DataBreachToday.com

User Panels and Command and Control Domains Seized
Law enforcement and Microsoft struck a blow against malware used to steal login credentials and financial data, seizing the central command structure and thousands of online domains used to control the Lumma Stealer. Lumma first appeared on Russian-language speaking cybercriminal forums in 2022.

Akamai Researchers Flag 'BadSucessor' in Windows Server 2025
An unpatched flaw in Windows Server 2025 that is "trivial" to exploit and present in the default configuration is full domain compromised, warns new research from Akamai. The flaw is present in a new account type known as delegated managed service accounts, or dMSA.

FIs Must Invest in AI-Fueled Behavioral Biometrics to Go Beyond Static Credentials
Scammers are increasingly turning to account takeover fraud, as financial institutions ramp up their defenses. Instead of luring victims into making authorized transactions, cybercriminals are bypassing them altogether, hijacking their digital identities and draining accounts from within.

Homeland Security Secretary Says Trump Budget Strengthens Cybersecurity
Senate Democrats Tuesday pushed Homeland Security Secretary Kristi Noem on the Trump administration's cuts to the cybersecurity component of the U.S. federal department she leads. Noem told senators the U.S. Cybersecurity and Infrastructure Agency will "continue to fulfill" its statutory obligations.

Scattered Spider Stole Tata Consulting Services Employee Login Details for Hack
British retailer Marks & Spencer was reportedly compromised by cybercrime group Scattered Spider using stolen employee credentials from a third-party IT company. Citing an unidentified source, Reuters reported hackers used the M&S login credentials of two Tata Consulting Services employees.

Georgia Court Allows Claims of Fraud, Trespass Over Falcon Software Update
Delta can proceed with its lawsuit against CrowdStrike over a July 2024 update that allegedly bypassed Microsoft safeguards and crashed thousands of systems. The judge found that Delta sufficiently alleged fraud, computer trespass and gross negligence, allowing key claims to move forward.

Acquisition Enhances Privileged Session Visibility, Session Replay, Granular Access
JumpCloud’s acquisition of VaultOne enhances its ability to offer secure, auditable privileged access management. With session recording, credential isolation and future integration into JumpCloud’s compliance ecosystem, the move reflects a broader identity and access strategy.

Privacy Activists Decry Loosening Record-Keeping Requirements
Privacy rights groups urged the European Commission to retreat from proposals to revise the GDPR. Europe pledged to lessen record-keeping obligations for companies with up to 500 employees so long as the data processing isn't "likely to result in a high risk."

Healthcare Providers Are Among Nationwide Recovery Service Data Breach Victims
A 2024 hacking incident at a debt collection firm has affected a growing list of clients and at least hundreds of thousands of individuals so far, including 210,000 patients of Harbin Clinic in Georgia and nearly 90,000 patients of Texas-based Vitruvian Health, also known as Hamilton Health Care.

New Cyber Law Enables Agencies to Neutralize Attackers' Servers Located Abroad
The Japanese Parliament passed the long-delayed active cyber defense bill on Friday, paving the way for government agencies to monitor external telecommunications and preemptively respond to signs of cyberattacks, including neutralizing attackers' servers.

Ministry of Justice Discloses April 23 Breach
Hackers stole from the U.K. Ministry of Justice personal information pertaining to criminal defendants in need of an attorney, the British government disclosed Monday. The ministry on Monday said it detected on April 23 a breach that targeted the Legal Aid Agency.

Executive Director Bridget Bean on How Proactive Alerts Prevented $8.7B in Damages
As state-sponsored threats become increasingly aggressive, CISA is scaling its proactive cyber defense efforts. Through real-time threat intelligence, joint task forces and pre-emptive alerts, it is shielding critical infrastructure from state-sponsored and ransomware-driven attacks.

'Lite Panel' Offering Easy Access to Anyone for Just $777 Confirmed by Researcher
Ransomware groups continue to find innovative new ways to shake down organizations large and small in their pursuit of ransom payoffs. For the LockBit group, one tweak was to debut a "lite" version of its ransomware portal that appears to have amassed dozens of very inexperienced business partners.

Australian Human Rights Commission Detected Leak of 670 Online Forms After a Month
The Australian Human Rights Commission said unprotected online complaint forms exposed the personal, healthcare and demographic information of Australians to the public internet for over a month. The data leak exposed 670 complaints and nominations online.

Serviceaide Incident Exposed Patient Data of Catholic Health, a NY-Based Client
Serviceaide, a provider of agentic AI-based IT management and workflow software, reported to regulators that an inadvertent exposure of data on the web has affected more than 483,000 patients of client Catholic Health, a network of six hospitals and dozens of other facilities in western New York.

Report Uncovered Malicious Fake Job Network Operated by a Chinese Company
Recently laid off U.S. federal government officials are being targeted by Chinese intelligence through a network of front companies purporting to offer consulting work. Reports that foreign adversaries intended to recruit former officials began as soon as the administration intentions became apparent.

Company Deploys Thousands of Use Cases, Underscores Responsible AI to Rebuild Trust
UnitedHealth faces AI backlash after nH Predict's 90% error rate and a DOJ probe. With more than 1,000 AI applications from call routing to claims efficiency and a robust responsible AI policy, the company aims to balance innovation with trust in a high-stakes bid to reshape healthcare.

Also: Prison Time for an Irish Crypto Launderer, an ISIS Financier
Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, prison sentences for Celsius CEO, Irish crypto launderer and an ISIS supporter, exCH and Haowang close, a Parisian kidnapping attempt on crypto CEO's family and Sinaloa Cartel leaders charged in U.S. federal court.