Colorado Health Clinic Warns Patients of Data That Was Leaked in 2024….. WTF?

Posted in Commentary with tags on February 2, 2026 by itnerd

Comparitech is reporting that a Colorado healthcare clinic Alpine Ear, Nose & Throat began the notification of 65K+ people of a data breach from November 2024. Data exposed includes SSNs, credit card numbers, health insurance info, names, and more. 

Commenting on this news is Rebecca Moody, Head of Data Research at Comparitech: 

“It is always concerning when it takes an organization a long time to issue data breach notifications. And when the breach involves incredibly sensitive data, as it does in this case, the delay can have significant consequences. While AENT did post a notice on its website in January 2025, only those patients who visited the website would have seen it. Equally, as the investigation was still underway, the type of data involved wasn’t included, meaning some patients may not have paid the notification much attention. Therefore, many patients’ personal data may have been compromised for over a year without them knowing/without them taking the necessary measures. 

AENT is now offering those affected access to free credit monitoring services. Although this is a bit of a case of “shutting the barn door after the horse has bolted,” it is still crucial that anyone who is impacted in this event takes AENT up on this offer. This will allow them to check to see if their data has been compromised, and, if not, take necessary steps toward safeguarding it going forward.”

Another healthcare breach. Oh joy. But this is one that happened almost 2 years ago. This is a total #EpicFail on the part of Alpine Ear, Nose & Throat. Clearly these guys were not taking this seriously if it took them this long to do what is right and notify patients in a timely manner.

Leave a comment »

AI Productivity Gains Collide with Economic and Geopolitical Volatility, Forcing a Strategic Reset for Technology Leaders, Reveal Survey Finds

Posted in Commentary on February 2, 2026 by itnerd

AI continues to deliver measurable productivity and performance gains across organizations, but global economic uncertainty and geopolitical risk are reshaping technology investment, hiring, and innovation strategies for 2026, according to the annual Reveal Top Software Development Challenges Survey from Infragistics, released today. The study surveyed 250 senior technology leaders in December 2025, including C-suite executives, CIOs, CTOs, VPs, IT managers, and directors responsible for software development and business intelligence at mid-market and enterprise organizations across industries.

The findings reveal a technology landscape defined by tension: strong momentum from AI-driven productivity improvements on one side, and growing constraints from talent shortages, budget pressure, and global instability on the other. While most organizations reported positive outcomes in 2025, many are entering 2026 with a more cautious, execution-focused mindset.

Talent and AI Complexity Top the List of Business Challenges

Recruiting and retaining skilled technology talent has emerged as the single biggest business challenge for 2026, cited by 50% of respondents. This increase highlights a gap between the pace of AI adoption and the availability of experienced professionals who can implement, govern, and scale these technologies effectively.

AI itself remains a double-edged sword. While it is a critical driver of productivity, 42% of respondents cited incorporating AI as a major business challenge, reflecting the growing complexity of moving from experimentation to full-scale deployment. Additional business challenges include increasing employee productivity (54%), economic cutbacks (35%), limited resources (31%), and the inability to make data-driven decisions (12%). Together, these pressures are making it harder for organizations to execute long-term technology roadmaps.

Despite these constraints, growth remains evident. In 2025, 53% of organizations reported productivity gains, 47% took on new projects, and 46% increased adoption of new technologies. These results build on strong momentum from 2024, when a majority of companies reported revenue growth, increased headcount, and rising demand. Heading into 2026, however, execution capacity—not demand—is emerging as the primary limiter of growth.

Productivity Gains Face Economic Reality

Technology-driven initiatives were the primary drivers of productivity gains in 2025. Two-thirds (66%) of respondents credited AI adoption, while similar percentages pointed to embedded analytics (62%), automation of repetitive tasks (62%), and investments in skills development (63%) as the engines behind rising productivity. The data confirms a clear shift: productivity is increasingly achieved through smarter systems, not longer hours.

Yet these gains are under threat. One-quarter of organizations plan to cut spending in 2026 due to a weakening economy. Inflation (60%), rising costs (58%), economic instability (53%), tariffs (50%), and higher interest rates (40%) are among the top pressures influencing planning decisions. This creates a growing disconnect between the technologies that drive performance and the budget constraints that may limit further investment.

Economic and Geopolitical Pressures Drive a Strategic Reset

More than half of technology leaders report delaying launches or expansions (54%), while 43% are reducing innovation budgets and 35% are changing development team locations. Only 17% say global conditions have had no impact on their plans.

These findings point to a broad shift in strategy across the industry. Organizations are shifting from aggressive growth strategies toward defensive optimization—prioritizing resilience, cost control, and risk management. As a result, even successful AI and analytics initiatives must now clearly demonstrate business value to survive in tighter budget environments. Companies are pushing AI investments that deliver measurable efficiency gains, cost reduction, or near-term revenue impact.

AI Integration Becomes the Top Software Development Challenge

In 2026, the biggest software development challenge is no longer whether to use AI, but how to integrate it safely and effectively. Nearly six in ten respondents (57%) cite AI integration into the development process as their top challenge, up from 44% in 2025. Security threats (49%) and data privacy and regulatory compliance (48%) closely follow, underscoring the increasing risk and governance complexity associated with AI-driven systems.

Operational challenges persist as well. Managing cloud applications and heavy workloads (29%) and maintaining legacy software (27%) reflect the realities of hybrid environments where innovation must coexist with aging infrastructure. Compared with 2025, the data shows a clear shift from exploratory AI concerns, such as AI-generated code quality, to full lifecycle integration, security, and compliance pressures.

AI-Centered Expansion Plans Signal Measured Optimism

Despite economic uncertainty, organizations are not retreating from growth entirely. Instead, they are pursuing more targeted expansion strategies anchored in AI. More than three-quarters of respondents (77%) plan to increase their use of AI in 2026, reinforcing its central role in productivity and competitiveness.

Notably, revenue ambitions have doubled year over year: 46% plan to increase revenue in 2026, compared with 23% in 2025. Plans to adopt new applications (40%), expand into new markets (35%), and develop new applications (34%) indicate a shift from internal optimization toward outward, commercially focused growth. AI investments are increasingly expected to deliver tangible, measurable business outcomes rather than experimental gains.

Embedded Analytics and BI Move from Insight to Action

Embedded analytics and business intelligence continue to gain momentum. Today, 76% of organizations use embedded analytics internally, and 84% expect their BI focus to increase in 2026. The emphasis is shifting from visualization to action: organizations cite better decision-making, faster trend identification, productivity gains, and automated analysis as top priorities.

Most companies now embed analytics directly into applications rather than relying on standalone BI tools. While 42% still build in-house, a majority (54%) turn to vendors to accelerate delivery, reduce costs, and avoid overburdening already stretched teams.

Looking Ahead

The 2026 Reveal survey underscores a defining reality for technology leaders: AI, analytics, and embedded BI are no longer optional—they are essential to competitive performance. However, success in 2026 will depend on execution. Organizations that can navigate talent shortages, security risks, and economic pressure while focusing investment on high-impact AI initiatives will be best positioned to sustain productivity, drive growth, and adapt in an increasingly uncertain global environment.

Leave a comment »

If You Use Notepad ++, You Should Download The Latest Version ASAP

Posted in Commentary with tags , on February 2, 2026 by itnerd

I am a big user of Notepad ++ as I find it to be the best way to go through logs. Especially big ones. Thus I will be downloading the latest version of the app as soon as I get home for this reason:

Following the security disclosure published in the v8.8.9 announcement https://notepad-plus-plus.org/news/v889-released/ the investigation has continued in collaboration with external experts and with the full involvement of my (now former) shared hosting provider.

According to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The exact technical mechanism remains under investigation, though the compromise occured at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.

And:

I recommend downloading v8.9.1 (which includes the relevant security enhancement) and running the installer to update your Notepad++ manually.

I have to admit that I completely missed this. That’s bad on me. The only good news is that I run Notepad ++ inside of a Windows 11 virtual machine on my Mac. So since it is largely isolated, I don’t believe that either yours truly or my customers were at risk. But for everybody who runs Notepad ++, update ASAP to keep yourself safe.

Leave a comment »

Ricoh acquires leading Canadian workplace technology and collaboration integrator ET Group

Posted in Commentary with tags on February 2, 2026 by itnerd

Ricoh today announced the acquisition of ET Group, a leading Canadian workplace technology and collaboration integrator. This strategic acquisition by Ricoh Canada Inc. accelerates Ricoh’s expansion into high‑growth digital services, strengthens its position as a leading provider of end‑to‑end workplace experience solutions in Canada, and reinforces its global strategy to support an evolving workplace environment.

By integrating ET Group’s audiovisual (AV) engineering expertise and long‑standing reputation for designing, delivering and supporting enterprise-wide collaboration environments — particularly within government and other highly regulated sectors — Ricoh further enhances its ability to provide scalable, technology‑driven workplace solutions across Canada.

Advancing Ricoh’s Digital Services Strategy

This strategic investment expands Ricoh’s digital workplace capabilities with:

  • Enterprise grade AV design, integration, and support
  • Hybrid meeting and collaboration solutions
  • Managed digital workplace services
  • Workplace experience and on-site staffing services

The acquisition formalizes and expands the existing partnership between Ricoh and ET Group, which will operate as a wholly owned subsidiary of Ricoh Canada.

Building a Stronger Service Network for Public‑ and Private‑Sector Organizations

ET Group brings a highly skilled team of AV engineers, designers, project managers, and support specialists trusted by major corporations, government agencies, and judicial systems. Its expertise in secure, resilient environments complements Ricoh’s footprint with Canada’s large enterprises and public institutions.

Customers will benefit from a more comprehensive service ecosystem that now integrates:

  • Audiovisual and collaboration technologies
  • Office and workplace experience services
  • Mailroom automation
  • Managed print, scan, and fleet services
  • On‑site staffing and managed services

This combined portfolio enables organizations to design, connect, and manage the workplace as a unified, intelligent environment.

Ricoh continues to make investments globally to deliver enhanced meeting experiences and hybrid work solutions for organizations worldwide, including the acquisitions of Presentation Products, Inc. (PPI) and Cenero (United States); DataVision, Pure AV, and AVC (EMEA); and Videocorp and Go2neXt (Latin America).

Leave a comment »

Panera Bread Pwned… Sigh

Posted in Commentary with tags on February 2, 2026 by itnerd

It appears that Panera Bread has had a data breach. Initial reports have said that 14 million people have been affected. Which is bad. Especially given that they had a data leak in 2018. Well, news has surfaced that the Panera Bread data breach has affected 5.1 million accounts, not 14 million customers as previously reported.

Ensar Seker, CISO at SOCRadar:

“The distinction matters, but it doesn’t materially reduce the risk. Accounts are what attackers monetize, credentials, contact data, and reuse potential, not abstract “customers.” From a defender’s perspective, 5.1 million compromised accounts still represents a massive downstream risk for credential stuffing, phishing, and identity-based attacks well beyond Panera itself.


This incident reinforces a clear trend: attackers are no longer “breaking in,” they’re logging in. Vishing-driven SSO compromise bypasses many traditional security controls because authentication flows are trusted by design. If identity becomes the new perimeter, then SSO misconfiguration, MFA fatigue, and help-desk social engineering are now tier-one attack vectors.

What’s notable here is scale and repeatability. Targeting identity providers allows attackers to industrialize access across hundreds of organizations with similar playbooks. This isn’t about Panera specifically, it’s about systemic weaknesses in identity assurance, employee verification, and SSO recovery workflows.

Companies need to treat identity telemetry with the same rigor as endpoint or network signals. That means stricter SSO enrollment controls, hardened help-desk verification, phishing-resistant MFA, and continuous monitoring for anomalous authentication behavior, especially for admin and customer-facing identity systems.”

Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“It’s reasonable to ask whether ShinyHunters or Panera Bread is lying about how many people were compromised in this attack. I would defer to Panera. ShinyHunters estimated the number of customers in the database based on the total number of records, but it didn’t account for duplicates and other outliers. According to breach disclosure laws, Panera Bread combed through the data and found contact information to notify every person affected. Therefore, Panera’s investigation is much more thorough and it’s legally obligated to tell the truth.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy:

“As always in breaches like this, Panera needs to be upfront with their customers and employees as to how bad the breach is and what the company is doing to protect their data and to guard against future attacks such as this. Employees and customers both should take advantage of any free credit and identity monitoring services that Panera will surely offer.

Unfortunately, this breach exposes the flaws in single sign-on (SSO) services such as those offered by Google, Microsoft, and others. Such services are susceptible to social engineered phishing schemes that trick employees and customers into entering their SSO credentials into fake company portal sites. Once that information is harvested, any site or service that uses those credentials could likely be accessed.”

While a lower number is good. It doesn’t change the fact that Panera got pwned. Whether this is one or one million people who got affected, pwnage is bad. The universe has to get to a place where pwnage isn’t a thing so that nobody has to worry about being affected.

Leave a comment »

Forcepoint X-Labs Researcher Reveals Sophisticated Dropbox PDF Phishing Campaign 

Posted in Commentary with tags on February 2, 2026 by itnerd

a new research blog post published today by Forcepoint’s X-Labs threat research team that uncovers a highly evasive phishing campaign abusing trusted cloud storage and PDF files to harvest user credentials.

In the blog post — “Fake Dropbox Phishing Campaign via PDF and Cloud Storage” — X-Labs Sr. Security Researcher Prashant Kumar details how attackers are now using multi-stage delivery techniques that evade traditional email, content and link scanning by:

  • Sending a seemingly benign PDF attachment via a business-themed email that bypasses standard filters.
  • Hosting a secondary PDF on a legitimate cloud infrastructure to exploit trust in “safe” services.
  • Redirecting users to a spoofed Dropbox login page designed to steal credentials and deliver them to attacker-controlled infrastructure.

This research highlights how trusted file types and cloud platforms are being weaponized to bypass security controls — a significant shift from traditional phishing vectors and an emerging concern for enterprises and users alike.

You can read the research here: Dropbox PDF Phishing Abuse of Trusted Cloud Storage

Leave a comment »

Cybernews researchers analyze leaked Bumble data and finds sensitive company documents and user-related identifiers

Posted in Commentary with tags on February 2, 2026 by itnerd

Cybernews researchers analyzed a data sample allegedly stolen from dating app Bumble after the ShinyHunters cybercrime group claimed responsibility for a breach involving internal company systems.

ShinyHunters added Bumble to its dark web leak site on January 29, claiming it exfiltrated approximately 30GB of data from the company’s Google Drive and Slack channels. According to the attackers, the data was obtained by compromising a contractor’s account through phishing. The gang claims to possess “thousands of internal documents” belonging to the company.

Bumble confirmed to Cybernews that a contractor’s account with limited privileges was compromised in a phishing incident. The company stated that the intrusion was detected and contained quickly.

“Our InfoSec team rapidly eliminated the access, and the incident is contained. We have engaged external cybersecurity experts and notified law enforcement. Importantly, there was no access to our member database, member accounts, the Bumble application, or member direct messages or profiles,” a Bumble spokesperson told Cybernews.

Bumble is a widely used dating platform with over 40 million active users and hundreds of millions of downloads globally. The app is operated by Bumble Inc., which also owns Badoo and Bumble For Friends (BFF).

Following the attackers’ claims, the Cybernews research team analyzed the data sample attached to the ShinyHunters dark web post. Researchers say the exposed files appear legitimate, but the dataset shared by the attackers is limited, making it unclear whether it represents the full scope of the allegedly stolen data or only a partial sample.

Based on the analysis, the majority of the exposed material consists of internal corporate information rather than user-facing data. The files include internal company documents such as contracts with partner companies, invoices, policy reviews, onboarding guides, internal reports, and CVs containing candidate employment history and personally identifiable information (PII).

While Bumble stated that no user accounts or messages were accessed, the Cybernews team noted that the sample contains some technical data, including user IDs, session IDs, and authentication cookies. In theory, such data could be abused by sophisticated attackers to attempt account takeover via session hijacking, although no evidence suggests this has occurred.

The dataset also includes information related to a limited number of Bumble in-app groups, known as Hives. While no group members were exposed, some group names, descriptions, welcome messages, rules, and change logs were present in the sample.

ShinyHunters is currently running a broader campaign targeting dating platforms and technology companies. Last week, Cybernews researchers analyzed a leaked Hinge data sample and found it contains user dating profile information, such as names and bios, as well as Hinge subscription data, including transaction IDs and amounts paid.

Cybernews continues to monitor the situation and analyze new information as it becomes available.

You can find a full technical breakdown of the Bumble data sample, the attackers’ claims, and expert analysis on potential risks in the complete investigation published on the Cybernews website here.  

Leave a comment »

Top Internet Outages of 2025 Studied By Cisco ThousandEyes

Posted in Commentary with tags on January 30, 2026 by itnerd

The folks at Cisco ThousandEyes have put out a study on the Top Internet Outages of 2025. It highlights the top outages and what happened as well as what to expect going forward. It’s an interesting piece and is worth your time to read.

You can find it here: https://www.thousandeyes.com/blog/the-top-internet-outages-of-2025-analyses-and-takeaways

Leave a comment »

World’s Most Cyber-Resilient Countries Ranked in New Study By Check Point

Posted in Commentary with tags on January 30, 2026 by itnerd

According to the January 2026 report on cybersecurity innovations, Singapore is the most cyber-resilient country in the world. A new study by a cybersecurity company, Check Point, analyzed over 35 countries, comparing their technical capabilities, cybersecurity education, and job markets.

  • Singapore ranks 1st among the most cyber-resilient countries, scoring the highest in technological infrastructure, national cybersecurity strategies, and cybercrime regulations.
  • With the most job opportunities in cybersecurity and almost 1,500 professionals per 100K workers, Estonia takes 3rd place.
  • The US ranks 6th in the world for cybersecurity, with almost 1.3 million people employed as cybersecurity specialists.

The study evaluated 38 countries around the world by looking at the key factors affecting cybersecurity: technical capabilities related to technological infrastructure and resources, cybersecurity institutions, and national cyber strategies. The report also looked at long-term cybersecurity skill development that includes educational and workforce programs, international cooperation, cybersecurity regulations, as well as overall digital development levels in the country, and the ratio of cybersecurity jobs to overall employment. The final score took into account these key criteria, highlighting countries that excel across all these categories.

Here’s the top five:

  1. Singapore
  • Technical capability: 20/20
  • Long-term cybersecurity skills building: 19.8/20
  • Cybersecurity-related law: 20/20
  • Employed cybersecurity professionals per 100K: 1,329
  • Score: 99/100

Singapore is the most cyber-resilient country in the world, showing the fastest development not only in technology but also in legal regulations, national agencies, and cybersecurity education. Singapore also stands out with the best developed digital infrastructure, earning a score of 86.9, the highest in the world. The job market for cybersecurity is also one of the largest, with 1,329 cyber specialists for every 100K workers.

  1. Finland

Finland follows closely with 2nd place, scoring the highest (20 out of 20) among all categories, including digital infrastructure, international joint efforts in cybersecurity, and job training. Finland trails behind Singapore only in the size of the job market. For every 100K workers, only 889 work in fields related to cybersecurity.

  1. Estonia

Estonia takes third place among the most cyber-resilient countries, with the most active job market in cybersecurity. There are almost 1,500 employed cyber specialists for every 100K workers in the country, over 1.5 times more than in Finland. Estonia also earns the best scores for national cybersecurity and international cooperation, but stays behind Finland and Singapore in digital tools, with a score of 15.3.

  1. Denmark

Similar to Finland, Denmark shows fast development across all categories, including digital infrastructure, specialized agencies, and job training, with all scores at 20 out of 20. At the same time, in Denmark, fewer cyber specialists are actually employed than in Finland, with only 500 filled vacancies per 100K people.

  1. The United Kingdom

The UK rounds up the top 5 of the world’s most cyber-resilient countries, with a level of technological development that is similar to Finland and Denmark. The UK shows strong cybersecurity initiatives inside and outside the country, and its cybersecurity job market bigger than in Denmark, with 349K specialists employed.

You can access the full report findings by following this link.

Leave a comment »

TELUS CEO Darren Entwistle named Distinguished Entrepreneur of the Year

Posted in Commentary with tags on January 29, 2026 by itnerd

Darren Entwistle, president and chief executive officer (CEO) of TELUS, has been named the University of Victoria (UVic) Peter B. Gustavson School of Business 2026 Distinguished Entrepreneur of the Year Award (DEYA) recipient. 

This recognition highlights exceptional entrepreneurial leadership that has reshaped an entire industry, including:

  • Entwistle is the longest-serving CEO in the global telecommunications industry, leading TELUS since 2000
  • Under his 26-year tenure, he transformed TELUS from a regional Western Canadian telephone company into a global communications and IT leader
  • TELUS now holds a brand value of $12.1 billion — making it Canada’s most valuable telecommunications brand
  • Since 2000, TELUS and its team members have contributed $1.8 billion to communities, including more than 2.5 million days of volunteer service, which is more than any other company in the world. 

For more information, please see the University of Victoria’s media release here.

Leave a comment »

« Older Entries