DataBreachToday.com

Competition Regulator Says WhatsApp Users Could Not Opt Out of Data Sharing
India's Competition Commission has fined social media conglomerate Meta over $25 million for forcing WhatsApp users to agree to a sweeping data sharing policy with other Meta platforms. The agency ordered the company to stop using users' data for online advertising on other Meta platforms.

Experts Call on Feds to Step Up Defense Against Escalating Chinese Threats
A panel of cybersecurity experts and top industry officials pushed lawmakers and the federal government to step up their defenses against escalating cyberthreats from China, citing recent high-profile examples of evidence that Beijing is increasingly targeting the U.S. with sophisticated attacks.

Hacker Reportedly Gained Access to File Containing Testimony Against Matt Gaetz
Matt Gaetz, President-elect Donald Trump’s pick to lead the Justice Department, faces growing controversy over allegations of sexual misconduct after a hacker reportedly gained access to a shared file containing testimony from a woman who said she had sex with the former congressman when she was 17.

Critical Authentication Flaw Impacts Both Free and Pro Users
A widely deployed five-in-one security plug-in for WordPress websites contained a flaw that hackers could automate into a large-scale takeover campaign. The critical authentication bypass vulnerability takes advantage of a now-patched flaw in the Really Simple Security plug-in.

Water Barghest Group Lists Infected Devices Within 10 Minutes of Initial Compromise
A threat actor with suspected ties to Russian nation-state hackers has listed thousands of IoT devices as proxy networks within minutes of their initial compromise. A campaign that began in 2020 has so far infected 20,000 IoT devices, according to a new report by Trend Micro.

Inspector General Report Reveals 97 Water Systems With Critical Cybersecurity Risks
The Environmental Protection Agency inspector general said over 100 million Americans depend on drinking water systems exposed to cybersecurity flaws that could allow hackers to "disrupt service or cause irreparable physical damage to drinking water infrastructure."

Critical Authentication Flaw Impacts Both Free and Pro Users
A widely deployed five-in-one security plugin for WordPress websites contained a flaw that hackers could automate into a large-scale takeover campaign. The critical authentication bypass vulnerability takes advantage of a now-patched flaw in the Really Simple Security plugin.

Gartner Publishes First Identity Verification MQ as Workforce-Related Uses Multiply
Gartner has recognized Entrust, Incode, Jumio, Socure and Sumsub as identity verification leaders amid a rise in regulatory demands and fraud prevention requirements. Identity verification was historically used for regulated onboarding in industries like banking, gambling and cryptocurrency.

Embracing Zero Trust and AI in Cloud Security
Zero trust, artificial-intelligence-driven security and automation tools are reshaping how organizations maintain uptime, even during a cyberattack. These advances underscore how the future of enterprise resilience is increasingly tied to advancements in cloud security.

Scrutiny Over Ethics of Profit-Sharing Prompts End to Cyberstarts CISO Compensation
Allegations of conflicts of interest in Cyberstarts’ Sunrise program have sparked debate in the CISO community. While the program connected CISOs with startups for advisory purposes, its profit-sharing incentives drew criticism, leading some participants to resign and the firm to halt compensation.

Also: Anticipating Donald Trump's Second Term; a Surprising Cybersecurity Merger
In the latest weekly update, ISMG editors explored the growing threat of disrupted ransomware attacks as a public health crisis, the potential global impact of a Donald Trump's second presidential term, and implications of the latest big merger in the cybersecurity market.

Researchers Find Exploitable Flaws in the OvrC Platform
Security flaws in a cloud platform for remotely configuring and monitoring Internet of Things gadgets could expose millions of devices to remote code execution hacks. Security researchers at Claroty's Team82 uncovered 10 vulnerabilities in the widely used OvrC cloud platform.

Trump Administration Picks May Test Bipartisan Support for Cybersecurity Agency
Newly empowered Republicans in U.S. president-elect Donald Trump's orbit appear slated to enact far-reaching changes to the federal cyber defense agency, with one senator pledging to act on his long-standing enmity to the Cybersecurity and Infrastructure Security Agency.

Health System's Cyberattack Affected More Than 235,000 Patients, Employees, Others
A New York state court has approved a preliminary $1.5 million settlement of a consolidated proposed class action lawsuit against One Brooklyn Health System following a November 2022 cyberattack that involved theft of sensitive health data belonging to more than 235,000 people.

CrowdStrike Healthcare Executive Insights Webinar
Discover strategies to safeguard health systems from identity-driven cyberattacks in this expert-led session.

Comprehensive Identity Security Platform Expands Protection to Cloud, On-Premises
Silverfort has acquired Rezonate, a cloud-focused identity protection startup. This acquisition accelerates Silverfort’s vision for an integrated platform that secures identities across both on-premises and cloud environments, cutting complexity and boosting threat visibility for enterprise clients.

Tehran Baits Aerospace Sector Into Downloading Malware With Fake Job Offers
Iranian state hackers are taking a page out of North Korean tactics to entice job seekers into downloading malware, with security researchers spotting a Tehran campaign directed against the aerospace industry. It's possible that Pyongyang shared its attack methods and tools.

Vaccine Skeptic's Views on Health Privacy Not Well-Known
President elect Donald Trump said Thursday he will nominate prominent vaccine skeptic Robert F. Kennedy Jr. as secretary to head up the U.S. Department of Health and Human Services. His stances on health information privacy, security and healthcare sector cyber matters are not well known.