BREAKING: For The Second Time In A Week, Bell Canada’s Internet Offerings Take A Dive [UPDATE: Resolved]

Posted in Commentary with tags on June 1, 2025 by itnerd

Earlier this week, Bell and their flanker brands had their Internet offrings go offline for roughly an hour. But just 20 minutes ago, it’s happened again with Down Detector providing the proof:

At the moment I see nothing from Bell via their Twitter feeds either admitting that they have issues, or offering an ETA as to when things will be fixed. But given that this is the second time in a week that Bell has had a serious outage, questions must be asked. Bell and their flanker brands have tended to have far more reliable Internet products offerings than their competitors. So Bell really needs to offer up an explanation as why they should be anyone’s choice for internet.

More info as it comes.

UPDATE: Things appear to be back online as of roughly 5:20 PM EST. But Bell as a company have some serious explaining to do as this is not cool to have this happen twice in one week.

1 Comment »

Flashpoint Discovers Websites That Provide The Personal Information Of About 1000 CEOs

Posted in Commentary with tags on May 30, 2025 by itnerd

I’ve just read a report from Flashpoint that sent a chill down my spine. It’s not available to the public, but let me detail what I read.

The brief that I read provides details on the websites “Luigi was right” and “The CEO Database” sharing the business and personally identifiable information of CEOs and executives from more than 1,000 companies. With this information, threat actors could conduct further searches on open-source platforms or paid data aggregator sites and potentially gain access to additional personally identifiable information (PII). One thing to note is that both websites were created by the same person or persons who have gone as as far as to ask for donations.

The websites are almost certainly referring to Luigi Mangione, the individual accused of fatally shooting UnitedHealthcare CEO Brian Thompson in December 2024. As of May 29, the “Luigi was right” site appeared to be taken down; however, portions of the data were still available via the Wayback Machine archive. “The CEO Database” was still live however.

Analysts assess that this list does not likely pose a significant physical threat to the named executives; however, potential threat actors could use the provided LinkedIn accounts to gather more information or the listed phone numbers to harass executives. Reverse phone number searches on paid data aggregator websites could potentially allow threat actors to gain additional personally identifiable information, such as residential addresses and family members.

Flashpoint obtained the full list of companies and named executives and is sharing that information with those impacted. Which is good. But the fact that these websites were even created is scary. And it highlights the need for better control of personally identifiable information.

2 Comments »

KnowBe4 Shares Tips for Smarter Online Habits for National Internet Safety Month

Posted in Commentary with tags on May 30, 2025 by itnerd

KnowBe4 today released a set of essential cybersecurity tips to help organizations and individuals protect themselves online during National Internet Safety Month this June.

June was designated National Internet Safety Month in 2005 by the U.S. Senate to raise awareness about internet safety. The digital threat landscape has transformed dramatically since then, with cyberthreats growing in sophistication and frequency. Phishing attacks and data breaches make the news almost daily, highlighting the need for strong security practices. Research shows that security awareness training reduces global phishing vulnerability by 86%. This month serves as an important reminder for individuals and organizations to reevaluate their digital behaviors and strengthen their defenses against online threats.

KnowBe4 recommends the following five essential cybersecurity practices:

  1. Use Non-Phishable Multifactor Authentication (MFA): Enable phishing-resistant MFA everywhere possible to add an additional layer of security on top of strong passwords.
  2. Be Skeptical of Urgency: If an email or message pressures you to act quickly, pause and verify its authenticity.
  3. Verify Before You Trust: Always double-check the sender’s email address or website URL to ensure it is legitimate before engaging.
  4. Secure Your Home Network: Change default router passwords and use strong encryption to protect your Wi-Fi from unauthorized access.
  5. Back Up Your Data Regularly: Use cloud services or external drives to back up important files to be prepared in case of a ransomware attack or data loss.

For more information on KnowBe4, visit www.knowbe4.com.

Leave a comment »

Guest Post: Microsoft begins Authenticator password phase-out this weekend – act before you lose access to your accounts

Posted in Commentary with tags on May 30, 2025 by itnerd

A friendly and somewhat urgent reminder to all Microsoft Authenticator users – starting this Sunday, June 1, you will no longer be able to save new passwords in the Authenticator. Microsoft is phasing out the password management and autofill features of its Authenticator app to consolidate them within the Microsoft Edge browser. This change is akin to what Google did with Chrome. 

Phase-out timeline

  • From June 2025, you will no longer be able to save new passwords in Authenticator.
  • From July 2025, the autofill function will stop working.
  • From August 2025, your saved passwords will no longer be accessible in Authenticator.

Those who wish to continue using their passwords, logins, and other saved data after August 2025 will need to separately install Edge on their smartphones or other devices. 

Also, starting July 2025, all credit card details and payment information will be removed from Authenticator. According to Microsoft, payment details won’t transfer automatically to Edge or other services, so you’ll need to re-enter your information manually. It doesn’t matter whether you choose Edge or a dedicated password manager solution. 

The Edge browser

Microsoft’s announcement about moving password management functionality to the Edge browser has sparked a debate online – is this move justified, and will it work? On Reddit and other social platforms, IT industry professionals who work with Microsoft infrastructure and tools,  seem to agree that the tech giant is making storing and syncing passwords across different devices less complicated. 

But most also agree that it does feel like Microsoft is pushing its Edge browser, which now holds around 5.2% of the global market (all platforms). In comparison, Google’s Chrome browser has around 66.2% of the market.

Users need to choose

Some analysts suggest that this move could prompt users to re-evaluate their overall password management strategy, potentially leading them to explore other solutions, especially since dedicated password managers typically offer strong encryption and are not tied to a specific browser or ecosystem.

“Microsoft’s decision to phase out password management from Authenticator represents a significant shift in the company’s approach to digital security. It seems like Microsoft is simplifying credential management across different devices and bringing password management logic closer to the market-dominant model, which is already familiar to many users. In addition, the company has a chance to increase the popularity of its browser. In theory, it’s a win-win situation. But people have various personal likes and dislikes, are often used to a particular ecosystem or a browser and may not wish to move. In that case, a dedicated password management solution might be a good idea since it can provide cross-platform synchronization across multiple browsers and devices, secure storage for credentials, and features like breach monitoring and encrypted sharing,” says Karolis Arbaciauskas, head of business product at NordPass.

If you don’t want to use Edge, you can export your passwords to a different service by heading to Authenticator > “Settings” > “Export passwords” > “Export” and then importing the saved file to the password manager of your choice.

ABOUT NORDPASS

NordPass is a password manager for both business and consumer clients. It’s powered by the latest technology for the utmost security. Developed with affordability, simplicity, and ease of use in mind, NordPass allows users to securely access their passwords on desktop, mobile, and browsers. All passwords are encrypted on the device, so only the user can access them. NordPass was created by the experts behind NordVPN – the advanced security and privacy app trusted by more than 14 million customers worldwide. For more information: nordpass.com.

Leave a comment »

Saviynt Showcases the Only Converged Identity Security Platform for All Identities – Human and Non-Human – at Identiverse 2025

Posted in Commentary with tags on May 30, 2025 by itnerd

Saviynt has announced that it now protects all forms of organizational identities, including Non-Human Identities (NHI). The company has expanded its identity security cloud platform to protect NHIs such as workloads, bots, and credentials. This is in addition to the existing capability of supporting NHI service accounts. The announcement was made just before Identiverse 2025, set for June 3-6 in Las Vegas, where Saviynt executives will lead a workshop on NHI.

As the authority in identity security, Saviynt will spotlight its latest innovations in NHI protection – integrated within its converged platform, The Identity Cloud. Attendees can visit booth #638 to see firsthand how Saviynt is redefining enterprise security by delivering converged, scalable protection through a single pane of glass for all digital identities – human and non-human – at scale.

As organizations embrace automation, AI, and cloud-native development, NHIs now vastly outnumber human users – by as much as 100:1 in DevOps environments. Saviynt’s Identity Cloud delivers full visibility, posture management, and actionable recommendations for all identities, enabling enterprises to discover and secure every NHI, including workloads, bots, and credentials. The platform extends its best-in-class controls to NHIs, offering deep insight into activity history, usage patterns, and prioritized risk insights – all without the need for additional tools or complex configurations.

Saviynt’s NHI capabilities are purpose-built to simplify and secure the most complex identity environments, helping organizations eliminate blind spots across cloud and hybrid ecosystems. The platform enables teams to:

  • Discover all non-human identities and their access in a unified view: Get complete, real-time inventory of your non-human identity landscape.
  • Understand security posture of non-human identities with deep analysis: Granular analysis of non-human identity activity and relationships to surface prioritized identity security and compliance issues.
  • Visualize non-human identity activity with timeline view: Surfaces access events, as well as lifecycle changes, to enable faster response and ensure compliance.

The growing demand for a converged, intelligent identity security platform has never been more urgent. With Agentic AI accelerating fast, organizations need a modern identity security foundation with the depth and flexibility to govern the right access for every identity — human or machine, known or emerging. Saviynt is at the forefront of delivering on that need. This leadership is reflected in the company’s prominent presence at Identiverse, where five of Saviynt’s top executives will share their expertise on the most pressing identity challenges and innovations, including how to drive the next wave of innovation to meet the significant identity challenges introduced by Agentic AI. Attendees can attend these expert-led sessions featuring Saviynt executives and customers:

Non-Human Identity Workshop
Ehud Amiri, vice president of product management and Henrique Teixeira, senior vice president of strategy | 9:00 a.m – 12:00 p.m. PT on June 3 | Mandalay Bay H

Amiri and Teixeira will lead a deep-dive workshop exploring the critical importance of securing NHIs, such as workloads, bots, AI agents, and secrets. Participants will learn about the growing risks NHIs pose to enterprises, especially in light of generative AI developments, and gain practical insights on how to detect, manage, and remediate these risks using Saviynt’s NHI Maturity Model and risk-based security approaches.

GE Healthcare’s Journey to Proactive Identity Security
Vibhuti Sinha, chief product officer, with GE Healthcare’s Joey Tyler| 2:35 – 3:00 p.m. PT on June 4 | Breakers J

Sinha and Tyler share GE Healthcare’s transformative approach to Identity Security Posture Management (ISPM). This session highlights how moving from reactive to proactive identity security significantly reduces risks and streamlines compliance efforts. Attendees will gain valuable insights into the practical application of ISPM and the benefits realized by one of the world’s largest healthcare providers.

B2B-IAM Smackdown: Defending the Future of Partner Identity
Jeff Margolies, chief product and strategy officer | 10:30 – 11:20 a.m. PT on June 5

Margolies presents a forward-looking session on partner identity security, a critical and often overlooked dimension of enterprise identity management. This talk explores emerging threats in B2B identity, challenges in securing third-party access, and how enterprises can proactively defend their partner ecosystems using Saviynt’s converged identity platform.

Identity: The Superhero No One Invited to the Boardroom
David Lee, field chief technology officer | 4:00 – 4:25 p.m. PT on June 5 | Mandalay Bay D

Lee offers a candid look at why Identity and Access Management (IAM) is the foundational technology “glue” holding modern enterprises together—yet often remains undervalued. He discusses the “Identity Plot Twist” driven by AI, decentralized identity models, and machine identities, and makes a compelling case for elevating IAM’s role and budget in enterprise security strategies.

After a full day of thought leadership and innovation, join Saviynt at the IDMWorks Identity Happy Hour on Wednesday, June 4, from 6:30 to 8:30 p.m. PT at Flanker Kitchen and Sports Bar in Mandalay Bay. Unwind with craft cocktails, hors d’oeuvres, playoff hockey, and great conversation with identity experts and peers from across the industry.

To learn more about Saviynt’s presence at Identiverse, please visit the website and blog.

Leave a comment »

Botetourt County Public Schools Pwned By Qilin

Posted in Commentary with tags on May 30, 2025 by itnerd

Ransomware gang Qilin took credit for a cyber attack on Botetourt County Public Schools earlier this month and demanded the district pay a ransom by June 12, 2025. Botetourt County Public Schools has not verified Qilin’s claim.

 In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“Qilin is a ransomware gang that began claiming responsibility for attacks on its data leak site in late 2022. Based in Russia, Qilin mainly targets victims through phishing emails to spread its ransomware. It launched in August 2022 and runs a ransomware-as-a-service business in which affiliates pay to use Qilin’s malware to launch attacks and collect ransoms. Qilin has claimed credit for 26 confirmed ransomware attacks so far this year, plus 201 unconfirmed claims that haven’t been acknowledged by the targeted organizations.”

“At the same time that Qilin claimed the attack on BCPS, it also took credit for an attack on Logan University that remains unconfirmed. In April 2025, Qilin attacked Western New Mexico University and defaced its website.”

“Comparitech researchers have logged 19 confirmed ransomware attacks on US schools, colleges, and other educational institutions in 2025 to date. Earlier this month, ransomware gangs also hit Coweta County School System in Georgia, Bartlesville Public Schools in Oklahoma, and Kalamazoo Public Schools in Michigan. The education sector takes longer than any other to report data breaches to victims: 4.8 months on average.”

While everyone is a target for threat actors, health care and education are top targets because they are underfunded from a cybersecurity perspective. That needs to change ASAP to stop this sort of thing from happening over and over again.

1 Comment »

85% of Canadian IT Leaders Say Security Must Evolve: Salesforce

Posted in Commentary with tags on May 29, 2025 by itnerd

Canadian IT security leaders are signalling a clear need for change, with 85% saying their current practices must evolve to keep pace with modern threats. According to Salesforce’s new State of IT Security report, many are turning to emerging technologies like agentic AI—solutions such as Agentforce—to support operations and strengthen defenses.

While 99% believe AI agents can improve at least one area of security, many remain cautious. Over half (61%) lack full confidence in deploying these tools with the right guardrails, and 56% say their data foundation isn’t ready to support agentic AI.

Still, adoption is growing. More than 41% of IT security teams in Canada are already using AI agents in day-to-day operations, with usage expected to rise. Encouragingly, 86% of security, privacy, and compliance leaders see AI agents as a source of new security opportunities.

As 78% of Canadian leaders predict AI-driven threats will soon outpace traditional defenses, getting data governance right is becoming a top priority for organizations looking to adopt AI securely and strategically.

You can read the report here.

Leave a comment »

Adidas Has Been Pwned Via A Third Party Hack

Posted in Commentary with tags on May 29, 2025 by itnerd

Adidas has confirmed a data breach stemming from a compromise of a third-party customer service provider. Hackers stole contact information of customers who had reached out to Adidas’ help desk. While no financial or password data was reportedly accessed, the breach raises concerns about supply chain vulnerabilities.

Andrew Obadiaru, CISO, Cobalt had this to say:

“This Adidas breach is yet another case of attackers taking the path of least resistance—third-party vendors with less mature defenses. In offensive security, these peripheral entry points are frequently the first tested during a campaign. And in retail, where customer engagement relies on sprawling digital ecosystems, vendors often fall outside the scope of proactive security testing. It’s no longer enough to harden your own walls—you must probe your supply chain with the same rigor. Otherwise, your vendors become the adversary’s open door.”

Wade Ellery, Field CTO, Radiant Logic follows with this:

“The Adidas breach puts a spotlight on the observability gap in third-party environments. While payment data may be safe, identity data—names, emails, contact history—still holds value in the attack chain. These are real identity artifacts, and they deserve the same level of scrutiny and visibility as any internal asset. Enterprises must rethink vendor oversight, ensuring that even external service layers feed into a unified observability framework. Without this, organizations risk flying blind where it matters most: at the seams between systems.”

Once again we see an example of a company getting pwned through no fault of their own. Other than the fact that they should consider holding third parties accountable for their security like the NHS recently did. Because it should be crystal clear by now that you’re only as secure as the companies that you work with.

Leave a comment »

Sage Scales Embedded Services to North America and Europe to Help Platform Partners Serve SMBs Better

Posted in Commentary with tags on May 29, 2025 by itnerd

Sage today announced the global expansion of Sage Embedded Services. 

Initially launched in the UK, Sage Embedded Services is now available across North America and Europe. enabling banks, fintechs, and software platforms to seamlessly build accounting capabilities directly into their products. This allows their small businesses and sole traders customers to save time, stay compliant, and make smarter business decisions. At the same time, it empowers platform partners to deliver branded accounting and related capabilities without the complexity or cost of developing their own solutions from scratch.

Sage Embedded Services aims to equip platform partners with capabilities that deepen customer engagement, drive loyalty, and unlock sustainable growth through enhanced user experiences.

The expansion responds to a growing demand from small businesses for simplified business management capabilities embedded directly into their ecosystem within the applications they already use in daily operations.  It enables access to key financial tools, like bookkeeping, reporting, and compliance, without switching platforms or disrupting existing workflows.

Why it matters for platform partners

Sage Embedded Services offers banks, fintechs, and software providers a powerful way to differentiate their offerings by embedding accounting and compliance tools directly into their own products. This enables partners to meet more of their customers’ day-to-day financial needs while delivering a unified, seamless experience.

For platform partners, this is a chance to:

  • Accelerate time to market with Sage’s headless APIs, reducing development time and lowering technical barriers to build and maintain.
  • Deliver tailored solutions with modular accounting capabilities, matching their specific customer needs.
  • Boost customer engagement by making their apps more useful, sticky, and central to daily workflows 
  • Unlock new revenue streams through monetizable, value-added features

Built for small businesses and the platform partner ecosystem

Sage Embedded Services is designed specifically for organisations that build digital products used by self-employed individuals and small businesses such as online banks, fintech providers, and industry specific software companies. The service is modular, allowing platform partners to directly embed:

  • Multi-dimensional general ledger
  • Real-time financial reporting
  • Customisable insights and analytics

Depending on the region, additional functionality such as carbon accounting, collaboration with accountants and more may be available.  Platform partners have complete control over how these accounting capabilities appear and function within their products, ensuring a seamless, brand-aligned experience for their customers, powered by Sage’s deep experience in bookkeeping, accounting and tax compliance.

Leave a comment »

Victoria’s Secret Has Been Pwned…. Website Down

Posted in Commentary with tags on May 29, 2025 by itnerd

Intimate clothing company Victoria’s Secret has taken it’s website down after apparently getting pwned. Though details aren’t clear how they got pwned.

Shares of Victoria’s Secret fell Wednesday after the lingerie company took down its US website, saying there was a prolonged “security incident.”

Shoppers visiting the website will see a black screen with the company’s statement rather than its usual selection of lingerie, sleepwear and other products.

The retailer has “identified and are taking steps to address a security incident,” according to a statement posted to its website. “We have taken down our website and some in store services as a precaution.”

It’s rare for a company of Victoria Secret’s size to have such a lengthy site-wide outage. While its physical retail stores remain open, revenue from online shopping is critical for Victoria’s Secret. The brand generated $2 billion in net sales from direct channels that include online shopping in 2024, or roughly a third of its annual sales.

Javvad Malik, Lead Security Awareness Advocate at KnowBe4, has provided the following commentary:

“The recent security incident at Victoria’s Secret, following a string of attacks on other retailers, suggests a potentially coordinated campaign targeting the retail sector. While information remains limited at this point, suspending website functionality is not a decision organizations take lightly.”

“This event underscores the critical importance of fostering a robust security culture within organizations. In the retail sector, where customer trust is paramount, embedding security awareness across all levels of the business is crucial. This culture should emphasize not only technological defenses but also staff vigilance to act swiftly when threats are detected.”

Clearly threat actors attacking the retail sector is the new cool thing of the moment. Thus proving that nobody is safe and everyone needs to take every precaution possible to prevent themselves from getting pwned. Because in the case of Victoria’s Secret, this is likely to cost them millions of dollars.

Leave a comment »

« Older Entries
Newer Entries »