Security. In focus.

TransUnion data breach hits 4.4 million consumers

TransUnion reported a data breach affecting over 4.4 million consumers, caused by hackers accessing a third-party application. While the specific information stolen is unknown, TransUnion assures that credit information was not accessed.

Sensitive medical marijuana patient data exposed in major breach

Ohio Marijuana Card, a company processing medical marijuana recommendations, exposed nearly 1 million records containing sensitive patient information, including medical histories and Social Security numbers. The data breach, discovered by security researcher Jeremiah Fowler, included unencrypted information such as dates of birth, addresses, and medical histories. The company has removed the data and is conducting an internal investigation.

Incident response planning linked to fewer cyber insurance claims: Marsh | Insurance Business America

New research from Marsh McLennan highlights that organizations regularly testing their cyber incident response plans are significantly less likely to file insurance claims, with tabletop exercises and breach simulations reducing material cyber events by 13 per cent. The findings, drawn from self-assessment data and claims records, ranked response planning as the fourth most effective control—behind endpoint detection and response, monitoring, and staff training—and suggest insurers may soon make detailed planning a condition for coverage. As underwriters seek to manage rising loss ratios, the study reinforces that practical controls such as EDR, phishing-resistant MFA, and structured response drills not only improve resilience but also directly influence the availability and cost of cyber insurance.

AI is making dark web monitoring crucial, says BOXX Insurance cyber chief | Insurance Business Canada

Dark web monitoring has shifted from optional to essential for organizations in 2025, according to Neal Jardine, BOXX Insurance’s chief cyber intelligence and claims officer, who cites the accelerating scale and speed of stolen data trading online. AI is transforming both sides of cybercrime, enabling attackers to automatically scan vast stolen data collections, identify password patterns, and accelerate account takeovers, while also empowering security teams to quickly identify relevant threats from millions of records. Login credentials remain the most valuable dark web commodity, with BOXX research showing nearly half of data breaches result in stolen information appearing on the dark web within 30 days, and stolen credentials surfacing every 1.5 seconds on average. The underground market contains over 24 billion complete username-password sets globally, with 73% of passwords reused across multiple accounts, making real-time monitoring crucial for organizations to implement immediate countermeasures like password resets before criminals can exploit the stolen data.​​​​​​​​​​​​​​​​

Google previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offense | CyberScoop

Google announced a new cyber “disruption unit” focused on proactive, intelligence-led actions to disrupt cyber campaigns. This development comes amid discussions in the U.S. about adopting more offensive cyber strategies, though legal and commercial barriers remain. While some advocate for increased offensive capabilities, including potential “letters of marque” for private sector companies, experts emphasize the need for clear legal frameworks and effective impact measurement.

OpenAI Says It’s Scanning Users' ChatGPT Conversations and Reporting Content to the Police

OpenAI has quietly implemented monitoring systems that scan ChatGPT conversations for harmful content, escalating concerning messages to human reviewers and potentially reporting threats to law enforcement, according to a new company blog post addressing AI-related mental health crises. The company states it routes conversations involving plans to harm others through specialized review pipelines, with human teams authorized to ban accounts and refer imminent threats to police, though it currently avoids reporting self-harm cases to respect user privacy. This announcement comes amid growing reports of AI chatbots contributing to user self-harm, delusions, and suicides, with OpenAI acknowledging certain failures in protecting vulnerable users while implementing these new surveillance measures. The policy creates apparent contradictions with OpenAI’s privacy stance in its ongoing lawsuit against the New York Times, where the company has resisted sharing user chat logs on privacy grounds, while CEO Sam Altman previously admitted ChatGPT conversations lack the confidentiality protections of professional therapy or legal consultations.​​​​​​​​​​​​​​​​

NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs

The NSA, NCSC, and allies warn that Chinese APT actors, including Salt Typhoon, are targeting global telecom, government, transport, lodging, and military sectors. These actors exploit known CVEs and weak configurations for initial access, using tactics like modifying ACLs, enabling remote access, and establishing covert communication channels. Defenders are urged to prioritize patching historically exploited CVEs and perform threat hunting to mitigate these threats.

The Role of Enterprise Email Security in Modern Cybersecurity Strategies

Email remains a primary entry point for cyberattacks, despite advancements in cybersecurity. Modern strategies employ multi-layered defenses, including advanced threat intelligence and machine learning, to protect against sophisticated attacks. Enterprise email security is now a critical component of overall cybersecurity, integrating with other systems to provide a comprehensive defense against evolving threats.

Claude AI chatbot abused to launch “cybercrime spree” | Malwarebytes

Anthropic, the company behind the Claude AI chatbot, uncovered a large-scale extortion operation where cybercriminals abused Claude to automate and orchestrate sophisticated attacks. The attackers used AI to design and launch attacks, compromising personal records and demanding ransom payments. Anthropic’s Threat Intelligence team is investigating the abuse and working to improve defenses against similar attacks.

Nx NPM packages poisoned in AI-assisted supply chain attack www.theregister.com/2025/08/2…

Nx is the latest target of a software supply chain attack in the NPM ecosystem, with multiple malicious versions being uploaded to the NPM registry on Tuesday evening.

According to researchers at Wiz, those poisoned packages were laden with malware designed to siphon secrets from developers, such as GitHub and NPM tokens, SSH keys, and cryptocurrency wallet details.

Nx’s security advisory, posted to GitHub, which details the affected versions, states that successful credential harvesting then led to those credentials being posted to GitHub as new public-facing repos under the corresponding user accounts.

With a self-proclaimed 24 million NPM downloads per month, a successful supply chain attack on Nx, an open source codebase management platform, could in theory capture the details of myriad developers.

FBI warns Chinese hacking campaign has expanded, reaching 80 countries www.msn.com/en-us/pol…

The FBI and other law enforcement and intelligence agencies around the world warned Wednesday that a Chinese-government hacking campaign that previously penetrated nine U.S. telecommunications companies has expanded into other industries and regions, striking at least 200 American organizations and 80 countries.

The joint advisory was issued with the close allies in the Five Eyes English-language intelligence-sharing arrangement and also agencies from Finland, Netherlands, Poland and the Czech Republic, an unusually broad array meant to demonstrate global resolve against what intelligence officials said is a pernicious campaign that exceeds accepted norms for snooping.

Governments, tech companies meet in Tokyo to share tips on fighting North Korea IT worker scheme therecord.media/japan-us-…

Multiple governments and companies held a forum in Tokyo on Tuesday to discuss ways of combating a years-long campaign by North Korea to have its citizens illicitly hired in information technology roles.

The U.S. State Department said it worked with the Ministries of Foreign Affairs in Japan and South Korea to organize the forum, which had more than 130 attendees from freelance work platforms, payment service providers, cryptocurrency companies, AI firms and more.

Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier therecord.media/sweden-mu…

A suspected ransomware attack on Miljödata, a Swedish software provider used for managing sick leave and similar HR reports, is believed to have impacted around 200 of the country’s municipal governments.

The attack was detected on Saturday, according to the company’s chief executive Erik Hallén. The attackers are attempting to extort Miljödata, police told local newspaper BLT.

Swedish Minister for Civil Defence Carl-Oskar Bohlin wrote in a short update on social media: “The scope of the incident has not yet been clarified, and it is too early to determine the actual consequences.”

Storm-0501 Hits Enterprise With ‘Cloud-Based Ransomware’ Attack www.darkreading.com/cloud-sec…

The march of progress continues, as a threat actor has now pulled off an attack described as “cloud-based ransomware.”

Microsoft on Aug. 27 published research concerning Storm-0501, a ransomware actor that has been active since 2021. To date, the group has utilized a wide range of ransomware-as-a-service (RaaS) strains, including Embargo, Hunters International, Hive, BlackCat/ALPHV, and LockBit, among others. Last September, Microsoft published research detailing how the group changed its tactics from buying credentials to leveraging weak credentials in order to move laterally from on-premises to cloud environments.

This latest research offers a look into how Storm-0501 has further evolved its tactics, techniques, and procedures (TTPs). More specifically, the research describes a recent attack in which the “the threat actor achieved cloud-based ransomware impact through cloud privilege escalation, taking advantage of protection and visibility gaps across the compromised environment, and pivoting from on-premises to cloud pivots.”

Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks www.bleepingcomputer.com/news/secu…

Hackers breached sales automation platform Salesloft to steal OAuth and refresh tokens from its Drift chat agent integration with Salesforce to pivot to customer environments and exfiltrate data.

Salesloft’s SalesDrift is a third-party platform that connects the Drift AI chat agent with a Salesforce instance, allowing organizations to sync conversations, leads, and support cases into their CRM.

New Report Sheds Light on the State of AI and Automation in Threat Intelligence www.recordedfuture.com/blog/stat…

In our discussions with cyber threat intelligence teams over the past year, one of the biggest topics has been AI and automation. Government agencies, commercial businesses, and other enterprises are expanding their use of these technologies in an effort to respond to cyber threats more efficiently.

Still, there’s a lot of hype around the subject, so we wanted to understand what’s truly happening. How are different teams using AI and automation in their day-to-day workflows? And how are they integrating it into their more strategic initiatives?

To find out, we partnered with researcher UserEvidence to survey over 520 cybersecurity leaders across industries and countries. Here are a few key themes we uncovered

How Threat Actors Are Rizzing Up Your AI for Profit www.recordedfuture.com/blog/how-…

AI is reordering search dominance. Conventional wisdom says Google’s traditional search engine is headed for the dustbin, something largely unimaginable even a few years ago. As people (and agents) migrate search habits from Google to LLMs, what happens to referrer monetization models? More importantly for enterprise defenders and risk managers, HOW will traffers and malicious Traffic Distribution Systems (TDS) adapt?

Recorded Future’s Insikt Group recently reported on TAG-124, which operates a TDS designed to redirect unsuspecting web browsers to malicious destinations for malware/ransomware installation, cryptocurrency theft, and more. SocGholish malware, also known as FakeUpdates, employs TDS such as Parrot TDS and Keitaro TDS to filter and redirect unsuspecting users to malicious sites. Additional criminal TDS include Help TDS, Los Pollos TDS, and more. The TDS options and branding are important reminders that threat actors (TAs) have choices when investing in traffic demand generation, which leads to competition and incentivizes first-mover advantage toward LLMs in this malicious services niche.

An APT… through your webcam - How attackers can hijack your computer through its webcam — and how to stop it. www.kaspersky.com/blog/badc…

Computer webcams have long been suspected of peeping on folks; nothing unusual about that. But now they’ve found a new role in conventional cyberattacks. At the recent BlackHat conference in Las Vegas, researchers presented the BadCam attack, which allows an attacker to reflash a webcam and execute malicious actions on the computer it’s connected to. Essentially, it’s a variation of the well-known BadUSB attack; the key difference is that with BadCam attackers don’t need to prepare a malicious device in advance — they can use a “clean” webcam already connected to the computer. Another unwelcome novelty is that the attack can be carried out completely remotely. Although the research was conducted by ethical hackers, and BadCam hasn’t yet been observed in real-world attacks, it won’t be difficult for criminals to figure it out and reproduce the necessary steps. That’s why organizations should understand how BadCam works and implement protective measures.

New zero-day startup offers $20 million for tools that can hack any smartphone | TechCrunch

Advanced Security Solutions, a new UAE-based startup, is offering up to $20 million for hacking tools that can break into any smartphone. The company, which claims to work with over 25 governments, offers bounties for exploits in various software, including Android, iOS, Windows, and Chrome. While the prices are in line with the current market, the company’s lack of transparency regarding its ownership and customers raises concerns.

China linked Silk Typhoon targeted diplomats by hijacking web traffic

The China-linked APT group Silk Typhoon targeted diplomats by hijacking web traffic to deliver malware disguised as an Adobe Plugin update. The attackers used an adversary-in-the-middle technique to redirect web traffic and deliver the malware, bypassing security tools and maintaining stealth. Google’s Threat Intelligence Group published indicators of compromise and YARA rules for detecting the malware.

ESET warns of PromptLock, the first AI-driven ransomware

ESET discovered PromptLock, the first AI-driven ransomware, using OpenAI’s gpt-oss:20b model to generate and execute malicious Lua scripts. The ransomware, written in Golang, can steal, encrypt, or potentially destroy data on Windows, Linux, and macOS.

Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS Infra

Cybersecurity researchers discovered five activity clusters linked to the threat actor Blind Eagle, targeting Colombian government entities and other sectors from May 2024 to July 2025. The attacks, tracked as TAG-144, utilized spear-phishing, RATs, and dynamic DNS infrastructure, with a focus on financial and government espionage. The group’s persistent targeting of Colombian government entities raises questions about its motivations, potentially involving both financial gain and state-sponsored espionage.

Vulnerability landscape analysis for Q2 2025 | Securelist

Vulnerability registrations in Q2 2025 were dynamic, impacting various computer subsystems. Threat actors continue to exploit vulnerabilities in real-world attacks, with a significant increase in critical vulnerabilities published compared to previous years. The most common exploits targeted Microsoft Office products, WinRAR, and Windows File Explorer vulnerabilities, while Linux exploits focused on Dirty Pipe, privilege escalation, and heap overflow vulnerabilities.

Google to Verify All Android Developers in 4 Countries to Block Malicious Apps thehackernews.com/2025/08/g…

Google has announced plans to begin verifying the identity of all developers who distribute apps on Android, even for those who distribute their software outside the Play Store.

“Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices,” the company said. “This creates crucial accountability, making it much harder for malicious actors to quickly distribute another harmful app after we take the first one down.”

To that end, the tech giant said it intends to start sending out invitations gradually starting October 2025, before opening it up to all developers in March 2026. The new requirements are expected to go into effect starting a year from now, in September 2026, in Brazil, Indonesia, Singapore, and Thailand.

Hackers Lay in Wait, Then Knocked Out Iran Ship Comms www.darkreading.com/cyber-ris…

A shadowy hacktivist crew known for outing Iran’s state-run hackers is claiming credit for knocking out communications aboard dozens of Iranian oil tankers and cargo ships, leaving critical onboard systems completely bricked.

UK-based Iran International on Friday described it as one of the largest cyberattacks ever on Iran’s maritime sector, disrupting some 25 cargo ships and 39 tankers operated by the National Iranian Tanker Company (NITC) and the Islamic Republic of Iran Shipping Lines (IRISL). Both companies have been sanctioned by the US Treasury Department for various violations linked to the Iranian government.