DataBreachToday.com

Financial Services Experts Call for Stronger Focus on Third-Party Risk Management
Financial services leaders and cybersecurity experts said at Information Security Media Group’s 2024 Financial Services Summit that third-party vendor security risks required the need for proactive, multi-layered security frameworks to combat the growing threat landscape.

New AWS-Hosted Solution to Integrate Claude With Palantir AI Platform
Palantir, Anthropic and AWS are developing an AI platform for U.S. defense, using Claude models to enhance decision-making, detect trends and speed document processing. The Biden administration has promoted the adoption of AI for national security.

ML, NLP Tools Collect More Personal Information Than Required, U.K. Regulator Says
Artificial intelligence tools currently used by organizations in the United Kingdom to screen job applicants pose privacy risks and are susceptible to bias and accuracy issues, the U.K. Information Commissioner's Office found. The ICO focused on machine learning and natural language processing.

Also: Potential Government Policy Changes; AI-Driven Zero-Day Discoveries
In the latest weekly update, ISMG editors discussed how the recent election results may reshape U.S. cybersecurity policy and healthcare privacy under HIPAA and the groundbreaking role of artificial intelligence in Google’s recent discovery of a critical zero-day vulnerability.

Google Designates Entrust 'Untrustworthy' After Years of 'Concerning Behaviors'
What's the worst-case scenario for a certificate authority? Citing years of "concerning behaviors," Google and Mozilla are set to treat all new digital certificates issued with Entrust as "untrustworthy," and have urged users to obtain new certificates from a trusted CA.

CISA Adds Critical Palo Alto Flaw to Vulnerability Catalog After Attack Discovery
The Cybersecurity and Infrastructure Security agency warned Palo Alto Networks that a critical vulnerability the technology giant previously patched has been actively exploited since then, according to a new advisory, potentially exposing configuration secrets and credentials.

New CEO Manny Rivelo Focuses on Security, Acquisitions to Empower MSPs, SMBs
New ConnectWise CEO Manny Rivelo is prioritizing security and new acquisitions, aiming to provide MSPs with a streamlined, multi-tenant platform. His vision offers an integrated approach to securing SMBs amid a dynamic threat landscape with capabilities like backup, MDR and managed SIEM.

HHS Alerts on Scattered Spider, Living of the Land, Miracle Exploit, F5 Attacks
Federal authorities are warning the healthcare sector of an array of cyberthreats - including Scattered Spider hacks, living-off-the-land attacks, and bad actors looking to exploit weaknesses such as F5 misconfigurations and also so-called "Miracle Exploit" flaws in some Oracle software.

Noka 'Is Aware of Reports'
Finnish telecommunications equipment manufacturer Nokia is investigating the alleged posting of source code data on a criminal hacking forum. A hacker going by the handle of "IntelBroker" on Thursday posted what he said is a trove of "Nokia-related source code."

Close International Law Enforcement Collaboration Will Continue, Experts Forecast
One post-election question pertaining to Donald Trump's upcoming presidency is how his administration will choose to combat cybercrime, and to what extent the White House will continue to take a leadership role in combating ransomware and cybercrime - especially based in Russia.

Trapets CEO Gabriella Bussien on Why Banks Need to Fine-Tune, Automate KYC Processes
KYC protocols traditionally focus on account-level verification, but examining KYC at the product level can help banks assess risk more accurately. Asking targeted questions based on product risk enables institutions to detect potential financial crimes, said Gabriella Bussien, CEO of Trapets.

Also: LottieFiles Attack, Craig Wright's Contempt of Court
This week, Metawin hacks, LottieFiles attack, hackers used Ethereum smart contracts to target npm developers, Craig Wright faced contempt of court, Alameda sued KuCoin, Binance sought dismissal of a U.S. Securities and Exchange lawsuit, and Immutable received a Wells Notice.

Also: Ransomware Hackers Demand Baguettes
This week, Chinese spying, Italian hacking scandal, an FBI warning and Okta fixed a bug. Google mandated MFA, zero days in PTZOptics and a Mexican airport didn't pay ransom. Cybercriminals demanded baguettes, breach lettersin Ohio and Germany will shield white hats. The Italian DPA rebuked a bank.

Did Data Theft at Firm Also Affect Other Clients' Information?
A hacking incident at Thompson Coburn, a national law firm based in Missouri, has affected an unspecified number of patients of a healthcare sector client, Presbyterian Healthcare Services in New Mexico. But a big unanswered question is whether other clients were affected.

Experts on Potential Data Security and HIPAA Privacy Changes in Trump's Second Term
With Donald Trump set to return to the White House to serve another four-year term as U.S. president, what might the healthcare sector expect to see when it comes to his next administration's cybersecurity priorities and HIPAA regulations and enforcement? Experts weigh in.