It’s been another week of the security beat eating itself: a record-shattering crypto heist, state attorneys general extracting nine-figure checks from automakers, hospitals diverting ambulances, and yet another privacy regulator realizing that nobody can actually account for the data they were trusted to protect. Below is our roundup of the stories worth your attention, with a bit of context on why each one matters.
We’ll start light, as tradition demands: Bruce Schneier’s recurring Friday Squid Blogging feature flags the first-ever sighting of a live bigfin squid off the northeastern Pacific coast. It’s a nice reminder that the ocean still has surprises left, and that Schneier’s open-thread format — using cephalopods as a pretext for crowdsourced security news — remains one of the more charming traditions in this industry.
Less charming is the DOJ’s intervention in the potential sale of Character.AI chat logs. The Justice Department’s bankruptcy trustee office wants a dedicated privacy ombudsman to oversee what happens to the famously intimate, sometimes deeply personal conversations users have had with AI companions. This is a preview of a problem that will only grow: AI platforms are accumulating some of the most sensitive data imaginable, and bankruptcy proceedings were never designed to safeguard it. Expect this fight to become a template for future AI-company wind-downs.
Meanwhile, old-fashioned retail breaches keep rolling in. Resolve, a fashion retailer targeting Gen Z shoppers, confirmed hackers made off with customer payment card data. It’s a reminder that “next-generation” branding doesn’t buy you next-generation security practices — card skimming and payment-system compromises remain depressingly routine even at companies built entirely around digital-native customers.
Far larger in scale is Florida’s disclosure that 4.9 million people had Social Security numbers exposed through its student financial aid website. When a breach of this size hits a system meant to help young people pay for college, the irony is hard to ignore — the tool meant to open doors becomes a liability that follows victims for years. Expect a wave of identity-theft monitoring offers and, probably, lawsuits.
On the lighter-but-still-unsettling end of consumer tech, Schneier also flagged a piece on bloatware baked into cheap aftermarket car head units. A Honda Civic owner used Claude to reverse-engineer a bargain Amazon stereo and found a voice assistant quietly burning a third of the processor’s cycles, built atop WebView — effectively a browser engine with internet access sitting inside your dashboard. It’s a small story with large implications: the supply chain for “smart” hardware now extends into car parts nobody thinks to audit, and AI tools are making it trivially easy for ordinary consumers to discover just how much junk ships inside.
On the enforcement side, there’s a modicum of justice: a member of the Syrian Electronic Army was sentenced to 42 months for his role in attacks tied to Assad regime insiders. State-sponsored hacktivist groups rarely see their members face Western courtrooms, so this sentencing — however modest relative to the damage caused over a decade of SEA operations — is notable simply for happening at all.
Across the pond, oversight failures of a different kind: Britain’s GCHQ reportedly cannot account for thousands of data storage devices, according to the Investigatory Powers Commissioner’s Office. When the watchdog overseeing a spy agency says it’s “very concerned” and frustrated by the pace of GCHQ’s own investigation into missing hardware, that’s a striking admission — an intelligence service that preaches operational security losing track of physical media is the kind of irony that writes itself.
On the malware front, researchers have uncovered a new loader called NetamLoader targeting government Windows systems across Asia. What’s notable here is the technique: abusing legitimate Microsoft components to execute code and evade detection, a living-off-the-land approach that continues to be the preferred method for sophisticated intrusions because it blends in with normal administrative activity.
Patch management teams should take note of CISA’s addition of two actively exploited Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog. Ivanti’s edge appliances have been a favorite target for years now, and a missing-authentication bug paired with a predictable-identifier flaw is a particularly dangerous combination — the kind of one-two punch that lets attackers skip credential theft entirely.
Crypto markets had their own bad week. Prediction market Polymarket confirmed a cyberattack on a third-party provider caused hours of outages, underscoring how much of the crypto and fintech ecosystem rests on a small number of shared infrastructure vendors — a single compromised provider can take down services that otherwise have nothing to do with each other.
In Russia, the home goods retail chain Poryadok has been struggling with days of disruption after a cyberattack knocked out its website, app, and in-store systems across 48 locations. Russian retailers and infrastructure have increasingly become targets of opportunistic and politically motivated hacking alike since the war in Ukraine began, and this latest incident fits that broader pattern of disruption-as-leverage.
But the headline-grabber of the week is unquestionably Binance’s confirmation of a record-breaking $6.3 billion hack, which blockchain investigators are attributing to North Korea. If that attribution holds, it cements Pyongyang’s crypto-theft operations as not just a sanctions-evasion sideshow but potentially the most lucrative state-sponsored cybercrime program in history. The scale here dwarfs previous exchange hacks by an order of magnitude, and it will likely reshape how exchanges — and regulators — think about custody risk going forward.
Smaller in scope but worth watching is the slow drip of exploitation around the PHP2Shell vulnerabilities, with one security firm tracking half a dozen real-world compromises and another pointing to a suspected Chinese campaign against U.S. government-affiliated servers. PHP’s enormous installed base means even a modestly exploited bug can translate into meaningful real-world compromise, particularly when nation-state actors start taking an interest.
On the regulatory front, General Motors has agreed to pay $220 million and reform its practices after selling driver behavior data to third parties, settling with a coalition of 36 state attorneys general. This is one of the largest state-led privacy enforcement actions against an automaker to date, and it sends a clear signal that “connected car” telemetry — long treated as a lucrative, loosely regulated data stream — is now squarely in regulators’ crosshairs.
Elsewhere, a federal contractor is trying to get ahead of a cybersecurity scare: BAE Systems says no data was extracted during a cyberattack on IT systems it manages for federal bankruptcy courts. Claims of “no data stolen” in the early aftermath of an intrusion deserve the usual healthy skepticism — these assessments have a habit of being revised upward as investigations mature.
The FTC, meanwhile, is turning its attention to algorithmic pricing. The agency has ordered nine food delivery, airline, and ride-share companies to disclose how they use personal data to set individualized prices and wages. Personalized pricing has been a quiet undercurrent of consumer-data anxiety for years; this inquiry could finally produce hard evidence of how widespread the practice actually is, and whether it disproportionately burdens certain consumers or workers.
Public services continue to be a favorite target too. A cyberattack disrupted Belgium’s online tax platform MyMinfin just ahead of a filing deadline, forcing authorities to suspend access while they assess the damage. The timing — right before a statutory deadline — is the kind of detail that suggests attackers (or simple bad luck) understand exactly how to maximize disruption to government operations.
Healthcare remains one of the most dangerous sectors to see hit: the University of New Mexico had to divert ambulances and cancel medical school classes after a cyberattack, though it has since restored hospital systems. The university’s advisory urging staff not to contact the hackers is a small but telling detail — a reminder that ransomware response playbooks now routinely include explicit instructions against freelance negotiation by panicked staff.
Rounding out the vulnerability news, CISA’s second KEV catalog update this week adds actively exploited bugs in GitLab and Cisco’s ASA/FTD firewall software. Cisco’s security appliances keep showing up on these lists with uncomfortable regularity, which should prompt any organization running ASA or Secure Firewall deployments to double-check their patch cadence rather than assuming perimeter hardware is inherently hardened.
Finally, on the industrial control systems side, CISA published an advisory on multiple vulnerabilities in Hitachi Energy’s TRO600 series products that could enable remote code execution and sensitive information disclosure. Energy-sector hardware vulnerabilities rarely make headlines the way consumer breaches do, but they arguably carry higher stakes — RCE against grid-adjacent equipment is the kind of risk that operators should treat as a priority patch, not a backlog item.
Taken together, this week’s stories trace a familiar but worsening pattern: breaches keep getting bigger, enforcement keeps getting slower to catch up, and the attack surface keeps expanding into places — car stereos, AI chat logs, grid hardware — that weren’t part of the conversation even a few years ago. As always, patch what you can, watch your vendors closely, and maybe take a moment to appreciate the squid.
Leave a Reply