Tag: data
-
Everest ransomware gang said to be sitting on mountain of Under Armour data
Have I Been Pwned reckons 72.7M customer accounts affected, sportswear firm remains silent First seen on theregister.com Jump to article: www.theregister.com/2026/01/21/under_armour_everest/
-
When Data Leaks Don’t Look Like Breaches: The Instagram Exposure Explained
A recent disclosure revealed that data associated with more than 17.5 million Instagram accounts was exposed through a large-scale data leak, with records reportedly including user IDs, contact details, and account metadata, according to CyberPress. While no direct breach of Instagram’s core infrastructure has been publicly confirmed, the exposed dataset highlights a persistent challenge for…
-
New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization
Boston, MA, USA, 21st January 2026, CyberNewsWire First seen on hackread.com Jump to article: hackread.com/new-research-exposes-critical-gap-64-of-third-party-applications-access-sensitive-data-without-authorization/
-
Magecart Hack Injects JavaScript to Steal Online Payment Data
A new Magecart-style campaign is actively targeting e-commerce websites by injecting malicious JavaScript that intercepts and exfiltrates payment card data during checkout. The malicious script was hosted at cc-analytics[.]com/app.js and discovered on compromised e-commerce sites through script injection. The code employs heavy obfuscation using hex encoding and base conversion functions to evade detection. Security researchers…
-
New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization
Boston, MA, USA, 21st January 2026, CyberNewsWire First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/new-research-exposes-critical-gap-64-of-third-party-applications-access-sensitive-data-without-authorization/
-
Vulnerability prioritization beyond the CVSS number
Tags: automation, container, credentials, cve, cvss, data, docker, endpoint, flaw, github, identity, network, open-source, risk, service, update, vulnerability, vulnerability-managementA different way to look at vulnerabilities: This is where the unified linkage model (ULM) comes in. Instead of asking, “How bad is this vulnerability on its own?” ULM asks, “What can this vulnerability affect once it starts moving?”It focuses on three kinds of relationships:Adjacency: Systems that sit side by side and can influence each…
-
Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs
Security vulnerabilities were uncovered in the popular open-source artificial intelligence (AI) framework Chainlit that could allow attackers to steal sensitive data, which may allow for lateral movement within a susceptible organization.Zafran Security said the high-severity flaws, collectively dubbed ChainLeak, could be abused to leak cloud environment API keys and steal sensitive files, or First seen…
-
13 cyber questions to better vet IT vendors and reduce third-party risk
Tags: access, api, attack, authentication, automation, best-practice, breach, business, ceo, ciso, cloud, compliance, control, credentials, credit-card, cyber, cyberattack, cybercrime, cybersecurity, data, detection, endpoint, exploit, extortion, firewall, healthcare, identity, incident response, infrastructure, insurance, international, ISO-27001, jobs, least-privilege, mfa, monitoring, network, nist, password, PCI, penetration-testing, radius, ransomware, risk, saas, sans, security-incident, service, supply-chain, threat, update, vpn, vulnerabilityVital vendor questions CISOs should ask: To gain that critical information, security leaders and experts recommend CSOs ask IT partners the following cyber-specific questions. 1. What attestation will you provide to prove proper security controls are in place? These are essential, says Juan Pablo Perez-Etchegoyen, CTO for cybersecurity and compliance platform Onapsis. Some of the…
-
13 cyber questions to better vet IT vendors and reduce third-party risk
Tags: access, api, attack, authentication, automation, best-practice, breach, business, ceo, ciso, cloud, compliance, control, credentials, credit-card, cyber, cyberattack, cybercrime, cybersecurity, data, detection, endpoint, exploit, extortion, firewall, healthcare, identity, incident response, infrastructure, insurance, international, ISO-27001, jobs, least-privilege, mfa, monitoring, network, nist, password, PCI, penetration-testing, radius, ransomware, risk, saas, sans, security-incident, service, supply-chain, threat, update, vpn, vulnerabilityVital vendor questions CISOs should ask: To gain that critical information, security leaders and experts recommend CSOs ask IT partners the following cyber-specific questions. 1. What attestation will you provide to prove proper security controls are in place? These are essential, says Juan Pablo Perez-Etchegoyen, CTO for cybersecurity and compliance platform Onapsis. Some of the…
-
Stateful Hash-Based Verification for Contextual Data Integrity
Learn how stateful hash-based signatures like XMSS and LMS provide quantum-resistant security for AI Model Context Protocol deployments and data integrity. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/stateful-hash-based-verification-for-contextual-data-integrity/
-
For cyber risk assessments, frequency is essential
Tags: access, authentication, backup, breach, ciso, cloud, compliance, cyber, cyberattack, cybersecurity, data, data-breach, exploit, framework, GDPR, infrastructure, mitigation, network, password, radius, ransomware, regulation, risk, risk-assessment, risk-management, strategy, tool, vulnerabilityIdentifying vulnerabilities: A cyber risk assessment helps to identify security gaps in a company’s IT infrastructure, networks, and systems. This provides the opportunity to eliminate these vulnerabilities before they can be exploited by cybercriminals.Prioritize risk management measures: Not every system is critical, and not all of a company’s data is equally important. The results of the risk…
-
AI slop pushes data governance towards zero-trust models
Organisations are beginning to implement zero-trust models for data governance thanks to the proliferation of poor quality AI-generated data, often known as AI slop. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366637476/AI-slop-pushes-data-governance-towards-zero-trust-models
-
Three vulnerabilities in Anthropic Git MCP Server could let attackers tamper with LLMs
mcp-server-git versions prior to 2025-12.18.The three vulnerabilities are·CVE-2025-68143, an unrestricted git_init.·CVE-2025-68145, a path validation bypass.·CVE-2025-68144, an argument injection in git_diff.Unlike other vulnerabilities in MCP servers that required specific configurations, these work on any configuration of Anthropic’s official server, out of the box, Cyata says.Model Context Protocol (MCP) is an open standard introduced by Anthropic in 2024 to…
-
What exciting developments are coming in AI-driven PAM
How Can Non-Human Identities Revolutionize Cybersecurity? Where systems interact autonomously and data flows seamlessly across networks, have you considered the emerging role of non-human identities (NHIs) in cybersecurity? NHIs, often overlooked, play a pivotal role in maintaining the integrity and security of systems, especially within cloud environments. The Role of NHIs in Cybersecurity NHIs refer……
-
Integrating Enzoic Alerts into Microsoft Sentinel with Azure Logic Apps
Introduction Enzoic provides real-time alerts when user credentials are exposed in data breaches, and integrating these alerts into your security operations center (SOC) can greatly enhance your threat response. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) platform in Azure that aggregates and analyzes security data across an organization. (Note: You will……
-
Flaws in Chainlit AI dev framework expose servers to compromise
/proc/self/environ file is used to store environment variables, and these can contain API keys, credentials, internal file paths, database paths, tokens for AWS and other cloud services, and even CHAINLIT_AUTH_SECRET, a secret that’s used to sign authentication tokens when authentication is enabled.On top of that, if LangChain is used as the orchestration layer behind Chainlit…
-
Data Readiness Scorecard 2026 als Wegweiser für IT-Führungskräfte
Tags: dataFirst seen on datensicherheit.de Jump to article: www.datensicherheit.de/data-readiness-scorecard-2026-wegweiser-it-fuhrungskrafte
-
Everest Ransomware Claims McDonalds India Breach Involving Customer Data
The notorious Everest ransomware group is claiming to have breached McDonald’s India, the Indian subsidiary of the American… First seen on hackread.com Jump to article: hackread.com/everest-ransomware-mcdonalds-india-breach-customer-data/
-
Minnesota Agency Notifies 304,000 of Vendor Breach
State Monitoring Incident Involving a Health Entity Worker for Potential Fraud. The Minnesota Department of Human Services is notifying nearly 304,000 people of data breach involving someone at a healthcare provider who inappropriately accessed information from an IT system managed by a vendor. State officials are monitoring the incident for potential fraud. First seen on…
-
UStrive security lapse exposed personal data of its users, including children
The online mentoring site UStrive exposed email addresses, phone numbers, and other non-public information to other logged-in users. The nonprofit told TechCrunch that the issue is now fixed, but wouldn’t commit to alerting affected individuals. First seen on techcrunch.com Jump to article: techcrunch.com/2026/01/20/ustrive-security-lapse-exposed-personal-data-of-its-users-including-children/
-
NDSS 2025 Studying the Defensive Registration Practices of the Fortune 500
Session 9C: Phishing & Fraud 2 Authors, Creators & Presenters: Boladji Vinny Adjibi (Georgia Tech), Athanasios Avgetidis (Georgia Tech), Manos Antonakakis (Georgia Tech), Michael Bailey (Georgia Tech), Fabian Monrose (Georgia Tech) PAPER The Guardians of Name Street: Studying the Defensive Registration Practices of the Fortune 500 Using orthographic, phonetic, and semantic models, we study the…
-
Trump administration admits DOGE may have misused Americans’ Social Security data
The revelation comes as part of a series of corrections in a legal case over DOGE’s access to Social Security Administration data. First seen on techcrunch.com Jump to article: techcrunch.com/2026/01/20/trump-administration-admits-doge-may-have-misused-americans-social-security-data/
-
UStrive security lapse exposed personal data of its users, including children
The online mentoring site UStrive exposed email addresses, phone numbers, and other non-public information to other logged-in users. The nonprofit told TechCrunch that the issue is now fixed, but wouldn’t commit to alerting affected individuals. First seen on techcrunch.com Jump to article: techcrunch.com/2026/01/20/ustrive-security-lapse-exposed-personal-data-of-its-users-including-children/
-
UStrive security lapse exposed personal data of its users, including children
The online mentoring site UStrive exposed email addresses, phone numbers, and other non-public information to other logged-in users. The nonprofit told TechCrunch that the issue is now fixed, but wouldn’t commit to alerting affected individuals. First seen on techcrunch.com Jump to article: techcrunch.com/2026/01/20/ustrive-security-lapse-exposed-personal-data-of-its-users-including-children/
-
Supreme Court to consider whether geofence warrants are constitutional
The Supreme Court agreed to hear a case challenging the constitutionality of geofence warrants, which let law enforcement compel companies to provide the location data of cell phones at specific times and places. First seen on therecord.media Jump to article: therecord.media/supreme-court-geofence-constitutionality
-
The Data Center Is Secure, But Your Users Are Not
Today’s data centers are hardened facilities with layered access controls, surveillance, redundancy and security teams focused on keeping threats out. Yet, even the most secure environment can be compromised by a single moment of trust, such as a legitimate-looking email that prompts someone to click a link. That’s the modern cybersecurity paradox. The perimeter can..…
-
NIST’s Blueprint for AI Security: How Data Trust Enables AI Success
Tags: access, ai, attack, automation, business, cloud, compliance, control, csf, cybersecurity, data, endpoint, exploit, framework, governance, guide, intelligence, least-privilege, nist, risk, risk-management, saas, toolThe rapid adoption of artificial intelligence has forced organizations to confront a hard truth: AI changes the cybersecurity equation. New attack surfaces, new misuse patterns and new forms of automation require a different approach to managing risk. That’s why NIST has stepped forward. Through its draft AI cybersecurity profile, NIST CSF 2.0 and the AI…
-
Google Gemini Flaw Let Attackers Access Private Calendar Data
Security researchers found a Google Gemini flaw that let hidden instructions in a meeting invite extract private calendar data and create deceptive events. The post Google Gemini Flaw Let Attackers Access Private Calendar Data appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-gemini-flaw-private-calendar-data/
-
Cybersecurity in the Age of AIOps: Proactive Defense Strategies for IT Leaders
There is a rise in cybersecurity threats in today’s rapidly changing digital landscape. Organizations have struggled to safeguard sensitive data and systems from ransomware and breaches. In fact, about 87% of security professionals report that AI-based cyberattacks are plaguing organizations worldwide. Traditional cybersecurity solutions are effective to a degree. However, they tend to be limited..…
-
Gemini AI assistant tricked into leaking Google Calendar data
Using only natural language instructions, researchers were able to bypass Google Gemini’s defenses against malicious prompt injection and create misleading events to leak private Calendar data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gemini-ai-assistant-tricked-into-leaking-google-calendar-data/