The IT Nerd

Canada’s number 2 airline Westjet is apparently dealing with a cyberattack. Bleeping Computer has the details:

“WestJet is aware of a cybersecurity incident involving internal systems and the WestJet app, which has restricted access for several users,” reads a security advisory on WestJet’s site.

“We have activated specialized internal teams in cooperation with law enforcement and Transport Canada to investigate the matter and limit impacts.”

“We are expediting efforts to maintain the safety of our operation and safeguard sensitive data and personal information for both our guests and employees, and we apologize to all guests for any disruption to their access to WestJet’s services.”

The attack also prevented users from logging into the website and mobile app, with those services now restored.

Christian Geyer, founder and CEO of Actfore had this to say:

“In a cyberattack like the one affecting WestJet, time is everything. The ability to rapidly identify what was stolen, and who’s behind it, can make or break the company’s response. This is why aviation and critical infrastructure companies need a battle-tested response plan, with pre-identified trusted partners in the response.”

It will be interesting to see what Westjet says in regards to all of that. Because as I type this, Westjet has not given a whole lot of detail. But they will need to if anyone will trust them again.

This morning, ransomware gang DragonForce uploaded Strafford County, NH, to its data leak site, giving the US government entity just five days to meet its ransom demands before 830.03 GB of data is leaked.

In a blog post today, Rebecca Moody, Head of Data Research at Comparitech, commented:

“DragonForce gained notoriety this year after it attacked three UK retailers–Marks & Spencer, Co-op, and Harrods. Its attack on Marks & Spencer was particularly disruptive and is expected to cost the company around $400 million.”

“So far this year, DragonForce has claimed 66 attacks with eight of these being confirmed by the entity involved. Other DragonForce victims from previous years are still being confirmed, too, with one of the latest being IT services firm, GeoLogics Corporation. At the end of May 2025, it began notifying nearly 12,000 of a breach that stemmed from a cyber attack way back in December 2023. Here, DragonForce alleged to have stolen nearly 123 GB of data.”

“DragonForce operates a ransomware-as-a-service business whereby affiliates use its malware to encrypt systems and take a percentage of the ransom payments in return. Like most gangs today, DragonForce employs a double-extortion tactic where it demands two ransoms: one to decrypt systems and another to delete stolen data. Throughout 2025, we’ve tracked 30 confirmed attacks on US government entities and are monitoring a further 31 unconfirmed.”

One thing to keep in mind is that even if they pay the ransom, there’s zero guarantee that data will be deleted and said data won’t be leaked anyway. That’s why preventing the bad guys from getting to the point of holding your data for ransom is critical.

Zoomcar Holdings, a peer-to-peer car-sharing marketplace, has disclosed that unauthorized accessed its system led to a data breach impacting 8.4 million users.

On June 9, 2025, Zoomcar Holdings, Inc. (the “Company”) identified a cybersecurity incident involving unauthorized access to its information systems. The Company became aware of the incident after certain employees received external communications from a threat actor alleging unauthorized access to Company data. Upon discovery, the Company promptly activated its incident response plan.

Based on preliminary findings, the Company determined that an unauthorized third party accessed a limited dataset containing certain personal information of a subset of approximately 8.4 million users, including names, phone numbers, car registration numbers, personal addresses and email addresses associated with such users. At this time, there is no evidence that financial information, plaintext passwords, or other sensitive identifiers were compromised.

In response to the incident, the Company has taken immediate actions to contain the threat and enhance its security posture. These measures include implementing additional safeguards across the cloud and internal network, increasing system monitoring, and reviewing access controls. The Company is also engaging with third-party cybersecurity experts to further assist with the investigation. The Company has also notified the appropriate regulatory and law enforcement authorities and is cooperating fully with their inquiries.

To date, the incident has not resulted in any material disruption to the Company’s operations. However, the Company continues to evaluate the scope and potential impacts of the event, including legal, financial, and reputational considerations, as well as any associated remediation costs.

Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“Although this was a large breach, the information compromised does not pose a direct threat to victims’ accounts or finances. Victims should be on the lookout for targeted phishing messages and scams via text and email. Those messages might pretend to be from Zoomcar or a related company. Never click on links or attachments in unsolicited emails and texts.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy:

“First of all, bravo to Zoomcar for quickly alerting the public to the breach. Luckily, no credit card, debit card, or other financial information was exposed in the breach. However, Zoomcar customers do need to stay alert for any attempts to open new accounts in their name and to especially stay alert for phishing attempts where bad actors use the information they were able to obtain to pry more information from customers that can be used to breach accounts.”

Roger Grimes, Data-Driven Defense Evangelist at KnowBe4:

“Everyone’s information, including the information taken by the Zoomcar theft, has been stolen multiple times over the years. I’m not sure how valuable it is to cybercriminals in either use or in selling, but the top risk scenario is some sort of phishing scam where someone fraudulently posing as Zoomcar tries to use the potential victim’s relationship with Zoomcar as a means to further compromise the victim. And for sure, scammers with information like that are more likely to be successful than with just sending out a generic phish with no “insider information.” Zoomcar customers need to pay attention to the breach announcement and use increased caution anytime someone supposedly from Zoomcar reaches out to them. History is replete with previous examples of compromised information being used to successfully phish the involved customers at a later date.”

Another day, another breach that may affect millions. Welcome to the new normal where some company getting pwned will result eventually in something bad happening to you. That’s not good and seriously needs to change.

But at least Zoomcar admitted to it quickly….. I guess.

It is being reported that a cyberattack on the Washington Post compromised the email accounts of several journalists and was potentially the work of a foreign government

Bleeping Computer has more details: Washington Post’s email system hacked, journalists’ accounts compromised

Roger Grimes, data-driven defense evangelist at cybersecurity company KnowBe4, commented:

 “Attacks against journalists are a serious problem. In most cases, the journalist has to click on a rogue link and somehow get tricked into running the malware. However, there are many commercial surveillance vendors (CSVs) with many zero-days that require zero clicks by the targeted journalist. This is a very serious problem and the cybersecurity world is trying to come to grips with how to treat CSVs who create and deploy zero-click zero-days. It’s a real problem that our industry is just starting to try and grapple with. It’s not helped when different governments, even our own government and its allies, also use these services. When they do, it’s harder to say do as I say but not as I do.”

I have the feeling that this will not be the last time that we will see a headline like this. Threat actors, especially nation state backed threat actors will see this as open season on journalists and you’ll see other high profile journalists, who are already targets for hacks, targeted even more.

UPDATE: Paul Bischoff, Consumer Privacy Advocate at Comparitech had this to say: 

“Unauthorized access to reporters’ emails could put journalists and their sources at risk. It could also allow attackers to hack into other accounts registered to the email address. I hope the Washington Post works as quickly as possible to notify sources and other data subjects who might be affected so they can take steps to protect themselves.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy follows with this:

“Currently, it appears that only emails were compromised. HOWEVER, MANY Microsoft accounts also use OneDrive cloud storage, which usually use the same credentials, so we could find out that files stored in the cloud could also have been compromised. Luckily, the Post employees use Slack in place of email to communicate, as well as the encrypted Signal for messaging. Hopefully this has also helped keep the damage minimal.”