Canada’s own Jonathan David previews Juventus vs. Inter clash with Fubo 

Posted in Commentary with tags on September 19, 2025 by itnerd

Ahead of Saturday’s Derby d’Italia between Juventus and Inter, Ottawa-raised striker Jonathan David sat down for an exclusive interview with Footy Culture (a digital platform covering global football culture), in partnership with Fubo, the leading sports-first live tv streaming platform and exclusive home of Serie A in Canada. He shared candid thoughts on the rivalry, his journey, and what it takes to win on the biggest stage.

A few highlights from the interview are:

  • On being the first Canadian at Juventus: “Growing up I never thought about playing for the biggest clubs — the dream was just to turn pro. After one good season, you start to believe maybe something bigger can happen.”
  • Derby d’Italia mindset (match hook): “In a game like this, it’s about finding that little bit more — more aggression, more running. The team that wants it more, that’s what makes the difference.”
  • Canadian pride / earning respect: “South Americans and Europeans are ‘known’ for football… as a Canadian you have to work more and show more.”
  • On Drake & ‘Iceman’ nickname: “Obviously I’m a fan of Drake — he’s still one of the best artists in the world. But I think I was the first Iceman.”
  • On Canada as home: “Canada for me is home. Whenever I can, I go back to spend time with family and friends. It’s always close to my heart.” 

Leave a comment »

Goshen Medical Center Notifying 450k+ people of data breach

Posted in Commentary with tags on September 18, 2025 by itnerd

Comparitech reported today that Goshen Medical Center, Inc. has started notifying 456,385 people of a data breach following a cyber attack that started in February 2025. Ransomware gang BianLian claimed the attack in late March.

Commenting on this is Rebecca Moody, Head of Data Research at Comparitech: 

“This week has seen three of the six largest data breaches (via ransomware) on US healthcare companies this year. This attack on Goshen Medical Center becomes the third largest, while Medical Associates of Brevard, LLC takes fourth place (notifying nearly 247,000 of a January 2025 breach via BianLian) and New York Blood Center Enterprises takes sixth place (nearly 194,000 affected in a January 2025 attack via unknown hackers).”

“All three of these attacks highlight two key things. First, they demonstrate how the healthcare sector remains a dominant target for ransomware gangs because of the amount of sensitive data up for grabs. Second, they serve as a reminder that it’s often months before we find out about the extent of these attacks.”

“So, while ransomware attacks on the US healthcare sector may seem lower than last year (we’ve noted 61 confirmed attacks and 6.1 million breached records so far this year, compared to 174 attacks and 28.6 million breached records in total last year), we shouldn’t focus too much on these as of yet. It’s highly likely we’ll see a number of other major breaches coming through in the coming months. For example, we still don’t know how many were impacted in the attack on Kettering Health and out of 

Two things jump out at me. First BianLian is quite busy with a growing list of victims. Second health care is yet again a victim of a cyberattack. Clearly there’s no end to the madness which is bad news for all of us.

Leave a comment »

CloudSEK Exposes China-Linked Counterfeit ID Operation Flooding North America with Fake Licenses

Posted in Commentary with tags on September 18, 2025 by itnerd

CloudSEK, a leading cybersecurity firm, has exposed a sophisticated China-based operation selling high-quality counterfeit U.S. and Canadian driver’s licenses and Social Security Number (SSN) cards, posing a severe threat to national security, financial systems, and public trust.

The investigation, conducted by CloudSEK’s STRIKE team, uncovered a sprawling network of 83+ interconnected domains supported by 24/7 WeChat customer support, custom order flows, and multiple payment channels. Analysis of the exfiltrated database revealed over 6,500 counterfeit licenses sold to 4,500+ buyers, generating more than $785,000 in revenue. 

A Hidden Threat Undermining Trust

Counterfeit IDs aren’t just tools for underage drinking—they enable serious crimes, including illegal firearm purchases, SIM-swap fraud, large-scale logistics misuse, and even election interference. CloudSEK researchers confirmed that the IDs, priced as low as $65 in bulk, are fully scannable and replicate advanced security features such as holograms, UV markings, laser engraving, and relief printing, making them nearly indistinguishable from genuine documents.

“This isn’t just about fake IDs – this is about a systematic attack on the foundation of trust that underpins our financial, legal, and civic systems,” said Sourajeet Majumder, security researcher at CloudSEK STRIKE. “When a single counterfeit license can enable unauthorized drivers, bypass compliance checks, or facilitate smuggling, we’re looking at a genuine national security threat.”

Sophisticated Operations

The threat actor demonstrated remarkable sophistication:

  • Shell E-commerce Sites: Transactions were routed through fake online stores (clothing, shoes, accessories) to mask payments via PayPal, LianLian Pay, and cryptocurrencies.
  • Covert Packaging: IDs were shipped globally via FedEx, USPS, DHL, and Canada Post, hidden inside toys, purses, or layered cardboard with camouflage stickers to evade detection. Tutorial videos guided buyers on retrieving concealed IDs.
  • Systemic Misuse: One buyer linked to two trucking companies with revoked U.S. operating authorities purchased 42 counterfeit commercial driver’s licenses—highlighting risks to transportation safety and regulatory integrity.
  • High-Confidence Attribution: Through HUMINT and OSINT, CloudSEK pinpointed the actor’s exact geolocation in Xiamen, Fujian, China and obtained a facial image via webcam capture. 
     

Key Findings

  • Massive Scale: Over 6,500 fake IDs sold, with dense clusters of buyers in New York, Pennsylvania, Florida, Georgia, Ontario, and British Columbia.
  • Financial Footprint: $785,000+ generated through PayPal, LianLian Pay, Bitcoin, Ethereum, and Western Union.
  • Age Analysis: Nearly 60% of buyers were above 25 years old, signaling intentions beyond casual misuse.
  • Marketing Tactics: The network promoted IDs via Meta Ads, TikTok, Telegram, and YouTube, openly advertising uses like passing police checks, renting cars, or accessing benefits.
     

Real-World Consequences

The implications are far-reaching:

  • National Security: Fake IDs can bypass airport, border, and law enforcement checks.
  • Financial Fraud: Scannable IDs enable SIM swaps and account takeovers.
  • Election Integrity: IDs can be exploited for mail-in ballot and voter registration fraud.
  • Logistics & Trafficking Risks: Fake commercial driver’s licenses allow unlicensed operators to bypass U.S. Department of Transportation checks.
     

A Call to Action

CloudSEK urges urgent global action:

  • Law Enforcement: Seize the 83+ domains and pursue legal action using attribution evidence.
  • Courier Vigilance: Alert FedEx, USPS, and DHL to the covert packaging tactics.
  • Payment Processors: Trace and freeze illicit accounts across PayPal, Western Union, and crypto platforms.
  • Continuous Monitoring: Deploy threat intelligence platforms like CloudSEK’s XVigil for proactive detection.
     

For More Information, Read The Full Report

Leave a comment »

Fortra Uncovers New, AI-Powered Phishing Campaign Exploiting ActiveCampaign

Posted in Commentary with tags on September 18, 2025 by itnerd

Fortra Intelligence and Research Experts (FIRE) have discovered a large-scale phishing campaign exploiting ActiveCampaign to mass-produce AI-generated impersonation sites promoting Small Business Administration loans.

These attacks are harvesting detailed business and financial data presumed to fuel future spear-phishing campaigns. 

You can read more here: https://www.fortra.com/blog/attackers-exploit-activecampaign-deliver-thousands-ai-generated-sba-phish

Leave a comment »

New York Blood Center notifies 194,000 people of data breach

Posted in Commentary with tags on September 17, 2025 by itnerd

Comparitech reported today that New York Blood Center Enterprises this week confirmed it notified 193,822 people of a January 2025 data breach that leaked names, SSNs, ID numbers, bank account info, health info, and test results. The attack was first reported back in January.

Commenting on this is Rebecca Moody, Head of Data Research at Comparitech: 

“This attack becomes the 89th confirmed attack on a healthcare company (worldwide) this year so far. Across these attacks, nearly 6.7 million records are known to have been breached with this attack on NYBCe becoming the sixth largest based on records affected.”

“To date, no gangs have claimed the attack on NYBCe, and, with the attack happening back in January 2025, it’s unlikely we’ll see a claim from a gang now. This could mean that ransom negotiations were successful but NYBCe hasn’t confirmed this. Across the 89 confirmed attacks we’ve noted for this year, the average ransom demand has been just under $627,000.”

Once again the healthcare sector is ground zero for getting attacked by threat actors. I don’t know how much clearer it will have to become before something is done to put this sector on better footing.

Leave a comment »

RegScale Raises $30+ Million to Redefine Cyber GRC for Highly Regulated Industries

Posted in Commentary with tags on September 17, 2025 by itnerd

RegScale, the leader in Continuous Controls Monitoring (CCM), today announced it has raised $30+ million in an oversubscribed Series B round led by Washington Harbour Partners, with additional investment from new investors M12, Microsoft’s Venture Fund, Hitachi Ventures, and Ankona Capital, as well as continued participation from existing investors SYN Ventures and SineWave Ventures. This raise confirms what customers and investors already know: RegScale isn’t building the next wave of cyber GRC, it’s redefining it, turning compliance from a burdensome, manual checklist process into a real-time and automated platform for the most heavily regulated industries.

The new capital will accelerate RegScale’s leadership in the $50+ billion GRC market and fuel key hires across R&D and sales, enabling the company to deliver increased impact to its growing customer base. It will accelerate RegScale’s RegML, industry-leading AI roadmap, expanding the only CCM platform with AI agents purpose-built to continuously monitor compliance, automate evidence collection/reviews, conduct audits, and analyze risk — capabilities no other provider delivers securely at scale. “RegScale’s AI-powered compliance-as-code approach delivers what today’s operators need most: faster certifications, lower costs, and a stronger security posture. This is the future of cyber GRC, and we’re excited to support RegScale as they scale to meet the growing demand,” said Todd Graham, Managing Partner at M12, Microsoft’s Venture Fund.

With this funding, RegScale is not only strengthening its value for government agencies, financial services, and high-tech organizations but also accelerating expansion into energy, utilities, and other highly regulated sectors where continuous compliance and security assurance are most urgent.

With cyberattacks escalating, nation-states and criminal groups exploiting compliance gaps, and budget cuts pushing for cost takeout and tool consolidation across all industries, CISOs can no longer rely on traditional GRC and manual labor approaches to just check a box. They need CCM to operationalize their risk program and deliver real-time control assurance against a growing set of cybersecurity threats.

RegScale is leading this revolutionary change in managing cyber GRC. Customers report 60% faster audit prep, 3–4x faster FedRAMP High authorizations, and up to 80% greater accuracy, with AI and automation delivering up to 10x staff efficiency. RegScale continues to promote industry standards, serving as the lead affiliate for the Cyber Risk Institute’s (CRI) OSCAL initiative, as a founding member of the OSCAL Foundation, a participant in the Cloud Security Alliance (CSA) Compliance Automation Revolution, and a contributor to the FedRAMP 20x initiative. Its impact has been recognized across the industry, most recently being named Best Compliance Solution by SC Media and as an industry leader by Gartner.

As proof of its platform’s maturity, RegScale achieved FedRAMP High Authorization sponsored by the DHS in half the cost and in just six months, versus the typical 18–24 months. Inside the company, the team is driving incredible growth: ARR has tripled year-over-year, key enterprise and federal customers are on board, and the team has expanded with major additions, including Devon Goforth as CTO, Rich Shirley as VP of Strategic Partnerships, Mike Kimball and Meghan Shafer as VPs of sales, Jennifer Stafford as GM of Federal, and strategic advisors Roland Cloutier and Alex Tosheff.

RegScale is a continuous controls monitoring (CCM) platform that is designed to be the operational risk tool for the CISO. Built on a compliance as code foundation, RegScale enables extreme automation with our API first strategy, self-updating paperwork, and powerful AI agents that all but eliminate manual labor, turn your program more proactive, save money, accelerate time to market, and reduce risk in your operational environment. Heavily regulated organizations, including Fortune 500 enterprises and the Federal government, use RegScale and report achieving compliance certifications 90% faster and trimming audit preparation efforts by 60%, thereby strengthening security and reducing costs. Learn more at http://www.regscale.com.

Leave a comment »

MIND Appoints New CMO, Accelerating Go-to-Market Strategy & Company Growth

Posted in Commentary with tags on September 17, 2025 by itnerd

Today, MIND announced the appointment of Jimmy Tsang as Chief Marketing Officer, whose leadership will be crucial in scaling the company’s global presence, driving revenue growth, and solidifying MIND’s brand positioning as a rising force in DLP. 

Since joining MIND in 2023, Tsang has led the company’s strategic branding efforts, significantly enhancing its market presence. With 2+ decades of experience in cybersecurity and marketing, Tsang previously served as VP of Marketing at Pondurance and led both product and content marketing for IBM Security.

This announcement comes amid a period of accelerated growth for MIND, driven by customer adoption already serving Fortune 1000 companies across diverse industries, strategic partnerships, and industry accolades. 

Recently, MIND announced $30 million in growth funding, bringing total funding to over $40 million. At this year’s Black Hat, MIND launched the first autonomous DLP platform and earned Honorable Mention in its Startup Spotlight Competition.

Leave a comment »

Microsoft Seizes 338 Sites to Disrupt RaccoonO365’ Phishing Service

Posted in Commentary with tags on September 16, 2025 by itnerd

Today, Microsoft’s Digital Crimes Unit said it disrupted RaccoonO365, the fastest-growing tool used by cybercriminals to steal Microsoft 365 credentials, by seizing 338 websites associated with the popular service and cutting off criminals’ access to victims.

Microsoft posted a blog post on the seizure here: https://blogs.microsoft.com/on-the-issues/2025/09/16/microsoft-seizes-338-websites-to-disrupt-rapidly-growing-raccoono365-phishing-service/

Erich Kron, security awareness advocate at KnowBe4, commented:

“Clearly, email phishing continues to be a major threat that organizations face on a daily basis. Phishing services make it far easier for unskilled attackers to be able to play in the cybercrime game, while not necessarily being cyber savvy themselves.

“Credential theft through phishing can be especially dangerous because people tend to reuse passwords across different accounts and services, meaning, if a bad actor can trick someone out of their password, they may not only have access to that account, but others as well.

“The social engineering threats drive home the reason that organizations need to have a well-established human risk management (HRM) program in place that will educate users on ways to spot fake login pages and help them understand why credential reuse is so dangerous. In addition, MFA should be deployed wherever possible to make things even tougher for attackers in the event they do steal someone’s credentials.”

This blog post is very much worth your time to read as it shows how threat actors are evolving to be increasingly more effective and dangerous.

Leave a comment »

Specops Research: Cracking Bcrypt: Is New-Gen Hardware/AI Making Password Hacking Faster?

Posted in Commentary with tags on September 16, 2025 by itnerd

Almost two years ago, the Specops research team analyzed how long it took to crack passwords hashed with the bcrypt algorithm.

Using newer, more powerful hardware, the researchers revisited that previous research creating a new table of Bcrypt cracking times in this just-published report Cracking bcrypt: New-gen hardware speeds up password hacking. The reason for the revisit is two-fold: the AI boom causing a glut of consumer hardware, as well as the arms-race in consumer graphics performance.

The focus on compute power for both consumers and enterprises whether for general purpose compute (GPGPU) or training LLMs has caused arguably all three major graphics vendors to focus more heavily on compute performance than they may have in the past. This shows in the performance of Nvidia’s recent 50-series, as well as AMD’s upcoming transition to the ‘UDNA’ architecture. Specops research team investigated what this boom and renewed focus on compute means for the difficulty of cracking a leaked password hash, and the future security of passwords.

Short, non-complex passwords can still be cracked relatively quickly, highlighting the huge risks of allowing users to create weak (yet very common) passwords such as ‘password’, ‘123456’, and ‘admin’. However the high cost factor of bcrypt makes longer passwords extremely secure against brute force attacks thanks to its slow-working hashing algorithm. Once a combination of characters are used in passwords over 12 characters in length, the time to crack quickly becomes a near-impossible task for hackers. This shows the value of enforcing longer passwords.

This research coincides with the latest addition of over 70 million compromised passwords to the Specops Breached Password Protection service. These passwords come from a combination of our honeypot network and threat intelligence sources.

To view the complete Specops research report, visit Cracking bcrypt: New-gen hardware speeds up password hacking

Leave a comment »

BDO Canada recognized as a Major Player in the IDC MarketScape for Canadian AI Services 2025

Posted in Commentary with tags on September 16, 2025 by itnerd

Today, BDO Canada is proud to be named as a Major Player in the IDC MarketScape: Canadian AI services 2025 Vendor Assessment (doc #CA51802124, September 2025).

BDO believes this recognition reflects the firm’s strong industry knowledge and proven track record of delivering AI solutions that are scalable and tailored to the needs of Canadian businesses. The IDC MarketScape report for Canadian AI services provides both a quantitative and qualitative look at how vendors perform in the market, helping technology buyers choose the right partners for AI-driven transformation.

With over 80 offices and more than 4,500 professionals across Canada, BDO combines industry knowledge in areas like manufacturing, financial services, energy, and infrastructure with hands-on experience to deliver AI solutions that create real impact for clients, including many of the country’s Fortune 100 companies.

BDO accelerates AI adoption for its clients through proprietary tools, strong partnerships, and sector-focused solutions. Backed by alliances with Microsoft, AWS, Google Cloud, Salesforce, Snowflake, and Databricks, and supported by a global network spanning 160+ countries, BDO Canada provides end-to-end AI services that combine technical expertise with practical, client-focused outcomes.

To learn more about BDO Canada’s Practical AI solutions, visit: Practical AI solutions to drive ROI growth.

Leave a comment »

« Older Entries
Newer Entries »