CySecurity News - Latest Information Security and Hacking Incidents: Cyberbreach

Cyberbreach CyberCrime CyberThreat Data Breach Ingram Ingram Micro Ransom Threat Ransomware SafePlay

Ingram Micro Faces Alleged Breach by SafePay with Ransom Threat

As Ingram Micro is dealing with a widespread outage in its global technology distribution operations that appears to be directly linked to a ransomware attack by the cybercrime group SafePay, the company appears to be experiencing a significant disruption. The company has shut down internal systems due to the incident, which has affected the company's website and online ordering platform since Thursday, according to information obtained by BleepingComputer.

Despite the fact that Ingram Micro is a major business-to-business technology distributor and service provider that offers hardware, software, cloud solutions, logistics, and training to resellers and managed service providers across the world, it has not yet been publicly confirmed what caused the disruption. According to a ransomware group known as SafePay, the group has issued an ultimatum to Ingram Micro, warning that it will publish 3.5 terabytes of allegedly stolen data unless they are paid a ransom by August 1st.

Several prominent warning signs, along with a countdown clock, are prominently displayed on the leak site of the group, increasing the pressure on the California-based technology distributor to enter into negotiations with the group. During an ongoing investigation, Ingram Micro informed the public on 5 July of a ransomware attack, which resulted in certain internal systems being shut down as a precaution.

SafePay did not confirm at that time that any data exfiltration occurred, but now, following the breach, the company claims responsibility and asserts that it has obtained a significant volume of sensitive corporate information. A security researcher has found code similarities to the LockBit ransomware family, suggesting a potential rebrand or offshoot. SafePay started causing threats in late 2024 to at least twenty organisations across different industries.

With the group operating under a double-extortion model, not only do they encrypt compromised systems, but they also threaten victims with leaking their data should they refuse to pay the ransom. In the course of investigating the incident, it has been determined that SafePay was responsible for orchestrating the attack, a comparatively new type of ransomware which emerged between September and November 2024.

Ingram Micro had not attributed the attack to any specific threat actor. However, BleepingComputer has now discovered a link between the breach and the group that employs the double-extortion model, in which data is stolen and encrypted using system encryption, as well as claiming to have compromised more than 200 companies across a wide range of fields, including manufacturing, healthcare, and education.

There has been some speculation that SafePay exploited vulnerabilities in the GlobalProtect VPN platform to gain access to the company and left ransom notes on the company's employee devices. As a result of the attack, Ingram Micro's AI-driven Xvantage distribution system, as well as its Impulse license provisioning platform, both critical components of the organisation's global operations, were reportedly affected by the hack.

According to Ingram Micro's announcement on July 5, a number of internal systems had been identified as infected with malicious software, following a ransomware attack. An immediate precautionary measure was taken by the company to secure its environment, including proactively taking down systems and implementing mitigation measures, and the company announced the following week that global operations were fully back to normal.

There has been no mention of the stolen data, ransom demands, or who was responsible on the company's official incident update page or in its 8-K filing to the Securities and Exchange Commission, as of 7 July. Although the company has continued to acknowledge that it is actively investigating the scope of the incident and the nature of any data affected, it has opted not to comment further on it.

Interestingly, however, the ransomware group SafePay—which claims responsibility for the intrusion—is more forthright, claiming that it has infected 3.5 terabytes of sensitive data and has set the public release deadline of 1 August 2025 if a ransom is not paid. Consequently, a countdown clock is displayed on their leak site stating that if the ransom is not paid, it will release the data publicly.

As an intermediary in the supply chain for major technology vendors, Ingram Micro is the largest reseller and enterprise network in the world, servicing over 160,000 resellers and enterprise customers worldwide. There is a growing concern among security specialists that the exposure of partner agreements, customer records, and proprietary product information may have a far-reaching impact across the technology channel.

From enabling targeted phishing attacks to eroding competitive advantages, the risks are extensive across the technology channel. According to industry consultants, organisations should take steps to strengthen access controls, enforce multifactor authentication, monitor for emerging vulnerabilities, and limit remote access to secured VPNs to prevent such threats.

While Ingram Micro is still investigating the SafePay leak, the persistent countdown clock on the leak site indicates that no agreement has been reached, which makes it more likely for full disclosure of data to occur. If the claimed dataset is made available, vendors, resellers, and end users might have to reset their credentials on a large scale, prepare for targeted scams, and comply with any potential regulatory reporting requirements.

Security researchers are then expected to examine these files for potential indicators of compromise and tactical insights that could mitigate similar attacks in the future, as well as the likelihood of these attacks occurring again. It was in a brief announcement published by Ingram Micro on a Sunday morning that they had been victimised by ransomware attacks, stating that malicious software was detected on several internal systems.

During the investigation, the company reported that it took immediate steps to secure its environment, including the initiation of a proactive shutdown of the affected systems, the implementation of additional mitigation measures, the launch of an investigation with the assistance of leading cybersecurity experts, and the notification of authorities.

Despite the inconvenience caused by Ingram Micro, the company has expressed its sincere apologies to customers, vendors, and partners, as well as a commitment to restoring affected systems so normal order processing and shipping can resume. Palo Alto Networks responded to reports suggesting that attackers had gained access via Ingram Micro's GlobalProtect VPN gateway on 7 Julyemphasisingng that the company was investigating the claims and emphasising that threat actors regularly infiltrate VPNs by using stolen credentials or misconfigured networks.

It was reported that Ingram Micro had made great progress toward restoring transactional operations by 8 July. Subscription orders, renewals, and modifications had been processed globally again through its central support organisation, and customers across multiple countries, including the UK, Germany, France, Italy, Spain, Brazil, India, China, Portugal, and the Nordic countries, were accepting phone or email orders.

There are still some restrictions that apply to hardware and technology orders. Sources also indicate that VPN access has been restored in certain regions. Palo Alto Networks later confirmed that none of the company's products were exploited or compromised by the breach. In spite og only operating for about a year, SafePay has established a substantial footprint in the cybercrime landscape, displaying 265 victims on the dark web leak site it has operated for.

Having been identified in September 2024, this group is believed to have previously deployed LockBit ransomware, though it is unclear whether it is related to LockBit. The SafePay ransomware company claims it is different from many contemporary ransomware operations because it does not utilise affiliates to breach networks as a ransomware-as-a-service model.

A report by Emsisoft’s Brett Callow indicates that this strategy, along with the preference for a low public profile of the group, may be the group’s attempt to avoid the intense scrutiny that law enforcement authorities have been paying for actions taken against other high-profile gangs in recent months. Among the most active ransomware actors worldwide, SafePay is ranked fourth behind Qilin, Akira, and Play in NCC Group's second quarter 2025 report.

It has been estimated that this group is responsible for 70 attacks in May 2025 alone, which makes them the most active ransomware operators in the entire month. Ingram Micro and its global network of partners were impacted by the SafePay attack that led to a cascade of operational, financial and reputational consequences. It was reported that technology resellers, managed service providers, and vendors worldwide were unable to conduct transactions due to the downtime of digital commerce platforms, order processing systems, and cloud license provisioning systems.

As a result of the disruption, hardware and cloud shipments slowed, and downstream partners sought alternate distribution channelsemphasisingng the central role large distributors play in supplying IT products. In the wake of the outage, industry analysts estimate that SafePay has lost up to $136 million in revenue per day, according to industry analysts. SafePay claims to have exfiltrated 3.5 terabytes of sensitive data, including financial, legal, and intellectual property. If its ransom demands are not met, it threatens public release.

The prolonged downtime, along with limited communication from the company, caused criticism from both customers and industry observers. Experts believe that the incident underscores the vulnerable nature of VPNs and identity management systems, especially where multi-factor authentication is lacking, password security is not enforced, and timely patches aren't applied promptly.

The report also reflects the increasing use of double-extortion tactics, which combine system encryption with the threat of sensitive data leaks to achieve double extortion. Thus, organisations must prepare not only for the restoration of services, but also for possible repercussions in terms of privacy and legality. Although Ingram Micro had restored global services on 30 July 2025, it remains under continuous extortion threat, and the company is still undergoing an extensive forensic investigation.

As a result of the Ingram Micro incident, ransomware operations have become increasingly sophisticated and persistent, where a technical compromise is just the beginning of a broader campaign of intimidation and leverage. The tactics employed by SafePay—combining the operational paralysis of core systems with the looming threat of massive data loss—illustrate how modern cyberattacks are built to exert sustained pressure on victims for quite some time after initial containment measures have been completed.

It has served as a reminder for global supply chain operators that security perimeters must extend far beyond traditional network defenses, including identity verification, remote access governance, and proactive vulnerability management, in addition to traditional network defenses. In light of the interconnected nature of modern information technology ecosystems, it is evident that disruptions can cause shockwaves across multiple industries and markets if a single node is disrupted.

Several experts have noted that in the wake of high-profile supply chain breaches, threat actors are likely to be more focused on distributors and service aggregators, since they have extensive vendor and customer relationships, which have the potential to increase the impact of financial gains and reputational harm. It is also likely that regulatory bodies will examine these incidents with greater care, particularly where they involve the disclosure of sensitive partner information or customer information, which can result in broader compliance obligations as well as legal liabilities.

Taking Ingram Micro to the next level will require not only the resolution of immediate security and operational issues, but also the rebuilding of trust with the vast network of customers and partners the company has cultivated.

To reduce the long-term repercussions of the incident, it is crucial to be transparent in communications following the incident, to demonstrate security enhancements, and to collaborate with the industry to share intelligence on emerging threats. In the course of the investigation, it is likely to become an important reference point for cybersecurity strategy debates, as well as in shaping future policy aimed at protecting global supply chains against cybersecurity threats.

Hackers Compromise French Submarine Engineering Company



 

Submarine

Black Web Cyber Attacks Cyberbreach Cyberhackers CyberThreat Dark Web Gigabyte Naval Group Submarine

Hackers Compromise French Submarine Engineering Company

One of the most chilling reminders of how threat landscapes are evolving even to the most fortified sectors is a major cyber breach that has hit the core of France’s naval defence ecosystem, the Naval Group. Naval Group—widely regarded as one of the nation’s key innovators in the maritime industry—has been compromised by a calculated cyberattack that compromised its reputation for operational secrecy.

Almost 13 gigabytes of highly sensitive data, including technical documentation, submarine combat software components, internal communications, as well as decades-old audio recordings from submarine monitoring systems, were discovered on the internet. It was discovered that virtual machine containers, detailed architecture schematics, and proprietary system blueprints belonging to Naval Group engineers were found in the leak, as well as virtual machine containers.

A silent and strategic adversary was responsible for the intrusion, as it lacked digital vandalism or extortion demands. In spite of the fact that attribution is still unclear, there is speculation that nation-state actors could have been involved in espionage as well as independent threat groups that were seeking disruption or strategic leverage.

However, what remains undeniable is the scale and intent of the breach. This was a precise attack against an impenetrable defence network that was once considered impenetrable and unbreakable. Adding to the fragility of national defence and digital security, French naval defence contractor Naval Group has been the target of scrutiny after claims of a significant cyberattack that have raised concerns about the company's operations.

An anonymous group operating on the dark web, known as the Black Web forum, has claimed it has accessed and exfiltrated classified information related to key French naval platforms, including the nuclear-powered submarines of the Barracuda class. A month ago, the group released approximately 30 gigabytes of data, including software code from combat management systems, and issued a demand that they be contacted within 72 hours or risk leaking more information.

Despite the fact that the authenticity of these files is still uncertain, cybersecurity experts warn that even partial exposure to such sensitive source code could allow adversaries to gain valuable insight into the performance of weapons, their system architecture, and any vulnerabilities they may be able to exploit. It has been confirmed that Naval Group, owned by the French government in the majority, has begun an urgent technical investigation into the alleged breach.

In response to the incident, the company spokesperson described it as a PR attack rather than a confirmed intrusion into its internal infrastructure, stating that operations across shipyards and naval projects remain undisturbed. However, the strategic implications of this incident remain significant. With the creation of some of France's most advanced maritime defence assets, including the Charles de Gaulle aircraft carrier and the Triomphant submarines, Navy Group has played a crucial role in the nation's defence and that of allies.

The potential impact of a confirmed compromise could include both the threat to homeland security as well as the threat to international trade agreements between Australia, India, and Brazil. The Ministry of Armed Forces has yet to release a statement on the matter, but it has been reported that French cybersecurity agencies are helping to conduct the forensic analysis. In light of increasing concerns about global security in the defense supply chain, Naval Group has issued a formal statement stating that no intrusion has yet been detected on its internal information technology infrastructure, as of yet.

In a statement, the company announced that all of its resources had been mobilised to investigate whether the recently leaked data are authentic, provenance, or owned by the Indian Navy, as they had partnered with Mazagon Dock Shipbuilders to deliver six Scorpene-class submarines to the Indian Navy. In order to conduct the forensic investigation, we are collaborating with French authorities.

A similar incident occurred in 2016, when more than 22,000 classified pages of India's Scorpene submarines were leaked, raising serious concerns over the integrity of India's underwater warfare capabilities, a breach that has echoed this recent incident.

A recent breach could have far-reaching implications, as well as threaten the operational security of other nations that operate Scorpene-class submarines, such as Malaysia, Indonesia, and Chile, if it is verified. According to analysts, such a compromise would have a devastating effect on the international defence manufacturing ecosystem, undermining trust in the protection of military technologies and exposing transnational arms collaborations to systemic vulnerabilities.

Geopolitical tensions are increasingly raging in grey zone conflict - a territory where cyberattacks and information warfare blur the line between peace and hostility, as global defence contractors are becoming very valuable targets. The Naval Group is a cornerstone of France's naval industrial base and is now found at the nexus of this strategic vulnerability.

In addition to providing advanced maritime platforms worldwide to nations like France, France's Nuclear Attack submarines (SSNs) and the Scorpene-class diesel-electric submarines (SSKs) in service with the Indonesian Navy, the company is also a major supplier of advanced military systems. There are also multipurpose French-Italian frigates, the FREMM, which are based in France.

In addition to serving as a technological leader and economic engine, Naval Group also supports tens of thousands of indirect jobs in France since 90% of its added value is generated within the country. The ownership structure of the company further reflects its national significance as well. 62.25 per cent of the company's shareholdings are held by the French state, 35 per cent by Thales, and the rest by its former employees through structured corporate shareholdings.

As strategic autonomy becomes increasingly important in a world where defence is regarded as an important component of economic growth, entities such as Naval Group symbolise more than just the capability to defend oneself; they represent a nation's industrial and strategic sovereignty in an era when strategic autonomy is increasingly emphasised.

In spite of a growing number of high-profile cyber intrusions that target both corporations and governments, the allegations of a breach involving Naval Group are yet another disturbing global trend. Days before, Microsoft disclosed a critical vulnerability in its widely used SharePoint platform, which is believed to have been exploited by Chinese threat actors to gain access to this platform.

Among the affected entities was the U.S. It is the responsibility of the National Nuclear Security Administration to maintain the American nuclear arsenal. This incident did not compromise any classified information, however the growing frequency and ambition of such attacks have raised alarm within international security communities because of the increased frequency and ambition.

With a workforce of more than 15,000 and generating revenue over €4.4 billion annually, Naval Group stands out as one of the world’s leading naval shipbuilders in an increasingly volatile threat landscape. It is an essential industrial asset for the government as a whole. Almost two-thirds of the company is controlled by the French government (holding nearly two-thirds of the equity), and the remainder is controlled by Thales, one of the leading defence conglomerates in the country.

It is not only the incident that has raised concerns about cyber-vulnerabilities within critical infrastructure, but it also emphasises the importance of coordinating resilient strategies across global defence supply chains to reduce the risk of a cyber attack. This incident involving Naval Group happens to fall at a critical moment in the global cybersecurity landscape, as the digital battlefield has become as important as traditional combat zones in terms of importance.

Despite the fact that governments and private companies invest billions in safeguarding technological superiority, the threat of real or perceived exposure of sensitive defence assets is amplifying strategic fears. The reputational and diplomatic fallout for France might be substantial, especially if defence partners start questioning the ability of collaborative programs to survive.

A key concern about the breach is that it has the potential to have a ripple effect: it strikes at the intersection of national security, industrial sovereignty, and global defence cooperation. As a consequence of Naval Group's integral role in multinational defence programs, any compromise could negatively impact not only France but also all of the nations which rely on its software frameworks and platforms.

It is becoming increasingly clear that in an era dominated by digitally enabled espionage, where classified data can be weaponised both for disruption and to provide intelligence, the protection of defence research and development is no longer a siloed responsibility, but rather a shared imperative across allies and defence ecosystems.

Aside from that, this breach serves as a stark reminder that cyber intrusions don't necessarily show up in the form of ransomware or defacing websites. There were motives underlying the leak in this case that were geopolitical manoeuvres, competitive sabotage, or intelligence collection, based on the absence of financial extortion and the precision of the leak. Therefore, the Naval Group episode should serve as a call to action for the broader defence community, emphasising the urgent need for robust, coordinated cybersecurity defences, cross-border intelligence sharing, and a renewed commitment to both legacy systems and new defence technologies that are being developed.

The Naval Group breach, which occurred in a high-stakes theatre of modern security where digital compromises could undermine years of strategic advantage, goes way beyond just an isolated incident in a theatre with high stakes. It represents not only the vulnerability of defence digitisation and the fragility of strategic partnerships, but also the persistent threats posed by adversaries operating in the shadows that exist today.

Ransomware Defence Begins with Fundamentals Not AI



 

Technology

AI AI vulnerabilities Artificial Intelligence Cyberbreach LLM Ransomware RSA Security System Technology

Ransomware Defence Begins with Fundamentals Not AI

The era of rapid technological advancements has made it clear that artificial intelligence isn't only influencing cybersecurity, it is fundamentally redefining its boundaries and capabilities as well. The transformation was evident at the RSA Conference in San Francisco in the year 2025, as more than 40,000 cybersecurity professionals gathered to discuss the path forward for the industry.

It was essential to emphasise that the rapid integration of agentic AI into cyber operations is one of the most significant topics discussed, highlighting both the disruptive potential and strategic complexities it introduces simultaneously. AI technologies continue to empower both defenders and adversaries alike, and organizations are taking a measured approach, recognising the immense potential of AI-driven solutions while remaining vigilant against the increasingly sophisticated attacks from adversaries.

As the rise of artificial intelligence (AI) and its application in criminal activities dominates headlines more often than not, the narrative is far from a one-sided one, as there are several factors playing a role. However, the rise of AI reflects a broader industry shift toward balancing innovation with resilience in the face of rapidly shifting threats.

Several cybercriminals are indeed using artificial intelligence (AI) and large language models (LLMs) to make ransomware campaigns more sophisticated and more convincing, crafting more convincing phishing emails, bypassing traditional security measures, and improving the precision with which victims are selected. In addition to increasing the stealth and efficiency of attackers, the stakes for organisational cybersecurity have increased as a result of these tools.

Although AI is considered a weapon for adversaries, it is proving to be an essential ally in the defence against ransomware when integrated into security systems. By integrating AI into security systems, organisations are able to detect threats more quickly and accurately, which leads to quicker detection and response to ransomware attacks.

Furthermore, AI helps enhance the containment and recovery efforts of incidents, leading to faster containment and a reduction in potential damage. Furthermore, AI helps to mitigate and recover from incidents more effectively. With AI coupled with real-time threat intelligence, security teams are able to adapt to evolving attack techniques, providing them with the agility to close the gap between offence and defence, making the cyber environment in which people live more and more automated.

In the wake of a series of high-profile ransomware attacks - most notably, those targeted at prominent brands like M&S - concerns have been raised that artificial intelligence may be contributing to a spike in cybercrime that has never been seen before. In spite of the fact that artificial intelligence is undeniably changing the threat landscape by streamlining phishing campaigns and automating attack workflows, its impact on ransomware operations has often been exaggerated.

In practice, AI isn't really a revolutionary force at all, but rather a tool to accelerate tactics cybercriminals have relied on for years to come. Most ransomware groups continue to rely on proven, straightforward methods that offer speed, scalability, and consistent financial returns for their attacks. As far as successful ransomware campaigns are concerned, scammy emails, credential theft, and insider exploitation have continued to be the cornerstones of these campaigns, offering reliable results without requiring the use of advanced artificial intelligence.

As security leaders are looking for effective ways to address these threats, they are focusing on getting a realistic perspective on how artificial intelligence is used within ransomware ecosystems. It has become increasingly evident that breach and attack simulation tools are critical assets for organisations as they enable them to identify vulnerabilities and close security gaps in advance of attackers exploiting them.

There is a sense of balance in this approach, which emphasises the importance of bolstering foundational security controls while keeping pace with the incremental evolution of adversarial capabilities. Nevertheless, generative artificial intelligence is continuing to evolve in profound and often paradoxical ways as it continues to mature. In one way, it empowers defenders by automating routine security operations, detecting hidden patterns in complex data sets, and detecting vulnerabilities that might otherwise go undetected by the average defender.

It also provides cybercriminals with the power to craft more sophisticated, targeted, scalable attacks, blurring the line between innovation and exploitation, providing them with powerful tools to craft more sophisticated, targeted, and scalable attacks. According to recent studies, over 80% of cyber incidents are caused by human error, which is why organisations need to harness artificial intelligence to strengthen their security posture to prevent future cyber attacks.

AI is an excellent tool for cybersecurity leaders as it streamlines threat detection, reduces human oversight, and enables real-time response in real-time. There is, however, a danger that the same technologies may be adapted by adversaries to enhance phishing tactics, automate malware deployment, and orchestrate advanced intrusion strategies. The dual use of artificial intelligence has raised widespread concerns among executives due to its dual purpose.

According to a recent survey, 84% of CEOs have expressed concern about generative AI being the source of widespread or catastrophic cyberattacks. Consequently, organisations are beginning to make a significant investment in AI-based cybersecurity, with projections showing a 43% increase in AI security budgets by 2025 as a result of this increase.

In an increasingly complex digital environment, it is becoming increasingly recognised that even though generative AI introduces new vulnerabilities, it also holds the key to strengthening cyber resilience. This surge is indicative of a growing recognition of the need for generative AI. As artificial intelligence is increasing the speed and sophistication with which cyberattacks are taking place, it has never been more important than now to adhere to foundational cybersecurity practices.

While artificial intelligence has unquestionably enhanced the tactics available to cybercriminals, allowing them to conduct more targeted phishing attempts, exploit vulnerabilities more quickly, and create more evasive malware, many of the core techniques have not changed. In other words, even though they have many similarities, the differences lie more in how they are executed, rather than in what they do.

As such, rigorously and consistently applied traditional cybersecurity strategies remain critical bulwarks against even the threats that are enhanced by artificial intelligence. In addition to these foundational defences, multi-factor authentication (MFA), which is widely used, provides a vital safeguard against credential theft, particularly in light of the increasing use of artificial intelligence-generated phishing emails that mimic legitimate communication with astonishing accuracy - a powerful security measure that is critical today.

As important as it is to maintain regular data backups, maintaining a secure backup mechanism also provides an effective fallback mechanism for ransomware, which is now capable of dynamically altering payloads to avoid detection. The most important element is to make sure that all systems and software are updated, as this prevents AI-enabled tools from exploiting known vulnerabilities.

A Zero Trust architecture is becoming increasingly relevant as attackers with artificial intelligence move faster and stealthier than ever before. By assuming no implicit trust within the network and restricting lateral movement, this model greatly reduces the blast radius of any potential breach of the network and reduces the likelihood of the attack succeeding.

A major upgrade is also required for email filtering systems, with AI-based tools that are better equipped to detect subtle nuances in phishing campaigns that have been successfully evading legacy solutions. It is also becoming more and more important for organisations to emphasise security awareness training to prevent breaches, as human error is still one of the leading causes. There is no better line of defence for a company than having employees trained to spot deceptive artificial intelligence-crafted deception.

Furthermore, the use of artificial intelligence-based anomaly detection systems is becoming increasingly important for detecting unusual behaviours that indicate a breach of security. In order to limit exposure and contain threats, segmentation, strict access control policies, and real-time monitoring are all complementary tools. However, it is important to note that even as AI has created new complexities in the threat landscape, it has not rendered traditional defences obsolete.

Rather, these tried and true cybersecurity measures, augmented by intelligent automation and threat intelligence, are the cornerstones of resilient cybersecurity, not the opposite. Defending against adversaries powered by artificial intelligence requires not just speed but also strategic foresight and disciplined execution of proven strategies.

As AI-powered cyberattacks become a bigger and more prevalent subject of discussion, organisations themselves are at risk from an unchecked and ungoverned use of artificial intelligence tools, a risk that is often overlooked. While much of the attention has been focused on how threat actors are capable of weaponising artificial intelligence, the internal vulnerabilities that arise from the unscheduled adoption of generative AI present a significant and present threat to the organisation.

In what is referred to as "Shadow AI," employees are using tools like ChatGPT without formal authorisation or oversight, which circumvents established security protocols and could potentially expose sensitive corporate data. According to a recent study, nearly 40% of IT professionals admit that they have used generative AI tools without proper authorisation.

Besides compromising governance efforts, such practices obscure visibility of data processing and handling, complicate incident response, and increase the organisation's vulnerability to attacks. The use of artificial intelligence by organisations is unregulated, coupled with inadequate data governance and poorly configured artificial intelligence services, resulting in a number of operational and security issues.

The risks posed by internal AI tools must be mitigated by organisations treating them as if they were any enterprise technologies. Among the measures that must be taken to mitigate these risks is to establish robust governance frameworks, ensure the transparency of data flows, conduct regular audits, and provide cybersecurity training that addresses the dangers of shadow artificial intelligence, as well as ensure that leaders remain mindful of current threats to their organisations.

Although artificial intelligence generates headlines, the most successful attacks continue to rely on the proven techniques - phishing, credential theft, and ransomware. The emphasis placed on the potential threats that could be driven by AI can distract attention from critical, foundational defences. In this context, complacency and misplaced priorities are the greatest risks, and not AI itself.

It remains true that maintaining a disciplined cyber hygiene, simulating attacks, and strengthening security fundamentals remain the most effective ways to combat ransomware in the long run. There is no doubt that artificial intelligence is not just a single threat or solution for cybersecurity, but rather a powerful force capable of strengthening as well as destabilising digital defences in an environment that is rapidly evolving.

As organisations navigate this shifting landscape, it is imperative to have clarity, discipline, and strategic depth as they attempt to navigate this new terrain. Despite the fact that artificial intelligence may dominate headlines and influence funding decisions, it does not negate the importance of basic cybersecurity practices.

What is needed is a recalibration of priorities as people move forward. Security leaders must build resilience against emerging technologies, rather than chasing the allure of emerging technologies alone. They need to adopt a realistic and layered approach to security, one that embraces AI as a tool while never losing sight of what consistently works.

To achieve this goal, advanced automation, analytics, and tried-and-true defences must be integrated, governance around AI usage must be enforced, and access to data flows and user behaviour must remain tightly controlled. In addition, organisations need to realise that technological tools are only as powerful as the frameworks and people that support them.

Threats are becoming increasingly automated, making it even more important to have human oversight. Training, informed leadership, and an environment that fosters a culture of accountability are not optional; they are imperative. In order for artificial intelligence to be effective, it must be part of a larger, more comprehensive security strategy that is based on visibility, transparency, and proactive risk management.

As the battle against ransomware and AI-enhanced cyber threats continues, the key to success will not be whose tools have the greatest sophistication, but whose application of these tools will be consistent, purposeful, and foresightful. AI isn't a threat, but it's an opportunity to master it, regulate it internally, and never let innovation overshadow the fundamentals that keep security sustainable in the first place. Today's defenders have a winning formula: strong fundamentals, smart integration, and unwavering vigilance are the keys to their success.

Ahold Delhaize USA Faces Data Breach Exposing Sensitive Information



 

USA

Ahold Delhaize Cyberbreach CyberCrime Cyberleak CyberThreat Data Breach Data Sfety Global Footprint USA

Ahold Delhaize USA Faces Data Breach Exposing Sensitive Information

In an announcement published by Ahold Delhaize, a leading global food retailer, the company confirmed that a significant data breach has compromised the personal information of over 2.2 million people across several countries.

With nearly 10,000 stores located across Europe, the United States, and Indonesia, the company serves more than 60 million customers every week from all over the world, employing approximately 400,000 people. The office of the Maine Attorney General received a formal disclosure from Ahold Delhaize USA on Thursday, which stated that 2,242,521 individuals had been affected by a cybersecurity incident but did not disclose the extent of the breach to date.

According to preliminary indications, the breach may have affected a wide range of sensitive personal information aside from usernames and passwords. Information that is potentially compromised may include the full name, residential address, date of birth, identification numbers issued by the government, financial account information, and even protected health information.

Clearly, the scale and nature of this incident demonstrate that large multinational retailers are faced with a growing number of risks and that there is a need for improved cybersecurity measures to be taken in the retail industry. There was a cyber incident in late 2024 that was officially acknowledged by Ahold Delhaize USA last week. Ahold Delhaize USA has acknowledged this incident, revealing that the personal data of more than 2.2 million individuals may have been compromised as a result.

According to an official FAQ, based on current findings, the company does not believe that the intrusion affected its payment processing systems or pharmacy infrastructure, which are critical areas often targeted by high-impact cyberattacks. As further support for the disclosure, documentation submitted to the Maine Attorney General's Office indicated that approximately 100,000 Maine residents were affected by the breach as a whole.

As Ahold Delhaize USA operates multiple supermarket chains under the Hannaford brand in this region, this state-specific detail has particular significance, especially since the Hannaford brand is one of the most prominent supermarket brands in the region. It is not known yet how much or what type of data was exposed by the company, however, the widespread scope of the incident raises significant concerns about the potential misuse of personal information and the implications that could have on many individuals across multiple states.

As far as cyberattacks targeting Ahold Delhaize USA are concerned, this incident can be attributed to a broader pattern of rising threats within the grocery distribution and food industry in general. On November 8, 2024, the parent company of the retailer publicly acknowledged the security breach, and later in April 2025, the company's parent company confirmed that the attackers had accessed sensitive data related to individuals in the Netherlands, where the company is headquartered.

It was imperative that Ahold Delhaize USA temporarily disable portions of its internal systems during the initial stage of the incident as a precautionary measure. In addition to maintaining a significant global footprint, Ahold Delhaize operates more than 9,400 stores in Europe, the United States, and Indonesia. It is a leading multinational retailer and wholesale conglomerate with more than 9,000 stores worldwide.

It serves approximately 60 million consumers every week both physically and digitally through its network of more than 393,000 employees. By the year 2024, the company will report annual net sales of more than $104 billion, driven by a diverse portfolio of well-known retail brands that are part of a broad range of well-known retail brands. As an example of these, in the United States, users will find Food Lion, Stop and Shop, Giant Food, and Hannaford, while in Europe, it is represented by Delhaize, Maxi, Mega Image, Albert, Bol, Alfa Beta, Gall & Gall, and Profi among a variety of banners.

In November 2024, the company first announced its breach, stating that certain U.S.-based brands and operations, including pharmacy operations and segments of its e-commerce infrastructure, had been compromised as a result of the breach. According to a formal filing filed with the Maine Attorney General's Office on Thursday, cyberattackers gained unauthorized access to Ahold Delhaize USA’s internal business systems on November 6, 2024, and this resulted in sensitive data belonging to 2,242,521 individuals being compromised.

Although the company has not yet confirmed whether customer information was among the stolen data, it has confirmed that internal employment records were also stolen as part of the theft. Ahold Delhaize USA and its affiliated companies may have collected and stored personal information about current and former employees, raising concerns about the possibility of misuse of personal identifying information as well as employment information, among other things.

It is evident from the scale of this breach that large, interconnected retail networks face increasingly dangerous vulnerabilities, which underscores the need to enforce robust cybersecurity practices at all levels of an organisation. It has been discovered through further investigation into the breach that the compromised files might have contained very sensitive personal information in a wide variety of forms.

Ahold Delhaize USA Services has made it clear that the data could be potentially exposed includes the full names of individuals, their contact information (such as postal addresses, telephone numbers, and email addresses) along with their dates of birth and numerous forms of government-issued identification number, such as Social Security numbers, passport numbers, or driver’s license numbers.

The company also reported that, besides information about financial accounts, such as bank account numbers and medical information, which can be contained within employment files, there was also potentially confidential information concerning workers' compensation records and medical records. An unauthorised party has been able to gain access to employment-related records related to current and former employees.

After receiving a formal notification from the Attorneys General of California, Maine, and Montana regarding the breach on June 26, 2025, the company began sending notification emails to those affected by the breach. Ahold Delhaize USA Services has stated that those individuals who receive confirmation that their personal information has been compromised may be eligible for compensation under this policy.

Whenever such a data breach occurs, the effects can be far-reaching, as sensitive personal data may be used for identity theft, financial fraud, or malicious activities. It is widely understood by security experts that companies that collect and store sensitive information are bound by legal and ethical obligations to protect that information from unauthorised access. There is a possibility that affected individuals may be able to sue for damages that result from the misuse or exposure of their personal information when proper safeguards are not observed.

In light of the increasing frequency of these breaches, the importance of strengthening corporate data protection frameworks and swiftly addressing incidents is increasing. An organisation known as Inc Ransom, formerly linked with sophisticated ransomware campaigns, claimed responsibility for the cyberattack. It has been found that the group has participated in the cyberattack, raising further concerns about the methods used and the possibility that the stolen data may be exploited in the future.

There has been another cyberattack which has recently struck United Natural Foods, Inc., which coincided with the timing of Ahold Delhaize USA's complete disclosure of the exposure of personal information. In the wake of this breach, UNFI, a major grocery distributor in the United States, was forced to temporarily shut down several online systems, disrupting the fulfilment process and causing delays in delivering groceries to retailers.

After containing the incident, UNFI has also restored its electronic ordering and invoicing capabilities. These back-to-back breaches highlight the growing cybersecurity vulnerabilities in the retail sector and the supply chain sector, making it increasingly important for companies to develop coordinated defensive strategies to protect sensitive consumer and business data, both of which are in urgent need.

United Natural Foods Confirms Network Disruption from Cyberattack



 

United Natural Food

Cyber Attacks Cyberbreach Cybernetworks CyberThreat Food Company Food Supply Chain UNFI United Natural Food

United Natural Foods Confirms Network Disruption from Cyberattack

United Natural Foods Inc.'s operations were disrupted by a serious cybersecurity incident. There have been widespread supply chain issues and widespread product shortages at Whole Foods Market locations all over the United States due to the company's failure to meet the demands of its customers. In addition to serving as the primary distributor of Whole Foods, a flagship grocery chain under the umbrella of Amazon, UNFI also plays a crucial role in the organic food supply chain.

It is headquartered in Rhode Island. This cyberattack was discovered by the company on June 5, according to a recent filing with the Securities and Exchange Commission. When the company discovered the cyberattack, several internal systems were immediately taken offline to contain the threat, which significantly hindered the company's ability to process and fulfil orders for customers.

In spite of the ongoing investigation, specifics regarding the nature and origin of the breach remain unadvertised, but it is a troubling development that aligns with a troubling pattern of ransomware attacks recently targeting large retailers and supply chain operators. According to experts, sophisticated cybercriminal groups are likely to have been the perpetrators of the intrusion, using malicious software to compromise critical business systems and extort money in exchange for their recovery.

A spokesperson for Whole Foods responded to the disruption by apologising briefly for the inconvenience it caused customers and reassuring the public that restocking efforts are underway right now. However, the company declined to comment further on the extent of the impact or if there were any timeframes for full recovery as a result of the disruption.

The investigation has highlighted the growing vulnerabilities of the digital infrastructure of essential service providers, which have led to a cascading effect of such breaches on consumer access to everyday goods United Natural Foods Inc. As the investigation continues, the company has revealed that it has suffered a significant cybersecurity breach that has impacted the operations of the company and shaken investor confidence in its stock price.

UNFI is a leading wholesale distributor for Whole Foods Market, owned by Amazon. According to the company's announcement made public by the Securities and Exchange Commission (SEC), unauthorised access to its IT systems was detected on June 5 of this year. As a result of the intrusion, UNFI immediately deactivated portions of its network, a measure that, since then, has resulted in widespread disruptions and delays in the fulfilment of customer orders due to widespread interruptions to operations.

The stock value of the company fell sharply after the disclosure of the incident, dropping by about 7%. This is indicative of the growing concerns among investors regarding the scope of the incident and the potential business ramifications. According to UNFI, the incident is currently being investigated by cybersecurity teams to assess the scope of the incident, as well as revert to normal operations as quickly and securely as possible.

There has already been a temporary disruption to the company's business functions, including supply chain and order fulfilment processes, as a result of the cyberattack, and this will probably continue in the future, according to the company. With over 30,000 retail locations serving over $30 billion in annual revenue as one of North America's largest full-service food distributors, UNFI's vulnerability to such an attack highlights what is becoming increasingly evident: even industry giants with vast resources are not exempt from cyber threats in the digital age.

Although experts are yet to confirm the exact nature of the breach, it appears that it may be part of a broader ransomware campaign that targets major supply chain operators. In light of the growing sophistication and aggressive nature of cybercriminals, essential service providers are faced with an increasing number of cybersecurity risks that should be emphasised to ensure robust digital defences are in place.

UNITED NATURAL FOODS INC (UNFI) is a leading global food distribution company that operates a range of food brands like Wild Harvest, Culinary Circle, and Essential Everyday, all of which cater to the growing demand for natural, organic, and speciality items. In addition to its vast wholesale operations, Cub Foods and Shoppers also own and operate 76 retail stores that are operated under their respective banners.

It has, however, maintained a strong financial position because it is primarily reliant on its wholesale division for revenue, accounting for over 95% of the company's total revenue, emphasising the vital role it plays in the food supply chain as a whole. A recent earnings call of the UNFI leadership team was challenged on whether certain operational aspects of the business may have contributed to the company being vulnerable to cyberattacks as a result.

Furthermore, analysts were pressed for more clarity on whether the security breach would prompt a re-evaluation of the company's future investment strategy, especially for IT infrastructure upgrades and cybersecurity improvements. In spite of the fact that the company has not yet provided a detailed response to the incident, there is no doubt that the incident has raised concerns about its digital defences and its risk mitigation protocols, which are undoubtedly being examined both internally and externally.

Cyber threats are continuing to grow, both in scale and sophistication, as a result of the breach at UNFI. As a consequence, critical infrastructure operators, especially those operating in vital sectors like food distribution, are under increasing pressure to prioritise cybersecurity as an integral part of corporate governance and operational continuity. There is a good chance that the event will act as a catalyst for UNFI to reevaluate and strengthen its technological investments so as to ensure its expansive supply chain and digital ecosystem remain secure in the future.

As a result of an escalation in cyberattacks within the food and agriculture industry within the past five years, industry data is revealing that over the next five years, cyberattacks will be at a staggering 600%. A growing threat has caused federal authorities to express greater concern, including the Federal Bureau of Investigation, which has issued formal warnings to private businesses concerning this growing threat.

Specifically, the agency cited ransomware as a critical threat to farms, food processors, manufacturers, and large-scale producers—all of whom play an integral role in the supply chain both nationally and globally. In the past, notable incidents have highlighted the severity of the threat landscape. For example, in 2021, meat processing giant JBS fell victim to a ransomware attack attributed to the REvil (Sodinokibi) group, which is believed to have been linked to Russia as a ransomware-as-a-service operator.

For JBS to regain access to its systems after the breach, cybercriminals charged it a $11 million fee. It is also important to point out that, in 2023, a large producer company called Dole temporarily stopped processing and distributing its products after it reported a ransomware attack that severely impaired its operational capabilities.

A recent cyberattack on United Natural Foods Inc. reflects this troubling trend, and it highlights how retail and supply chain infrastructure are becoming increasingly vulnerable. Semperis' director of incident response, Jeff Wichman, a cybersecurity expert, said the breach falls within a larger wave of cyberattacks that have recently affected major retailers, such as Sam's Club and Ahold Delhaize, which is one of the largest food retail conglomerates in the world.

A number of organisations within these sectors, including the food and beverage sector, must be vigilant against cyberattacks in the future. As cyberattacks continue to increase in frequency and sophistication, Wizman explained that this incident is yet another critical reminder that they must enhance their preparedness. In its most recent statement, United Natural Foods confirmed that efforts are underway to reestablish full operational capabilities after restoring affected systems.

Also, the company reported that the police have been informed of the breach, digital forensics experts have been engaged, as well as several computer systems have been proactively taken offline to contain further exposure. United Natural Foods Inc. stated that the breach has limited its impact on the company's business and contained further exposure in its most recent financial disclosure. A company called UNFI (UNFI) reported net sales of $8.1 billion in the fiscal quarter ending May 3, 2025, demonstrating the company's continued dominance in the wholesale grocery market in North America.

Despite strong performance on the top line, UNFI has indicated that despite its full-year outlook for 2025, it is expected to report a net loss in income and earnings per share, even though it achieved a strong top-line performance. As a result of terminating a significant supply contract with a large grocery chain located in the northeastern part of the United States, the company's financial prospects have already been severely impacted by this anticipated downturn.

A recent cyberattack has not prompted UNFI to adjust its fiscal guidance at the present time, as a comprehensive internal assessment must be conducted to evaluate the full scope and potential financial consequences of this attack. Executives at the company stressed that, despite the fact that the breach has brought about operational uncertainty, any changes to the company's financial outlook will be determined based on the comprehensive analysis currently being conducted.

Even though UNFI has lost contracts and suffered a cyberattack, the multifaceted challenges it is facing are underscored as it attempts to stabilise operations, maintain retailer confidence, and safeguard shareholders' value in an increasingly volatile environment that has made the organisation more vulnerable to cyberattacks. Despite the continuing effects of the cyberattack on United Natural Foods Inc., this incident continues to serve as a crucial lesson for organisations operating within complex supply chain ecosystems.

As a consequence, it underscores the importance of adopting forward-looking, resilience-driven cybersecurity strategies that integrate digital risk management into the fabric of every company's daily operations as a way of addressing cybersecurity threats in the future. For food and logistics providers whose services directly affect national infrastructure and consumer access to essential goods, cybersecurity is a business-critical function that must not be overlooked as an IT peripheral concern.

Increasing threat actor sophistication and a widening attack surface posed by increasingly complex digital ecosystems are the reasons why companies need to invest more in advanced threat detection, zero-trust architectures, and employee cyber hygiene in order to be on top of things. UNFI's recent breach may be a turning point in not only the company's history but also in the industry at large.

This breach might prompt a broader reevaluation of how cybersecurity readiness is integrated into strategic planning, regulatory compliance, as well as stakeholder trust. With the rapidly evolving cyber threat landscape, organisations that take proactive, system-level action are going to be best positioned to mitigate disruption, protect brand integrity, maintain operational continuity, and maintain operational efficiency as they navigate these new, evolving threats.

A Closer Look at Torrenting and Its Applications



 

VPN

BitTorrent Cyber Security Cyberattacks Cyberbreach CyberThreat Server Torrent VPN

A Closer Look at Torrenting and Its Applications

Downloading through a peer-to-peer (P2P) network referred to as torrenting involves either using torrent files or magnet links to download files. Torrent files are index files that provide the necessary information to locate certain files, segments of files, or segments within a network. Using this method, the computer can download multiple parts of the same file from multiple peers across a network at the same time, greatly enhancing the efficiency of the download process.

With magnet links, which function similarly to torrent files, it is unnecessary to host or download the torrent file itself, further streamlining the process and eliminating the need for hosting. As a result, both methods utilize the distributed nature of P2P networks to speed up and increase the efficiency of file transfers. It is worth mentioning that before streaming platforms made it possible to access digital content, torrents were used widely.

It has been estimated that many individuals are turning to torrent websites to download movies, music albums, and video games; however, such practices often fall into the category of questionable and legally questionable behaviour. Digital piracy and its complex relationship with modern technology will continue to be relevant in 2025, despite controversies such as Meta's claims of using pirated books to train artificial intelligence, according to an article that discusses the principles and mechanisms of torrenting.

There has been an increase in the use of torrents as a method of sharing and downloading files over the Internet. As well as providing fast download speeds, torrenting also offers access to a wide variety of content, including movies, television shows, and music. However, torrenting carries significant legal and security risks, which make it difficult for torrenting to be successful. The possibility of inadvertently downloading copyrighted materials, which may result in legal consequences, or finding malware-containing files, which may compromise system security, is well known to users.

The Torrent protocol, which is a peer-to-peer (P2P) file-sharing system that utilizes BitTorrent, is a decentralized method of file sharing. A torrent is an open-source file-sharing service that allows users to share and download files directly from one another, as opposed to traditional file sharing which relies on a central server to distribute content.

To create a torrent, users connect and share files directly. Its decentralized nature enables the system to work efficiently and faster than other existing file transfer systems, especially for large files since it leverages the resources of multiple users instead of relying on a single source for file transfers.

Understanding Torrent Files

When it comes to torrenting, a torrent file plays a crucial role. A torrent is simply a small file containing metadata about the content downloaded. However, it does not contain the actual content of the downloaded content itself, such as a video, a music file, or a document.

Instead, it is a roadmap that guides the torrent client, software that manages and facilitates the torrenting process, in finding and assembling the file you are looking for. Torrent files contain a lot of essential information, including the names and sizes of the files being shared, the structure and content of the content, as well as the location of the network servers that assist in coordinating the download process.

There are certain pieces of information that the torrent client needs to reassemble the complete file, including the following information, as they are required for it to be able to break the content down into smaller segments, to retrieve these segments from multiple sources within the swarm, and then to reassemble them. As opposed to traditional methods of downloading, this approach to file sharing offers a significant advantage.

Besides making these processes more effective and faster, it is also more resilient to interruptions as different parts of the image can be sourced from multiple peers simultaneously, making this process very fast and more reliable. Even if one peer goes down, the client will still be able to download the files from other active peers, ensuring that minimal interruption will occur. There is, however, a risk associated with torrenting not only that it provides a convenient way of sharing files, but also that there are some legal and security risks associated with it.

Ensure that users exercise caution to make sure they do not unintentionally download copyrighted content or malicious files, as this can compromise both their legal standing as well as the integrity of their systems. There has been a negative perception of torrenting over the years due to its association with illegally downloading copyright-protected media. There were some early platforms, such as Napster, Kazaa, and The Pirate Bay, which gained attention and criticism as they began to enable users to bypass copyright laws and enable them to disseminate content illegally.

Although torrenting can be unlawfully used, it is equally important to remember that it is not inherently illicit and that its ethical implications depend on how it is employed. Similarly, seemingly benign objects can be misused to serve unintended purposes, just as any tool can have ethical implications. The reputation of torrenting has been diminishing in recent years because its potential for legitimate applications has been increasingly acknowledged, resulting in its decreased controversy.

In addition to providing a variety of practical benefits, peer-to-peer (P2P) file-sharing technology allows for faster file transfers, decentralized distribution, and improved accessibility when it comes to sharing large quantities of data. To minimize the risks associated with torrenting, it is very important to observe certain safety practices.

There is no inherently illegal aspect of torrenting technology, however, its reputation has often been shaped by its misuse for bypassing copyright laws, which has shaped its reputation. It is the most reliable and efficient way to ensure the safety of content is to restrict it to materials that do not possess any copyright protection, and by adhering to "legal torrenting" users will be able to avoid legal repercussions and promote ethical use of the technology safely.

The use of Virtual Private Networks (VPN) is another important step in ensuring secure torrenting when users are downloading files. By encrypting the internet connection of a user, a VPN makes file-sharing activities more private and secure, while ensuring that the user's IP address remains hidden so that the user's online actions can remain safe. VPNs also offer a significant layer of protection against the possibility of monitoring by Internet Service Providers (ISPs) and third parties, thereby reducing the risk of being monitored.

In addition to offering robust security features and user-friendly interfaces, trusted platforms such as uTorrent, qBitTorrent Transmission, and Deluge make it very easy for users to navigate torrenting. In addition to protecting against malicious files and potential threats, these clients help facilitate a seamless file-sharing experience. Torrents, while they are an efficient method of sharing content, can also pose several risks as well.

There are several concerns associated with the use of copyrighted material without the proper authorization, one of which is the potential legal repercussions. Serious problems can arise if improper authorization is not obtained. Furthermore, torrents can contain malicious software, viruses, or any other dangerous element that can compromise the security of a user's device and their personal information. A user should practice caution when downloading torrents, remain informed about the risks, and take the appropriate steps to ensure that their torrenting experience is safe and secure.

Cryptojacking Attacks Soar 409% in India Amid a Global Shift in Cybersecurity Tactics



 

Trojan

cryptocurrency Cryptojacking Cyberattacks Cyberbreach Cyberhakcers Cybersecurity Cyberthreats IoT Malicious program Technology Trojan

Cryptojacking Attacks Soar 409% in India Amid a Global Shift in Cybersecurity Tactics

A rise in technology has also led to an increase in cybersecurity concerns as a result of the rise of technology. It is becoming more and more common for users across the world to fall victim to online scams day after day, and this is even getting the authorities in action, as they're now attempting to combat this trend by taking steps to introduce safeguards for users.

According to the first half of 2024 global statistics, malware volume increased by a whopping 30 per cent on a global scale. As a result of this increase alone, the number of reports increased by 92 per cent in May. Throughout 2024, the number of malware attacks in the country increased by 11 per cent and ransomware attacks rose by 22 per cent, indicating that businesses are facing more cyber threats than ever before, according to a report by SonicWall.

A SonicWall report published in February 2024 revealed that malware attacks increased by eleven per cent in volume from 12,13,528 in 2023 to 13,44,566 in 2024 as compared to the previous year. IoT (Internet of Things) attacks have increased by 59 per cent in the last year, with 16,80,787 attacks occurring annually in 2024 as opposed to 10,57,320 in 2023, the study found.

There is no doubt that India is making substantial efforts to become one of the leading countries in the field of technology. While the use of technology has increased over the years, a recent trend has also been accompanied by significant cybersecurity risks. Attacks on Internet of Things (IoT) devices have increased by 59 per cent in 2024 as compared to 1,057,320 in 2023, which marks an increase of 11 per cent in malware attacks, a 22 per cent increase in ransomware attacks, and an 11 per cent increase in Internet of Things (IoT) attacks.

According to the report, there was a marked increase in both ransomware attacks and crypto attacks; the latter grew by an astonishing 409 per cent. The SonicWall Vice President for APJ Sales, Debasish Mukherjee, noted that organizations are facing an increasingly hostile threat environment because attackers are continuing to innovate beyond traditional defences to become more successful. According to the "Mid-Year Cyber Threat Report" published by SonicWall, the rise of new cyber threats is becoming increasingly prevalent among businesses due to these new developments in cybersecurity.

Cryptojacking attacks are increasing, and India has reported the highest number of attacks with a 409 per cent increase compared to a global decline of 60 per cent — a startling statistic. In a recent report published by SonicWall Capture Labs, SonicWall released the 2024 SonicWall Mid-Year Cyber Threat Report today. This report reveals that cyber threats are once again on the rise after an 11% increase in 2023, confirming the 11% rise in high-quality attacks since 2023.

A report published by the company details the changing threat landscape over the first five months of this year, showing the persistence, relentlessness, and ever-growing nature of cyber threats across the globe. A report that has been designed with SonicWall's partners in mind, has undergone several changes over the past few years, much like SonicWall itself has undergone several changes. As part of its evolution, the report has recently changed the way it measures vital cyber threat data to include time as a component.

A key part of the report outlines the latest threats which are affecting our partners and the customers they serve, and for the first time, it highlights how attacks can have a direct impact on our partners, including threats to revenue. According to SonicWall intelligence, on average, companies are likely to be under critical attack - that is, attacks which are most likely to deplete business resources - for 1,104 of the 880 working hours they have in a given month.

In the first five months of 2024, businesses were shielded from potential downtime of up to 46 days, a critical safeguard that protected 12.6% of total revenues from potentially devastating cyber intrusions. This significant finding was among the key insights from a recent report, underscoring the escalating threats faced by modern enterprises.

Douglas McKee, Executive Director of Threat Research at SonicWall, emphasized the importance of robust cybersecurity measures, stating, "The data and examples found in the report provide real-life scenarios of how crafty and swift malicious actors operate, underscoring that traditional cybersecurity defences often prove to be the most reliable." One of the most pressing concerns highlighted in the report is the increasing sophistication of supply chain attacks.

These attacks exploit the interconnectedness of modern enterprises, targeting vulnerabilities in third-party software and services to compromise broader networks. The first half of 2024 saw several sophisticated attacks, including a high-profile breach involving the JetBrains TeamCity authentication bypass. By the end of 2023, three out of the top five companies globally had already suffered supply chain breaches, affecting more than 50% of their customers.

These breaches were primarily due to vulnerabilities such as Log4j Log4Shell and Heartbleed. The report also revealed that organizations, on average, took 55 days to patch even 50% of their critical vulnerabilities, further exposing them to risk. In response to these growing threats, Microsoft has made significant strides in addressing vulnerabilities.

In 2023, the company patched more than 900 vulnerabilities, with Remote Code Execution (RCE) vulnerabilities accounting for 36% of them. Despite the high number of RCE vulnerabilities, they were exploited only 5% of the time. In contrast, Elevation of Privilege vulnerabilities, which were leveraged 52% of the time, posed a greater risk. By mid-2024, Microsoft had already patched 434 vulnerabilities, matching the record set in 2023.

Notably, 40% of these vulnerabilities were classified as RCE, yet 86% of the exploited vulnerabilities were related to Security Feature Bypass or Elevation of Privilege issues. The report also sheds light on the growing threat posed by Remote Access Trojans (RATs). These malicious programs disguise themselves as legitimate applications to obtain necessary permissions and connect to command-and-control servers, enabling them to steal sensitive information and bypass multi-factor authentication (MFA). Industries will experience several sophisticated RAT attacks in 2024, with malware such as Anubis, AhMyth, and Cerberus evolving to bypass MFA, making them a significant cybersecurity threat. PowerShell, a versatile scripting language and command-line shell, has also become a favoured tool among malicious actors due to its user-friendly features.

The report revealed that 90% of prevalent malware families, including AgentTesla, AsyncRAT, GuLoader, DBatLoader, and LokiBot, utilize PowerShell for malicious activities. Of these, 73% use PowerShell to download additional malware, evade detection, and carry out other harmful actions. This report serves as a stark reminder of the increasing sophistication and prevalence of cyber threats in 2024, underscoring the need for continued vigilance and robust cybersecurity measures to protect businesses and their customers.

Security Nightmare with Hackers Releasing 1,000 Crore Passwords in Major Breach



 

Privacy

Cyber Hackers Cyberbreach CyberCrime Cybersecurity CyberThreat Data Major Breach Password Breach Privacy

Security Nightmare with Hackers Releasing 1,000 Crore Passwords in Major Breach

Cyber-security breaches are becoming more and more prevalent and this is causing a lot of concerns amongst the public. The report by Semafor claims that some 10 billion (1,000 crore) passwords have been leaked from a hacking forum online about a file that contains nearly 10 billion (1,000 crore) passwords. The incident that took place on July 4th is regarded as being among the largest cyber-security breaches that have been recorded in history. As a result of the massive leak, a credential stuffing attack could be performed with the help of this massive leak, highlighted the report.

As a type of cyberattack, credential stuffing involves hackers stealing usernames and passwords from several related data breaches to gain access to other accounts owned by the same individual. A significant increase in cyberattacks and malicious attempts to steal data in the past five years has led to an increase in the probability of financial harm becoming a worldwide problem, not only for individual citizens but also for governments and financial institutions spread around the globe.

Cybersecurity reports state that around 10 billion passwords belonging to various people have been made public on global forums, whether they represent social media accounts or email accounts owned by individuals. There is no doubt that this was one of the biggest data breaches ever in the history of mankind.

The Semafor news website reports that a file containing around 10 billion (1,000 crores) passwords was leaked via online hacking forums, which was compiled by an anonymous hacker. Several old and new password breaches were compiled into the compilation, which was uploaded to the internet on July 4 and is one of the largest leaks that anyone has seen to date. According to the SEMAFO report, this massive leak has increased the risk that credential-stuffing attacks will become possible.

As a result of the leak's nature, as it yields a single searchable file, hackers will have an easier time discovering user data thanks to the single searchable file. An attack called credential stuffing occurs when hackers use an infected password to access multiple accounts connected to the same user as soon as the password has been compromised. In the example below, it is possible to break into user A's bank account by using the email password that they use for their email.

The cyber-news is reporting that credential stuffing attacks are compromising users across various platforms such as AT&T, Santander Bank, Ticketmaster, 23andMe, and several other companies. It was also noted in the report that related to a report by the International Monetary Fund (IMF) and a study published by Lancet Journal, the number of malicious cyberattacks has doubled globally since 2020, with the financial industry (20,000 cyberattacks since 2020) and health sectors being hit hardest.

The size of the leak, however, has provided some relief for worried netizens - some analysts have suggested that, as a result of its sheer size, the file may not be able to be accessed. Even though more accounts have been leaked, the report notes that the likelihood of cyberattacks is not heightened just by more passwords being leaked - but of course, it highlights the "glaring holes" in the security systems in place.

The Growing Concern About School Record Hacking



 

School Record Hacking

Cyberattacks Cyberbreach CyberCrime Cybersecurity Privacy School Record Hacking

The Growing Concern About School Record Hacking

The confidential documents stolen from schools and dumped online by ransomware gangs are raw, intimate and graphic. They describe student sexual assaults, psychiatric hospitalizations, abusive parents, truancy — even suicide attempts.

Cybercriminals are not only seeking ransom payouts but are also targeting students’ personal information, including credit details, assessments, grades, health records, and more. The potential socio-emotional impact on students, coupled with financial implications, adds urgency to addressing cybersecurity challenges in schools.

The sheer volume of devices and users in educational settings creates a complex environment prone to human failure. Challenges include phishing attacks, exploitation of vulnerabilities, and the rising ransomware threat, leading to downtime, recovery efforts, and paid ransoms.

“Please do something,” begged a student in one leaked file, recalling the trauma of continually bumping into an ex-abuser at a school in Minneapolis. Other victims talked about wetting the bed or crying themselves to sleep. Complete sexual assault case folios containing these details were among more than 300,000 files dumped online in March after the 36,000-student Minneapolis Public Schools refused to pay a $1 million ransom.

Other exposed data included medical records, discrimination complaints, Social Security numbers and contact information of district employees. In the U.S., 1,981 schools across 45 districts fell victim to cybersecurity attacks in 2022, almost doubling the previous year’s incidents, according to an Emsisoft report based on aggregated publicly available data.

Schools are “definitely not funded enough to support cyber warfare,” said Josh Heller, supervisor of information security engineering at Digi International. Penn Manor School District has 5,500 students who collectively generate more than two million individual data points in the core student management system alone.

An attack that targets a business, through an employee or an employee's child, may seem like a step too much work when phishing and business email compromise are so much simpler. But, to state the obvious: Children are easy marks, and nearly all of them play video games. Combined with the proliferation of remote work and bring-your-own-device (BYOD) policies, this vector is long-tailed but fruitful for attackers.

Cybercriminals seeking ransom payouts or identity thieves going after a student’s spotless credit can gain access to identifying information, assessments, assignments, grades, homework, health records, attendance history, discipline records, special education records, home communications and more.

The increase in ransomware attacks in schools poses severe emotional and physical risks to students. Besides extorting money from students, cybercriminals also target sensitive personal data, making the potential harm even greater. Educators are suffering from major downtime, and resurgent action must be a result of these attacks.

To protect students, and to prevent further damage, it is imperative that urgent action be taken, increased funding be provided, and cybersecurity be enhanced. To strengthen educational institutions against cyber threats escalating in number and intensity, it is imperative that awareness is elevated and collaborative efforts are put into place.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Showing result(s) for

Popular Posts

Pages

Ingram Micro Faces Alleged Breach by SafePay with Ransom Threat

Hackers Compromise French Submarine Engineering Company

Ransomware Defence Begins with Fundamentals Not AI

Ahold Delhaize USA Faces Data Breach Exposing Sensitive Information

United Natural Foods Confirms Network Disruption from Cyberattack

A Closer Look at Torrenting and Its Applications

Understanding Torrent Files

Cryptojacking Attacks Soar 409% in India Amid a Global Shift in Cybersecurity Tactics

Security Nightmare with Hackers Releasing 1,000 Crore Passwords in Major Breach

The Growing Concern About School Record Hacking

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Showing result(s) for

Popular Posts

Pages

Menu Item

Understanding Torrent Files