“Overly broad language” and concealment of file access in SolarWinds hack cybersecurity disclosures can lead to fines in the millions of dollars, as an SEC investigation has recently demonstrated.
A Brazilian hacker who has been a general menace for at least several years now, and involved with the massive National Public Data breach among others, is in the custody of the country’s federal police after a somewhat unusual series of events.
Word began spreading of Pokémon developer Game Freak’s secrets being spread on 4Chan in early October. Tidbits found in the data breach include plans for a new animated cartoon with Netflix, and the company’s aim to make two sequels to its 2019 Detective Pikachu film.
2023 saw Mandiant log 138 total incidents of exploited vulnerabilities for its report, of which 70% were zero-days. That is up substantially from 61% and 62% in the two prior years.
What this development warns of is the possibility of weaker quantum computers being used to crack encryption ahead of schedule, by focusing on specific standards and coming up with innovative approaches tailored to them.
Service at the Internet Archive remains spotty after about two weeks of off-and-on attacks, beginning with a major data breach in late September that exposed 31 million user credentials.
The basic setup of the GoldenJackal malware attack is simple, but clever: compromise a USB drive known to be regularly connected to air-gapped systems, and let it harvest files for you. When it is returned to an internet-connected device, the stolen files are forwarded along their way.
There is a particular spike in cyber claims from “hyperlitigation” that results when a managed services provider or some other upstream source is breached, causing follow-on client data and privacy breaches and a cascade of lawsuits.
The group seemed to have a specific priority goal for the US telecoms: accessing a federal wiretap system used for legally ordered surveillance of criminal suspects, a type of intel that Chinese hackers have targeted before.
The new CRI guidance does not call for a shutdown of ransomware payments, but does encourage victims to get in touch with law enforcement as soon as possible even if they intend to make a payment.