Tag: breach
-
That breach cost HOW MUCH? How CISOs can talk effectively about a cyber incident’s toll
Tags: attack, breach, business, ciso, cyber, cybersecurity, data, email, incident, incident response, insurance, jobs, network, phone, ransomware, risk, risk-managementThe importance of practice in estimating costs: Quantifying the costs of an incident in advance is an inexact art greatly aided by tabletop exercises. “The best way in my mind to flush all of this out is by going through a regular incident response tabletop exercise,” Gary Brickhouse, CISO at GuidePoint Security, tells CSO. “People…
-
CISA Warns of Active Exploitation in GitHub Action Supply Chain Compromise
Tags: breach, cisa, cve, cybersecurity, exploit, flaw, github, infrastructure, kev, malicious, supply-chain, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a vulnerability linked to the supply chain compromise of the GitHub Action, tj-actions/changed-files, to its Known Exploited Vulnerabilities (KEV) catalog.The high-severity flaw, tracked as CVE-2025-30066 (CVSS score: 8.6), involves the breach of the GitHub Action to inject malicious code that enables a remote First…
-
Sperm donation giant California Cryobank warns of a data breach
US sperm donor giant California Cryobank is warning customers it suffered a data breach that exposed customers’ personal information. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sperm-donation-giant-california-cryobank-warns-of-a-data-breach/
-
US DOGE Staffer Sent Unencrypted Treasury Data over Email
Agency Official Says Ex-DOGE Staffer’s Data Breach Violated Security Policy. An ex-Department of Government Efficiency staffer violated Treasury rules by sending unencrypted personal data to two senior Trump administration officials without approval, raising concerns about the task force’s apparent disregard for or lack of knowledge about critical data security policies. First seen on govinfosecurity.com Jump…
-
GitHub Action hack likely led to another in cascading supply chain attack
A cascading supply chain attack that began with the compromise of the “reviewdog/action-setup@v1” GitHub Action is believed to have led to the recent breach of “tj-actions/changed-files” that leaked CI/CD secrets. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-action-hack-likely-led-to-another-in-cascading-supply-chain-attack/
-
Western Alliance Bank notifies 21,899 customers of data breach
Arizona-based Western Alliance Bank is notifying nearly 22,000 customers their personal information was stolen in October after a third-party vendor’s secure file transfer software was breached. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/western-alliance-bank-notifies-21-899-customers-of-data-breach/
-
Data breach hits California Cryobank
First seen on scworld.com Jump to article: www.scworld.com/brief/data-breach-hits-california-cryobank
-
Western Alliance Bank says nearly 22,000 impacted by file transfer software breach
Phoenix-based Western Alliance Bank filed data breach notices saying about 22,000 people were affected by an incident involving file transfer software. First seen on therecord.media Jump to article: therecord.media/western-alliance-bank-data-breach
-
Over 16.8 Billion Records Exposed as Data Breaches Increase 6%
Flashpoint data points to a surge in data breaches fueled by compromised credentials, ransomware and exploits First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/168-billion-records-exposed/
-
Western Alliance Bank Discloses Data Breach Linked to Cleo Hack
The personal information of 22,000 Western Alliance Bank customers was stolen in a data breach linked to Cl0p’s hacking of the Cleo file transfer tool. The post Western Alliance Bank Discloses Data Breach Linked to Cleo Hack appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/western-alliance-bank-discloses-data-breach-linked-to-cleo-hack/
-
Not all cuts are equal: Security budget choices disproportionately impact risk
Tags: ai, application-security, attack, awareness, backdoor, breach, bug-bounty, business, ceo, ciso, cloud, compliance, container, control, cyber, cybersecurity, data, iam, identity, incident response, infrastructure, monitoring, phishing, risk, risk-management, service, software, strategy, technology, threat, tool, training, update, usa, vulnerability[Source: Splunk] As cyber threats evolve at an unprecedented pace, delaying essential technology upgrades can severely impact an organization. The newest technological updates are introduced to enhance an organization’s security offerings and directly address recently identified challenges.”Outdated systems lack new features and functionality that allow for more sophisticated offerings, like moving to the cloud,” Kirsty…
-
Crypto exchange OKX shuts down tool used by North Korean hackers to launder stolen funds
OKX said it detected a coordinated effort by one of North Korea’s most prolific hacking outfits to misuse its decentralized finance (DeFi) services. First seen on therecord.media Jump to article: therecord.media/crypto-okx-shuts-down-exchange
-
Infosys Settles Data Breach Class Action Lawsuits for $17.5M
Ransomware Attack in 2023 Affected More Than 6 Million People. Indian IT services giant Infosys said its U.S. subsidiary Infosys McCamish Systems agreed to pay $17.5 million to settle six class action lawsuits related to a cybersecurity incident that compromised the personal information of more than 6 million people. First seen on govinfosecurity.com Jump to…
-
What Is Exposure Management and Why Does It Matter?
Tags: access, attack, breach, business, ciso, cloud, compliance, credentials, cve, cyber, cybersecurity, data, data-breach, group, identity, infrastructure, iot, metric, password, phishing, risk, service, software, technology, threat, tool, vulnerability, vulnerability-managementEach Monday, the Tenable Exposure Management Academy will provide the practical, real-world guidance you need to shift from vulnerability management to exposure management. In our first blog in this new series, we get you started with an overview of the differences between the two and explore how cyber exposure management can benefit your organization. Traditional…
-
FCC creates national security council to counter cyber threats from China
Tags: 5G, access, ai, attack, breach, china, communications, computing, cyber, cyberattack, cybersecurity, data, espionage, government, group, hacking, incident, infrastructure, Internet, microsoft, office, strategy, supply-chain, technology, threat, vulnerabilityThree-pronged strategy: The council will pursue a tripartite strategy focusing on reducing dependency, mitigating vulnerabilities, and ensuring American technological leadership.First, it aims to reduce American technology and telecommunications sectors’ trade and supply chain dependencies on foreign adversaries. This goal aligns with broader government efforts to “friend-shore” critical technology supply chains and decrease reliance on potentially…
-
Jaguar Land Rover Hit by HELLCAT Ransomware Using Stolen Jira Credentials
The HELLCAT ransomware group has claimed responsibility for a significant data breach at Jaguar Land Rover (JLR), exposing vast amounts of sensitive data including proprietary documents, source codes, employee information, and partner details. This attack follows a pattern previously observed against prominent companies like Telefónica, Schneider Electric, and Orange, highlighting the group’s reliance on exploiting…
-
AI development pipeline attacks expand CISOs’ software supply chain risk
Tags: access, ai, api, application-security, attack, backdoor, breach, business, ciso, cloud, container, control, cyber, cybersecurity, data, data-breach, detection, encryption, exploit, flaw, fortinet, government, infrastructure, injection, intelligence, LLM, malicious, malware, ml, network, open-source, password, penetration-testing, programming, pypi, risk, risk-assessment, russia, saas, sbom, service, software, supply-chain, threat, tool, training, vpn, vulnerabilitydevelopment pipelines are exacerbating software supply chain security problems.Incidents of exposed development secrets via publicly accessible, open-source packages rose 12% last year compared to 2023, according to ReversingLabs (RL).A scan of 30 of the most popular open-source packages found an average of six critical-severity and 33 high-severity flaws per package.Commercial software packages are also a…
-
South African Department of Defence Denies Stolen Data Claims
Attackers leaked 1.6TB of stolen data, which government officials dismissed as fake news. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/south-african-department-of-defence-denies-stolen-data-claims
-
Kroll’s Crypto Breach Highlights SIM-Swapping Risk
Information was exposed on hundreds of crypto-related bankruptcy claimants in proceedings involving FTX, Genesis, and BlockFI. First seen on darkreading.com Jump to article: www.darkreading.com/remote-workforce/kroll-cryoto-breach-sim-swapping-risk
-
7 misconceptions about the CISO role
Tags: api, attack, breach, business, ceo, ciso, compliance, control, corporate, cyber, cyberattack, cybersecurity, defense, exploit, finance, firewall, governance, infrastructure, insurance, jobs, network, password, phishing, resilience, risk, risk-assessment, risk-management, saas, software, startup, strategy, technology, threat, tool, training, update, vulnerabilityKatie Jenkins, EVP and CISO, Liberty Mutual Insurance Liberty Mutual InsuranceThe field is changing so rapidly, Jenkins adds, she needs to commit time to keeping up on research and connecting with other CISOs for knowledge exchange.In addition to securing infrastructure, an effective CISO focuses on securing the business, experts say. This requires understanding how security…
-
What are the best practices for managing NHIs with dynamic cloud resources?
Why Is Management of NHIs Integral for Dynamic Cloud Resources? How often have we heard about data leaks and security breaches? The frequency of such incidents highlights the pressing need for robust security measures. One such measure that often goes overlooked is the management of Non-Human Identities (NHIs), a critical component of cloud security. New……
-
Breaches Often Start Where You Least Expect – Grip Security
Major breaches don’t start with hackers”, they start with overlooked security gaps. Learn how to find and fix SaaS blind spots before they become attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/breaches-often-start-where-you-least-expect-grip-security/
-
Invisible C2″Š”, “Šthanks to AI-powered techniques
Tags: ai, api, attack, breach, business, chatgpt, cloud, communications, control, cyberattack, cybersecurity, data, defense, detection, dns, edr, email, encryption, endpoint, hacker, iot, LLM, malicious, malware, ml, monitoring, network, office, openai, powershell, service, siem, soc, strategy, threat, tool, update, vulnerability, zero-trustInvisible C2″Š”, “Šthanks to AI-powered techniques Just about every cyberattack needs a Command and Control (C2) channel”Š”, “Ša way for attackers to send instructions to compromised systems and receive stolen data. This gives us all a chance to see attacks that are putting us at risk. LLMs can help attackers avoid signature based detection Traditionally, C2…
-
Insurer Notifying 335,500 Customers, Agents, Others of Hack
Texas Incident is Largest Breach Reported by a Health Plan So Far in 2025. A Texas-based insurance firm is notifying more than 335,500 people of a December hack involving their sensitive personal and health information. The breach affects many – but not all – of the company’s policyholders, agents and insurance carrier partners in multiple…
-
Appellate court upholds sentence for former Uber cyber executive Joe Sullivan
A federal three-judge panel in California upheld the sentence former Uber executive Joe Sullivan received after being convicted in an attempted coverup of a 2016 data breach at the company. First seen on therecord.media Jump to article: therecord.media/joe-sullivan-former-uber-executive-conviction-upheld
-
Ransomware gang creates tool to automate VPN brute-force attacks
The Black Basta ransomware operation created an automated brute-forcing framework dubbed ‘BRUTED’ to breach edge networking devices like firewalls and VPNs. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/black-basta-ransomware-creates-automated-tool-to-brute-force-vpns/