Tag: data
-
The head of the California Privacy Protection Agency on the future of data privacy regulation
Kemp spoke with Recorded Future News about why he believes data brokers are dangerous and whether forthcoming federal privacy legislation is likely to wipe out California’s pioneering privacy law. First seen on therecord.media Jump to article: therecord.media/california-privacy-protection-agency-tom-kemp-interview
-
Qantas says 5.7 million affected by breach, leaked info not enough to access frequent flyer accounts
In an updated advisory, Qantas broke down the categories of personal data breached in a recent cyberattack, saying frequent-flyer numbers were involved, but not in a way that would compromise accounts. First seen on therecord.media Jump to article: therecord.media/qantas-airline-data-breach-frequent-flyer-numbers
-
TikTok’s Handling of EU User Data in China Comes Under Scrutiny Again
A new probe, opened two months after a Euro530m fine to TikTok, will investigate the tech giant’s storage of EU users’ data in China First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/tiktok-handling-eu-user-data-china/
-
ServiceNow Platform Vulnerability Enables Attackers to Exfiltrate Sensitive Data
Security researchers have identified a critical vulnerability in ServiceNow’s widely-used enterprise platform that could enable attackers to extract sensitive data including personally identifiable information (PII), credentials, and financial records. The flaw, dubbed >>Count(er) Strike
-
AMD discloses new CPU flaws that can enable data leaks via timing attacks
Tags: access, attack, crowdstrike, cve, cvss, data, exploit, firmware, flaw, guide, leak, malware, microsoft, mitigation, risk, side-channel, strategy, supply-chain, threat, update, vulnerability, windowsCrowdStrike elevates threat classification despite CVSS scores: While AMD rates the vulnerabilities as medium and low severity based on attack complexity requirements, CrowdStrike has independently classified them as critical enterprise threats. The security firm specifically flagged CVE-2025-36350 and CVE-2025-36357 as “Critical information disclosure vulnerabilities in AMD processors,” despite both carrying CVSS scores of just 5.6.According…
-
Nippon Steel IT Subsidiary Hit by Zero-Day Attack, Causing Data Breach
Personal data of Nippon Steel Solutions’ customers, partners and employees may be compromised First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nippon-steel-it-subsidiary-0day/
-
Sovereign-ish: Google Cloud keeps AI data in UK, but not the support
Processing and storage for Gemini 2.5 Flash to stay in Blighty First seen on theregister.com Jump to article: www.theregister.com/2025/07/10/google_uk_data_sovereignty/
-
Qantas data breach impacted 5.7 million individuals
Australia’s largest airline Qantas has confirmed that the recent data breach impacted 5.7 million individuals. Early this month, Australian airline Qantas disclosed a cyberattack after hackers accessed a third-party platform used by a call centre, stealing significant customer data. The breach, linked to ongoing Scattered Spider activity, was detected and contained on Monday. Qantas confirmed that while…
-
Qantas Confirms 5.7 Million Customers Hit by Data Breach
Qantas says nearly six million passengers were impacted by a recent data breach First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/qantas-57m-data-breach/
-
Hackers Exploit GeoServer RCE Flaw to Deploy Cryptocurrency Miners
Tags: attack, crypto, cve, cyber, data, exploit, flaw, hacker, intelligence, open-source, rce, remote-code-execution, threat, vulnerabilityThe AhnLab Security Intelligence Center (ASEC) has confirmed that unpatched GeoServer instances are still facing relentless attacks by threat actors exploiting a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2024-36401. GeoServer, an open-source Geographic Information System (GIS) server developed in Java for spatial data processing, became a prime target after the vulnerability was disclosed…
-
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs
A high-severity security flaw has been disclosed in ServiceNow’s platform that, if successfully exploited, could result in data exposure and exfiltration.The vulnerability, tracked as CVE-2025-3648 (CVSS score: 8.2), has been described as a case of data inference in Now Platform through conditional access control list (ACL) rules. It has been codenamed Count(er) Strike.”A vulnerability has…
-
McDonald’s AI Hiring Bot Exposed with ‘123456’ Password, Millions of Job”‘Seekers’ Data at Risk
A shocking security vulnerability in McDonald’s AI-powered hiring system has exposed the personal information of millions of job applicants, after security researchers discovered they could access the entire database using the laughably weak password >>123456.
-
Unbefugter Zugriff bei einem Glücksspielunternehmen in Irland
Up to 800,000 Betfair and Paddy Power customers hit by data breach First seen on irishtimes.com Jump to article: www.irishtimes.com/business/2025/07/09/up-to-800000-betfair-and-paddy-power-customers-hit-by-data-breach/
-
Unbefugter Zugriff auf ein Mail-Konto eines Gesundheitssystems in Indiana, USA
Notice of Data Security Incident First seen on ecommunity.com Jump to article: www.ecommunity.com/notice-data-security-incident-july2025
-
Global software supply chain visibility remains critically low
Only 23% of organizations are confident that they have very high visibility of their software supply chain, according to LevelBlue’s Data Accelerator. The limited visibility … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/10/low-global-software-supply-chain-visibility/
-
Serious Flaws Patched in Model Context Protocol Tools
Always Secure MCP Servers Connecting LLMs to External Systems, Experts Warn. Warning: Popular technology designed to make it easy for artificial intelligence tools to connect with external applications and data sources can be turned to malicious use. Researchers discovered two separate vulnerabilities tied to tools in the ecosystem around model context protocol, or MCP. First…
-
McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data to Hackers Using the Password ‘123456’
Basic security flaws left the personal info of tens of millions of McDonald’s job-seekers vulnerable on the “McHire” site built by AI software firm Paradox.ai. First seen on wired.com Jump to article: www.wired.com/story/mcdonalds-ai-hiring-chat-bot-paradoxai/
-
Qantas confirms data breach impacts 5.7 million customers
Australian airline Qantas has confirmed that 5.7 million people have been impacted by a recent data breach, in which threat actors stole customers’ data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/qantas-confirms-data-breach-impacts-57-million-customers/
-
McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data to Hackers Using the Password ‘123456’
Basic security flaws left the personal info of tens of millions of McDonald’s job-seekers vulnerable on the “McHire” site built by AI software firm Paradox.ai. First seen on wired.com Jump to article: www.wired.com/story/mcdonalds-ai-hiring-chat-bot-paradoxai/
-
API Use is Growing Fast, but Security is Lacking: Raidiam
A survey by UK company Raidiam found that even as the use of APIs continues to growth, most organizations have woefully inadequate protections in place to safeguard the increasingly sensitive data the APIs carry, exposing them up cyberattacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/api-use-is-growing-fast-but-security-is-lacking-raidiam/
-
Nippon Steel Solutions suffered a data breach following a zero-day attack
Tags: attack, breach, cloud, cybersecurity, data, data-breach, exploit, hacker, network, vulnerability, zero-dayNippon Steel Solutions reported a data breach caused by hackers exploiting a zero-day vulnerability in their network equipment. Nippon Steel Solutions, a subsidiary of Japan’s Nippon Steel, disclosed a data breach, attackers exploited a zero-day vulnerability. The company provides cloud and cybersecurity services. On March 7, 2025, Nippon Steel Solutions detected suspicious server activity and…
-
Bitcoin Depot breach exposes data of nearly 27,000 crypto users
Bitcoin Depot, an operator of Bitcoin ATMs, is notifying customers of a data breach incident that has exposed their sensitive information. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bitcoin-depot-breach-exposes-data-of-nearly-27-000-crypto-users/
-
Agentic AI Is Fueling a Rise of Deepfake Phishing Scams
Ironscales Founder, CEO Eyal Benishti Pushes to Expand AI Protection Beyond Email. Deepfake phishing is escalating as cybercriminals deploy agentic AI to automate everything from data collection to social engineering. Ironscales founder and CEO Eyal Benishti outlines how phishing is targeting communication platforms beyond email, and how defenders can keep up. First seen on govinfosecurity.com…
-
Trend Micro flags BERT: A rapidly growing ransomware threat
Low-code, high impact: BERT is not an isolated development, it is part of a growing wave of emerging ransomware groups that are proving both capable and elusive. In just the last three to four months, cybersecurity researchers have identified multiple new ransomware families that signal a shift toward leaner, low-code, and faster malware operations.For instance,…
-
Microsoft 365 PDF Export Feature Vulnerable to LFI Sensitive Data at Risk
A critical security vulnerability in Microsoft 365’s PDF export functionality has been discovered and subsequently patched, highlighting significant risks to sensitive enterprise data. The vulnerability, which earned its discoverer a $3,000 bounty from Microsoft’s Security Response Center (MSRC), exposed a Local File Inclusion (LFI) attack vector that could potentially compromise confidential system information across multi-tenant…
-
Verified, featured, and malicious: RedDirection campaign reveals browser marketplace failures
Browser hijacking and phishing risks: According to their research, the malicious code was embedded in each extension’s background service worker and used browser APIs to monitor tab activity. Captured data, including URLs and unique tracking IDs, was sent to attacker-controlled servers, which in turn provided redirect instructions.The setup enabled several attack scenarios, including redirection to…
-
Malicious Open Source Packages Spike 188% YoY
Data exfiltration was the most common malware in Sonatype report, with more than 4,400 packages designed to steal secrets, personally identifiable information, credentials, and API tokens. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/malicious-open-source-packages-spike
-
July Patch Tuesday: 14 critical Microsoft vulnerabilities, one SAP hole rated at 10 in severity
Tags: access, attack, authentication, business, citrix, computer, control, credentials, cve, cvss, data, email, espionage, exploit, grc, microsoft, monitoring, network, ransomware, remote-code-execution, risk, sap, service, threat, update, vulnerability, windowsNetwork security: Allow PKU2U authentication requests to this computer to use online identities“.Tyler Reguly, Fortra’s associate director of security R&D, told CSO that, based on Microsoft’s presentation of the information, disabling this GPO will mitigate this vulnerability.The second priority is a fix for CVE-2025-49704, a SharePoint Remote Code Execution vulnerability, because it presents a critical risk to a…
-
DoNot APT Expands Operations, Targets European Foreign Ministries with LoptikMod Malware
A threat actor with suspected ties to India has been observed targeting a European foreign affairs ministry with malware capable of harvesting sensitive data from compromised hosts.The activity has been attributed by Trellix Advanced Research Center to an advanced persistent threat (APT) group called DoNot Team, which is also known as APT-C-35, Mint Tempest, Origami…