MoneyGram hack claimed by The Gentleman, 60M customers at risk

Posted in Commentary with tags on October 12, 2026 by itnerd

The Gentlemen ransomware gang has claimed an attack on MoneyGram, one of the world’s largest payment networks, and is threatening to release the stolen data. MoneyGram serves 60 million active customers across more than 200 countries. 

Rebecca Moody, Head of Data Research at Comparitech: 

“The Gentlemen has become one of the most prolific ransomware groups of recent years and isn’t known for fabricating its claims. MoneyGram needs to issue a statement as soon as possible to either reassure its customers that a breach hasn’t occurred or warn them of any potential unauthorized access to its systems.

Financial organizations are a key target for ransomware groups because of the highly sensitive data they deal with. The Gentlemen has claimed 46 attacks on such entities so far this year. 

Also of note is its attack on a South African tech company, MIP Holdings. This took place in June 2026, with MIP paying The Gentlemen a ransom to delete the stolen data. However, The Gentlemen has now started targeting MIP’s clients and is issuing them with their own ransom demand. This serves as a key reminder that paying a ransomware group to delete data doesn’t guarantee any data will be deleted. In MoneyGram’s case, regardless of whether or not negotiations are successful, individual customers could be contacted by the group. Therefore, MoneyGram’s customers and employees should be on high alert for any potential phishing messages and unauthorized account activity.”

Brian Higgins, Security Specialist at Comparitech:

“It’s very early in the incident response timeline but that’s no reason for anyone who may be affected should this attack prove genuine not to be extra vigilant whilst more details become available. It’s not MoneyGram’s first rodeo so there’s a good chance they will be able to offer decent information and advice as things progress, so it would be a good idea to monitor their comms output. Unfortunately these days more and more people are aware of the personal mitigations they should be considering; changing passwords, monitoring accounts, ignoring and reporting unsolicited contact and checking they have two-factor authentication applied wherever possible etc, but given the volume and diversity of the potentially vulnerable client base on this occasion it’s worth checking in with family, friends and others in your community to make sure they are doing the same. Nobody wants to be worried about their personal financial info being compromised going into Thanksgiving and Christmas so it can only help to look after each other where you can.”

Comparitech in August published a study of The Gentleman ransomware, which can be read here: https://www.comparitech.com/news/the-gentlemen-ransomware-stats-on-attacks-ransoms-data-breaches/

Leave a comment »

Inside ICMacOS: From an Infostealer to a Persistent RAT

Posted in Commentary with tags on October 12, 2026 by itnerd

SOCRadar researchers have just published a new analysis of ICMacOS (also marketed as Icarus macOS), a Malware-as-a-Service infostealer for macOS that has been actively advertised on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, since early September 2026.

Key findings include:

  • Rapid evolution: Within weeks of its public launch, ICMacOS moved from one-shot credential and wallet theft to a persistent remote access trojan, adding LaunchAgent persistence and a live WebSocket-based shell that lets operators run commands on infected Macs in real time
  • Developer and enterprise exposure: The malware specifically harvests SSH keys, AWS, Kubernetes and cloud CLI credentials, Git tokens, and .env files, creating a potential pathway from a single compromised Mac into broader enterprise infrastructure and the software supply chain
  • Convincing social engineering: ICMacOS is delivered through ClickFix pages that trick victims into pasting terminal commands, then displays a fake “System Preferences” dialog to capture the user’s login password and validates it against the local Keychain
  • Wide collection scope: Targets include browser credentials and cookies across Chromium, Safari, and Firefox, 29 browser extensions covering crypto wallets and password managers, desktop crypto wallets, the macOS Keychain, Telegram, WhatsApp, Discord, iMessage, and Apple Notes; the latest version adds Steam, Outlook, clipboard contents, and additional password managers
  • Commercial operation: The stealer is sold by an actor using the handle GlowComa, operating under the MADHASH crypto-draining affiliate group, at $699 per week, $1,199 every two weeks, or $1,699 per month, and it is configured to avoid infecting systems in Russia and CIS countries

For full details, the analysis can be found here: https://socradar.io/blog/icmacos-infostealer-rat/

Leave a comment »

Amazon Fire TV Cube hacked using 4-year-old vulnerability

Posted in Commentary with tags on October 12, 2026 by itnerd

Amazon’s Fire TV Cube 3rd Gen has been hacked using a four-year-old GPU vulnerability, allowing users to gain complete control over the device, Cybernews reports.

The discovery has sparked excitement among home theater enthusiasts, who are exploiting the flaw to turn the Cube into a powerful media player. However, the same vulnerability could also pose security risks.

Here are the key findings:

  • The vulnerability (CVE-2022-38181), rated 8.8/10 in severity, allows arbitrary kernel code execution and root access.
  • ARM patched the flaw in August 2022, two months before the Fire TV Cube 3rd Gen was released.
  • Enthusiasts are using the exploit to install custom operating systems, remove Amazon’s software, and unlock advanced video and audio playback capabilities.
  • Attackers could potentially exploit the vulnerability to spy on users, steal data, or incorporate devices into botnets, although there’s no evidence of active exploitation in the wild.

Amazon told Cybernews that the demonstrated method poses little risk to customers, as it requires physical access and deliberate, multi-step modifications. The company says it’s reviewing the details and will take appropriate action if needed.

You can read the full story here: https://cybernews.com/security/amazon-fire-tv-cube-root-exploit-enables-full-unlock/ 

Leave a comment »

Park Place Technologies Extends Microsoft Cloud Capability Across U.S. and Canada

Posted in Commentary with tags on October 12, 2026 by itnerd

Park Place Technologies has extended its Microsoft Cloud Solution Provider (CSP) capability for Microsoft Azure to customers across the United States and Canada. This extension brings a cloud practice already established in Europe to two of the company’s largest and fastest-growing markets.  

Park Place Technologies is now able to license, provision, support and manage Microsoft Cloud services for customers throughout the United States and Canada, with support for Microsoft 365, Azure, Azure Virtual Desktop (AVD) and Microsoft’s broader business, data and AI platforms. 

The significance of this expansion is what it enables for customers: a more direct, accountable path to Microsoft cloud and applications. It also empowers customers to make enhanced infrastructure decisions with the support of a partner that already understands their estates.  

Park Place has built its reputation by supporting complex, business-critical infrastructure for more than 35 years, a foundation that remains a key advantage as customer estates become more hybrid, distributed and outcome-driven. The company’s cloud practice is underpinned by a firm commitment to continuously innovate, expand and add new routes to value without losing sight of the infrastructure realities customers depend on daily. 

Bringing CSP capability in-house removes a layer of complexity for customers and puts Park Place’s own engineers and account teams behind every Azure engagement, from design through ongoing support.  

For customers in the U.S. and Canada, Park Place’s CSP capability includes cost optimization and management, security and identity services and managed cloud operations across Azure Virtual Desktop, Microsoft 365, SQL, Dynamics and Copilot. This complements the company’s broader Microsoft competencies, supporting the full journey from migration and modernization planning to ongoing Microsoft environment support. It also strengthens Park Place’s broader Infrastructure Managed Services and Software Technical Support portfolio solutions, allowing customers to leverage a single partner for cloud, Microsoft environments and the infrastructure that supports them. 

Park Place’s expanded Microsoft Cloud Solution Provider CSP capability is available now to customers and partners across the United States and Canada. Organizations interested in learning more can contact their Park Place representative or visit ParkPlaceTechnologies.com. 

Leave a comment »

Review: Apple Watch Ultra 4

Posted in Products with tags on October 10, 2026 by itnerd

On Halloween of 2022 I posted a review of the Apple Watch Ultra which was at the time a brand new product category for Apple. Which to be clear was to play in the watch space that was occupied by Garmin, Coros, and the like. Now the Apple Watch Ultra is in its fourth generation and I have decided to upgrade.

Now if you’re looking for major or minor differences in the watch, you won’t find any. Mostly. It looks the same. The watch, the packaging, everything. So what you will find is this:

This is the new “Health Sensing System” which is Apple’s term for new sensors that allow for sampling heart rate every 5 seconds instead of every 5 minutes, as well as sampling heart rate variability every 5 minutes throughout the day. And Apple has a study that they funded to back up that this is the most accurate sensor of its type. I will link the study here. And I would suggest that you take it with a grain of salt as this is an Apple funded study. Which means that it may not be taken seriously. Having said that, it facilitated a new score called the “Readiness Score” which shows how ready you are to take on the day.

Your readiness score ranges from 0-10:

  • Go for it: 8–10
  • Ready: 5–7
  • Pace Yourself: 2–4
  • Recover: 0–1

And your Activity data, daytime and overnight vitals, and sleep data factor into your overall readiness score.

  • Activity: Activity from both today and your recent history can impact your readiness score. Active calories, workout effort ratings, and Training Load data are all used to calculate the score. Increased activity in general can reduce your score, while steady or reduced activity raises it. Additionally, you might see your score go down during the day after a workout or activity.
  • Vitals: Readiness considers the status of your daytime and overnight metrics from the Vitals app. When your vitals indicate you’re Notably or Slightly off, your score is reduced. When all of your metrics are Typical or Favorable, your score is raised. Higher-than-usual heart rate variability (HRV) can lead to Favorable vitals and a high readiness score.
  • Sleep: Your sleep score from the previous night and your recent history can impact your readiness score. A low sleep score from poor-quality or inconsistent sleep can reduce your readiness score, while a high sleep score, or an improved sleep score, can raise your readiness score.

So ideally you want to be within 5 or up to do any strenuous activity. In my case, I not only used indoor and outdoor cycling as a baseline, but I measured this score against Athlytic which gives me Whoop like functionality from the Apple Watch Ultra. For the most part, they agreed with each other as I felt the way both apps said I would feel. Though I will note an exception or two. They based around Athlytic saying that based on my heart rate variability, I should take a rest. But I got a readiness score of 8. So I pushed myself indoors on the bike that day and I felt fine. So maybe there is something to this score. Apparently Athlytic is still collecting heart rate variability and resting heart rate data. Thus I may revisit this later.

Since the majority of this watch is basically an evolution rather than a revolution. I will cover off the rest of this pretty quickly.

Screen: This watch now does 3000 nits of peak brightness to make it easier to read in bright sunlight. Now I never had any issue reading this watch before. But the extra nits do help. It also has a screen that allow the reading of the watch that from more oblique angles. That on the bike I really appreciated.

Battery: Apple claims 50 hours of normal use from the watch which is just over 2 days. While not Garmin territory as their watches can last for days, I did find this to be better than expected. I charged my watch to 100% on a Sunday at 3 PM and got 28% on a Tuesday at 9:30 PM when the watch told me that I had to charge above 30% to get sleep tracking. That’s 54 hours with lots of room remaining. And I used cellular about 4 or 5 times during that period, and I recorded at least one workout a day. Thus Apple’s claim of 50 hours seems reasonable.

Charging: There is a new 10W charger in the box that allows the Apple Watch Ultra to add 18 hours of life with a 15 minute charge. So what Apple have clearly done is focus on the charging part of the equation by allowing you to charge faster rather than have the watch last longer.

Cellular: Like previous Apple Watches, these support cellular independence. But what is different is that this supports 5G cellular if the carrier supports 5G reduced capacity or RedCap for short. I am on Freedom Mobile so this isn’t supported, but if it were supported, I can expect better battery life and maybe faster speeds.

S11 Chip: Apple has a brand new S11 chip that is a 2 nm chip which promises efficient usage and better battery life. When I moved through the watch, it didn’t seem faster. But I am missing the new Siri functionality which will likely make any differences more noticeable. There is one feature that I will get to that this watch does offer. I come to in a second. Another note is that the Ultra 4 has 64 GB of storage on board. That’s a win. But there’s no easy way that doesn’t involve shoving all your music onto the Apple Watch via adding every playlist that you have on the iPhone unless you have an Apple Music subscription. That is not a win.

Materials: It’s the same titanium case that you got in the original Ultra. So no change there. But this time around I got the Trail Loop. And frankly, this is the most comfortable band that I have ever gotten from Apple. Though if you do any sweaty activities, it will stay wet for a wile.

Now comes the tough conversation. There’s two features that the S11 chip facilitates:

  • Live Rewind lets you recall what was just said in the previous 15 seconds of a conversation as a text snippet by double-pressing the Digital Crown.
  • Siri Recap, meanwhile, creates high-level summaries of conversations that you can review later.

They’re part of what Apple calls “Audio Intelligence.” And they are currently not here yet but are coming later this year. Apple has outlined these features via a thorough privacy strategy. The tough conversation starts with this. If you turn these features on, they are always listening. And even though nobody is attributed to anything that it records, I find this problematic. If these features are always listening, then anyone within earshot is being recorded. And they may not have consented to this. And if you add the fact that Apple Watches all look the same as the new Series 12 has these features as well, then that is really problematic as there is no way for you to tell if one Apple Watch has this feature and another doesn’t. To me, it seems one step away from Meta’s glasses which have be caught “up skirting” people and people who own Meta glasses seem to invest a lot of time to turn off any indication that the built in camera might be recording. You have to believe that Apple expects to be questioned if not sued over these features, and I for one will be interested to see how Apple handles this and keeps these features intact.

Another feature is the new Health App which is not out there either. That I am waiting for as the main failing that Apple Watches have is that the current Heath App is more of a dumping ground for data that has no context. What the new Health App will do is wrap some context around that data. I will circle back on that when it officially ships. But it will make a huge difference for non-developers as you will be able to action that data and make it useful for you.

Finally, the Apple Watch Ultra 4 has a price of $1099 CAD as you see it here. That’s a price that probably is hard to justify for 95% of the people out there as a Series 12 has all of these features and 24 hours of battery life at a lower price point. Plus this is also total overkill for 95% of the population from a functionality standpoint. But if you need the battery life (I do) or features like the “Action Button” (I do for about 4 months of the year), this is the Apple Watch to get.

Leave a comment »

From a Japanese cloud outage to Gorton’s parent company: the hidden supply chain risk for U.S. firms

Posted in Commentary with tags on October 9, 2026 by itnerd

A ransomware attack against a SoftBank-owned cloud provider in Japan has affected 495 companies and local governments, and the impact is expanding beyond the original infrastructure outage.

JR East has now disclosed approximately 6.09 million potentially exposed customer records across its group. Nissui, which operates major U.S. seafood businesses including Gorton’s, has confirmed disruptions to its Japanese logistics subsidiary. No direct U.S. disruption has been established.

The next development to watch is which additional customers disclose incidents as investigations continue.

John Watters, Founder & CEO, iCOUNTER | Former President & COO, Mandiant Said This:

“One ransomware attack against a cloud provider in Japan has put 495 companies and local governments at risk, with JR East already reporting approximately 6.09 million potentially exposed customer records. And this story is far from over. As more organizations investigate their exposure, we should expect additional disclosures that reveal just how far a single attack can reach.

This isn’t just a Japan problem. It’s a warning to American businesses about the dependencies hiding inside their supply chains. Nissui, one of the affected organizations, has significant U.S. operations, illustrating how interconnected these ecosystems have become, even though no impact on its American operations has been confirmed.

What concerns me most is that many organizations won’t know they’re exposed until a vendor tells them. By then, critical decisions about data protection, business continuity, and recovery may already be overdue.

Every CISO should be asking three questions right now: Which of our vendors and their suppliers depend on the affected infrastructure? Is our data exposed? And what is our response plan if those services go down?

Traditional third-party risk assessments tell you whether a vendor met security requirements at a point in time. They don’t tell you when that vendor, or a supplier behind it, is actively under attack.

The next breach notification shouldn’t be the first time you discover your organization was at risk. Security teams need to identify threats across their extended ecosystem, determine what matters to their business, and act before a supplier’s incident becomes their own.”

With everything being interdependent on everything else, you’re only as secure as the guy next to you. Thus need to make sure that the guy next to you is secure to your standards and not theirs.

Leave a comment »

Midnight Mimosa malware in Android firmware with system level privileges

Posted in Commentary with tags on October 8, 2026 by itnerd

Bitdefender found Midnight Mimosa malware preinstalled in the firmware of thousands of inexpensive Android phones being sold across 150+ countries. Researchers  said: “The malware ships preinstalled in the device firmware, and (was) found multiple system packages involved, depending on the device. It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled.

“The malware runs with system-level privileges that allow it to silently install and remove apps, grant permissions, and load arbitrary code supplied remotely. This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets. This scheme is likely designed mainly to generate revenue,” the reviewers said. 

Western Europe and the Americas are “centers of gravity” for the infected devices.


Ted Miracco, CEO, Approov:

The uncomfortable takeaway from Midnight Mimosa is that you can’t assess an app’s security in isolation from the environment it runs in.

If malware is embedded in firmware before a phone even reaches the customer, trust is undermined before the first login. The user didn’t have to download a malicious APK. The app didn’t necessarily do anything wrong. The underlying device was already compromised.

For organizations protecting mobile APIs, this raises a bigger question: Should a successful login be enough to trust a mobile request?

The answer is no. Authentication verifies user credentials; it does not establish the integrity of the app or device making the request. App attestation and runtime integrity signals provide additional evidence that should inform API access decisions.

Crucially, those decisions should be enforced outside the potentially compromised device, using remotely evaluated integrity checks and backend verification.

When compromise occurs below the application layer, app and device integrity need to become part of the API security decision—not assumptions sitting underneath it.

Roland Lindsey, Lead Solutions Engineer, Finite State:

“This is why there is no substitute for binary analysis on the shipping firmware.  Source trees and build processes are aspirational.  If you aren’t looking at what ships to the customer, you are running blind.”

Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:

“This is a serious supply chain security issue because these devices are potentially compromised before consumers ever turn them on. When malware is embedded in firmware, traditional security tools may have limited visibility, and consumers have little chance of identifying or removing the threat.

“One of the biggest blind spots is the lack of oversight into third-party firmware, preinstalled applications, and software components supplied by outside vendors. Manufacturers need to take responsibility for the entire software supply chain, not just the components they develop themselves.

“Firmware integrity checks, cryptographic signing, secure boot, and independent security testing should be standard practices before devices ship. Security needs to start at manufacturing, not after a compromised device reaches the consumer.”

This is a serious problem as there are millions of Android phones out there and a lot of them are on the cheaper side. This may make people decide to go more upscale if they want a phone that doesn’t have unwanted guests.

Leave a comment »

Hacker uses AI-powered attack tools to breach South Korean banks 

Posted in Commentary with tags , on October 8, 2026 by itnerd

A suspected Chinese-speaking hacker used AI-powered penetration testing tools to target South Korean financial institutions in a campaign that resulted in stolen data, according to new CrowdStrike research.

The activity occurred from late September through early October 2026, although the total number of affected organizations remains unconfirmed, at least five lenders affected include Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank, and BNK Busan Bank

The attacker used ARTEX, an open-source agentic penetration testing tool developed in China, alongside several LLMs. CrowdStrike identified exposed attacker-controlled directories containing Claude Code session histories, ARTEX configuration files and AI memory files. The ARTEX deployment used DeepSeek v4.1-flash as its primary model, while additional sessions involved GLM-5.3 and Grok 4.6.

According to reports examined by CrowdStrike, one affected bank’s loan inquiry service used by financial brokers was breached, while another bank’s employee mobile work-support system was compromised.

The recovered AI conversations also showed the attacker asking Claude where stolen Korean data could be sold and seeking assistance locating Telegram groups involved in data sales.

ㅤRyan McCurdy, VP of Marketing, Liquibase:

“AI is changing the economics of cyberattacks. Tools that once required considerable expertise can now be combined with AI agents that help attackers find weaknesses, test approaches, and operate across multiple targets.

“ That has significant implications for companies running open-source software. Vulnerabilities aren’t new, but the time between discovering one and exploiting it could get much shorter as these capabilities improve.

“Enterprises need to reconsider how they manage that exposure. It’s no longer enough to know that a vulnerability exists or that a patch is available. You need to know where you’re exposed, who owns remediation, and how quickly you can safely deploy a fix.

“Open source isn’t inherently less secure. But as AI accelerates offensive capabilities, relying on community-driven remediation without clear ownership, support commitments, or a tested response process becomes a much harder risk to justify.”

ㅤOpen source anything isn’t going to keep costs down. At least not if you think that you don’t have to follow proper security standards.

Leave a comment »

Over 8,500 European wind, solar systems publicly exposed

Posted in Commentary with tags on October 8, 2026 by itnerd

Researchers from the Dutch National Cyber Security Centre (NCSC-NL) and cybersecurity company Modat identified 8,547 internet-exposed systems across European wind farms and solar parks, including administrative interfaces and operational control panels that should not be publicly accessible, according to new research.

The researchers examined renewable energy facilities across 40 European countries and identified exposed systems in 35. Of those, 7,942 were associated with solar installations across 34 countries, while 605 were linked to wind farms across 23 countries.

Some exposed interfaces displayed live electricity production data, turbine locations and operational controls labeled Start, Stop and Reset.

Researchers estimated that approximately 181 sites could potentially allow full operational control. Other exposed pages included administrative login screens, with one displaying the default username “root.” Some interfaces could manage multiple turbines or an entire wind farm.

The researchers said the 8,547 figure is likely an undercount because only systems confidently associated with specific facilities were included.

ㅤDamon Small, Board of Directors, Xcape, Inc.:

“Unauthenticated, Internet-exposed interfaces on critical infrastructure threaten regional grid resilience and create operational, legal, and reputational risk across renewable energy portfolios. The discovery of over 8,500 exposed European wind and solar management endpoints, including over 180 permitting full operational intervention, highlights fundamental identity and network perimeter failures. While remote access to operational technology (OT) systems is a clear operational requirement, it must be delivered securely through zero-trust access, network segmentation, and multi-factor authentication rather than exposing control panels directly to the public Internet. To prevent these foolish architectural decisions, organizations must conduct mandatory threat models and architecture reviews before production systems go live, while immediately pulling existing interfaces behind secure gateways and enforcing credential rotation.”

Critical Takeaways

  • Publicly exposing OT control interfaces directly to the Internet turns standard management features into severe grid resilience vulnerabilities.
  • Remote access is a valid operational requirement, but it must be mediated via zero-trust architecture, multi-factor authentication, and secure gateways.
  • Formal architecture reviews and threat modeling must occur prior to live deployment to catch perimeter and identity flaws early.

Threat modeling before deployment costs a fraction of what an incident responder will charge to explain why “root” was still the password.

ㅤ

Steven Swift, Managing Director, Suzu Labs:

“This isn’t an AI problem, even if the authors of the research claim that “AI made things a little faster” We’ve seen decades of organizations putting resources directly onto the public internet with minimal to no protections in place, and then act surprised when its found and exploited.

“There’s already a rich well developed industry of mapping the entire attack surface of literally every single public IP. This isn’t new, and it doesn’t depend on AI. If you put a resource on the internet, existing (non-ai) automation will find it, document it, and put it into a database for easy access by others.

“For this research specifically, there’s a mix of single devices and management interfaces for groups of devices. That said, much of the wind and solar infrastructure is decentralized. So while 8,500 devices being directly exposed to the internet is a lot, if a threat actor wanted to cause harm, they would be limited to a subset of these at a time.

“That’s still a problem. Power is part of critical infrastructure. People want their power to keep working, and not to have an outage because someone decided to hack in. If an attacker wanted to cause harm, rather than simply turning power generation off they could tamper with the working configuration. If the system can be misconfigured to intentionally overload for example, permanent damage could result.

“This is an example where security best practices are completely basic, yet still not being followed. Literally just don’t have equipment directly exposed to the internet. Having remote access to systems is fine, but it needs to be secure. Putting equipment behind a secure VPN for example is only minimally more complex to setup, and orders of magnitude more secure.”

ㅤThreat actors will always target stuff like this because they can pwn it easily. Thus your job is to not be the guy who gets pwned.

Leave a comment »

ASOS Confirms That They Were Pwned

Posted in Commentary with tags on October 8, 2026 by itnerd

ASOS confirmed Thursday that its investigation found customer names and contact details had been accessed from a cybersecurity breach earlier this week. This differs from most hacks that I see as the threat actors used a trusted communication channel to communicate with the outside world. This takes away any doubt that they got in and ASOS got pwned.

More info here: https://www.reuters.com/business/retail-consumer/uks-asos-says-breach-exposed-some-customer-personal-data-2026-10-08/?utm_source=chatgpt.com

Danny Jenkins, CEO and Co-Founder of ThreatLocker, provided the following comments:

“Organizations must stop treating legitimate employee credentials as a trusted key to the kingdom. If an attacker can trick an employee into giving them valid credentials, the question isn’t whether that employee should have been more careful. It’s why those credentials alone are enough to compromise an entire organization. Zero Trust defenses are designed to add hardware verification to authorization checks. In this case, had a device needed to be verified, stolen credentials may have been useless to the attacker if they weren’t using them from an approved device.”

Jason Brown, Director of Customer Advisory, Counter Fraud Lead, iCOUNTER

“The ASOS breach started with one employee who was tricked into handing over their login by someone impersonating a trusted contact. From there, the attacker reached the third-party platforms ASOS uses to talk to its customers. That’s the part security teams should focus on. Every marketing, messaging and customer data platform a company connects to becomes another route to its customers, and in this case the attacker used ASOS’s own push notification channel to announce the breach directly to shoppers. The same access that sent a ‘HACKED’ message could just as easily have sent a convincing phishing message from a brand customers already trust, which is why anyone who received that notification should be on alert for follow-up scams. The attackers’ claim that they compromised ASOS’s Snowflake instance hasn’t been confirmed, and Snowflake says its platform wasn’t compromised. But the broader point holds. AI marketing tools are often given wide access to customer data so they can personalize campaigns, and that makes them valuable targets. Companies need an inventory of every third-party platform that holds or can reach their customer data, clear limits on what each one can access, and strong authentication on the employee accounts that manage them. Organizations that work with retailers like ASOS should also treat any data those partners hold on them as potentially exposed until they hear otherwise. Threat intelligence that watches for impersonation campaigns against your employees and partners, and for your vendors’ names showing up in breach claims, gives you a chance to act before an attacker uses your own channels against your customers.”

Well at least they knew how they got in. The real question is what are they going to do about it? Better training? Passwordless solutions? It all has to be on the table.

Leave a comment »

« Older Entries