Ransomware DataBreachToday.com

3,000 Exposed ASP.NET Keys Put Web Applications at Risk of Code Injection Attacks
Threat actors are using publicly exposed cryptographic keys - ASP.NET machine keys - to manipulate authentication tokens, decrypt protected information, and insert harmful code into susceptible web servers, creating opportunities for unauthorized control and long-term access.

Governments Are Skeptical of Chinese A1 Platform's Data Security Controls
Countries across Asia are racing to ban government officials, national agencies and critical infrastructure organizations from using Chinese artificial intelligence company DeepSeek's open-source chatbot application, citing data security and privacy risks.

Also: Researchers Bypass GitHub Copilot's Protections, Deloitte Pays $5M for Breach
This week: A hacker claims to have 20 million OpenAI logins, Sweden clears ship in Baltic cable damage, researchers find ways to bypass GitHub Copilot's protections, Netgear patches router flaws, undetectable Mac backdoor raises alarms, Spain nabs hacker, and Deloitte pays $5M for RIBridges breach.

CISO Buyout Offers, Industry-Wide Skills Shortage Raise Fears of Cybersecurity Gaps
The Cybersecurity and Infrastructure Security Agency has reversed an exemption for its staffers to participate in the administration’s “Fork in the Road” resignation program, as lawmakers and security experts warn of a growing cyber workforce shortage threatening U.S. national security.

Experts Cast Nervous Eye on Musk and Team's Handling of Health-Related Info
Privacy experts are keeping a nervous eye on the potential for compromises involving Americans' health and personal information resulting from the White House's Department of Government Efficiency - led by Elon Musk - accessing government IT systems containing Medicare and health related data.

Data Security Posture Management Becomes Key to Cloud Visibility But Lacks Controls
The rapid rise of DSPM has fueled deals by major security firms looking to enhance their platforms. Industry leaders see DSPM as crucial for cloud data visibility, security integration and regulatory compliance. But can standalone DSPM vendors survive, or will they be absorbed by larger platforms?

AI-Powered Social Engineering and Deepfake Threats in 2025
Security researchers predict threat actors will use artificial intelligence and large language models to enhance phishing attacks and create convincing fake personas, while defensive AI enters a new phase of semiautonomous operations.

Officials Hope to Curb Global Fraud by Targeting Border Operations in Myanmar
In a drastic move to curb fraud along the Myanmar border, Thailand announced plans to cut power and telecommunications in border areas of Myanmar linked to scam operations. The move is aimed at crippling criminal syndicates running notorious call centers that orchestrate scams, financial fraud and human trafficking.

Mitigate Career Risk With a Self-Audit, Targeted Training and Real-World Testing
Changing jobs or going after that promotion can be difficult, even in a field like cybersecurity where the demand for skilled professionals is high. Often, the biggest career challenge is not that advanced persistent threat or the zero-day vulnerability. It's what we call "mental malware."

Guidance Intended to Help Companies Detect Compromises Faster
Countries forming the Five Eyes intelligence alliance outlined Tuesday minimum security requirements that edge device vendors should follow to enable swifter forensics analysis in the wake of cyberattacks. Edge devices have become the repeated target of nation-state hackers.

Lawsuit Claims R.I. Health Information Exchange Retaliated Against 'Whistleblower'
The former HIPAA compliance officer of Rhode Island's state health information exchange is suing the organization in a federal lawsuit claiming that she was terminated from her job after blowing the whistle on the HIE's alleged unlawful disclosures of patient information for research purposes.

Lawmakers Warn of Security Risks as DOGE is 'Running Roughshod' in Federal Systems
Democrats on Capitol Hill are calling on the White House to provide transparency into billionaire Elon Musk's attempts to shrink the U.S. government after reports indicated his unvetted aides gained access to key federal systems containing troves of sensitive data on millions of Americans.

Incident Response Firm Reports 25% of Victims Paid - Typically for a Decryptor
The slice of organizations opting to pay extortion after being hit by ransomware dropped to an all-time low of 25%. Underpinning the drop is a combination of better defenses, improved business resilience as well as organizations simply deciding to not pay criminals.

Former ConnectWise CEO Plans US Growth, Operational Maturity, Product Innovation
Jason Magee, newly appointed CEO of Cynet, wants to grow the company’s presence in the U.S. He aims to increase domestic revenue to 60%, expand partnerships and refine Cynet’s all-in-one security platform. His leadership strategy also prioritizes the education, healthcare and manufacturing sectors.

Could Open-Source AI Redefine the Future? Here's What Experts Say
Open-source AI is shaking up the industry, challenging traditional large and small language models and raising new security concerns. With DeepSeek-R1 leading the charge, experts weigh in on the risks, rewards and the future of AI monetization. Is the future of AI open - or are we headed for new challenges?

Analyst Allie Mellen on Open-Source AI Adoption, Vendor Considerations, Data Risks
AI adoption is accelerating across security operations, but DeepSeek has introduced security, privacy, and geopolitical risks that organizations should carefully assess. Forrester's Allie Mellen shares advice on AI adoption by cybersecurity, third-party risks and data protection.

Attacks Hit Hospitals, Clinics in California, Alabama and Colorado
Three healthcare entities - including a California hospital and outpatient care provider, an Alabama cardiology practice, and a Colorado community health system, are notifying a total of more than 1.2 million individuals that their sensitive information was compromised in 2024 hacks.

FIs Expected to Move from Periodic Reviews to Perpetual KYC
Banks are struggling to keep up with evolving KYC expectations. Despite efforts to modernize, outdated processes continue to leave compliance gaps, leading to increased regulatory action. Penalties for financial institutions surged with KYC-related fines more than doubling to $51 million.

Espionage and Cybercrime Campaign Tied to 7-Zip Mark-of-the-Web Bypass Hits
Russian hackers targeting Ukrainian government agencies and businesses - including a major automotive manufacturer - have been targeting a zero-day vulnerability in the open source and widely used 7-Zip archive utility, to infect systems with credential-stealing SmokeLoader malware.

OneTrust's Ojas Rege Details Act Requirements, AI Governance Challenges
The first set of rules banning high-risk AI systems under the European Union AI Act went into effect on Sunday. Starting this week, companies are now barred from deploying AI-driven emotion recognition in the workplace and schools. OneTrust's Ojas Rege discusses the implications.