SEC Eyes Final Rules on Incident Disclosure, Board Expertise

Michael Novinson • March 31, 2023

Rules coming in April could require publicly traded companies to disclose a breach within four days of deeming it material as well as board member cybersecurity expertise. The SEC in March 2022 proposed a mandate that companies disclose "material" incidents within four business days of discovery.

►

Analytics

Essential Steps to Building a Robust API Security Program

Latest

3rd Party Risk Management

North Korean Lazarus Group Linked to 3CX Supply Chain Hack

Prajeet Nair • April 1, 2023

Security researchers have uncovered more evidence that the North Korean Lazarus group is responsible for the software supply chain attack on 3CX, a voice and video calling desktop client used by major multinational companies. Tools and code samples match previous Lazarus hacks.

Cloud Security

Evolving AlienFox Malware Steals Cloud Services Credentials

Prajeet Nair • March 31, 2023

Hackers have used a modular toolkit called "AlienFox'" to compromise email and web hosting services at 18 companies. Distributed mainly by Telegram, the toolkit scripts are readily available in open sources such as GitHub, leading to constant adaptation and variation in the wild.

Breach Notification

Subprime Lender TitleMax Hit With Hacking Incident

Rashmi Ramesh • March 31, 2023

The parent company of subprime lender TitleMax says hackers made off the Social Security numbers and financial account information of up to nearly 5 million individuals. The company notified the FBI and "believes the incident has been contained." Hackers stole information over an 11 day period.

3rd Party Risk Management

3 More Healthcare Entities Report Website Tracking Breaches

Marianne Kolbasuk McGee • March 31, 2023

Three more healthcare organizations have joined the growing list of entities reporting large data breaches to federal regulators involving the previous use of tracking codes on their websites.

Artificial Intelligence & Machine Learning

Italian Privacy Watchdog Imposes ChatGPT Ban

Akshaya Asokan • March 31, 2023

Italian regulators announced Friday an effective ban on ChatGPT after determining that artificial intelligence firm OpenAI likely engaged in a massive illegal collection of personal data. The agency gave OpenAI until April 19 to address its concerns or potentially face fines.

Endpoint Security

Spyware Campaigns Exploited Zero-Day iOS and Android Flaws

Jayant Chakravarti • March 30, 2023

Google says it spotted two "highly targeted" advanced spyware campaigns using zero-days in the Android and iOS operating systems and vulnerabilities in the Samsung Internet Browser. The U.S. Cybersecurity and Infrastructure Security Agency ordered agencies to patch many of the vulnerabilities.

Blockchain & Cryptocurrency

Cryptohack Roundup: Euler Finance, SafeMoon, BitKeep

Rashmi Ramesh • March 30, 2023

Every week, Information Security Media Group rounds up cybersecurity incidents in the world of digital assets. In focus between March 24 and 30: SafeMoon, an update on Euler Finance, crypto-stealing Clipper malware, BitKeep, theft fail at Swerve Finance, THORChain, APT43 and an update on ParaSpace.

Cyberwarfare / Nation-State Attacks

3CX Desktop Client Under Supply Chain Attack

Prajeet Nair • March 30, 2023

Suspected North Korean hackers trojanized installers of a voice and video calling desktop client made by 3CX and used by major multinational companies. The vulnerability traces to a poisoned Electron software library file, an open-source framework for user interfaces.

Cyberwarfare / Nation-State Attacks

Leaks Reveal Moscow Source for Hacking, Disinformation Tools

Mathew J. Schwartz • March 30, 2023

Leaked documents from a Moscow IT consultancy reveal how the Russian government has commissioned tools for its military and intelligence agencies for conducting cyber operations, information warfare, and controlling the internet, as well as training critical infrastructure hackers.

Fraud Management & Cybercrime

Breach Roundup: Lumen, QNAP, NCB and Toyota Italy

Mihir Bagwe • March 30, 2023

In this week's data breach spotlight: Telecom giant Lumen reports incidents, Taiwanese hardware vendor QNAP discloses vulnerabilities, debt collector NCB suffers a data breach and more data breaches occur in Australia. Also, there's a new Mac info stealer, and Toyota Italy exposed customer data.

Fraud Management & Cybercrime

Will Customer Refunds for Scams Trigger First-Party Fraud?

Suparna Goswami • March 30, 2023

The U.S. Consumer Financial Protection Bureau is mulling over whether to reimburse consumers for online scams and fraud, but this regulatory change could lead to an increase in first-party fraud, cautioned Karen Boyer, senior vice president of financial crimes at M&T Bank.

Anti-Phishing, DMARC

Phishing Campaign Tied to Russia-Aligned Cyberespionage

Mathew J. Schwartz • March 30, 2023

A hacking group with apparent ties to Russia or Belarus has been using "simple yet effective attack techniques and tools" to gain access to multiple governments' email systems as part of apparent cyberespionage operations in support of Russia's invasion of Ukraine, researchers warn.