Scott Ikeda, Senior Correspondent at CPO Magazine

Control panel showing Russian hackers attack on water treatment plant

State-Sponsored Russian Hackers Linked to Breach of Texas Water Treatment Plant

April 23, 2024

Leading cybersecurity firm Mandiant believes that a notorious group of Russian hackers is behind a recent rash of attacks on water utilities in several countries, including the United States. On January 18 the group was able to induce a tank overflow at a Texas water treatment plant, and has made similar incursions in France and Poland.

TV remote on TV background showing credential stuffing attacks and 2FA

Cyber Security News

Roku Makes 2FA Mandatory for Customers After String of Credential Stuffing Attacks

April 22, 2024

After weathering two waves of credential stuffing attacks thus far in 2024, the second of which involved over half a million compromised accounts, Roku is now requiring that customers set up a 2FA method.

Hammer on US flag showing federal privacy law

Cyber Security News

New Attempt at Federal Privacy Law Would Complement State Laws, Add Private Right of Action

April 19, 2024

As with many of these recent attempts at a comprehensive federal privacy law, the bill has bipartisan support. But its fate is just as uncertain as any of its predecessors during a Congressional period in which data privacy has been kept in the backseat.

Man typing on keyboard and holding smartphone showing third party breach impact MFA

Cyber Security News

Third Party Breach at Cisco Exposes MFA Logs for Some Customers

April 18, 2024

Cisco Duo customers may have had VoIP and SMS MFA logs exposed to an attacker in early April. Third party breach is the result of one of the provider's employees being phished. The attackers then seemed to target the MFA logs of specific clients of interest.

Hacker on the phone showing audio deepfake and voice phishing

Cyber Security News

LastPass Reports Voice Phishing Attempt on Employee Using Audio Deepfake of Company CEO

April 16, 2024

A blogpost from LastPass Labs warns of an attempted voice phishing attack on an employee that made use of an audio deepfake of company CEO Karim Toubba. The attacker peppered the LastPass employee with a series of calls, text messages, though the employee recognized it as a scam attempt and no damage was done.

Alert sign showing cyber extortion on Change Healthcare

Cyber Security News

Second Cyber Extortion Attack on Change Healthcare Follows Rumored $22 Million Payment, May Involve Former BlackCat/ALPHV Hackers

April 12, 2024

RansomHub has claimed credit for the new cyber extortion attempt on Change Healthcare. The group says that it stole 4 TB of data that includes sensitive personal information, including financial information and medical records belonging to US military personnel.

Cyber Security News

DHS Finds 2023 Microsoft Security Breach Was Preventable, Chinese Hackers Took Advantage of Corporate Culture

April 9, 2024

The CSRB found that the security breach was preventable, and that a "a corporate culture that deprioritized enterprise security investments and rigorous risk management" ended up leaving open doors for the Chinese hackers.

Cyber Security News

AT&T Data Leak: 73 Million Account Passcodes From Prior to 2020 Exposed, Including 7 Million Current Account Holders

April 8, 2024

A new development in an old data breach has seen 73 million AT&T customer passcodes published to an underground forum. The data leak now appears to be as bad as originally advertised with customer contact information attached to weakly encrypted passcodes that are easily deciphered.

Google signboard on building showing settlement for incognito mode to delete browsing data

Data Protection News

Google Agrees to Delete Billions of Records of Browsing Data as Part of Proposed “Incognito Mode” Settlement

April 5, 2024

The settlement would impact all Incognito Mode data collected from June 1, 2016 to before the start of 2024. Google says that it would delete most of this browsing data, but in some cases would "de-identify" records instead.

Capitol building with flag showing AI rules for federal agencies

Cyber Security News

New AI Rules for US Federal Agencies: Mandatory Risk Assessments and Public Disclosures, Appointment of “Chief AI Officers” Now Required

April 4, 2024

Two of the biggest components of the new AI rules are the implementation of mandatory AI safeguards by federal agencies, such as those used in healthcare and financial benefit systems, and expanded transparency requirements.

State-Sponsored Russian Hackers Linked to Breach of Texas Water Treatment Plant

Roku Makes 2FA Mandatory for Customers After String of Credential Stuffing Attacks

New Attempt at Federal Privacy Law Would Complement State Laws, Add Private Right of Action

Third Party Breach at Cisco Exposes MFA Logs for Some Customers

LastPass Reports Voice Phishing Attempt on Employee Using Audio Deepfake of Company CEO

Second Cyber Extortion Attack on Change Healthcare Follows Rumored $22 Million Payment, May Involve Former BlackCat/ALPHV Hackers

DHS Finds 2023 Microsoft Security Breach Was Preventable, Chinese Hackers Took Advantage of Corporate Culture

AT&T Data Leak: 73 Million Account Passcodes From Prior to 2020 Exposed, Including 7 Million Current Account Holders

Google Agrees to Delete Billions of Records of Browsing Data as Part of Proposed “Incognito Mode” Settlement

New AI Rules for US Federal Agencies: Mandatory Risk Assessments and Public Disclosures, Appointment of “Chief AI Officers” Now Required

ASOS Data Breach Led to Customers Receiving Unauthorized Push Notifications

Wikimedia: Rogue AI Agents Traced Back to OpenAI Made Unauthorized Edits, Attempted to Compromise Etherpad

A Wave of AI-Powered Cyber Attacks Hits Numerous South Korean Banks, Exposing Sensitive PII

Hackers Abuse Custom GPT Instances on chatgpt.com to Distribute ClickFix Malware