Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

NCSC Warns of Rising Cyber Threats Linked to China, Urges Businesses to Build Defences

  The United Kingdom’s National Cyber Security Centre (NCSC) has cautioned that hacking groups connected to China are responsible for an inc...

All the recent news you need to know
Identity Theft
Airline Customer Data Cyber Attacks cyberattacks on airline Data Breaches Data Leak data security Hackers Identity Theft

Qantas Data Leak Highlights Rising Airline Cyberattacks and Identity Theft Risks

 

Airlines continue to attract the attention of cybercriminals due to the vast amounts of personal data they collect, with passports and government IDs among the most valuable targets. According to privacy firm Incogni, the exposure of such documents poses a “severe, long-term identity theft risk” since they are difficult to replace and can be exploited for years in fraud schemes involving fake identities, counterfeit documents, and impersonation scams. 

The recent Qantas Airways data breach, claimed by the Scattered LAPSUS$ Hunters group, underscores the sector’s growing vulnerability. The stolen data included names, email addresses, Frequent Flyer details, and limited personal information such as phone numbers and birth dates. Fortunately, Qantas confirmed that no passport details, financial information, or credit card data were compromised. 

However, experts warn that even limited leaks can have serious consequences. “Attackers often combine personal identifiers like names and loyalty program details from multiple breaches to build complete identity profiles,” said Darius Belejevas, Head of Incogni. Such composite records can enable large-scale fraud even without financial data exposure. 

The Qantas incident also highlights the danger of third-party compromises. The breach reportedly stemmed from Salesforce social engineering and vendor vulnerabilities, illustrating how a single compromised supplier can have ripple effects across industries. Belejevas emphasized that “one compromised partner can expose millions of records in a single incident.” 

Data breaches in the airline industry are escalating rapidly. According to Cyble’s threat intelligence database, more than 20 airline-related breaches have been reported on the dark web in 2025 — a 50% increase from 2024. Much of this surge is attributed to coordinated attacks by Scattered Spider and the broader Scattered LAPSUS$ Hunters alliance, although other groups have also begun targeting the aviation sector. 

In a separate incident, the CL0P ransomware group claimed to have breached Envoy Air, a regional carrier of American Airlines. Envoy confirmed the intrusion but stated that no customer data was affected, only limited business information. In contrast, WestJet, which suffered a breach in June 2025, had passports and government-issued IDs exposed, prompting it to offer two years of free identity monitoring to affected customers. Incogni, however, warned that identity theft risks from such documents can persist well beyond two years. 

Experts urge travelers to take preventive security measures. Incogni recommends enrolling in identity theft monitoring, reporting phishing attempts to national anti-fraud agencies, using strong passwords with multi-factor authentication, and removing personal data from data broker sites. 

“Individuals and organizations must do more to safeguard sensitive data,” said Ron Zayas, CEO of Incogni. “In today’s world, data isn’t just being stolen by hackers — it’s also being misused by legitimate entities to manipulate outcomes.”
Read more »
Ransomware attack
Aviation System Collins Aerospace Cyber Attacks European Flights Ransomware attack

Hundreds of European Flights Disrupted by Major Ransomware Attack

 

A major ransomware attack recently caused widespread disruption to airline operations across several key European airports, resulting in hundreds of flight cancellations and delays for passengers. The incident highlights the growing vulnerability of the aviation industry due to its heavy reliance on technology, especially third-party software for critical services such as check-in and baggage handling.

The attack specifically targeted the popular MUSE check-in and boarding system, developed by US-based Collins Aerospace, a subsidiary of RTX. European cybersecurity agency ENISA confirmed on September 22 that ransomware had affected MUSE’s operations, forcing airports in Berlin, Brussels, and London Heathrow to revert to manual systems. 

The impact was severe: Brussels Airport canceled half of its Sunday and Monday flights, and Berlin Airport reported delays exceeding an hour due to nonfunctional check-in systems. At London Heathrow, Terminal 4 experienced significant disruption, with departures delayed by up to two hours and ongoing manual check-ins.

While Collins Aerospace claimed that manual processes could mitigate problems, the scale of the disruptions proved otherwise. Staff struggled to manage operations without technological support, underscoring the risks posed by dependence on software and the critical need for robust cybersecurity measures. Restoration of MUSE was nearly complete by Monday, yet some airports like Dublin experienced minimal disruption, showing varying impacts across different locations.

The broader risk is amplified by the fact that MUSE is used by over 300 airlines at 100 airports worldwide, raising concerns about the possibility of further attacks if vulnerabilities remain unaddressed. Experts caution that a compromised update could still threaten other airports, or that attackers may use initial breaches to extort further ransom from software providers.

This incident is part of a dramatic surge in cyberattacks facing the aviation sector, which saw a staggering 600% increase in 2025 compared to the previous year, according to French aerospace company Thales. Experts point out the economic and geopolitical stakes involved, advocating for a comprehensive cybersecurity strategy, adoption of AI tools, and industry-wide collaboration to address threats. 

The attack highlights that cyberattacks may have objectives beyond operational disruption, potentially targeting sensitive data and system integrity and emphasizing the urgent need for more resilient aviation security protocols.
Read more »
VMO Incident
cyber resilience Cybersecurity Breach Data protection Digital Infrastructure Hong Kong Security Network Security Privacy Ransomware attack VMO Incident

Cheung Sha Wan Wholesale Market Faces Major Data Breach Impacting Thousands

 


As part of an alarming incident that highlights the growing threat of cyberattacks on public sector systems, the Vegetable Marketing Organisation (VMO) reported that it was targeted by a ransomware attack that disrupted the Cheung Sha Wan Vegetable Wholesale Market's operations through a ransomware attack on a segment of its computer infrastructure. 

Upon discovering the breach on October 13, immediate suspension of network service was imposed as a precautionary measure to contain the intrusion and safeguard critical data. VMO announced on Wednesday that the affected servers were quickly isolated from external access and alerted the Hong Kong Police, the Hong Kong Computer Emergency Response Team Coordination Centre, and the Office of the Privacy Commissioner for Personal Data to the incident. 

A preliminary study suggests that the attack had a significant effect on the gate and accounting systems of the market, potentially exposing the personal information of approximately 7,000 registered users to the outside world. Founded in 1946 to ensure that local produce will be available continuously, the VMO, a non-profit organisation established to ensure this, has begun a comprehensive investigation into the extent of the data breach to determine whether any personal information has been compromised, and it has promised to inform individuals if any personal information is found to be at risk.

As of Thursday, the organisation's official website has remained inaccessible as a result of the ongoing disruption that the cyber incident has caused. After detecting the breach, Vegetable Marketing Organisation engaged an external contractor to assist them with restoring the system and supporting the ongoing investigation into the attack after the breach had been discovered. 

Although the core operations of the Cheung Sha Wan Vegetable Wholesale Market remain unaffected, the company has announced that it will temporarily utilise manual processes to manage invoicing and payment procedures, ensuring continuity of operations. Hong Kong's digital resilience has been questioned in the wake of a series of cybersecurity breaches that have struck numerous prominent institutions in the city in recent years. 

These have included Cyberport, the Consumer Council, and the Hong Kong Post, raising concerns about the city's digital resilience in general. There has been an increase in cyber threats over the past few years, which has led lawmakers to pass legislation to strengthen critical infrastructure security, including penalties of up to HK$5 million for lapses in cybersecurity compliance, resulting in an increase in cybersecurity threats. 

In a statement made by the VMO, it was noted that it would conduct a thorough review of the incident and that reinforced measures would be implemented to safeguard its systems from future attacks. The Vegetable Marketing Organisation has hired an external contractor to assist with restoring its systems, thereby accelerating the recovery process and facilitating the investigation.

It was acknowledged by the organisation that, despite continuing to operate daily, certain administrative functions, such as invoicing and payment processing, are being handled manually temporarily so that business continuity can be maintained. Hong Kong has been experiencing an increasing number of cybersecurity breaches in recent years, including Cyberport, the Consumer Council, and Hong Kong Post, which have put major institutions in a state of anxiety. 

As a result, critical infrastructure remains vulnerable to cyberattacks, which has been highlighted in recent months. Recently, the city's legislature approved a new measure aimed at bolstering defences against cyberattacks, with penalties of up to HK$5 million for non-compliance outlined in the legislation. VMO reiterated its commitment to digital security, and that it places a high level of importance on cybersecurity, and that a comprehensive review of the event would be conducted, along with enhancements to network safeguards to prevent similar events from recurring. 

Considering the recent incident at the Cheung Sha Wan Vegetable Wholesale Market, it has become increasingly apparent to me that Hong Kong's public and semi-public sectors need to strengthen cybersecurity resilience urgently.

The security experts have long warned that as digital systems are becoming increasingly integrated into key components of the services that consumers rely on, the effects of cyberattacks can quickly escalate from data breaches to disruptions in the regular functioning of processes and the public trust in them. Several industry observers believe that organisations like the VMO should go beyond enhancing only technical safeguards and make a concerted effort to train their staff regularly, to perform continuous vulnerability assessments, and to update their monitoring frameworks in real time to detect anomalies early. 

As a supplement to this, the establishment of cross-agency collaboration and information-sharing mechanisms could also enhance the city's overall preparedness to handle similar attacks in the future. Despite the VMO's quick response and transparency in handling the incident, it highlights a crucial national imperative-the strengthening of cyber hygiene and cultivation of a culture of sensitive information across all levels of governance and commerce in order to mitigate the immediate risks. 

The resilience of Hong Kong's institutions will be determined by how proactive vigilance is managed against cyber-attacks as much as it will be determined by their ability to defend themselves against technological disruption.
Read more »
Sotheby
Data Breach Employee Data Financial Information Ransomware Sotheby

Sotheby’s Investigates Cyberattack That Exposed Employee Financial Information

 



Global auction house Sotheby’s has disclosed that it recently suffered a data breach in which cybercriminals accessed and extracted files containing sensitive information. The company confirmed that the security incident, detected on July 24, 2025, led to unauthorized access to certain internal data systems.

According to a notification filed with the Maine Attorney General’s Office, the compromised records included details such as full names, Social Security Numbers (SSNs), and financial account information. While the filing listed only a few individuals from the states of Maine and Rhode Island, the overall number of people affected by the breach has not been publicly confirmed.

Sotheby’s stated that once the intrusion was identified, its cybersecurity team immediately launched a detailed investigation, working alongside external security experts and law enforcement authorities. The process reportedly took nearly two months as the company conducted a comprehensive audit to determine what type of information was taken and whose data was affected.

In its notice to those impacted, the company wrote that certain Sotheby’s data “appeared to have been removed from our environment by an unknown actor.” It added that an “extensive review of the data” was carried out to identify the affected records and confirm the individuals connected to them.

As a precautionary measure, Sotheby’s is offering affected individuals 12 months of free identity protection and credit monitoring services through TransUnion, encouraging them to register within 90 days of receiving the notification letter.

Initially, it was unclear whether the compromised data involved employees or clients. However, in an update on October 17, 2025, Sotheby’s clarified in a statement to BleepingComputer that the breach involved employee information, not customer data. The company emphasized that it took the incident seriously and immediately involved external cybersecurity experts to support the response and remediation process.

“Sotheby’s discovered a cybersecurity incident that may have involved certain employee information,” a company spokesperson said in an official statement. “Upon discovery, we promptly began an investigation with leading data protection specialists and law enforcement. The company is notifying all impacted individuals as required and remains committed to protecting the integrity of its systems and data.”

Sotheby’s is among the world’s most recognized auction houses, dealing in high-value art and luxury assets. In 2024, the firm recorded total annual sales of nearly $6 billion, highlighting the scale and sensitivity of the data it manages, including financial and transactional records.

Although no ransomware groups have claimed responsibility for this breach so far, similar attacks have previously targeted high-end auction platforms. In 2024, the RansomHub gang allegedly breached Christie’s, stealing personal data belonging to an estimated 500,000 clients. Such incidents indicate that cybercriminals increasingly view global art institutions as lucrative targets due to the financial and personal data they store.

This is not the first time Sotheby’s has dealt with cybersecurity issues. Between March 2017 and October 2018, the company’s website was compromised by a malicious web skimmer designed to collect customer payment information. A comparable supply-chain attack in 2021 also led to unauthorized access to sensitive data.

The latest breach reinforces the growing risks faced by major cultural and financial institutions that handle valuable client and employee data. As investigations continue, Sotheby’s has urged affected individuals to remain vigilant, review their financial statements regularly, and immediately report any suspicious activity to their bank or credit institution.


Read more »
Nation-State Attacks
CISOs Cyber Attacks Cyber Awareness cyber resilience Cyber Threats Cybersecurity CyberWar Digital Defense Identity Security Nation-State Attacks

The Silent Guardians Powering the Frontlines of Cybersecurity

 


There is no doubt that a world increasingly defined by invisible battles and silent warriors has led to a shift from trenches to terminals on which modern warfare is now being waged. As a result, cyberwarfare is no longer a distant, abstract threat; now it is a tangible, relentless struggle with real-world consequences.

Power grids fail, hospitals go dark, and global markets tremble as a result of unseen attacks. It is at this point that a unique breed of defenders stands at the centre of this new conflict: cyber professionals who safeguard the fragile line between digital order and chaos. The official trailer for Semperis Midnight in the War Room, an upcoming documentary about the hidden costs of cyber conflict, has been released, bringing this hidden war to sharp focus. 

Semperis is a provider of AI-powered identity security and cyber resilience. It has an extraordinary lineup of voices – including Chris Inglis, the first U.S. National Cyber Director; General (Ret.) David Petraeus, the former Director of the CIA; Jen Easterly, former Director of the CISA; Marcus Hutchins, one of the WannaCry heroes; and Professor Mary Aiken, a globally recognised cyber psychologist – all of whom are highly respected for their expertise in cybersecurity. 

The film examines the high-stakes battle between attackers, defenders, and reformed hackers who have now taken the risk of exploiting for themselves. As part of this documentary, leading figures from the fields of cybersecurity and national defence gather together in order to present an unprecedented view of the digital battlefield. 

Using their insights into cyber conflicts, Midnight in the War Room explores the increasing threat that cybercrime poses to international relations as well as corporate survival today. A film that sheds light on the crucial role of chief information security officers (CISOs), which consists of who serve as the frontlines of protecting critical infrastructure - from power grids to financial networks - against state-sponsored and criminal cyber threats, is a must-see. 

It is the work of more than fifty international experts, including cyber journalists, intelligence veterans, and reformed hackers, who provide perspectives which demonstrate the ingenuity and exhaustion that those fighting constant digital attacks have in the face. Even though the biggest threat lies not only with the sophistication of adversaries but with complacency itself, Chris Inglis argues that global resilience is an urgent issue at the moment. 

It has been reported that Semperis' Chief Marketing Officer and Executive Producer, Thomas LeDuc, views the project as one of the first of its kind to capture the courage and pressure experienced by defenders. The film is richly enriched by contributions from Professor Mary Aiken, Heath Adams, Marene Allison, Kirsta Arndt, Grace Cassy and several former chief information security officers, such as Anne Coulombe and Simon Hodgkinson, and it provides a sweeping and deeply human perspective on modern cyber warfare. 

With its powerful narrative, Midnight in the War Room explores the human side of cyberwarfare—a struggle that is rarely acknowledged but is marked by courage, resilience and sacrifice in a way that is rarely depicted. A film about those defending the world's most vital systems is a look at the psychological and emotional toll they endure, in which trust is continually at risk and a moment of complacency can trigger devastating consequences. 

The film explores the psychological and emotional tolls endured by those defending those systems. During his remarks at Semperis, Vice President for Asia Pacific and Japan, Mr Sillars, points out that cyber threats do not recognise any borders, and the Asia Pacific region is at the forefront of this digital conflict as a result of cyber threats. 

During the presentation, he emphasises that the documentary seeks to highlight the common challenges cybersecurity professionals face worldwide, as well as to foster collaboration within critical sectors to build identity-driven resilience. As the Chief Marketing Officer at Semperis and Executive Producer, LeDuc describes the project as one of the most ambitious in cybersecurity history—bringing together top intelligence leaders, chief information security officers, journalists, victims and reformed hackers as part of a rare collaborative narrative.

In the film, Cyber Defenders' lives are portrayed through their own experiences as well as the relentless pressure and unwavering resolve they face every day. Among the prominent experts interviewed for the documentary are Marene Allison, former Chief Information Security Officer of Johnson & Johnson; Grace Cassy, co-founder of CyLon; Heather M. Costa, Director of Technology Resilience at the Mayo Clinic; Simon Hodgkinson, former Chief Information Security Officer of BHP; and David Schwed, former Chief Information Security Officer of Robinhood. 

Among those on the panel are Richard Staunton, Founder of IT-Harvest, BBC Cyber Correspondent Joe Tidy, as well as Jesse McGraw, a former hacktivist who has turned his expertise towards safeguarding the internet, known as Ghost Exodus. As Jen Easterly, former Chief Information Security Officer of the U.S. Department of Homeland Security (CISA), points out, defeating malicious cyberattacks requires more than advanced technology—it demands the human mind's ingenuity and curiosity to overcome them. 

A global collaboration was exemplified through the production of this documentary, which was filmed in North America and Europe by cybersecurity and professional organisations, including the CyberRisk Alliance, Cyber Future Foundation, Institute for Critical Infrastructure Technology, (ISC)2 Eastern Massachusetts Chapter, Michigan Council of Women in Technology, and Women in CyberSecurity (WiCyS) Delaware Valley Chapter. 

As part of these partnerships, private screenings, expert discussions, and public outreach will be conducted in order to increase public awareness and cooperation regarding building digital resilience. By providing an insight into the human narratives that underpin cybersecurity, Midnight in the War Room hopes to give a deeper understanding of the modern battlefield and to inspire a collective awareness in the safeguarding of society's systems. 

There is something special about Midnight in the War Room, both as a wake-up call and as a tribute - a cinematic reflection of those who stand up to the threats people face in today's digital age. The film focuses on cyber conflict and invites governments, organisations, and individuals to recognise the importance of cybersecurity not just as a technical problem, but as a responsibility that people all share. 

In light of the continuous evolution of threats, people need stronger international collaborations, investments in identity security, and the development of psychological resilience among those on the front lines to help combat these threats. Semperis' initiative illustrates the power of storytelling to bridge the gap between awareness and action, transforming technical discourse into a powerful narrative that inspires vigilance, empathy, and unity among the community.

Providing a critical insight into the human aspect behind the machines, Midnight in the War Room reinforces a fundamental truth: that is, cybersecurity is not just about defending data, but also about protecting the people, systems, and values that make modern society what it is today.
Read more »
phishing
Bitwarden Data Breach LastPass Master Password phishing

Fake Breach Alerts Target LastPass and Bitwarden Users to Hijack PCs

 

An ongoing phishing campaign is targeting users of LastPass and Bitwarden with fake breach alerts designed to install remote access tools on victims’ systems. The emails falsely claim that both password managers suffered security incidents and urge users to download a “more secure” desktop application to protect their data.

LastPass confirmed it was not hacked and labeled the messages as social engineering attempts meant to create urgency and prompt users to install malicious software. The campaign began over a holiday weekend to exploit reduced IT staffing and delay detection. Fake emails were sent from domains like hello@lastpasspulse[.]blog and hello@lastpasjournal[.]blog, mimicking official communication.

Similarly, Bitwarden users received nearly identical messages from hello@bitwardenbroadcast.blog, using the same urgent tone and lure of a secure desktop app update. Cloudflare has since blocked the phishing landing pages, identifying them as malicious.

The downloaded binaries install Syncro, a legitimate remote monitoring and management (RMM) tool, which then deploys ScreenConnect to enable remote access to the infected device. The Syncro agent is configured to hide its system tray icon and check in with the attacker’s server every 90 seconds, maintaining stealth. It disables security agents from Emsisoft, Webroot, and Bitdefender and avoids deploying other bundled tools like Splashtop or TeamViewer, focusing solely on gaining remote control.

Once connected via ScreenConnect, attackers can deploy additional malware, exfiltrate data, and access stored credentials from password managers. Syncro clarified that its platform was not breached; instead, attackers created a fraudulent MSP account to abuse the service. A separate phishing wave targeted 1Password users with similar tactics, redirecting them to onepass-word[.]com through a malicious email sent from watchtower@eightninety[.]com. 

Cybersecurity experts stress that users should never respond to such alerts via email and should verify security news only through official company websites and communications. Companies do not request master passwords, and any such demand is a definitive sign of phishing.
Read more »
Subscribe to: Comments (Atom)

Featured