DataBreachToday.com

It's Time for Enterprises to Manage Risks Posed by Compromised Personal Devices
Online job scams have evolved beyond consumer fraud and now pose a direct threat to corporate networks. Google warns that scammers are embedding remote access Trojans and info-stealers disguised as interview software or application materials to hack personal devices and ultimately corporate systems.

OT Security 'a Generation Behind Traditional IT'
For those charged with the cyber defense of OT and industrial control systems, one challenge towers above all others: Data. Specifically, its scarcity. Most operators simply don't capture it, in stark contrast with their IT counterparts.

Senate HELP Committee Chair Seeks to Secure Data in Smart Watches, Health Apps
Sen. Bill Cassidy, R-La., a physician and chair of the Senate health committee, has proposed legislation that aims to create parallel HIPAA-like privacy protections to more types of health data - such as data collected by consumer wearable devices and health apps - not currently covered under HIPAA.

Keyless's Biometric Tech to Improve Privacy, Account Recovery and User Experience
Ping Identity will acquire Keyless to expand passwordless authentication to frontline workers who lack access to smartphones. The deal gives Ping deepfake-resistant, privacy-first biometrics that don't store user templates on servers, easing identity verification and account recovery.

Spyware Targets Samsung Galaxy Devices, Says Unit 42
Hackers used previously unknown commercial spyware dubbed "Landfall" to surveil the activities of Samsung Galaxy device owners in the Middle East, say security researchers who posit the threat actor has connections to the United Arab Emirates.

Audit Issues, Policy Debt and Limited Project Scope Are Hampering Adoption
Microsegmentation has long been touted as the gold standard for restricting lateral movement by hackers. It helps lock down network traffic and reduces the blast radius of a breach. Vendors say it's transformative, but if you walk into most large enterprises, you'll will find it half-implemented.

CISA Argues None of 54 Fired Workers Fall Under Union Protections
The Cybersecurity and Infrastructure Security Agency told a federal court it complied with an injunction blocking shutdown-related layoffs by sending reduction-in-force notices only to non-union staff within a unit vital to coordination with state, local and private-sector defenders.

OTsec India Steering Committee Discuss Cyberthreats, Compliance and Innovation
Featuring some of the most prominent voices in Indian operational technology cybersecurity, the steering committee for the inaugural OTsec India Summit shares insights on a range of topics including OT threats, regulatory imperatives and the latest innovations.

Also: SBF Appeals Conviction, PHP Exploits Fuel Cryptomining
Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Europol's 600 million euro fraud network bust, Sam Bankman-Fried conviction appeal, PHP exploits fueled cryptomining campaigns and sentencing set for Samourai Wallet founders.

Statewide Breach Hit 60 Agencies Before Ransomware Was Deployed
A threat actor infiltrated Nevada’s statewide systems undetected for months, ultimately disrupting at least 60 agencies by deleting backups and launching ransomware that forced a full rebuild of core infrastructure and triggered a multimillion-dollar emergency response.

Also, Australian Police Arrest 55 in New Round of Anom App Sting
This week: UPenn hit by email breach, Australian police arrested 55, 'SesameOp' backdoor hid C2 traffic, BEC scammers used AWS, hackers stole trucking cargo, Ukrainian national extradited to United States for role in Conti ransomware and a supply chain risk in advanced installer tool.

Central Jersey Medical Center Runs Health Centers for Schools in Newark
Central Jersey Medical Center, a federally qualified health center that partners with public schools in Newark, New Jersey, is notifying an undisclosed number of people of a data breach related to an August ransomware attack. The incident is latest to hit a resourced-stretched healthcare provider.

Learn the Business, Be Intentional, Find a Mentor and Build Non-Technical Skills
New to cybersecurity? Start by learning how organizations work - their people, processes and priorities - before diving deep into technical stacks. Understanding how to translate technical findings into business risk differentiates a professional from a technician.

DOJ: Suspects Hit 5 Firms, Including 3 in Healthcare, Netted $1.3M in Ransom Money
Three former employees of two cybersecurity firms stand accused of using BlackCat ransomware in a conspiracy to extort five U.S. companies, including three in the healthcare sector. One of the victim companies paid nearly $1.3 million to the attackers, U.S. federal prosecutors said.

DHS Plans to Expand SAVE Database Use Raise Privacy, Accuracy and Security Concerns
A Department of Homeland Security move to broaden an immigration verification database into a voter verification tool could expose sensitive information to security threats. Critics caution it accelerates a pattern of data being repurposed by the Trump administration for surveillance.

Chinese Hackers Target European Diplomats with LNK File Flaw
Chinese nation-state hackers are exploiting a Windows vulnerability to hack European diplomatic outposts, say security researchers - but operating system giant Microsoft says the flaw doesn't merit a patch. Hackers used a flaw already compromised by North Korea and Russia.

Funding Round Led by Goldman Sachs Boosts Valuation to $6.1 Billion
Another cybersecurity vendor is planning to dive into the still waters of an initial public offering. Cyber exposure management firm Armis dipped its toe in the market Wednesday, announcing a pre-IPO funding round of $435 million that boosted the company's valuation to $6.1 billion.