Ransomware DataBreachToday.com

AI Actions Bypass Security Tools
Artificial intelligence-powered browsers could expose enterprises to data theft, malware distribution and unauthorized access to corporate apps, new research shows. AI browsers built to complete tasks autonomously lack the security awareness to verify whether an instruction is safe.

Also: Shutdown's Ripple Effects on Healthcare, Mounting Threats to Aging OT Systems
In this week's update, four ISMG editors discussed the fallout from the U.S. federal shutdown and the impact on state and regional cyber offices, the knock-on effects for healthcare, and the growing cyberthreats facing aging operational technology environments.

Akira Ransomware Hackers Targeting SonicWall Devices
Firewall maker SonicWall said Friday all customers who used its cloud backup services are at increased "risk of targeted attacks" following a recent cyberattack. The California firm in September disclosed that unidentified hackers launched brute-force attacks against servers storing backup files.

Also, a Renault Breach, WhatsApp Malware and Qilin Claims Asahi Attack
This week, insurer cybersecurity spending, a Renault breach, a WhatsApp malware campaign in Brazil. Germany skeptical of Chat Control. Two UK teens arrested for ransomware attack. Qilin claimed the attack on Japan's Asahi. Hackers weaponized Nezha. An Invoice data breach exposed personal records.

Australian Clinical Labs Ordered to Pay $5.8M in Data Theft at Medlab Pathology Unit
An Australian court has fined a medical lab $5.8 million for cybersecurity failures leading up to - and following - a 2022 cyberattack that affected 223,000 patients. The penalty marked the first time Australia has levied a civil monetary fine for violations of its Privacy Act of 1988.

Pentera-DevOcean Platform to Deliver Unified Attack Simulation and Remediation
Pentera has acquired DevOcean to close a major operational gap in threat resolution. With AI-based prioritization and remediation orchestration across over 100 tools, Pentera is building a unified platform to address both attack simulation and fix deployment.

Researcher Found Bug Could Exfiltrate Secrets Via Camo Images
A now-patched flaw in GitHub Copilot Chat could have allowed attackers to steal private source code and secrets by embedding hidden prompts that hijacked the artificial intelligence assistant's responses. The exploit also used the code hosting platform's image proxy to leak the stolen data.

Risk and Compliance Review Professionals Can Save Millions and Help Avoid Breaches
Risk and compliance review requires more than just checking off boxes. It involves understanding what the fine print reveals about how a vendor protects data, manages incidents and upholds contractual obligations. Professionals who review contracts become trusted voices in procurement and security.

Platform Vendors Target Runtime Defense, Prompt Flow, Agent Identity and Output
As autonomous AI grows, so does the security risk. Prompt injection, identity control and AI observability are at the center of a dozen recent acquisitions, as vendors including Cisco, CrowdStrike, Palo Alto Networks and SentinelOne try to adapt to the autonomy and unpredictability of LLM-powered bots.

Beijing-Based Institute Researches Steganography, Forensics, Network Penetration
Beware previously undocumented front companies for China's main intelligence service that appear to be tasked with gathering and developing steganography, digital forensic, network penetration and other cybersecurity tools to serve Beijing's military and intelligence apparatus, warn researchers.

Guide Helps Teams Prioritize, Recognizing Not All Vendors Pose Same Level of Risk
Third-party security risk is among the most complicated challenges facing the healthcare sector because of the wide variety of vendors involved and the critical products and services they provide. A new Health Sector Coordinating Council toolkit aims to help entities navigate those difficulties.

AI Strategies Seeks to Bolster Its Position in the Global AI Race
The European Union is pledging $1 billion euros to boost a continental vision of artificial intelligence amid mounting fears the trading bloc is falling behind on research and adoption into the cutting edge technology. "We will help speed up the process," said the European Commission president.

Telegram Used to Lure Teen Recon Recruits
The late September arrest of two teenagers in the Netherlands on suspicion of capturing Wi-Fi signals for pro-Russian hackers has sparked warnings from security analysts over a digital drive for low-skill reconnaissance tasks by nation-state spymasters.

Firm Deploys Claude for Staff, Refunds Australian Government Over AI Errors
Deloitte will embed Anthropic's Claude across its workforce despite flaws in a report from a government client that its analysts produced work with the help of generative artificial intelligence, costing the company thousands of dollars.

Texas-Based Harris Health Says FBI Just Gave Green Light to Notify 5,000 Patients
Harris Health is contacting 5,000 patients about a breach involving a former employee who improperly accessed electronic health records for over a decade. The Texas health entity said it discovered and reported the incident four years ago to the FBI, which just gave the green light for notification.

Signal and Rights Groups Urge Berlin to Reject CSAM Proposal Ahead of Key EU Vote
The German federal government is under pressure to withdraw support for a European Union content scanning proposal that critics argue poses large-scale privacy risks. The EU Justice and Home Affairs Council is set to vote Oct. 14 on a regulation called Chat Control.

Email Security Acquisition Aims to Bring Cross-Platform Data to Phishing Defense
Kaseya’s acquisition of Inky reflects the need for broader platform integration in email security. With phishing attacks becoming more subtle, founder and CEO Dave Baggett says access to login data and other platform signals is critical for threat detection.

Deal Would Boost Veeam's Cyber Footprint as Data Protection Vendor Valuations Surge
Bloomberg reported that data protection and ransomware recovery giant Veeam is in advanced talks to buy DSPM and AI security vendor Securiti for $1.8 billion, with an announcement coming as soon as this week. The deal would accelerate Veeam's pivot from backup and disaster recovery to cybersecurity.

The Edmund Group's Adler on Managing Third- and Fourth-Party Risk in Healthcare
Healthcare organizations face growing risks from data distribution, vendor dependencies and global instability. Steven Adler, partner at The Edmund Group, discusses practical steps to strengthen vendor oversight and resilience.

2020 Hack Has Cost EyeMed About $12.6M in Multiple Regulatory Fines, Settlements
Benefits provider EyeMed Vision Care has agreed to pay $5 million and improve its security practices to settle class action litigation involving a 2020 phishing breach. The incident has been the subject of previous multimillion dollar settlements and enforcement actions by multiple state regulators.