DataBreachToday.com

Contec and Epsimed Monitors Containing 'Backdoors' Are at the Center of Order
Texas Gov. Abbott has ordered agencies to review foreign-made connected medical devices - especially those from Chinese manufacturers - used in state-owned facilities for cybersecurity issues that could pose security and privacy risks to patients and healthcare infrastructure.

Also: CISA Protocol Concerns, AI Agents Push Past Cybersecurity Controls
In this week's panel, four ISMG editors unpacked the cyber dimensions of the Stryker attack amid the escalating Iran-Israel-U.S. tensions, the growing controversy around CISA leadership and alleged protocol breaches, and a new set of concerns related to AI agents bypassing security controls.

New Handala Site Is Also Available
U.S. federal agents seized four web domains associated with Iranian hacking operations days after a threat actor going by Handala posted screenshots it said came from inside the IT systems of medical device manufacturer Stryker. The registrars used to create them are located in the United States.

Phishing Campaign Used AsyncRAT to Maintain Long-Term Network Access
A suspected cyberespionage campaign targeted a Libyan oil refinery using commodity malware and politically themed phishing lures. The activity ran from November 2025 to mid-February, with evidence that attackers maintained long-term access to at least one oil company network.

No Arrests, But Virtual Servers, IP Addresses Seized and Residencies Searched
U.S. authorities seized KimWolf - the attack infrastructure responsible for the largest distributed denial of service attack yet recorded in an international police operation that swept up servers underpinning four botnets.

New Filing Frames Anthropic Dispute as Operational Control Issue - Not Free Speech
The Justice Department is arguing in a new court filing that Anthropic’s ability to update guardrails and behavior post-deployment creates unacceptable supply-chain risks, warning that vendor access to AI systems could enable manipulation or failure in mission-critical defense operations.

Newly Minted Unicorn Says AI-Driven Attacks Force Shift to Continuous Pen Testing
Xbow has raised $120 million in Series C funding after proving its autonomous AI hacking platform can outperform human pen testers. CEO Oege de Moor says the rise of AI-driven cyberattacks is forcing enterprises to test systems continuously rather than periodically.

Also, Telus Breach, Microsoft Hotpatching, Interpol Malicious IP Takedown
This week, Russian hacker OpSec failure, Interpol helped disrupt 45,000 malicious IPs, the FBI is looking for an ATM jackpotting suspect and Telus disclosed a breach. Windows hotpatching, an FTP exploit, a foiled attack on a nuclear research center and China-linked espionage.

Vulnerability Affects Certain Centricity Medical Imaging Products
The U.S. Food and Drug Administration has issued a recall notice for certain GE Healthcare Centricity medical imaging products due to a "potential" cybersecurity vulnerability that could allow a hacker to manipulate data or impact availability of the affected products.

Practical Guide to Collector-First Architecture and Phased OTel Migration
OpenTelemetry has become the observability standard, but adoption remains difficult. This blog provides a blueprint for teams to implement OTel with collector-first architecture, edge and gateway design, gradual migration and combined instrumentation strategies.

Medtech Maker Is Still Recovering While Iranian Hackers Threaten More Attack Victims
As medtech maker Stryker continues working to restore global IT systems brought offline by a cyberattack last week, class action lawsuits against the company are piling up in federal court and the Iranian hackers claiming credit for the attack are warning of more assaults to come on other victims.

White House Cyber Strategy Urges Deeper Industry Partnership Without Defining Roles
The administration's cyber strategy pushes deeper public-private coordination and expanded threat visibility across critical infrastructure, but lacks specifics on operational roles, incentives and legal protections needed for industry to actively disrupt malicious activity.

CEO Says Added OEM Context Can Sharpen Industrial Cybersecurity and New Use Cases
Nozomi Networks CEO Edgard Capdevielle said Mitsubishi Electric's purchase gives the industrial cybersecurity firm richer OEM context to improve OT and IoT security and pursue adjacent use cases such as asset visibility, maintenance support and operational efficiency across critical infrastructure.

Datos Insights' Serpil Hall on Using Predictive AML Tools to Support Compliance
Instant payments are reshaping financial crime controls as speed and the irreversibility of transactions strain anti-money laundering compliance programs. While many assume real-time AML means faster processing, this approach can increase risk, said Serpil Hall, strategic advisor at Datos Insights.