Latest

Application Security

OpenSubtitles Data Breach Affected 6.7 Million Users

Mihir Bagwe  •  January 19, 2022

OpenSubtitles, a website providing free movie subtitles, confirmed to its users today that it had been hacked last August and the hacker had demanded a ransom to remain silent about the attack and to delete the leaked data. This data breach affected 6,783,158 users.

Critical Infrastructure Security

European Authorities Seize VPN Service Tied to Ransomware

Devon Warren-Kachelein  •  January 19, 2022

VPN Lab, known for its alleged wide use by ransomware threat actors, has been shut down. Fifteen servers associated with VPNLab.net were seized or disrupted based on multiple international investigations tying the VPN service provider to cybercrime operations, according to Europol.

Business Continuity Management / Disaster Recovery

JPMorgan Chase Invests $12 Billion in Security Updates

Devon Warren-Kachelein  •  January 19, 2022

JPMorgan Chase will earmark $12 billion for technological updates - including cloud migration, upgrading legacy architecture, data strategy, and emerging technologies. About half of this budget will go toward security modernization, while the other half will be invested into digital innovation.

3rd Party Risk Management

Why SBOMs in the Healthcare IT Supply Chain Are Critical

Marianne Kolbasuk McGee  •  January 19, 2022

Because healthcare IT environments are so complicated, it will become essential for all suppliers to provide and maintain a software bill of materials for their products to remain relevant, says Curt Miller of the Healthcare Supply Chain Association.

Endpoint Protection Platforms (EPP)

McAfee Enterprise and FireEye Products Rebrand as Trellix

Mathew J. Schwartz  •  January 19, 2022

Endpoint detection and response software news: The entity formerly known as McAfee Enterprise and FireEye Products has a new name: Trellix. Think of a "security trellis to businesses across the globe, giving them support they need to keep them safe," says CEO Bryan Palma. Will customers and prospects buy in?

General Data Protection Regulation (GDPR)

Privacy Fines: GDPR Sanctions in 2021 Exceeded $1 Billion

Mathew J. Schwartz  •  January 18, 2022

Privacy regulators in Europe last year imposed known fines totaling more than $1.2 billion under the EU's General Data Protection Regulation, including two record-breaking sanctions, law firm DLA Piper finds. The total value of fines in 2021 was nearly a sevenfold increase from that seen in 2020.

Fraud Management & Cybercrime

NSO Group Spyware Reportedly Used by Israeli Police Force

Dan Gunderman  •  January 18, 2022

Spyware from controversial Israeli firm NSO Group was reportedly used by the nation's civilian police force, according to a new report from an Israeli business publication. Its findings allege that the Israel Police conducted warrantless phone taps on Israeli politicians and activists, among others.

Cyberwarfare / Nation-State Attacks

New Chinese Threat Group Deals in Espionage and Theft

Mihir Bagwe  •  January 18, 2022

A new threat group linked to China, dubbed "Earth Lusca" by researchers, is not only running cyberespionage campaigns against governments around the globe, but also seeking financial gain.

3rd Party Risk Management

GAO: SolarWinds, Exchange Hacks Reveal Info-Sharing Gaps

Dan Gunderman  •  January 17, 2022

GAO auditors say in a new report that the federal government's response to both the SolarWinds software supply chain attack and the exploitation of Microsoft Exchange Servers in 2021 sharpened its coordination efforts, but also exposed information-sharing gaps.

Business Continuity Management / Disaster Recovery

Doxbin Leak Includes Criminals' Data, Could Boost Hacking

Soumik Ghosh  •  January 17, 2022

Threat actors who use data-sharing website Doxbin have had passwords, decryptor keys, multifactor authentication codes and stealer log information leaked online, according to some security experts. Doxbin is used by threat actors to dump victims' personally identifiable information.

3rd Party Risk Management

Record Number of Major Health Data Breaches in 2021

Marianne Kolbasuk McGee  •  January 17, 2022

In the midst of a global pandemic, the federal breach tally shows that a record number of major health data breaches were reported in the U.S. in 2021, and the overwhelming majority of them involved hacking/IT incidents. Will those trends continue in 2022?

Application Security

Destructive Malware Discovered Targeting Ukrainian Systems

Mathew J. Schwartz  •  January 17, 2022

The defacement of Ukrainian government websites may have been intended as a smokescreen for a destructive malware attack that failed to execute or has yet to be unleashed, some security experts warn. Ukraine continues to investigate the attack, which it suggests may trace to Russia, Belarus or both.