New KnowBe4 Report Reveals Local Governments Face Surge in Ransomware Attacks with Minimal Resources

Posted in Commentary with tags on May 27, 2025 by itnerd

KnowBe4 today released new research highlighting the critical cybersecurity challenges facing state, local, tribal, and territorial (SLTT) governments. The report details how government organizations have become prime targets for cybercriminals while simultaneously facing severe resource constraints.

The data reveals that despite being the third most-targeted sector by ransomware in 2023, over 80% of SLTT organizations operate with fewer than five employees dedicated to cybersecurity. This staffing shortage coincides with a dramatic increase in cyberattacks, as evidenced by a 313% rise in security incidents reported in the MS-ISAC’s 2022 survey. The situation is worsened by the recent cut of $10 million in federal funding for the Center for Internet Security (CIS), which supports crucial information sharing networks for government agencies.

Human error, often exploited through social engineering, remains the most common entry point for cyberattacks in 70-90% of cases. The limited staffing and resources highlight the need for cost-effective and low-maintenance tools to support government entities. KnowBe4’s 2025 Phishing by Industry Benchmarking Report found that a year of security awareness training can reduce an organization’s phishing susceptibility from approximately 33.1% to just 4.1% after one year of implementation. These findings underscore that effective human risk management offers resource-constrained organizations a powerful and affordable defense against the rising tide of cyberthreats.

Key findings from the report:

  • 70% of surveyed SLTT organizations cite lack of sufficient funding as their top security concern
  • More than 80% of government organizations operate with fewer than five dedicated cybersecurity employees.
  • Average ransom per attack reached $872,656 between 2018 and December 2024, with total costs exceeding $1.09 billion.
  • Security awareness training reduced phishing susceptibility from approximately 33.1% to just 4.1% after one year.

To download the “State and Local Cybersecurity: Facing New Burdens Amid Rising Threats” report, visit here.

TELUS investing $70 billion in Canada through 2029 

Posted in Commentary with tags on May 27, 2025 by itnerd

TELUS has announced that it is investing more than $70 billion over the next five years to expand and enhance its network infrastructure and operations across Canada. As the country navigates a challenging economic environment and seeks to attract more investment to stimulate growth, this commitment to Canada’s future will help fuel homegrown innovation and support the prosperity of urban and rural communities. This investment builds on an impressive track record, with TELUS investing more than $276 billion since 2000 to boost productivity and support a robust national economy.

Now through 2029 in Canada, TELUS is:

  • Bringing TELUS PureFibre connectivity to homes and businesses across B.C., Alberta, Quebec and Ontario, driving job creation, accelerating innovation and fueling productivity
  • Deploying targeted enhancements to our 5G and LTE services at more than 500 macro and micro sites nationwide this year, significantly increasing wireless coverage and capacity to meet the evolving needs of our customers and communities, now and in the future
  • Addressing the increasing demand for affordable rental housing by redeveloping our central office buildings into TELUS Living initiatives as part of our world-leading copper retirement program. Advancing the journey to net-zero, TELUS continues to support the circular economy by reclaiming and repurposing legacy copper networks, helping meet Canada’s need for this important resource. To date, they have mined more than 4,600 tonnes of copper from their network and enabled a reduction of 9,300 tonnes of GHG emissions – equal to removing nearly 2,000 cars from roads for a year
  • Launching two Sovereign AI Factories in Kamloops and Rimouski. These secure facilities provide Canadian businesses and researchers access to cutting-edge technology, ensuring every piece of data, computation and breakthrough created will remain within Canadian borders
  • Deepening their commitment to rural and Indigenous connectivity by expanding TELUS’ advanced broadband networks to an additional 20 Indigenous lands and 53 rural communities through 2026, on top of the 637 Indigenous lands and 530 rural communities that are already connected to their networks
  • Further bridging digital divides through TELUS Internet, Mobility, Tech and Health for Good, as well as TELUS Wise. Since inception, these initiatives have enhanced access to connectivity and healthcare for 1.4 million people across Canada, while helping them remain safe in the digital world
  • Supporting local youth-focused charities, community partners and projects across Canada and around the world by granting more than $138 million in cash donations since 2005 through the TELUS Friendly Future Foundation and TELUS Community Boards to enable health and education programming
  • Building healthier workplaces and communities through TELUS Health by increasing access to health and well-being solutions, caring for or supporting someone every 10 seconds in Canada and across the globe, in collaboration with innovative Canadian organizations such as McMillan LLP, Canadian Men’s Health Foundation and Clinia
  • Reducing inefficiencies in food and consumer goods production, distribution and consumption through digital tools and data insights provided by TELUS Agriculture & Consumer Goods, improving supply chain connectivity, sustainability, efficiency and traceability
  • Fostering community connection through strategic partnerships with leading sports organizations (Canada Soccer, Canadian Premier League, Vancouver Rise, Vancouver Whitecaps FC, CF Montreal, Canadian Football League, Calgary Flames, Hockey Canada), resorts (Whistler Blackcomb, Resorts of the Canadian Rockies, Mont Tremblant), and cultural and educational venues (MTELUS, Vancouver Symphony Orchestra, Science Centres in Toronto, Montreal, Edmonton and Calgary), while delivering free sports programs and scholarships to over 14,000 youth across Canada, including 15 remote and Indigenous communities

Additionally since 2000, TELUS, team members and retirees have provided $1.8 billion in cash, in-kind contributions, time and programs, including 2.4 million days of volunteerism to communities in Canada and around the world. 

These investments are consistent with TELUS’ capital expenditure guidance for 2025 as disclosed in the company’s fourth quarter 2024 results and 2025 targets news release dated February 12, 2025 and in the company’s first quarter 2025 results news release dated May 9, 2025.

TELUS also embraces tax morality as a means of further investing in our communities. Since 2000, TELUS has paid approximately $61 billion in total tax and spectrum remittances to federal, provincial and municipal governments across Canada, consisting of corporate income taxes, sales taxes, property taxes, employer portion of payroll taxes, various regulatory fees and spectrum remittances, including more than $2.3 billion in taxes in 2024 alone. These funds support public works projects, education, healthcare, cultural pursuits and other initiatives that improve the social and economic well-being of communities.

5 out of 10 leading AI LLM providers have experienced data breaches

Posted in Commentary with tags on May 27, 2025 by itnerd

Cybernews researchers evaluated the cybersecurity postures of the top 10 large language model (LLM) providers—including OpenAI, Claude, Perplexity, and DeepSeek — and discovered that half had suffered data breaches, with one breach occurring just nine days before the audit.

The Cybernews Business Digital Index, which evaluates companies based on key cybersecurity criteria, also revealed that all providers had vulnerabilities in their SSL/TLS configurations, and several faced widespread issues in system hosting, credential hygiene, and password reuse.

Additionally, nearly half of sensitive AI prompts are submitted via personal accounts, bypassing official company channels and potentially exposing corporate data without oversight — a growing risk as LLM tools become standard in the workplace.

Key research takeaways:

  • 50% of the top LLM providers have experienced data breaches, including OpenAI (1,140 incidents) and Perplexity AI (190 credentials leaked just 13 days before the audit).
  • All providers had SSL/TLS configuration issues, exposing them to potential man-in-the-middle attacks and data interception.
  • Credential reuse was widespread — 35% of Perplexity AI employees and 33% of EleutherAI reused breached passwords.
  • System hosting vulnerabilities were found in 8 out of 10 providers. Only AI21 Labs and Anthropic avoided major issues in this area.
  • The average cybersecurity score across all providers was 88/100 — but scores ranged widely, with Inflection AI receiving an F.
  • U.S. and Israeli providers generally scored higher than Chinese providers—none of the Chinese companies rated above a C.
  • The growing use of personal accounts to interact with LLMs increases the risk of unmanaged data exposure.

To read the full research, please click here.

Research Methodology

For this study, Cybernews researchers analyzed 10 popular LLM providers. The report evaluates cybersecurity risk across seven key dimensions: software patching, web application security, email protection, system reputation, hosting infrastructure, SSL/TLS configuration, and data breach history.

The report’s Methodology can be found here. It provides detailed information on how researchers conducted this analysis.

Samsung Introduces Galaxy XCover7 Pro and Galaxy Tab Active5 Pro

Posted in Commentary with tags on May 26, 2025 by itnerd

Samsung Electronics Co., Ltd. today announced the new Galaxy XCover7 Pro and Galaxy Tab Active5 Pro, enterprise-ready devices designed to meet the demands of today’s fast-paced, high-intensity work environments. Continuing the legacy of Samsung’s ruggedized devices, these latest Pro models are versatile, optimized and secure — delivering water resistance, steady performance and optimized workflow to empower frontline workers, from the office to the field and beyond.

With 5G connectivity, an upgraded processor and increased memory, the XCover7 Pro and Tab Active5 Pro offer high performance. The XCover7 Pro features a powerful new stereo speaker system with anti-feedback technology, which minimizes unwanted audio loops for clearer communication. Both devices offer enhanced battery capacity, with the XCover7 Pro equipped with a 4,350mAh battery for longer usage, while the Tab Active5 Pro comes with a 10,100mAh battery set designed to support demanding workflows. The Tab Active5 Pro also supports Dual Hot-Swap battery functionality, allowing workers to replace batteries without powering down their devices and ensuring seamless operation even when battery levels are low.

These high-performing and durable devices can be an asset in ensuring seamless operations in any work environment, including retail, government, logistics, healthcare and manufacturing.  

he Galaxy XCover7 Pro and Galaxy Tab Active5 Pro are designed to thrive on the frontlines of all industries. Having undergone rigorous testing to ensure they withstand demanding environments, they are ideally built to offer reliable performance in the field. Both devices feature IP68-rated water and dust resistance,[7] helping to protect against dust ingress and exposure to water – making them a great choice for conditions where accidental splashes or occasional submersion may occur.

The Tab Active5 Pro’s S Pen — an essential tool for field professionals who annotate documents, sign forms or input data on the go — further extends usability by functioning even in certain wet conditions.

Their MIL-STD-810H certified designs help ensure resistance to drops, extreme temperatures and vibrations, while the Corning® Gorilla® Glass Victus®+ display on the Tab Active5 Pro helps provide enhanced scratch and impact protection. Those in retail, government, and manufacturing settings can also depend on enhanced touch sensitivity in both devices, allowing seamless use with compatible gloves.

Clear communication is crucial in fast-paced work environments, especially for teams relying on walkie-talkie functionality in industries like construction and emergency response. The Galaxy XCover7 Pro and Galaxy Tab Active5 Pro enhance speaker technology with anti-feedback noise reduction, minimizing disruptive sounds that can occur when multiple devices that share the same channel are in close range. With higher volume and improved clarity, these upgraded stereo speakers help frontline workers stay connected and relay critical information without disruption. The Tab Active5 Pro further strengthens communication with optimized audio tuning, boosting volume levels and incorporating intelligent sound processing to filter out background noise, making collaboration even more effective.

Both devices also offer Vision Booster, which enhances outdoor visibility by improving screen readability in bright environments. The Galaxy Tab Active5 Pro further builds on this with an upgraded display brightness of up to 600 nits — a notable increase from 480 nits in the previous model — ensuring clearer visuals even in challenging lighting conditions. Whether reviewing critical information on-site or navigating workflows outdoors, these upgrades provide better contrast, improved tone mapping, and enhanced visibility against strong illumination, allowing users to stay focused wherever the job takes them.

With extended battery life and seamless power solutions, the Galaxy XCover7 Pro and Galaxy Tab Active5 Pro support uninterrupted workflow. Both devices feature POGO charging interfaces, making it easy for workplaces with POGO docks to charge multiple devices at once. For environments in which devices remain plugged in, the Tab Active5 Pro supports No Battery Mode, allowing it to function when connected to a dedicated power source — ideal for in-vehicle setups, kiosks and workstations.

Seamless connectivity is also key to maintaining work continuity. The XCover7 Pro and Tab Active5 Pro both support 5G connectivity, Wi-Fi 6E and network slicing to prioritize device communication even in dense network environments and ensure fast and stable network access. With dual SIM support (pSIM + eSIM) on the Tab Active5 Pro, workers can effortlessly switch between networks, keeping them connected in any environment.

The Tab Active5 Pro introduces front-facing NFC Tagging, enhancing usability in retail, hospitality and logistics environments where fast, secure interactions are essential. Enabling seamless authentication, asset tracking and mobile payments, the tablet can effectively be used as a mobile point-of-sale (mPOS) system in retail stores and restaurants alike. Employees can quickly validate credentials, process transactions and manage assets without any additional hardware, enhancing efficiency in industries where speed and security are critical.

Samsung’s latest ruggedized devices also introduce AI-driven enhancements, reinforcing Samsung’s commitment to expanding AI capabilities across its entire ecosystem. These intelligent features make everyday tasks more intuitive and efficient, helping frontline professionals work smarter and faster in dynamic environments while making advanced AI more accessible across a broader range of devices.

Equipped with high-performance chipsets, enhanced usability features and intuitive AI-powered tools, both devices enable workers to multitask with ease. Features like Circle to Search with Google, Object Eraser, AI Select and Read Aloud allow users to complete tasks more efficiently, reducing manual effort. The Galaxy XCover7 Pro is powered by the Snapdragon® 7s Gen 3 Mobile Platform (4nm Octa-Core) chipset which optimizes power efficiency and processing speed, while the Tab Active5 Pro, featuring the same chipset, delivers increased RAM and expanded storage options to handle demanding workloads.

Designed for professionals who need flexibility, both devices support Samsung DeX, allowing them to connect to a monitor or PC for a desktop-like experience. Whether managing field reports, performing administrative tasks or presenting data, users can transition seamlessly between mobile and desktop environments.

Additionally, programmable keys allow users to assign shortcuts to frequently used applications, such as barcode scanning, push-to-talk or emergency alerts. This customization enhances workflow efficiency, reducing time spent navigating menus and improving responsiveness in critical situations.

Security remains a cornerstone of Samsung’s ruggedized devices, with Samsung Knox Vault safeguarding sensitive data through advanced encryption and authentication to ensure compliance with enterprise security standards. Beyond that, Samsung offers a comprehensive suite of security innovations designed to provide strong protection, transparency and user control. Real-time Kernel Protection and DEFEX deliver runtime protection at both the app and kernel layers, while Samsung’s Warranty Bit detects tampering and restricts access to sensitive applications, such as Work Profile, helping to maintain a trusted device environment.

Availability

The new Galaxy XCover7 Pro and Galaxy Tab Active5 Pro will be available starting May 26, 2025.

SafeBreach Analysis: Russian APTs and LummaC2

Posted in Commentary with tags on May 23, 2025 by itnerd

The U.S. government recently issued two critical cybersecurity alerts: AA25-141A and AA25-141B. These alerts highlighted a surge in sophisticated threat activity, from Russian state-sponsored campaigns to the rise of LummaC2 malware. SafeBreach recently published in-depth breakdowns of both alerts, offering insights into the attack chains and how enterprises can validate their defenses against them.

Links to the related blog posts can be found here:

Guest Post: Tips and strategies for network failover for business from Ericsson

Posted in Commentary with tags on May 23, 2025 by itnerd

As some Canadian businesses have recently experienced, unforeseen challenges including weather-related issues, carrier/service provider issues and networking configuration errors can cause network downtime. For organizations that rely on technology — including network and application access — for their day-to-day business, outages are costly and debilitating.

According to last year’s 2024 State of Connectivity report from Ericsson Enterprise Wireless Solutions (formerly Cradlepoint), shared downtime continued to impact Canadian businesses. More than half (53 per cent) of respondents experienced one to two hours of connectivity downtime per week on average over the previous 12 months, resulting from fixed line/fibre network failure. Additionally, 28 per cent of Canadian businesses experienced three to four hours of downtime per week. Those connectivity issues resulted in higher operational costs (45 per cent), operational inefficiencies (41 per cent), and loss of talent (36 per cent), affecting productivity and the ability for organizations to be competitive.

Tips – Failover strategies for businesses

There are, however, ways for business to protect themselves. Failover strategies enable network data to be rerouted on a secondary or back up network if the primary network link fails, enablingorganizations to continue to operate as usual.

Below are three recommended failover strategies from Jason Falovo, Vice President and General Manager, Canada at Ericsson EWS, to enable businesses to stay connected.

Add link/connection diversity: In many cases, an organization’s internet connection relies upon a single wire running to their chosen internet service provider (ISP), which could not only be affected by a provider’s outage, but also by weather or other forces of nature. While adding a second Wide Area Network (WAN) connection can be a simple and fast way to reduce the risk of losing connectivity, that second wire is just as susceptible to risks as the first. Instead, consider adding a satellite or cellular wireless link which offers not only backup, but also diversity to the network. If the wired connection goes down, rapid failover can seamlessly switch to the second connection, minimizing network and service disruption. Another option is to add a wireless connection to an existing router using a 5G or LTE adapter, then relying on its SD-WAN and failover functionality.

Ensure dual-carrier connectivity: It’s no longer practical to rely on just one telecom carrier or internet provider. Relying on a single service provider is another risk point for branch continuity. Network congestion, routing and DNS issues, and core network outages are just some of the potential incidents that can disrupt business operations.

You can reduce the risk of carrier disruptions by using two links with two different wireless carriers. The separate infrastructure adds network diversity, making it highly unlikely that both would be unavailable at the same time. You can set the two connections as a primary and a backup, or use both connections in tandem to increase bandwidth. Wireless WANs also bring greater agility and make easier to open new locations or move existing ones, which can be especially useful for short-term or temporary locations. The simplest way to employ two wireless carriers is to use a 5G or LTE router that supports two modems, providing advanced network awareness and routing capabilities. With routers that have this capability, deployment is easy as adding a second modem and SIM card to the device. A dual modem router has two active radio connections, allowing SIM cards from different carriers to be active at the same time without the downtime of switching between the two.

Add hardware redundancy: Routers can go offline for many reasons, and can often require a site visit to fix, leaving the location isolated until tech support arrives. Redundant or mirrored routers are an effective protection against router downtime. These routers monitor each other, with the backup automatically taking over if the primary router or WAN connection fails, switching back when the primary is restored.

With a primary and backup router IT can safely stage updates, configuration changes, and other periodic maintenance without risking business-critical communications.

Adding different WAN connections or carriers to each router provides additional protection from common business continuity risks. If the backup router has a lower bandwidth connection, traffic policies ensure that essential traffic is prioritized.

In today’s business environment, where organizations and their employees rely heavily on applications housed in the cloud or data centre, down time is not an option. A network failover strategy is critical to ensuring the redundancy needed to keep your business running, even when networks go down.

Meta Users Warned Of Instant Account Takeover Attack 

Posted in Commentary with tags on May 23, 2025 by itnerd

The KnowBe4 Threat Labs has published a new threat alert looking at the huge surge in phishing attacks impersonating Meta since March 2025. These attacks, through exploiting Google’s AppSheet platform, consist of a highly sophisticated campaign using tactics such as polymorphic identifiers, advanced man-in-the-middle proxy mechanisms and MFA bypass techniques to harvest credentials. 

The threat alert outlines the process of these attacks and their impacts. 

For full details please see the KnowBe4 blog which has all the details.

Power Meets Efficiency: The Perfect Tech Gift for Dads this Father’s Day From Samsung

Posted in Commentary with tags on May 22, 2025 by itnerd

We all know the struggle of finding the perfect gift for the dad who seemingly doesn’t want anything. This Father’s Day, we’re reaching out with a gift idea that will give dads what they really need: time.  

Whether it’s more time with the kids, more time relaxing, or more time for his favourite hobby, Samsung is offering the perfect tool to help dads get things done seamlessly and quickly. The Galaxy Book5 Pro is expertly designed to help you get more accomplished in less time, ensuring dads are equipped for efficiency.   

Stay connected – Any given day as a dad is a busy one. The Galaxy Book5 ensures uninterrupted connection with Wi-Fi 7 connectivity and long-lasting battery so dads can be assured they have tech they can rely on.    

Maximize your day – The Galaxy Book5 Pro is powered by the Intel Core Ultra 7 processor, delivering high-speed performance for any task. Samsung’s smart AI tools like AI Select and the dedicated AI Key help streamline everything from spreadsheets to passion projects, giving dads more time to spend offline and in the moment.  

Focus on what matters – We know dads have a lot to keep up with, so no more wasting time trying to remember where you saved last year’s files. With Recall, users can quickly and easily explore PC history to find exactly what they need.  

Give dad the gift of time with a laptop that accelerates everything he needs to do. The Galaxy Book5 Pro is available for purchase at Samsung.com/ca starting at $2,399.99.   

Claims Have Surfaced That Coca-Cola Has Been Pwned

Posted in Commentary with tags on May 22, 2025 by itnerd

It is being reported from posts on dark web forms that the Everest ransomware group claims to have compromised internal and confidential information belonging to Coca-Cola, while the Gehenna hacking group claims to have breached Coca-Cola Europacific Partners’ Salesforce database earlier this month.

According to their claims, the compromised data appears to be primarily related to the Middle East operations.

This group has previously been linked to high-profile attacks on organizations including NASA and the Brazilian government.

In a separate but potentially more damaging incident, the Gehenna hacking group claims to have successfully breached Coca-Cola Europacific Partners’ Salesforce dashboard in early May 2025.

Javvad Malik, lead security awareness advocate at cybersecurity company KnowBe4, commented:

“The recent breaches at Coca-Cola and its Europacific Partners, claimed by the Everest and Gehenna hacking groups, highlight the vulnerability of internal systems and third-party platforms like Salesforce, emphasizing the need for comprehensive cybersecurity strategies. It underscores the importance of not only robust technical defenses but also human-centric approaches to cybersecurity.

In response, organizations must prioritize data protection through layered and advanced security measures which can reduce the target area, educate and inform people of the dangers, create a culture which empowers people to make the right security decision, and protects the organization should an error occur.” 

Another day, another incident that highlights the need for organizations of all sizes to prioritize defences that keep the bad guys out regardless of the attack vector. Because incidents like these are becoming way too frequent.

Saviynt to Launch SaviTalk Podcast

Posted in Commentary with tags on May 22, 2025 by itnerd

Saviynt today announced the launch of SaviTalk, its official audio and visual podcast, with the first episode going live on Thursday, June 5. Taping of the episodes began in April at the RSA Conference in San Francisco. SaviTalk will provide an engaging platform for thought-provoking discussion on the evolving landscape of cybersecurity, identity security, and digital transformation.

Designed to be the go-to resource for security professionals, industry leaders, and enterprises navigating the complexities of modern identity security, SaviTalk will feature insightful conversations with Saviynt’s top executives, customers, and industry influencers. The podcast aims to unpack the most pressing challenges and opportunities in identity governance, privileged access management, and compliance, while also exploring the latest innovations shaping the future of cybersecurity.

The name SaviTalk was inspired by the concepts of TED Talks – concise, insightful discussions that drive thought leadership and innovation. By incorporating Savi, the podcast stays true to Saviynt’s identity while reinforcing its role as a leading voice in identity security.

Meet the Hosts

SaviTalk is hosted by some of the most influential experts in identity security, each bringing a unique perspective and wealth of experience to the conversation:

  • Henrique Teixeira, SVP of Strategy – A seasoned identity security strategist with a deep background in product and business transformation, Teixeira previously held an analyst role at Gartner, where he influenced major market shifts in identity and access management.
  • Simon Gooch, Field CIO – With decades of experience advising enterprise CIOs and CISOs, Gooch bridges the gap between technology and business needs. He has led digital transformation initiatives across Europe and North America, offering a customer-first perspective that resonates with global audiences.
  • David Lee, Field CTO – Known for his engaging communication style and sharp insights, Lee is a go-to voice in the cybersecurity community. With experience at companies like Cloudentity, AWS, and Lockheed Martin, he brings clarity to complex topics and a vision for simplifying identity security at scale.
  • Jim Routh, Chief Trust Officer – A legendary cybersecurity executive, Routh has served as CISO for organizations like Mass Mutual, Aetna, and JP Morgan Chase. He is widely respected for his forward-thinking approach to cyber risk, innovation, and building resilient security cultures.

With these industry experts at the helm, SaviTalk will deliver high-impact conversations designed to educate, challenge, and inspire listeners across the security ecosystem.

SaviTalk will debut Thursday, June 5, with an exclusive first episode featuring CEO Sachin Nayyar, where he shares his journey in identity security and the vision for Saviynt’s future. Listeners can tune in on Spotify, Apple Podcasts, and other major streaming platforms.

Additionally, Saviynt is inviting security professionals, customers, and partners to participate in upcoming episodes. Whether it’s a customer success story, a major industry trend, or an innovative security approach, SaviTalk aims to spotlight the voices shaping the future of identity security. Interested guests can submit nominations for topics and speakers through Saviynt’s website.

For more information and to listen to the latest episodes of SaviTalk, visit the website.