Author: Staff Writer

Top Highlights Experian Netherlands was fined EUR 2.7 million for GDPR violations due to unauthorized collection and use of personal data from public and private sources without informing or obtaining consent from individuals. The company used personal data, including credit scores and financial information, to provide assessments that influenced interest rates and deposits, impacting consumers’ financial decisions. The Dutch Data Protection Authority found Experian failed to justify or protect individuals’ data rights, leading to unlawful data processing activities, including the collection of sensitive information like debts and bankruptcies. Experian ceased operations in the Netherlands, committed to deleting all personal data,…

Summary Points Cybercriminals are using TikTok videos masquerading as free activation guides for popular software to spread infostealing malware through a social engineering attack called ClickFix. These videos instruct users to run malicious PowerShell commands that connect to remote servers, download and execute a variant of Aura Stealer, which harvests credentials and sensitive data. An additional payload, named source.exe, is used to self-compile code in memory with unclear purpose, amplifying the threat. Users should avoid executing commands from untrusted sources, especially from social media, and immediately reset credentials if they’ve been targeted or compromised. The Core Issue Cybercriminals are exploiting…

Top Highlights Accusation of Cyberattacks: China has accused the U.S. National Security Agency of cyberattacks on its national time center, claiming this could have disrupted critical infrastructure. Exploitation of Vulnerabilities: The Chinese Ministry of State Security alleges that the NSA exploited messaging service vulnerabilities to steal sensitive information in 2022. Advanced Cyberattack Tools: The NSA reportedly used 42 types of cyberattack tools to target the time center’s internal systems and attempted infiltration of crucial timing systems between 2023 and 2024. Rising Tensions: This accusation may escalate existing tensions between the U.S. and China, already strained due to issues in trade,…

Top Highlights Despite tight budgets and staffing challenges across states, there is a widespread emphasis on leveraging AI, modernization, and digital transformation to enhance government services. Cybersecurity remains a top priority amid rising threats like ransomware and electronic fraud, exacerbated by federal budget cuts and shifting federal support. State CIOs are focused on adapting policies to keep pace with rapid technological advancements, especially in accessibility, data governance, and innovative service delivery. Recognitions and awards highlight efforts in legacy modernization, AI deployment, and digital experience improvements, emphasizing innovation and responsible technology use in government. The Core Issue At the 2025 NASCIO…

Summary Points WatchGuard’s Fireware OS has a critical vulnerability (CVE-2025-9242) allowing unauthenticated remote code execution through crafted IKEv2 VPN negotiation packets, impacting versions 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1. The flaw stems from a stack-based buffer overflow in the IKE process, enabling attackers to hijack control flow, execute arbitrary code, and potentially gain root access, risking system compromise and internal network breaches. Attackers can identify vulnerable firmware via custom IKE_SA_INIT responses and manipulate IKE payloads to trigger the overflow, chains involving ROP gadgets, and deploy reverse shells for persistent access. Mitigation requires immediate patching to updated versions (e.g.,…

Fast Facts Adaptive OT cybersecurity employs AI, micro-segmentation, and flexible encryption to close operational gaps without disruption, enhancing resilience against evolving threats. Evidence-based, quantifiable risk models are transforming OT security assessments, enabling better investment decisions and regulatory compliance by linking cyber risks to operational and financial impacts. Defending interconnected and legacy systems requires tailored strategies such as micro-segmentation, identity management, and cyber deception, alongside supply chain risk management and external boundary redefinition. The future of OT cybersecurity hinges on preemptive, AI-driven defenses, built-in security during device manufacturing, and integrating risk insights with operational context to shift the power balance from…

Top Highlights Europol and partner countries dismantled a sophisticated SIM farm used for cybercrime, seizing devices, servers, and suspected assets totaling over €1 million, and arresting seven suspects, mainly Latvian nationals. The illegal infrastructure facilitated over 49 million online accounts, enabling crimes like phishing, SMS scams, financial fraud, extortion, migrant smuggling, and distribution of child abuse material. The platform, GoGetSMS, marketed fake and temporary phone numbers globally, allowing users to conduct anonymous communications and monetize SIM cards, but also caused significant financial and reputational harm to victims. The operation highlights the global threat posed by cybercrime-as-a-service platforms, with over 1,700…

Quick Takeaways Non-Human Identities (NHIs) are critical digital assets across industries, serving vital roles in operations but pose significant security risks if unmanaged. Effective NHI management enhances security, compliance, and operational efficiency through holistic, lifecycle-centric platforms and automation, reducing human error. Continuous monitoring, strict access controls, and industry-specific strategies are essential for safeguarding NHIs against evolving cyber threats. Future-proofing NHI security involves integrating advanced technologies like AI, predictive analytics, and context-aware systems for proactive threat detection and resilience. What’s the Problem? The story explains that Non-Human Identities (NHIs)—machine-based credentials such as passwords, tokens, or keys—are increasingly vital yet vulnerable components…

Top Highlights Volkswagen denies their core IT systems were affected by the 8Base ransomware attack, but raises concerns about potential third-party or supply chain vulnerabilities. 8Base, primarily a data extortion group, claimed to have stolen sensitive files—including employee and financial data—though no data has been leaked yet. The incident highlights increased risks in automotive supply chains, with threats targeting not just direct attacks but also third-party partners. Authorities and cybersecurity experts emphasize the importance of enhanced third-party risk management amidst ongoing investigations and potential GDPR implications. The Issue In September 2024, the ransomware group 8Base claimed to have stolen and…

Top Highlights Non-Human Identities (NHIs) are machine credentials, including secrets like passwords and tokens, essential for establishing secure machine-to-machine interactions, especially in cloud environments. Effective NHI management enhances cybersecurity by reducing risks, ensuring compliance, improving operational efficiency, and enabling comprehensive visibility and control over machine access and behavior. Industry-specific challenges in sectors like finance, healthcare, and travel necessitate tailored NHI strategies to safeguard sensitive data, meet regulatory standards, and prevent breaches. Integrating AI and ML into NHI management offers real-time analytics and threat prediction, while evolving market trends emphasize the need for scalable, user-friendly solutions to secure complex multi-cloud infrastructures.…