BankInfoSecurity.com

Senate HELP Committee Chair Seeks to Secure Data in Smart Watches, Health Apps
Sen. Bill Cassidy, R-La., a physician and chair of the Senate health committee, has proposed legislation that aims to create parallel HIPAA-like privacy protections to more types of health data - such as data collected by consumer wearable devices and health apps - not currently covered under HIPAA.

Keyless's Biometric Tech to Improve Privacy, Account Recovery and User Experience
Ping Identity will acquire Keyless to expand passwordless authentication to frontline workers who lack access to smartphones. The deal gives Ping deepfake-resistant, privacy-first biometrics that don't store user templates on servers, easing identity verification and account recovery.

Spyware Targets Samsung Galaxy Devices, Says Unit 42
Hackers used previously unknown commercial spyware dubbed "Landfall" to surveil the activities of Samsung Galaxy device owners in the Middle East, say security researchers who posit the threat actor has connections to the United Arab Emirates.

Central Jersey Medical Center Runs Health Centers for Schools in Newark
Central Jersey Medical Center, a federally qualified health center that partners with public schools in Newark, New Jersey, is notifying an undisclosed number of people of a data breach related to an August ransomware attack. The incident is latest to hit a resourced-stretched healthcare provider.

Audit Issues, Policy Debt and Limited Project Scope Are Hampering Adoption
Microsegmentation has long been touted as the gold standard for restricting lateral movement by hackers. It helps lock down network traffic and reduces the blast radius of a breach. Vendors say it's transformative, but if you walk into most large enterprises, you'll will find it half-implemented.

CISA Argues None of 54 Fired Workers Fall Under Union Protections
The Cybersecurity and Infrastructure Security Agency told a federal court it complied with an injunction blocking shutdown-related layoffs by sending reduction-in-force notices only to non-union staff within a unit vital to coordination with state, local and private-sector defenders.

OTsec India Steering Committee Discuss Cyberthreats, Compliance and Innovation
Featuring some of the most prominent voices in Indian operational technology cybersecurity, the steering committee for the inaugural OTsec India Summit shares insights on a range of topics including OT threats, regulatory imperatives and the latest innovations.

Nation-State Teams Tied to Grain Sector Targeting, Plus More Joined-Up Operations
Russia's nation-state hacking groups have returned to pummeling Ukrainian targets with destructive, wiper malware, including in apparent attempts to disrupt its economically valuable grain sector, alongside the repeat targeting of allied European nations, researchers report.

Also: SBF Appeals Conviction, PHP Exploits Fuel Cryptomining
Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Europol's 600 million euro fraud network bust, Sam Bankman-Fried conviction appeal, PHP exploits fueled cryptomining campaigns and sentencing set for Samourai Wallet founders.

Statewide Breach Hit 60 Agencies Before Ransomware Was Deployed
A threat actor infiltrated Nevada’s statewide systems undetected for months, ultimately disrupting at least 60 agencies by deleting backups and launching ransomware that forced a full rebuild of core infrastructure and triggered a multimillion-dollar emergency response.

Learn the Business, Be Intentional, Find a Mentor and Build Non-Technical Skills
New to cybersecurity? Start by learning how organizations work - their people, processes and priorities - before diving deep into technical stacks. Understanding how to translate technical findings into business risk differentiates a professional from a technician.

DOJ: Suspects Hit 5 Firms, Including 3 in Healthcare, Netted $1.3M in Ransom Money
Three former employees of two cybersecurity firms stand accused of using BlackCat ransomware in a conspiracy to extort five U.S. companies, including three in the healthcare sector. One of the victim companies paid nearly $1.3 million to the attackers, U.S. federal prosecutors said.

DHS Plans to Expand SAVE Database Use Raise Privacy, Accuracy and Security Concerns
A Department of Homeland Security move to broaden an immigration verification database into a voter verification tool could expose sensitive information to security threats. Critics caution it accelerates a pattern of data being repurposed by the Trump administration for surveillance.

Chinese Hackers Target European Diplomats with LNK File Flaw
Chinese nation-state hackers are exploiting a Windows vulnerability to hack European diplomatic outposts, say security researchers - but operating system giant Microsoft says the flaw doesn't merit a patch. Hackers used a flaw already compromised by North Korea and Russia.

Funding Round Led by Goldman Sachs Boosts Valuation to $6.1 Billion
Another cybersecurity vendor is planning to dive into the still waters of an initial public offering. Cyber exposure management firm Armis dipped its toe in the market Wednesday, announcing a pre-IPO funding round of $435 million that boosted the company's valuation to $6.1 billion.

AI's Impact on Productivity and Employment Demands Proactive Policy Action
The future of work is no longer speculative, it is already being coded. From automated writing assistants to robotic warehouse employees, artificial intelligence is entering every part of the modern workforce faster than regulations or social frameworks can adapt.

Joint Platform to Offer Human-Led, Automated Application Security in One Place
Bugcrowd acquired Mayhem Security to integrate automated application testing with human-led testing capabilities. The company plans to embed Pittsburgh-based Mayhem's reinforcement learning tech and AI models into its broader platform to speed up vulnerability detection.