security and compliance postures, and mitigate risks. To add to the difficulty, the advent of Generative AI (GenAI) has brought unprecedented security and privacy risks.

Data privacy

Data privacy Unstructured Data Risk Data breaches

U.S. Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason”

From Risk Assessment to Action: Improving Your DLP Response

Trending Sources

Customs and Border Protection Confirms Its Use of Hacked Signal Clone TeleMessage

On the Catastrophic Risk of AI

Digital nomads and risk associated with the threat of infiltred employees

Massive Oracle Cloud Breach: 6M Records Exposed, 140k+ Tenants Risked

AI in the Cloud: The Rising Tide of Security and Privacy Risks

FBI arrested former Disney World employee for hacking computer menus and mislabeling allergy info

Ô! China Hacks Canada too, Says CCCS

Mazda Connect flaws allow to hack some Mazda vehicles

U.S. agency cautions employees to limit phone use due to Salt Typhoon hack of telco providers

Elon Musk ’s DOGE team granted ‘full access’ to sensitive Treasury systems. What are the risks?

LW ROUNDTABLE — How 2024’s cyber threats will transform the security landscape in 2025

Attackers could hack smart solar systems and cause serious damages

Schneider Electric Confirms Ransom Hack — Hellcat Demands French Bread as ‘Joke’

WhatsApp hack: Meta wins payout over NSO Group spyware

LW ROUNDTABLE: Wrist slap or cultural shift? SEC fines cyber firms for disclosure violations

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

Bybit Hack: $1.46 Billion Crypto Heist Points to North Korea's Lazarus Group

SEC fined 4 companies for misleading disclosures about the impact of the SolarWinds attack

The Turmoil Following BreachForums Shutdown: Confusion, Risks, and a New Beginning

Experts found rogue devices, including hidden cellular radios, in Chinese-made power inverters used worldwide

The Biggest Cybersecurity Risk We're Ignoring—And No, It's Not AI

Simson Garfinkel on Spooky Cryptographic Action at a Distance

Arkana Security group claims the hack of US telco provider WideOpenWest (WOW!)

SEC Fines Four Companies $7M for Misleading Cybersecurity Disclosures

EDR-as-a-Service makes the headlines in the cybercrime landscape

US Treasury Department sanctioned Chinese cybersecurity firm linked to Flax Typhoon APT

How Interlock Ransomware Affects the Defense Industrial Base Supply Chain

CISA’s 11-Month extension ensures continuity of MITRE’s CVE Program

Synology fixed critical flaw impacting millions of DiskStation and BeePhotos NAS devices

Online food ordering and delivery platform GrubHub discloses a data breach

VMware fixed a flaw in Avi Load Balancer

News alert: INE Security shares cyber hygiene guidance for small- and medium-sized businesses

Security Affairs newsletter Round 494 by Pierluigi Paganini – INTERNATIONAL EDITION

U.S. CISA adds Microsoft Outlook, Sophos XG Firewall, and other flaws to its Known Exploited Vulnerabilities catalog

U.S. CISA adds ScienceLogic SL1 flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA adds CyberPanel flaw to its Known Exploited Vulnerabilities catalog

Akira ransomware gang used an unsecured webcam to bypass EDR

A 7-Zip bug allows to bypass the Mark of the Web (MotW) feature

FBI warns of malicious free online document converters spreading malware

Security Affairs newsletter Round 496 by Pierluigi Paganini – INTERNATIONAL EDITION

U.S. CISA adds Array Networks AG and vxAG ArrayOS flaw to its Known Exploited Vulnerabilities catalog

Why DSPM is Essential for Achieving Data Privacy in 2024

Stay Connected