Scott Ikeda, Senior Correspondent at CPO Magazine

Binary code on monitor showing software supply chain attacks and open source

Open Source Software Supply Chain Attacks Have Tripled, But Nearly All Vulnerabilities Are Avoidable by Updating

October 17, 2023

Software supply chain attacks have spiked significantly year-over-year. Sonatype logged over 245,032 malicious packages in open source projects available to public download in 2023, double the number seen from 2019 to 2022. In total, one in eight open source downloads poses a risk.

Hooded hacker in cyber war showing cyber attacks in Israel-Hamas conflict

Cyber Security News

Hacker Groups Contributing Cyber Attacks to Israel-Hamas Conflict

October 16, 2023

Israel-Hamas conflict draws in an international coalition of hackers conducting cyber attacks in support of both sides. Report finds that there are about 100 hacker groups that have involved themselves thus far, and that the number skews heavily to Palestine supporters (at 77).

Hand holding phone with Snapchat on the screen showing children's privacy concerns with AI chatbot

Data Protection News

Snap AI Chatbot Facing Potential Enforcement Action After Investigation of Children’s Privacy Complaints

October 16, 2023

The UK ICO has wrapped up a preliminary investigation into Snap's AI chatbot, and has indicated that it is failing to adequately address children's privacy risks. There are numerous concerns about AI chatbots that are not yet resolved, but children's privacy seems to have driven much of the early action from regulators.

Man pretends to peek through a hole with his hands showing workplace monitoring guidelines from UK ICO

Data Protection News

“Business Interests Must Never Be Prioritized Over Worker Privacy,” According to Workplace Monitoring Guidelines From UK ICO

October 13, 2023

The UK ICO guidelines specify that workplace monitoring must be disclosed to employees (along with its 'clearly defined' purpose), and the 'least intrusive' method must be used to accomplish the stated purpose.

Surveillance camera on the street showing facial recogntion technology in schools

Data Privacy News

State of New York Makes Moratorium on Facial Recognition Technology in Schools Permanent

October 12, 2023

A temporary moratorium on the use of facial recognition technology in state schools is now a matter of law in New York, following the conclusion of a study that found that potential rights violations outweighed the safety benefit.

Crypto coins hanging on clotheslines showing crypto laundering and Lazarus group

Cyber Security News

Cross-Chain Crypto Laundering Spikes to $7 Billion, Lazarus Group Responsible for $900 Million

October 11, 2023

New report from Elliptic finds a major spike in cross-chain crypto laundering to $7 billion in the past year. North Korea's state-backed Lazarus group is a major driver, responsible for about 13% ($900 million) alone.

Man covering mouth in fear showing malware botnet Qakbot return

Cyber Security News

Qakbot Malware Botnet Operators Continue Spam Campaigns Despite Infrastructure Seizure by International Law Enforcement

October 10, 2023

The long-running Qakbot malware botnet was disrupted by international law enforcement action in August, but its operators appear to still have some capability and are continuing to run spam email campaigns that attempt to pass ransomware.

Night city skyline with mail icons showing privacy complaint over mail marketing using address data

Data Protection News

Canada Post’s Use of Address Data for Mail Marketing Lists Sparks Privacy Act Complaint

October 10, 2023

Canada Post has been scanning address data from the outside of envelopes it delivers and selling it to third-party mail marketing lists. The Office of the Privacy Commissioner of Canada (OPCC) found that this violates a Privacy Act requirement to obtain authorization from individuals before collecting information in this way.

Virtual lock showing EU Cyber Resilience Act and vulnerability disclosure

Cyber Security News

EU Cyber Resilience Act Proposal Requires Controversial 24-Hour Vulnerability Disclosure

October 9, 2023

Proposed EU Cyber Resilience Act includes a vulnerability disclosure requirement that would have all manufacturers report to the government within 24 hours of first discovered exploitation. In most cases, this would mean disclosing before the vulnerability has been mitigated.

Hand using calculator showing MGM ransomware attack and ransomware costs

Cyber Security News

Bill for MGM Ransomware Attack Expected to Top $100 Million

October 9, 2023

MGM's ransomware attack in September is expected to have $100 million negative impact for Q3 due to cleanup costs and lost business. The company believes that its cybersecurity insurance will cover nearly all of the ransomware attack's associated costs.

Open Source Software Supply Chain Attacks Have Tripled, But Nearly All Vulnerabilities Are Avoidable by Updating

Hacker Groups Contributing Cyber Attacks to Israel-Hamas Conflict

Snap AI Chatbot Facing Potential Enforcement Action After Investigation of Children’s Privacy Complaints

“Business Interests Must Never Be Prioritized Over Worker Privacy,” According to Workplace Monitoring Guidelines From UK ICO

State of New York Makes Moratorium on Facial Recognition Technology in Schools Permanent

Cross-Chain Crypto Laundering Spikes to $7 Billion, Lazarus Group Responsible for $900 Million

Qakbot Malware Botnet Operators Continue Spam Campaigns Despite Infrastructure Seizure by International Law Enforcement

Canada Post’s Use of Address Data for Mail Marketing Lists Sparks Privacy Act Complaint

EU Cyber Resilience Act Proposal Requires Controversial 24-Hour Vulnerability Disclosure

Bill for MGM Ransomware Attack Expected to Top $100 Million

Data Breach at Denmark’s Central Population Registry Impacts 8.8 Million People

ASOS Data Breach Led to Customers Receiving Unauthorized Push Notifications

Wikimedia: Rogue AI Agents Traced Back to OpenAI Made Unauthorized Edits, Attempted to Compromise Etherpad

A Wave of AI-Powered Cyber Attacks Hits Numerous South Korean Banks, Exposing Sensitive PII