DataBreachToday.com

Cybersecurity Compliance Vendor A-Lign Plans Global Expansion With Backing From Hg
Cybersecurity compliance firm A-LIGN has received a majority investment from Hg, a top tech-focused private equity firm. The deal supports A-LIGN's global ambitions to deliver SOC 2 and other compliance audits and leverages Hg’s expertise in scaling data and AI-driven services.

China's Hack-For-Hire Scene Disgorges Another Leak
The Chinese nation-state threat actor tracked as Salt Typhoon is operated by a clutch of private firms whose clients include multiple Chinese government agencies, finds analysis of leaked data by Spy Cloud. Researchers found a spreadsheet listing buyers, sellers and financial transaction details.

Crypto Defense, Data Centers, Monitoring Systems Strain Global Energy Use
As security monitoring, crypto mining protection and data centers fuel cybersecurity's energy demands, new regulations, such as Australia's National Greenhouse and Energy Reporting Act 2007, signal a global shift toward holding the industry accountable for its environmental impact.

Firms Adding Chief AI Officer to C-Suite to Lead Integration, Value Creation
Generative AI is now a top budget priority over security for many enterprises, but AI talent gap continues to hinder progress on AI projects. A recent AWS report recommends redefining AI leadership roles and strengthening third-party partnerships to unlock gen AI's full potential.

Proposed Deal Could End Precedent-Setting SEC Case Over Cybersecurity Misstatements
The SEC and SolarWinds told a federal judge they've reached a tentative agreement to resolve a first-of-its-kind fraud case over cybersecurity disclosures. Federal regulators alleged that SolarWinds misled investors about its cybersecurity, and the settlement hinges on SEC commissioner approval.

Automation Saves Time But Risks Hollowing Out Critical Early-Career Roles
Time travel can seem like an unofficial requirement for cybersecurity job seekers, with would-be employers demanding mid-tier chops for entry-level positions. Come back in a few years, they say, after you've gained experience. But organizations can't assume the pipeline will fix itself.

Citrix Issues Patches to Counter Active Attacks Against Two Critical Vulnerabilities
Administrators of Citrix Netscaler devices are being urged to immediately patch their devices to fix two actively exploited vulnerabilities. One, dubbed Citrix Bleed 2, can be abused by hackers to bypass multifactor authentication, hijack user sessions and gain unauthorized access to the equipment.

SafePay Ransomware Blamed for Prolonged System Outage
Global tech distributor and service provider Ingram Micro confirmed days after a widespread IT outage that a ransomware attack disrupted internal systems. The firm disclosed the incident following reports that extortion demands associated with SafePay ransomware appeared on employee devices.

345 Major HIPAA Breaches Reported to Feds So Far This Year, Affecting 29.9 Million
Midway through 2025, the federal website listing major health data breaches in the U.S. shows a familiar scene: Many hacking incidents including ransomware, dozens of third-party vendor incidents, and millions of individuals affected by compromised personal data.

German Consultancy's Latest LLM Aims to Reduce Costs, Preserve Reasoning Skills
Say hello to DeepSeek-TNG R1T2 Chimera, a large language model built by German firm TNG Consulting, using three different DeepSeek LLMs. The goal of R1T2 is to provide a faster LLM with more predictable performance that maintains full reasoning accuracy.

Also: Medicare Data Breach; Gartner Security & Risk Management Summit Takeaways
In this week's update, ISMG editors discussed Iran-linked hackers claiming to steal emails from Trump's inner circle, how to refine application development in the age of AI, and a U.S. Medicare data breach amplifying concerns over the safety, security and privacy of federal health systems.

Rejects Business and AI Leaders' Call for Two-Year Enforcement Moratorium
Expect to see no pause in the EU's enforcement of new rules governing artificial intelligence, a spokesperson for the European Commission said amid intensifying calls for officials to "stop the clock" over implementing the bloc's AI Act, in the name of innovation and competition.

While many of the proposed updates to the HIPAA Security Rule are reasonable expectations, others will be extremely onerous to implement if federal regulators finalize the rule's overhaul as it's written today, said Stephen Goudreault of Gigamon and Samantha Jacques of McLaren Health.

Experts Warn Funding Gaps Elevate Cyber Risk
A breach of Columbia University’s IT systems after repeated attacks by U.S. President Donald Trump is highlighting how universities are unprepared for today’s threat landscape. Schools often leave campuses without enough resources for strong cyber defenses.

Also, Spain Arrests Hacker Behind Leaks Targeting Politicians and Journalists
This week, Chinese sites mimicked brands, Spain arrested data leak hackers, Swiss health nonprofit ransomware attack, ICC probed a cyberattack, UNFI restored systems, a flaw in smart tractors, RomCom RAT. A U.K. man sentenced for locking employer out of network. A WordPress hack installs a Trojan.

Flaw Exposes Remote Privilege Escalation Risk
Cisco released urgent security updates to fix a critical vulnerability in Unified Communications Manager that could allow unauthenticated attackers gain root access to affected systems. The maximum-severity vulnerability allows unauthenticated remote attackers to log in using static credentials.

Telephone-Oriented Attack Delivery Social Engineering Tactic Thrives
The phishing industry is a never ending source of innovation. Cyber fraudsters are determined to sneak their way into your inbox. Recent attacks involve callback phishing, a social engineering tactic designed to break down victims' defenses by spurring them into calling the scammers themselves.