Security. In focus.

Hertz data breach exposed customers’ personal information, lawsuits claim

Three class action lawsuits were filed against Hertz and Cleo Communications alleging a data breach compromised customer information in a ransomware attack. The lawsuits claim Hertz and Cleo failed to protect customer data, which was unencrypted and vulnerable to cyberattacks. The plaintiffs seek damages, attorney fees, and injunctive relief to force the companies to more securely store sensitive customer data.

Somnia anesthesia firm gets $2.4M data breach wakeup call - Westfair Communications

A $2.4 million class-action settlement was approved for a data breach at Somnia Inc., a medical management company. The breach compromised the personal records of over 400,000 patients, including 707 from a Somnia affiliate at Phelps Hospital. The settlement includes payments to claimants who suffered out-of-pocket losses and $1 million in attorney fees.

Ascension discloses new data breach after third-party hacking incident

Ascension, a major US healthcare system, notified patients of a data breach involving personal and health information stolen from a former business partner in December 2024. The breach, likely linked to a Clop ransomware attack, exposed data including names, addresses, SSNs, and medical records. Ascension is offering free identity monitoring services to affected individuals.

Former Disney employee sentenced to three years for menu hacking www.theverge.com/news/6578…

A former Disney employee will serve three years in federal prison for logging into the company’s servers to make changes to its restaurant menus’ allergen information, as well as carrying out “denial-of-service attacks” aimed at locking other employees out of their accounts.

Other alterations included swapping menu fonts for Wingdings and replacing the names of dishes with joke names. (“Shellfish” became “Hellfish,” for example.)

Spotlight on RSAC: How to survive as a CISO aka ‘chief scapegoat officer’ www.theregister.com/2025/04/2…

Chief security officers should negotiate personal liability insurance and a golden parachute when they start a new job – in case things go sideways and management tries to scapegoat them for a network breach. And if they blow the whistle, it’s best not to sue their employer as well, lest they get blacklisted.

Spotlight on RSAC: The one interview question that will protect you from North Korean fake workers www.theregister.com/2025/04/2…

“My favorite interview question, because we’ve interviewed quite a few of these folks, is something to the effect of ‘How fat is Kim Jong Un?’ They terminate the call instantly, because it’s not worth it to say something negative about that,” [Adam Meyers] told a panel session at the RSA Conference in San Francisco Monday.

Spotlight on RSAC: China is using AI to sharpen every link in its attack chain, FBI warns www.theregister.com/2025/04/2…

The biggest threat to US critical infrastructure, according to FBI Deputy Assistant Director Cynthia Kaiser, can be summed up in one word: “China.” In an interview with The Register during RSA Conference, she said Chinese government-backed crews are testing out AI in every stage of the attack chain. This isn’t to say that they’re succeeding, but it does make them “more efficient, or might make them a little faster,” Kaiser added.

Spotlight on RSAC: China now America’s number one cyber threat – US must get up to speed www.theregister.com/2025/04/2…

Russia used to be considered America’s biggest adversary online, but over the past couple of years China has taken the role, and is proving highly effective at it. This shift was signified by the Volt Typhoon attacks against the US last year, retired Rear Admiral Mark Montgomery told the RSA Conference in San Francisco on Monday.

WhatsApp says in-app AI tools will still keep messages secret therecord.media/whatsapp-…

WhatsApp is launching a new feature for the messaging platform that will ensure users’ messages remain private when being analyzed by AI tools, even if they are not kept within the app’s end-to-end encrypted protocol.

In a security engineering blog published Tuesday, the company previewed how its Private Processing feature will “enable users to initiate a request to a confidential and secure environment” where users can process messages using Meta AI without WhatsApp and Meta being able to access them.

The announcement comes amid ongoing public concerns about the ways in which AI service providers can access users’ interactions with their tools, potentially giving providers additional material to train their models.

AI-generated code could be a disaster for the software supply chain. Here’s why. arstechnica.com/security/…

AI-generated computer code is rife with references to non-existent third-party libraries, creating a golden opportunity for supply-chain attacks that poison legitimate programs with malicious packages that can steal data, plant backdoors, and carry out other nefarious actions, newly published research shows. The study, which used 16 of the most widely used large language models to generate 576,000 code samples, found that 440,000 of the package dependencies they contained were “hallucinated,” meaning they were non-existent.

One of the things that makes package hallucinations potentially useful in supply-chain attacks is that 43 percent of package hallucinations were repeated over 10 queries. [M]any package hallucinations aren’t random one-off errors. Rather, specific names of non-existent packages are repeated over and over. Attackers could seize on the pattern by identifying nonexistent packages that are repeatedly hallucinated. The attackers would then publish malware using those names and wait for them to be accessed by large numbers of developers.

Amazon launches its first internet satellites to compete against SpaceX’s Starlinks apnews.com/article/a…

Amazon’s first batch of internet satellites rocketed into orbit Monday, the latest entry in the mega constellation market currently dominated by SpaceX’s thousands of Starlinks. The United Launch Alliance’s Atlas V rocket carried up 27 of Amazon’s Project Kuiper satellites, named after the frigid fringes of our solar system beyond Neptune.

Stargazers oppose the fast-growing constellations of low-orbiting satellites, arguing they spoil observations. Others fear more satellite collisions.

Founded by Jeff Bezos, who now runs his own rocket company, Blue Origin, Amazon aims to put more than 3,200 of these satellites into orbit to provide fast, affordable broadband service around the globe.

Hackers ramp up scans for leaked Git tokens and secrets www.bleepingcomputer.com/news/secu…

Threat actors are intensifying internet-wide scanning for Git configuration files that can reveal sensitive secrets and authentication tokens used to compromise cloud services and source code repositories. In a new report from threat monitoring firm GreyNoise, researchers have recorded a massive spike in searches for exposed Git configs between April 20-21, 2025.

Developers or companies deploy web applications without correctly excluding .git/ directories from public access, inadvertently exposing these files to anyone. Scanning for those files is a standard reconnaissance activity that provides numerous opportunities for threat actors.

In October 2024, Sysdig reported about a large-scale operation named “EmeraldWhale” which scanned for exposed Git config files, snatching 15,000 cloud account credentials from thousands of private repositories.

Hello 0-days, my old friend: A 2024 zero-day exploitation analysis cloud.google.com/blog/topi…

GTIG tracked 75 zero-day vulnerabilities exploited in the wild in 2024. We divided the reviewed vulnerabilities into two main categories: end-user platforms and products (e.g., mobile devices, operating systems, and browsers) and enterprise-focused technologies, such as security software and appliances.

Vendors continue to drive improvements that make some zero-day exploitation harder, demonstrated by both dwindling numbers across multiple categories and reduced observed attacks against previously popular targets. At the same time, commercial surveillance vendors (CSVs) appear to be increasing their operational security practices, potentially leading to decreased attribution and detection.

We see zero-day exploitation targeting a greater number and wider variety of enterprise-specific technologies, although these technologies still remain a smaller proportion of overall exploitation when compared to end-user technologies. While the historic focus on the exploitation of popular end-user technologies and their users continues, the shift toward increased targeting of enterprise-focused products will require a wider and more diverse set of vendors to increase proactive security measures in order to reduce future zero-day exploitation attempts.

France blames Russian military intelligence for years of cyberattacks on local entities therecord.media/france-bl…

France has accused a hacker group controlled by Russia’s military intelligence agency (GRU) of orchestrating a series of cyberattacks against French institutions over several years. In a rare public attribution, the French foreign ministry said on Tuesday it “condemns in the strongest possible terms” the actions of the GRU-linked threat actor known as APT28.

According to French officials, APT28 — also known as Fancy Bear or BlueDelta, and long believed to be an arm of the GRU’s Unit 26165 —has been behind cyber operations affecting around ten French entities since 2021. The targets included public services, private companies and a sports organization involved in Olympic preparations.

The group reportedly relies on low-cost, easily accessible infrastructure like rented servers and VPNs to evade detection and complicate attribution, according to a report by France’s state cybersecurity agency (ANSSI).

VMware security advisory (AV25-242) - Canadian Centre for Cyber Security

VMware released security advisories on April 28, 2025, addressing vulnerabilities in Tanzu GemFire Vector Database and Tanzu Greenplum. Users are advised to review the provided links and perform the suggested mitigations.

“Shadow Role” Vulnerability In AWS Services Could Lead To Full Account Takeover

A critical vulnerability in six AWS services, including Glue, SageMaker, and CodeBuild, allows attackers to gain control over cloud environments. The flaw, called “Shadow Role,” exploits AWS’s automatic creation of default IAM roles with overly permissive trust policies. Aqua Security responsibly disclosed the issue to AWS, who patched the services, and advises organizations to audit their IAM roles.

Indian Court Orders Action to Block Proton Mail Over AI Deepfake Abuse Allegations

A high court in India ordered the blocking of Proton Mail across the country following a complaint alleging the receipt of obscene and abusive emails, including AI-generated deepfake imagery. The ruling, issued on April 29, 2025, mandates the Indian government to initiate proceedings to block Proton Mail URLs.

91% of organizations face vulnerability remediation delays | Security Magazine

A new report from Seemplicity reveals that 91% of organizations experience vulnerability remediation delays due to communication breakdowns and team collaboration issues. Despite 85% of organizations believing they have strong cross-team collaboration, the report suggests otherwise.

NT Analyzer can help determine “data broker” status under the new Bulk Data Transfer requirements | Data Protection Report

The U.S. Department of Justice’s new Bulk Data Transfer regulations, effective April 8, 2025, prohibit the transfer of bulk sensitive personal data to “countries of concern” including China, Cuba, Iran, North Korea, Russia, and Venezuela. The regulations define “bulk sensitive personal data” to include IP addresses and precise geolocation data, and consider data collected on over 100,000 U.S. persons in the previous 12 months to be in-scope. NT Analyzer, a proprietary testing tool, can help determine data broker status by identifying the host country of servers based on IP addresses and analyzing data transmission to third parties.

Meta Launches LlamaFirewall Framework to Stop AI Jailbreaks, Injections, and Insecure Code

Meta launched LlamaFirewall, an open-source framework to secure AI systems against cyber risks like prompt injection and jailbreaks. The framework includes three guardrails: PromptGuard 2, Agent Alignment Checks, and CodeShield. Alongside LlamaFirewall, Meta released updated versions of LlamaGuard and CyberSecEval, and launched the Llama for Defenders program.

AirPlay Vulnerabilities Expose Apple Devices to Zero-Click Takeover - SecurityWeek

Vulnerabilities in Apple’s AirPlay protocol and SDK could allow attackers to remotely execute code on devices, potentially leading to complete compromise. Two of the discovered vulnerabilities enable wormable zero-click remote code execution exploits, posing a significant risk to Apple and third-party devices using the AirPlay SDK. Apple has addressed these vulnerabilities in recent iOS, iPadOS, and macOS releases.

France Blames Russia for Cyberattacks on Dozen Entities - SecurityWeek

France’s cybersecurity agency, ANSSI, attributed cyberattacks on a dozen French entities to the Russian state-sponsored hacking group APT28. The attacks targeted government, administration, ministerial, aerospace, research, and financial organizations, as well as think-tanks. France condemned the attacks, stating they are contrary to UN norms of responsible state behavior in cyberspace.

RansomHub Went Dark April 1; Affiliates Fled to Qilin, DragonForce Claimed Control

RansomHub, a prominent ransomware-as-a-service (RaaS) operation, experienced a sudden shutdown of its online infrastructure on April 1, 2025. This event led to uncertainty among affiliates, with some migrating to Qilin, while others speculated about a potential takeover by DragonForce. The incident underscores the evolving nature of the ransomware landscape, with groups experimenting with new business models and tactics to maintain their influence and profitability.

Meta Releases Llama AI Open Source Protection Tools - SecurityWeek

Meta released new open source Llama AI protection tools, including Llama Guard 4, LlamaFirewall, and Llama Prompt Guard 2. These tools aim to enhance security for the open source AI community, providing safeguards for text and image understanding. Additionally, Meta introduced AI-enabled tools for security operations and launched the Llama Defenders Program for select partners.

China Hackers Used Trojanized UyghurEditPP App to Target Uyghur Activists

China-linked hackers targeted Uyghur activists using a Trojanized UyghurEditPP app in a spear-phishing campaign. The attackers impersonated a trusted contact, leading recipients to download a compromised version of the app, which contained a backdoor that collected system information and transmitted it to a remote server. The campaign, likely tied to the Chinese government, demonstrates a high level of social engineering and suggests a targeted operation against the Uyghur community.