BankInfoSecurity.com

Also: Why AI Agents Are Colliding, What Good Governance Ought to Look Like
In this week's panel, four ISMG editors discussed real-time vishing attacks that are defeating MFA, the growing problem of AI agents making conflicting decisions inside of enterprises and why the next phase of AI adoption depends on governance, accountability and control.

Comstar Paid Feds $75K Last Year to Settle HIPAA Allegations in Same 2022 Breach
An ambulance billing and collections firm has agreed to pay $515,000 to Massachusetts and Connecticut regulators and implement a prescriptive information security program in the aftermath of a 2022 hacking incident affecting the sensitive information of nearly 350,000 residents in those states.

ACAMS Says Investigators Need Better Data, Architecture and AI-Based Detection
The financial system has a trust problem driven by artificial intelligence, and CIOs looking to prevent fraud and other financial crimes will only face more challenges as criminals find new ways to use AI to swindle, according to an Association of Certified Anti-Money Laundering Specialists survey.

Also, SmarterMail Flaw, Nike Breach Probe, Empire Market Co-Creator Pleads Guilty
This week, researchers exposed an Android RAT abusing Hugging Face. Attackers exploited a SmarterMail flaw. Automakers raised cyber spending. CISA flagged a VMware bug. Microsoft patched Office. An Empire Market co-creator pleaded guilty. Nike probed a breach.

Agents Fuel Digital Risk Protection, Open-Source Intel Adoption in Regulated Spaces
Outtake will invest $40 million to grow its automated platform for digital risk protection and open-source threat intelligence. CEO Alex Dhillon says the New York-based startup's agent-led model stands apart by replacing manual labor with scalable AI workflows.

Revisions to 42 CFR Part 2 that go into effect soon to better align federal regulations for the confidentiality of substance use disorder records with HIPAA require entities to adjust their compliance programs. But the changes aren't easy, said attorney David Holtzman, founder of HITprivacy LLC.

Web-Based Client on Local Host Didn't Sanitize Inputs
Video camera surveillance management software made by South Korean manufacturer Idis is susceptible to a one-click attack giving hackers the power to execute arbitrary code. The vulnerability allows an attacker to escalate beyond the browser sandbox and achieve code execution on the host.

Reported Victim Tally in HCIactive's Health Data Theft Incident Soars
The victim count in a 2025 hack against a Maryland-based firm that provides "AI-powered" administrative and technology services to healthcare practices soared to nearly 3.1 million nationwide, according to an updated breach report from Healthcare Interactive.

CIO Elliott Cheu on Identity Upgrades, Unified Support and Research-Ready Systems
The University of Arizona is advancing a campus-wide modernization and security agenda by centralizing a previously fragmented IT environment and unifying core platforms that support teaching, research and operations, said Elliott Cheu, CIO at the university.

CISA Defends Director’s Use of AI Tool Despite Internal Compliance Review
Cybersecurity and Infrastructure Security Agency Acting Director Madhu Gottumukkala uploaded sensitive documents to ChatGPT under a temporary, approved exception, prompting internal alerts and reigniting concerns over the agency's AI governance and leadership judgement.

CISA Urges Agencies to Treat Quantum Readiness as a Standard Buying Expectation
The Cybersecurity and Infrastructure Security Agency is urging agencies to treat post-quantum cryptography as a near-term procurement expectation, signaling that information technology products should embed quantum-resistant security now to avoid rushed retrofits before federal migration deadlines.

Trellix Says Email, Identify Failures Are Among Top Vectors in Health Compromises
Of the millions of threats detected in healthcare IT environments last year, email phishing, identity failures and device vulnerabilities were among the top vectors for non-clinical IT compromises - often "cascading" and disrupting patient care, said a new report from security firm Trellix.

Digital Risk Protection Startup to Expand Preemptive Scam Detection Tools
With brand impersonation and account takeover attacks surging, Memcyco raised $37 million in Series A funding to scale its preemptive scam detection platform. The firm plans to grow its sales team, develop AI-based features and support new product launches in the coming year.

Cisco Research Shows How AI Is Reshaping Data Privacy and Governance
Enterprise data privacy and governance are undergoing fundamental shifts as the promised speed and efficiency of artificial intelligence come crashing into the realities of data risk and regulatory uncertainty.

The Urgency of High-Assurance Identity Proofing Amid Growing Identity Fraud
Remote work has fueled a new crimewave built on stolen and synthetic identities. As deepfakes scale, high-assurance identity proofing - combining biometrics, liveness detection and verified IDs - becomes essential to verify users, prevent impersonation and protect enterprise access.

Identity Proofing Becomes Essential as Remote Work Redefines Enterprise Trust
Remote work has expanded hiring reach but introduced new risk. Identity now must be verified through digital signals rather than physical interactions. High-assurance identity proofing using solutions such as MajorKey's IDProof+ helps enterprises protect data, mitigate fraud and preserve trust.

From Remote Hiring to Access and Support, Trust Must Be Verified - Not Assumed
Attackers no longer break in - they simply impersonate an employee or contractor to gain access. Discover how continuous identity assurance across hiring, third-party access and call centers reduces human-layer risk, and how IDProof+ enables fast, trusted verification across critical workflows.