Tag: data
-
Yale New Haven Health Will Pay $18M to Settle Hack Lawsuit
March Breach Affected Nearly 5.6 Million; NextGen Proposed Settlement Also Reached. Connecticut’s largest healthcare network – Yale New Haven Health System – has agreed to pay $18 million to settle class action litigation filed in the aftermath of a March hack affecting nearly 5.6 million people. The incident ranks as the biggest health data breach…
-
Sneaky Mermaid attack in Microsoft 365 Copilot steals data
Redmond says it’s fixed this particular indirect prompt injection vuln First seen on theregister.com Jump to article: www.theregister.com/2025/10/24/m365_copilot_mermaid_indirect_prompt_injection/
-
Randall Munroe’s XKCD ”Ping<<
Tags: datavia the comic artistry and dry wit of Randall Munroe, creator of XKCD Permalink First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/10/randall-munroes-xkcd-ping/
-
Cybersecurity Snapshot: Top Advice for Detecting and Preventing AI Attacks, and for Securing AI Systems
Tags: access, ai, attack, authentication, awareness, best-practice, breach, business, chatgpt, china, ciso, cloud, computing, container, control, credentials, crime, cve, cyber, cyberattack, cybersecurity, data, defense, detection, email, exploit, extortion, finance, flaw, framework, fraud, google, governance, government, group, guide, hacker, hacking, healthcare, iam, identity, incident response, intelligence, LLM, malicious, malware, mitigation, monitoring, network, open-source, openai, organized, phishing, ransom, risk, risk-management, russia, sans, scam, service, skills, soc, strategy, supply-chain, technology, theft, threat, tool, training, vulnerability, zero-trustAs organizations eagerly adopt AI, cybersecurity teams are racing to protect these new systems. In this special edition of the Cybersecurity Snapshot, we round up some of the best recent guidance on how to fend off AI attacks, and on how to safeguard your AI systems. Key takeaways Developers are getting new playbooks from groups…
-
How to Detect Shadow AI in Your Organization FireTail Blog
Tags: access, ai, api, automation, awareness, business, cloud, compliance, control, cybersecurity, data, detection, endpoint, guide, identity, monitoring, network, software, toolOct 24, 2025 – Alan Fagan – Quick Facts: Shadow AI DetectionShadow AI often hides in day-to-day tools; chatbots, plug-ins, or automation apps.It rarely looks like a threat; it starts as convenience.The signs: odd data access, unknown app traffic, missing visibility.Firetail AI helps uncover hidden AI tools and activity before problems escalate.The earlier you detect…
-
Cross Site Scripting
Web applications are integral to modern business and online operations, but they can be vulnerable to security threats. Cross-Site Scripting (XSS) is a common vulnerability where attackers inject malicious scripts into trusted websites, compromising user data and website integrity. At StrongBox IT, we help organizations identify and mitigate such vulnerabilities, focusing on detecting and preventing……
-
Mozilla: New Firefox extensions must disclose data collection practices
Starting next month, Mozilla will require Firefox extension developers to disclose whether their add-ons collect or share user data with third parties. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/software/mozilla-new-firefox-extensions-must-disclose-data-collection-practices/
-
Lazarus group targets European drone makers in new espionage campaign
Drone-component theft meets geopolitical ambition: The targeting of firms linked to UAV design and manufacture is no coincidence. At least two of the companies compromised were tied to critical drone component supply chains and software systems.”The in-the-wild attacks successively targeted three European companies active in the defense sector,” researchers added. “Although their activities are somewhat…
-
Baohuo Android Malware Hijacks Telegram Accounts via Fake Telegram X
New Android malware Baohuo hijacks Telegram X accounts, stealing data and controlling chats. Over 58,000 devices infected, mainly in India and Brazil. First seen on hackread.com Jump to article: hackread.com/baohuo-android-malware-telegram-x-hijacks-accounts/
-
Baohuo Android Malware Hijacks Telegram Accounts via Fake Telegram X
New Android malware Baohuo hijacks Telegram X accounts, stealing data and controlling chats. Over 58,000 devices infected, mainly in India and Brazil. First seen on hackread.com Jump to article: hackread.com/baohuo-android-malware-telegram-x-hijacks-accounts/
-
Baohuo Android Malware Hijacks Telegram Accounts via Fake Telegram X
New Android malware Baohuo hijacks Telegram X accounts, stealing data and controlling chats. Over 58,000 devices infected, mainly in India and Brazil. First seen on hackread.com Jump to article: hackread.com/baohuo-android-malware-telegram-x-hijacks-accounts/
-
North Korean Hackers Target UAV Industry to Steal Confidential Data
ESET researchers have uncovered a sophisticated cyberespionage campaign targeting European defense companies specializing in unmanned aerial vehicle (UAV) technology. The attacks, attributed to the North Korea-aligned Lazarus group operating under Operation DreamJob, reveal a coordinated effort to steal proprietary manufacturing data and design specifications from critical players in the drone industry. The campaign, observed beginning…
-
North Korean Hackers Target UAV Industry to Steal Confidential Data
ESET researchers have uncovered a sophisticated cyberespionage campaign targeting European defense companies specializing in unmanned aerial vehicle (UAV) technology. The attacks, attributed to the North Korea-aligned Lazarus group operating under Operation DreamJob, reveal a coordinated effort to steal proprietary manufacturing data and design specifications from critical players in the drone industry. The campaign, observed beginning…
-
Malicious NuGet Packages Pose as Nethereum, Steal Crypto Wallet Keys
Socket’s Threat Research Team has uncovered a sophisticated supply chain attack targeting cryptocurrency developers through the NuGet package registry. The malicious packages, which exfiltrate sensitive wallet data including private keys and mnemonics, highlight a critical vulnerability in package registry security practices. The attack centers on a package named Netherеum.All, which appears identical to the legitimate…
-
Ransomware recovery perils: 40% of paying victims still lose their data
Tags: access, attack, authentication, backup, breach, business, ceo, crypto, cyber, cybersecurity, data, data-breach, encryption, extortion, finance, GDPR, group, incident response, insurance, leak, mfa, privacy, ransom, ransomware, resilience, risk, risk-management, service, threat, updateAdditional recovery pressures: Modern ransomware attacks now routinely involve double or triple extortion whereby attackers threaten to leak stolen data or launch distributed denial of service (DDoS) attacks even after payment.This fundamentally changes the calculus on what victims can expect in cases where they decide to make a ransomware payment, which more often than not…
-
Ransomware recovery perils: 40% of paying victims still lose their data
Tags: access, attack, authentication, backup, breach, business, ceo, crypto, cyber, cybersecurity, data, data-breach, encryption, extortion, finance, GDPR, group, incident response, insurance, leak, mfa, privacy, ransom, ransomware, resilience, risk, risk-management, service, threat, updateAdditional recovery pressures: Modern ransomware attacks now routinely involve double or triple extortion whereby attackers threaten to leak stolen data or launch distributed denial of service (DDoS) attacks even after payment.This fundamentally changes the calculus on what victims can expect in cases where they decide to make a ransomware payment, which more often than not…
-
New infosec products of the week: October 24, 2025
Here’s a look at the most interesting products from the past week, featuring releases from Axoflow, Elastic, Illumio, Keycard, Netscout and Rubrik. Axoflow Security Data Layer … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/24/new-infosec-products-of-the-week-october-24-2025/
-
Prosper Marketplace Data Breach Expands: 17.6 Million Users Impacted in Database Intrusion
In a significant development in one of the year’s largest fintech breaches, new reports released today confirm that Prosper Marketplace, the San Franciscobased peer-to-peer lending platform, suffered a data compromise affecting roughly 17.6 million people. The updated figure, first published by TechRadar and Tom’s Guide, sheds light on the scale of the incident and reveals……
-
Toys “R” Us Canada warns customers’ info leaked in data breach
Toys “R” Us Canada has sent notices of a data breach to customers informing them of a security incident where threat actors leaked customer records they had previously stolen from its systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/toys-r-us-canada-warns-customers-info-leaked-in-data-breach/
-
Surge in UK savings lost to investment scams, with fake crypto thought to top the list
Banking industry data shows £629m was stolen in six months from fraud that included gold, wine and property The amount of money lost to investment scams by UK consumers has leapt 55% in a year as cryptocurrency fraudsters intensify their efforts to cheat people out of their savings, data shows.Official UK banking industry data shows…
-
Playtime’s over: Crooks swipe Toys R Us Canada customer data and dump it online
What?! No complimentary credit monitoring? First seen on theregister.com Jump to article: www.theregister.com/2025/10/23/toysrus_canada_data_leak/
-
Breach Roundup: the Qilin Hack That Wasn’t
Also, Envoy Air Confirms Data Compromise Following Clop Extortion Campaign. This week, Qilin didn’t hack a Spanish tax agency, Nexperia standoff, Envoy Air confirmed a data compromise, Experian Netherlands fined 2.7M euros, ToolShell used to breach global networks, flaws in TP-Link Omada and Festa VPN routers and a New York firm settled a cybersecurity investigation.…
-
Dataminr to Buy ThreatConnect for $290M in Intelligence Push
Proposed Acquisition Aims to Merge Internal Risk Data With External Threat Signals. Dataminr will acquire ThreatConnect, combining public data detection with internal intelligence to give CISOs an AI-powered, context-aware response platform. The deal is producing results for shared customers and is central to Dataminr’s push toward predictive, client-specific cybersecurity tools. First seen on govinfosecurity.com Jump…
-
NDSS 2025 Symposium on Usable Security and Privacy (USEC) 2025, co-located with the Network and Distributed System Security (NDSS) Symposium 2025 Afternoon, Session 3
Authors, Creators & Presenters: PAPERS Vision: Retiring Scenarios — Enabling Ecologically Valid Measurement in Phishing Detection Research with PhishyMailbox Oliver D. Reithmaier (Leibniz University Hannover), Thorsten Thiel (Atmina Solutions), Anne Vonderheide (Leibniz University Hannover), Markus Dürmuth (Leibniz University Hannover) Vision: Towards True User-Centric Design for Digital Identity Wallets Yorick Last (Paderborn University), Patricia Arias Cabarcos…
-
Montana Officials Looking Into BCBS Breach Tied to Vendor
Regulators Want to Know If Insurer Delayed Notifying 462,000 Affected Members. Montana regulators are investigating a breach affecting 462,000 Blue Cross Blue Shield of Montana members involving one of the insurer’s service providers. The vendor, Conduent, in April notified the SEC that the data theft affected numerous clients and a significant number of people. First…