The IT Nerd

Following up on this post about the Washington Post being hacked comes this story which indicates that China was behind the hack:

The incident marks the second known instance of Chinese hackers targeting the Washington Post. In 2013, the newspaper disclosed a breach of its technology servers and multiple systems that exposed a broad array of internal data.

Chinese state-backed cyber groups frequently target American journalists, government officials, and dissidents abroad in campaigns of espionage and transnational repression. Last year, the Department of Justice indicted seven Chinese nationals linked to a prolific group tracked as APT31 for running a 14-year cyber campaign against critics, businesses, journalists, and political figures worldwide (see: US Indicts Accused APT31 Chinese Hackers for Hire).

The group, also tracked as Judgment Panda and Violet Typhoon, is affiliated with the Chinese Ministry of State Security. The hackers impersonated prominent media outlets and journalists to send phishing emails embedded with tracking links. The links harvested data such as email open times, recipient locations, and IP addresses from their targets.

Chinese nation-state hackers have been known to target email systems. Microsoft in 2023 disclosed that Chinese hackers exploited a Microsoft Outlook token validation flaw to target governments in Europe and the United States 

Christian Geyer, founder and CEO of Actfore had this comment:

“Whether it’s a missile strike on a newsroom or a cyber breach that delays critical reporting, the goal is the same…silence, intimidate, and control the narrative. With tensions rising globally, the attack on the Washington Post should be seen not just as a breach, but as a signal in a broader campaign to disrupt independent journalism.” 

China is a well resourced adversary that needs a lot more attention placed on it. Because I really believe that we will see more and more attacks by them with severe consequences if we don’t act now to counter them.

Krispy Kreme has confirmed that attackers stole the personal information of over 160,000 individuals in a November 2024 cyberattack.

While not huge, this is a far from trivial amount of people affected.

Rebecca Moody, Head of Data Research at Comparitech had this comment:

“This is a significant breach, and, according to our findings, it is the second-largest data breach following a ransomware attack on a food and beverage company in 2024. Worldwide, we tracked 68 attacks on this sector in 2024 with 726,650 records affected across these attacks in total. The largest breach was on Bojangles Restaurants, Inc. in February 2024 where 165,106 people had their data breached, while the third largest was on Panera Bread (Panera, LLC) in which 136,302 people had their data impacted.”

“So far this year, we’ve noted 13 attacks on food and beverage companies, affecting just over 40,000 records. Across 2024/25 the average ransom demand across these attacks was just under $1.9 million.”

“Krispy Kreme has been quite slow in reporting this breach, taking around 7 months to notify victims. This is significantly above the overall average we noted across all US companies reporting breaches following ransomware attacks (4.1 months) and even higher than the average across food and beverage companies (3.6 months). Therefore, we’d highly recommend anyone affected take up the free identity monitoring services being offered by Krispy Kreme as soon as possible, while being on high alert for any potential phishing messages.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy had this to say:

“It is concerning that it has taken Krispy Kreme this long to acknowledge the data breach and inform the individuals affected by the breach. I’m not saying they need to put a glowing neon sign in their window that says “Your data is hot and has been stolen,” but they should not have taken this long. 7 months is a long time for data to be exposed without anyone being informed, and the least Krispy Kreme could do is offer free credit monitoring and free donuts for life.”

“Affected individuals need to keep an eye on their accounts (and take advantage of any free credit monitoring services that may be offered) and stay alert for any phishing texts, emails, or phone calls from bad actors attempting to use the harvested data to get their hands on even more personal and financial data.”

Krispy Kreme really stuffed it in terms of how long it took to let the world know that they had been pwned. Normally I would be saying that the relevant authorities should be asking questions as to why that was the case. But given how the world is right now, I don’t think that’s going to happen. But it should.