Tag: data-breach
-
Don’t confuse asset inventory with exposure management
Tags: access, ai, api, attack, breach, business, chatgpt, cloud, compliance, control, credentials, cyber, cybersecurity, data, data-breach, detection, endpoint, flaw, framework, governance, government, identity, infrastructure, intelligence, Internet, leak, least-privilege, metric, mfa, monitoring, network, regulation, risk, saas, service, software, threat, tool, update, vulnerability, vulnerability-managementAsset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can’t connect vulnerabilities, identities, misconfigurations, and AI systems into real attack paths, you don’t have exposure management. You have inventory. Key takeaways True exposure management requires more than asset inventory. It’s about merging…
-
Security Affairs newsletter Round 567 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Starbucks data breach impacts 889 employees Storm-2561 lures victims to spoofed VPN sites to harvest corporate…
-
A Hacker Accidentally Broke Into the FBI’s Epstein Files
Plus: A porn-quitting app exposed the masturbation habits of hundreds of thousands of users, Russian hackers are trying to take over people’s Signal accounts, and more. First seen on wired.com Jump to article: www.wired.com/story/security-news-this-week-a-hacker-accidentally-broke-into-the-fbis-epstein-files/
-
An AI Agent Didn’t Hack McKinsey. Its Exposed APIs Did.
This week’s McKinsey incident should be a wake-up call for every enterprise moving fast to deploy AI. Not because AI itself is inherently insecure. But because too many organizations are still thinking about AI security at the model layer, while the real enterprise risk sits in the action layer: the APIs, MCP servers, internal services,…
-
AiLock Ransomware Claims England Hockey Data Breach
England Hockey is investigating a potential cyberattack claimed by the AiLock ransomware group. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/ailock-ransomware-claims-england-hockey-data-breach/
-
Starbucks HR Portal Breach Exposes Employee Information
A phishing attack on Starbucks’ HR portal exposed sensitive data for hundreds of employees. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/starbucks-hr-portal-breach-exposes-employee-information/
-
Autonomous Agent Hacked McKinsey’s AI in 2 Hours
Cybersecurity Startup Exposed Lilli Using a Flaw as Old as the Web. Security startup CodeWall disclosed this week that its autonomous AI agent breached McKinsey’s internal AI platform Lilli in two hours on Feb. 28, accessing tens of millions of messages and hundreds of thousands of files through a basic, years-old database flaw. First seen…
-
Autonomous Agent Hacked McKinsey’s AI in 2 Hours
Cybersecurity Startup Exposed Lilli Using a Flaw as Old as the Web. Security startup CodeWall disclosed this week that its autonomous AI agent breached McKinsey’s internal AI platform Lilli in two hours on Feb. 28, accessing tens of millions of messages and hundreds of thousands of files through a basic, years-old database flaw. First seen…
-
US Agencies Face CISA Deadline Over Critical Cisco SD-WAN Flaw
US agencies race to meet a CISA deadline after a critical Cisco SD-WAN Flaw exposed federal networks to long-term intrusion and forced security action. First seen on hackread.com Jump to article: hackread.com/us-agencies-cisa-deadline-critical-cisco-sd-wan-flaw/
-
Starbucks Data Breach Exposes Personal Data of Hundreds of Users
Starbucks Corporation recently disclosed a targeted cybersecurity incident that compromised the personal and financial information of 889 individuals. This internal platform is utilized by the company to manage human resources, employee benefits, and payroll details. While the number of impacted users represents a small fraction of the company’s global workforce, the highly sensitive nature of…
-
Hybrid resilience: Designing incident response across on-prem, cloud and SaaS without losing your mind
Tags: access, authentication, business, cloud, communications, data, data-breach, group, identity, incident response, metric, mitigation, network, radius, resilience, saas, service, strategy, technology, updateSeverity is driven by customer impact, not by who is pagedWe maintain one current hypothesis, even if it is wrongWe keep one shared timeline that captures decisions, not just symptomsWe communicate on a predictable cadence, even when answers are incompleteEvery action has a named owner and an explicit “time we expect to learn”The biggest behavior…
-
Hybrid resilience: Designing incident response across on-prem, cloud and SaaS without losing your mind
Tags: access, authentication, business, cloud, communications, data, data-breach, group, identity, incident response, metric, mitigation, network, radius, resilience, saas, service, strategy, technology, updateSeverity is driven by customer impact, not by who is pagedWe maintain one current hypothesis, even if it is wrongWe keep one shared timeline that captures decisions, not just symptomsWe communicate on a predictable cadence, even when answers are incompleteEvery action has a named owner and an explicit “time we expect to learn”The biggest behavior…
-
Starbucks discloses data breach affecting hundreds of employees
Starbucks has disclosed a data breach affecting hundreds of employees after threat actors gained access to their Starbucks Partner Central accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/starbucks-discloses-data-breach-affecting-hundreds-of-employees/
-
Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Full Root Takeover
A newly disclosed set of nine vulnerabilities, dubbed >>CrackArmor,<< has exposed a critical flaw in AppArmor, a foundational Linux security module. AppArmor serves as the default mandatory access control system for Ubuntu, Debian, SUSE, and numerous cloud platforms, this flaw allows unprivileged local users to bypass container isolation and gain full root control over compromised…
-
The cyber perimeter was never dead. We just abandoned it.
Tags: access, advisory, authentication, awareness, backup, cisa, ciso, cloud, control, cyber, cybersecurity, data-breach, email, exploit, firewall, flaw, governance, government, Hardware, identity, infrastructure, Internet, resilience, risk, router, rust, service, software, strategy, technology, update, zero-trustIndustry has comforted itself with the idea that the perimeter is dead. It is not. What happened is far worse. We ignored the edge, let unsupported hardware decay in place, and effectively donated our perimeter to adversaries who were more than willing to accept it.The FBI’s Winter SHIELD effort is the operational side of the…
-
The cyber perimeter was never dead. We just abandoned it.
Tags: access, advisory, authentication, awareness, backup, cisa, ciso, cloud, control, cyber, cybersecurity, data-breach, email, exploit, firewall, flaw, governance, government, Hardware, identity, infrastructure, Internet, resilience, risk, router, rust, service, software, strategy, technology, update, zero-trustIndustry has comforted itself with the idea that the perimeter is dead. It is not. What happened is far worse. We ignored the edge, let unsupported hardware decay in place, and effectively donated our perimeter to adversaries who were more than willing to accept it.The FBI’s Winter SHIELD effort is the operational side of the…
-
The cyber perimeter was never dead. We just abandoned it.
Tags: access, advisory, authentication, awareness, backup, cisa, ciso, cloud, control, cyber, cybersecurity, data-breach, email, exploit, firewall, flaw, governance, government, Hardware, identity, infrastructure, Internet, resilience, risk, router, rust, service, software, strategy, technology, update, zero-trustIndustry has comforted itself with the idea that the perimeter is dead. It is not. What happened is far worse. We ignored the edge, let unsupported hardware decay in place, and effectively donated our perimeter to adversaries who were more than willing to accept it.The FBI’s Winter SHIELD effort is the operational side of the…
-
The cyber perimeter was never dead. We just abandoned it.
Tags: access, advisory, authentication, awareness, backup, cisa, ciso, cloud, control, cyber, cybersecurity, data-breach, email, exploit, firewall, flaw, governance, government, Hardware, identity, infrastructure, Internet, resilience, risk, router, rust, service, software, strategy, technology, update, zero-trustIndustry has comforted itself with the idea that the perimeter is dead. It is not. What happened is far worse. We ignored the edge, let unsupported hardware decay in place, and effectively donated our perimeter to adversaries who were more than willing to accept it.The FBI’s Winter SHIELD effort is the operational side of the…
-
The cyber perimeter was never dead. We just abandoned it.
Tags: access, advisory, authentication, awareness, backup, cisa, ciso, cloud, control, cyber, cybersecurity, data-breach, email, exploit, firewall, flaw, governance, government, Hardware, identity, infrastructure, Internet, resilience, risk, router, rust, service, software, strategy, technology, update, zero-trustIndustry has comforted itself with the idea that the perimeter is dead. It is not. What happened is far worse. We ignored the edge, let unsupported hardware decay in place, and effectively donated our perimeter to adversaries who were more than willing to accept it.The FBI’s Winter SHIELD effort is the operational side of the…
-
Im Visier der Hacker: Welche Branchen am stärksten gefährdet sind
Die Sektoren Technologie, Bildung und E-Commerce waren über einen Zeitraum von drei Jahren am stärksten von Datenlecks betroffen. In diesem Zeitraum sind bei fast 10.000 größeren Vorfällen mehr als 7,8 Milliarden E-Mail-Datensätze offengelegt worden. Eine Analyse der Datenlecks ergab, dass 90 % der Lecks E-Mail-Adressen enthielten, 32 % Zugangsdaten und 12,3 % sensible staatliche… First…
-
Canadian retail giant Loblaw notifies customers of data breach
Still, out of an abundance of caution, Loblaw says it has automatically logged out all customers from their accounts. Account holders who need to access the company’s digital services will have to log in again. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/canadian-retail-giant-loblaw-notifies-customers-of-data-breach/
-
England Hockey investigating ransomware data breach
England Hockey, the governing body for field hockey in England, is investigating a potential data breach after the AiLock ransomware gang listed it as a victim on its data leak site. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/england-hockey-investigating-ransomware-data-breach/
-
Enzoic Expands Protection Against Dark Web Credential Exposure
Credentials exposed in breach data can create risk long after the original incident. Once those passwords circulate through underground marketplaces, they can be reused to target enterprise systems and customer accounts. According to the Verizon Data Breach Investigations Report, stolen credentials play a major role in web application breaches. Attackers frequently automate credential stuffing and……
-
400K WordPress Sites Exposed by Elementor Ally Plugin SQL Flaw
A SQL injection flaw in the Elementor Ally plugin exposes over 400,000 WordPress sites to potential data theft. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/400k-wordpress-sites-exposed-by-elementor-ally-plugin-sql-flaw/