Ransomware DataBreachToday.com

Chinese Hackers Hitting Unpatched Products From Microsoft, Sophos, Fortinet, Ivanti
Chinese nation-state hackers who surreptitiously gained "broad and full" access to telecommunications networks in the U.S. and dozens of other countries have regularly exploited known flaws in their networking gear that the victims failed to patch, security experts have warned.

Operator Cannot Yet Reliably Perform Complex, Customized Tasks
OpenAI introduced an AI agent capable of independent action with the launch of Operator, an general-purpose AI tool that interacts with websites to perform tasks. The agent can navigate menus and complete forms to do tasks such as travel booking, ordering takeout, buying stuff or scheduling tasks.

Fraud Expert Ken Westbrook on Successful Ways to Stop Fake Investment Sites
According to the FBI, losses from investment scams surged 38% between 2022 and 2023. Fraudsters are using highly effective tactics, including sending text messages to lure victims to fake cryptocurrency platforms, said Ken Westbrook, founder and CEO of Stop Scams Alliance.

The EU-US Data Privacy Framework Requires a Functional PCLOB
A Trump administration move to gut a key oversight body meant to guarantee European data rights in the United States could endanger the legal basis underpinning commercial data flows across the Atlantic. The board is charged with overseeing U.S. surveillance practices.

Why MFA and Data Minimization Remain Key for Preventing Massive Data Breaches
While PowerSchool's investigation into the massive theft of its customers' data is continuing, clear lessons have already emerged. Count among them the importance of using multifactor authentication, which could have safeguarded access to PowerSchool's exploited customer support systems.

Enterprises Prepare for Quantum-Resilient Infrastructures to Combat Future Threats
Many enterprises understand the potential risks of quantum computing. But few have begun actively planning or implementing post-quantum cryptography. The NIST PQC standardization process provides enterprises with guidance on adopting quantum-resistant algorithms, said David Close of Futurex.

Executive Order Scraps Biden-Era Policies
U.S. President Donald Trump signed an executive order directing the development of a plan within 180 days to ensure America's dominance in artificial intelligence. The order seeks to ensure AI systems are "free from ideological bias or engineered social agendas."

Also: US Prosecutors Charge Suspected North Korean IT Worker Collaborators
This week, researchers spied Palo Alto firewall flaws, a North Korean IT worker conspiracy, ChatGPT as DDoS vector. Chinese hackers targeted a VPN maker, a fake PyPi package and a Russian threat actor shifted tactics. BreachForums admin faces prison and scammers used the release of Ross Ulbricht.

Hackers Unlikely to Exploit Flaws in the Wild
Security researchers found an unpatchable flaw in the system that prevents commercial aircraft from crashing into each other, the U.S. federal government said in a Tuesday advisory that called the likelihood of its exploitation "unlikely" outside of a laboratory setting.

California User's Class Action Suit Says LinkedIn Violated Contract, Privacy Regs
A LinkedIn user has sued the company for flouting privacy requirements by allowing third-party companies to access user data - including Premium users' private messages - to train their artificial intelligence models. A LinkedIn spokesperson called the lawsuit "false claims with no merit."

Under the Trump administration, the proposed update to the HIPAA Security Rule - issued in the final weeks of the Biden administration - is likely to get trimmed but not totally cut, predicts regulatory attorney Sharon Klein of the law firm Blank Rome. What else should the health sector expect?

The pace of change including the rise of artificial intelligence and a sense of accelerating chaos can make cybersecurity professionals feel like "things are kind of everything, everywhere, all at once," said Black Hat conference founder Jeff Moss. How should they respond?

Inadequate Cyber Resilience and More Findings From WEF's Global Risks Report 2025
Polarization within societies, escalating geopolitical tensions and the proliferation of generative AI tools have cemented misinformation and disinformation as the top global risk in a two-year outlook, according to the World Economic Forum's Global Risks Report 2025.

Greer on Adding Capabilities Adjacent to NDR, Using Channel Partnerships for Scale
New ExtraHop CEO Rob Greer sees massive potential in scaling the company's network detection and response platform globally. His strategy includes investing in international markets, enhancing channel partnerships and delivering value to large enterprises through seamless technology integration.

Also: CLS Global Pleads Guilty to Wash Trading
This week, Trump token making millions, Hester Peirce to lead a crypto task force, CLS Global pleaded guilty to wash trading, Upbit faced KYC violation charges, DCG's $38M settlement with the SEC, guilty plea in $100M theft, and the SEC accused Nova Labs of securities violation.

Exploring New Ways to Deliver and Measure Cybersecurity Awareness Programs
Regulations such as GDPR, HIPAA and CMMC have made security awareness training a staple of corporate security programs. But compliance is only part of the story. Organizations face an even deeper challenge: influencing employee behavior in ways that create a truly secure workplace.

7 Texas Health and Human Services Workers Fired in Incident Affecting 61,000 people
Authorities in Texas are investigating an insider incident at the Texas Health and Human Services Commission that led to the firing of seven employees, an investigation into hundreds of thousands of dollars in stolen funds and notification of a breach of personal information affecting 61,000 people.

HHS' Privacy Rule Update Limits Use, Disclosure of Reproductive Health PHI
A Biden administration HIPAA Privacy Rule that went into effect last June to restrict the disclosure of reproductive health information is being challenged in federal court by the attorneys general of 15 states. The AGs are asking a Tennessee federal court to overturn the rule.

House Homeland Security Committee Mulls Response to Volt Typhoon, Future of CISA
The United States needs to respond more aggressively to nation-state hacking, members of Congress heard Wednesday against a backdrop of changes, actual and planned, at the primary federal civilian cyber defense agency. "We need to call them out for this," said Rep. Michael McCaul, R-Texas.

Rao Replaces Bryan Palma, Who Combined McAfee Enterprise, FireEye to Form Trellix
Symphony Technology Group tapped Vishal Rao to take over as CEO of Trellix while continuing to serve as chief executive of sister company Skyhigh Security. The San Jose, California-based security vendor tasked longtime Cloudera and Splunk leader Rao with accelerating Trellix's market share.