Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Hugging Face Breach Raises Concerns Over AI-Driven Attacks

  Hugging Face is investigating a security incident after its production infrastructure was compromised in an intrusion the company says inv...

All the recent news you need to know
information management
AI adoption AI Data Governance AI governance AI technology Cyber Security Data Governance information management

AI Adoption Shifts Focus Toward Data Governance and Enterprise Trust

 

The rise of artificial intelligence (AI) is uncovering vulnerabilities in enterprise data governance, as organizations grapple with managing information rather than applications and users. As companies rely on AI to analyze, create, research, and make decisions using enterprise data, experts say data governance is becoming a priority. 

According to industry research, over 50% of employees are already using AI outside of corporate systems, raising concerns about shadow AI. However, experts say the bigger issue is understanding how enterprise information is being used, accessed, and processed by employees and systems. AI is fundamentally changing the value of enterprise data as it empowers organizations to analyze, summarize, and act on information instantly. Documents that previously required human analysis can now be processed by AI to extract business intelligence in seconds. 

This makes enterprise information more valuable than ever before as it becomes embedded in decision-making processes and systems. As the value of enterprise data increases, so does the need to ensure its context is appropriately maintained. Experts say that business documents, customer data, intellectual property, and presentations have value and meaning based on their intended use. 

As this information is shared internally and externally and processed by AI, policies, accountability, and governance must be attached to the data to ensure it is used as intended. Security professionals say information governance should be connected to the data itself rather than where that information is stored. They recommend that policies, procedures, and enforcement be attached to the information to ensure its proper use in an increasingly distributed and AI-driven enterprise. 

Trust is quickly becoming a critical success factor for organizations that want to maximize the value of AI while minimizing risk. Business leaders, regulators, and customers are demanding more excellent transparency, which puts pressure on enterprises to ensure sensitive information is handled responsibly. Experts say organizations that get governance right will be best positioned to adopt AI while maintaining the trust of their stakeholders. 

The next wave of AI innovation will include autonomous agents that can access and retrieve information, coordinate tasks, make recommendations, and take action across enterprise systems. These AI agents will require access to data, which means organizations must have robust information governance practices to ensure the data being processed is accurate and secure. 

As the capabilities of AI continue to evolve, enterprises are focusing on ensuring the information that fuels these systems is governed appropriately. Experts recommend organizations prioritize information governance, maintain the context of enterprise data, and leverage trusted AI to maximize the value of their data assets.
Read more »
Hardware Wallet Flaw
Bitcoin Theft Bitcoin Wallet Security Coinkite Coldcard Hardware Wallet Cryptographic Entropy Cyber Security Firmware Vulnerability Galaxy Research Hardware Wallet Flaw

Coldcard Wallet Security Incident Linked to Multi-Million Dollar Bitcoin Theft


 

There has been a connection between a critical firmware flaw in the Coldcard hardware wallet and one of the largest cryptocurrency thefts of the year, after hackers allegedly drained nearly $70.2 million in Bitcoins (BTC) from 1,196 wallets on July 30 by exploiting a critical firmware flaw, according to Galaxy Research. 

A firmware integration error introduced in March 2021 is responsible for the vulnerability, which affects Coldcard, a Bitcoin-only hardware wallet developed by Canadian company Coinkite. According to security researchers, affected firmware versions generated wallet recovery seeds using deterministic software-based pseudorandom number generators (PRNGs) rather than the hardware random number generators (RNGs) of the devices. In this way, the amount of randomness necessary to create cryptographic seeds has been significantly reduced. 

Block researchers explained that, under certain circumstances, an attacker could reproduce seed values offline under sufficient knowledge of the device's unique identification number and internal state. Attackers can then identify and steal funds from vulnerable wallets by matching those candidate seeds against publicly available blockchain addresses. 

It was found that the flaw occurred as a result of a production configuration error resulting in affected Coldcard devices relying on MicroPython's Yasmarang pseudorandom number generator instead of the hardware random number generator intended for them. 

During initialization of the fallback algorithm, unique identifiers and timer values of the device were used without the collection of fresh entropy, leading to significantly more predictable recovery seeds. Contrary to conventional cryptocurrency attacks directed towards exchanges, smart contracts, and online wallets, this incident involved hardware wallets designed to remain offline. 

According to security experts, the compromise did not require the device to be connected directly to the internet. As an alternative, attackers are alleged to have generated a large number of possible recovery seeds offline, derived the addresses of the corresponding wallets, and compared them with blockchain records available on the Internet until they found matching wallets containing Bitcoins. 

As determined by investigators, the attacker generated candidate recovery seeds using hardware configured under similar conditions, then deduced the Bitcoin address corresponding to each seed. The address of a blockchain is publicly visible, and matching the address of a recreated seed to the address of an active wallet would allow the attacker to retrieve the private keys and transfer funds without physically accessing the victim's device. 

A firmware update was released by Coinkite on July 31 for all Coldcard models that were affected. However, the company has stressed that installing the update alone will not secure wallets that have been created with vulnerable firmware. 

Users whose recovery seeds were generated on affected versions have been advised to generate new seeds utilizing the patched firmware and transfer their Bitcoin to new wallets as soon as possible. It is important to note that even when an old seed is restored on an updated firmware or another wallet, the underlying weakness remains. 

Galaxy Research has reported that the stolen funds were transferred in batches over a period of six Bitcoin blocks rather than through a single continuous transaction. Observations by researchers indicated that three interconnected blocks did not show any related activity, indicating that the transactions were deliberately grouped before being broadcast. 

Coldcard versions 4.0.1 to 4.1.9, Mk4 and Mk5 versions before 5.6.0, Q versions before 1.5.0Q, and Edge builds released prior to the latest patches are affected by this firmware. The vulnerability has been estimated by Coinkite to reduce the effective entropy of wallet recovery seeds by approximately 40 bits for Mk3 devices and around 72 bits for Mk4, Mk5 and Q devices. This results in significantly lower levels of security than a standard 12-word BIP-39 seed's 128-bit encryption. 

Researchers noted that practical challenges in recovering a seed are still influenced by factors such as device characteristics, boot timing and computational resources. It was noted by Coinkite that wallets generated with at least 50 fair and private dice rolls do not suffer from this vulnerability. Despite the fact that a strong passphrase provided additional security, users should nonetheless replace vulnerable seeds with stronger BIP-39 passphrases. 

Multisignature wallets will not be compromised if all signing devices are not affected by the same issue. There has been no public identification of the attacker. According to Galaxy Research, the observed on-chain transaction patterns indicate a coordinated wallet sweep, but do not conclusively indicate theft. Researchers also observed that blockchain activity followed a distinctive transaction pattern, though they cautioned that on-chain analysis alone cannot conclusively prove theft. 

The pattern instead pointing to coordinated wallet sweeps consistent with a single operator or related group of operators, which has raised concerns over the importance of secure random number generation in cryptocurrency wallets. In order to store cryptocurrency offline securely, hardware devices that remain disconnected from the internet must maintain strong cryptographic entropy during wallet creation, and any weakness in that process can compromise its security. 

After Coinspect released the "Ill Bloom" vulnerability in just weeks past, another weak random number generation vulnerability has led to more than $5 million worth of cryptocurrency theft across Bitcoin, Ethereum, Tron, Rootstock and Polygon, with the "Ill Bloom" vulnerability being linked to more than $5 million in cryptocurrency thefts. Even wallets designed with strong offline security can be compromised by vulnerabilities in cryptographic randomness. 

A subsequent update from Galaxy Research identified two more suspected Coldcard-related wallet sweeps, which increased the estimated losses to 1,367.05 Bitcoins, worth approximately $88.6 million across 4,585 addresses, for a total of 1,367.05 Bitcoins. In addition to sharing details with federal investigators, compliance organizations and cybersecurity teams about nearly 600 suspected attacker-controlled addresses, the firm said the activity is ongoing.
Read more »
Supply Chain
Bitcoin Crypto Wallet Cyber Security Ethereum Supply Chain

Hackers Compromise Organization to Swap Crypto Wallet Address In A Supply Chain Attack


Threat actors exploited a JavaScript file offered by advertising technology firm Adform, and modified it into a browser-side tool that rewrites crypto wallet addresses.

Malicious script

Adform found the incident and removed the malicious code, informed the impacted clients, and notified the authorities.

For users who visited a website carrying the modified script on July 27 and copied Ethereum, Tron, or Bitcoin may have deployed malicious code by pasting the a different address.

What should the users do?

Adform has advised users to clean their browser cache as the modified file may stay cached after the fix, and to also double-check any wallet address before sending any money.

According to Adform, the code was not built to deploy software or create persistence and worked only when an affected page stayed open. Clipboard copying was not the only method of replacement; the captured sample also rewrites addresses entered straight into form fields. 

According to Adform’s implementation document, the tracking code can run across a website, several sections, or even a single page. Exploiting the shared resource allowed the hackers a path into downstream websites without having to hack each one of them. Supply chain compromise happened due to the shared deployment path. 

Shared path leading to supply chain attack

One modified address at the point of payment could change a transfer, as the impacted page stayed open.

Security expert Beaumont discovered the hack and said, "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.”

Beaumont also said that “this allows end user devices of downstream websites to be compromised with crypto stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device.” The file and linked domains, IP addresses, and URLs showed no detections on VirusTotal at the time. 

The discovered sample consists of two malicious blocks attached to the authentic library. Their replacement strings are hidden with a six-byte XOR key. The first looks out for the copy event, attempts to read the clipboard every four seconds, and to replace matching addresses.

The second block rewrites values in textarea, contenteditable elements, and input, and restores the cursor point after a rewrite.

“Based on our investigation to date, we have found no evidence that the malicious code transmitted users’ IP addresses or information about the websites they visited to an external party. Technical analysis indicates that such transmission may have been possible, and this aspect remains under investigation,” says Adform.

Read more »
User Privacy
ALPR Cyber Security Flock Cameras Florida User Privacy

Flock Cameras Blanket Southwest Florida, Sparking Privacy and Safety Backlash

 

Flock Safety's automated license plate reader (ALPR) cameras are spreading rapidly across Southwest Florida, with hundreds now installed at intersections, parking lots, and private communities. These solar-powered devices, mounted on poles along roads, capture detailed vehicle data—including license plates, make, model, color, and unique features like bumper stickers or dents—every time a car passes. The information is instantly uploaded to a shared law enforcement database, enabling police to search and track vehicles without warrants, raising serious privacy concerns among residents and civil liberties advocates.

The network's growth in Southwest Florida reflects a national trend, with over 100,000 Flock cameras now mapped across the United States. In Cape Coral and surrounding Lee and Charlotte counties, cameras are so dense that some intersections have readers on every corner. Local agencies, including the Cape Coral Police, Sanibel Police, and county sheriffs, use Flock or access its shared data, while private gated communities and businesses also deploy cameras that feed into the same system. Florida law allows agencies to query Flock records from other jurisdictions nationwide without a warrant, amplifying the reach of this surveillance infrastructure.

Critics argue that Flock's technology enables mass surveillance, as the AI-powered cameras generate "vehicle fingerprints" and log every trip, from grocery runs to medical appointments. Privacy advocates warn that the data can be misused: police officers have been caught using Flock networks to stalk ex-partners, with hundreds of illegal license plate searches documented. Additionally, a 2025 investigation found at least 60 Flock cameras exposed to the open internet, allowing outsiders to view live footage, highlighting security vulnerabilities in the system. 

Backlash against Flock has intensified, with citizens in five states destroying cameras using sledgehammers and vice grips, while city governments in Fort Collins, Eugene, Madison, and others have canceled contracts or deactivated the devices. At the federal level, Representative Thomas Massie plans to introduce legislation blocking federal funding for Flock cameras, citing civil liberties concerns. Road safety advocates have also raised alarms, noting that Flock's 80,000 to 100,000 roadside poles may violate federal clear-zone rules, creating crash hazards beyond privacy issues. 

As Flock cameras expand into retail parking lots—Home Depot and Lowe's have deployed them nationwide—the debate over warrantless surveillance and data sharing is set to intensify. For Southwest Florida residents, the visible proliferation of these devices underscores a broader tension between law enforcement capabilities and the right to privacy in public spaces.
Read more »
Telecom Industry
eSIM mobile carriers Technology Telecom Industry

Here's Why eSIM Became a Trap for Mobile Users

 

eSIM technology was heralded as the future of mobile connectivity, promising to eliminate the hassle of physical SIM cards and make switching carriers as effortless as connecting to Wi-Fi. However, the reality has fallen short of this vision, with mobile operators transforming what should have been a consumer-friendly innovation into a mechanism for maintaining control and creating new friction points for users. 

Promise versus the reality 

The original concept behind eSIM was straightforward and appealing: embedded SIM chips soldered directly onto smartphone motherboards would allow users to download carrier profiles digitally, eliminating the need for tiny plastic cards, waiting for postal deliveries, or fumbling with paperclip tools to access SIM trays. This technology promised seamless international travel connectivity, instant carrier switching, and the ability to store multiple profiles on a single device. Instead, carriers have retained many of the old constraints while adding new layers of complexity to the activation and transfer processes. 

The most significant issue with eSIM implementation is that carriers maintain complete control over profile provisioning and transfers. Unlike physical SIM cards that could be moved between devices in seconds, eSIM transfers often require carrier intervention, lengthy customer service calls, and verification processes that can take hours or even days. Many carriers impose restrictions such as one-time-use QR codes that expire quickly, fees for profile replacements, and limits on how many times users can re-provision their eSIM. When phones are carrier-locked, which is common with devices purchased on installment plans, users cannot add competing carrier profiles until the device is fully unlocked, sometimes requiring months of payments or complete balance settlement. 

Perhaps the most frustrating aspect of eSIM technology is the difficulty of switching devices. With physical SIM cards, transferring service to a new phone was as simple as removing the card from one device and inserting it into another. Now, the process has become a "joint decision" between users and carriers, requiring multiple authentication steps, carrier app interactions, and often technical support assistance. If a phone breaks or is lost, users find themselves without service until the carrier issues a new digital profile, whereas a physical SIM could be immediately transferred to a backup device. This creates significant vulnerability during emergencies or travel situations where immediate connectivity is essential. 

Path Forward

Despite these challenges, eSIM technology still offers genuine benefits for specific use cases, particularly international travel where services like Saily enable seamless profile switching without physical card exchanges. However, realizing the technology's full potential requires industry-wide standardization of activation and transfer processes, regulatory intervention to prevent carrier lock-in tactics, and consumer advocacy for clearer provisioning standards. Until carriers prioritize user experience over retention strategies, eSIM will remain a half-realized promise that has inadvertently created new barriers to mobile connectivity freedom while maintaining the very dependencies it was supposed to eliminate.
Read more »
Third-Party Cloud Security
Amgen Data Breach Data Breach Data Exfiltration Healthcare cybersecurity Patient Health Information Pharmaceutical Cybersecurity Third-Party Cloud Security

Third-Party Cloud Breach Exposes Patient Data at Amgen


 

The global biotechnology company Amgen has disclosed a significant data breach resulting from unauthorized access to cloud environments operated by third-party service providers, leading to the theft of sensitive patient and corporate information. According to a filing with the Securities and Exchange Commission (SEC), the pharmaceutical company, based in California, discovered the incident in July 2026 and initiated its cybersecurity incident response process immediately. 

Several containment measures were implemented by the company and independent forensic experts were engaged in an investigation into the breach. As a result of assessing the volume of files that appeared affected and determining that the compromised data could contain sensitive information, Amgen formally classified the incident as material on July 29, 2017. 

As part of the legal requirement to inform investors of significant cybersecurity incidents, the company made the disclosure in a regulatory filing with the Securities and Exchange Commission. Upon preliminary investigation, it was determined that hackers successfully exfiltrated data from a number of cloud-based systems. 

In addition to proprietary corporate data, protected health information (PHI) belonging to patients, and other sensitive records, this information has been compromised. Despite not identifying the vendors involved or revealing how the attackers gained access to the stolen data, Amgen claims that the stolen data originated from cloud storage environments managed by third-party service providers. Additionally, Amgen is assessing whether confidential business information, intellectual property, research and development data, and additional patient information was compromised. 

During the ongoing forensic investigation, the company is continuing to determine if patient records, confidential business information, intellectual property, research and development data, or other sensitive information was accessed or stolen during the incident. 

Upon completion of the forensic investigation, the full scope of the compromise is anticipated. There has been no disclosure by the company as to identification of the third-party cloud providers, attack vectors used by threat actors, or number of individuals affected. No known cybercriminal organization has been attributed to the incident.

Following an evaluation of the number of potentially affected files and the likelihood that they contained highly sensitive information, Amgen determined that the breach was material on July 29. Even though the breach is serious, the company stated that it does not anticipate that the breach will adversely affect its financial condition or operating results in the near future. 

In addition to the assistance of external cybersecurity experts, the investigation is currently ongoing. Considering its legal and regulatory obligations, Amgen stated that it would notify affected patients where required under applicable data protection laws. According to Amgen's current assessment, the cybersecurity incident has not adversely affected its products, manufacturing operations, financial reporting systems, or its ability to continue supplying medicines and meeting the needs of patients. 

There has been an increase in cyberattacks targeting healthcare and pharmaceutical organizations, whose cloud-hosted patient records and valuable research data have made these organizations attractive targets for cybercriminals. In addition to highlighting the increasing cybersecurity risks associated with third-party cloud infrastructure, the incident highlights the importance of securing sensitive healthcare data throughout the supply chain as a whole. 

Amgen stated its response was to activate its cybersecurity incident response plan immediately after detecting the unauthorized activity, implement containment measures in order to limit exposure, and continue to work with independent forensic experts to determine the extent and impact of the incident. There has been an increase in cybersecurity incidents impacting the healthcare and pharmaceutical sectors in recent months. 

The breach is another in a string of recent cybersecurity incidents. The industry has also experienced numerous cyber incidents, including Abbott Laboratories, Clover Health, Stryker, Medtronic, Novo Nordisk, and West Pharmaceutical Services, which illustrates the increasing vulnerability of medical and corporate data to cyberattacks. 

Amgen has not yet disclosed whether it has received any extortion demands or whether the attackers have attempted to take advantage of the stolen data for ransom or another malicious purpose. It is anticipated that additional details will be released once the forensic investigation has been completed. 

Privacy-preserving technologies are reshaping digital identity verification as governments enforce age verification requirements. It is anticipated that solutions that minimize biometric data collection while maintaining security and regulatory compliance will play an important role in the future of online security.
Read more »
Subscribe to: Posts (Atom)

Featured