Toronto District School Board Data Has Been Leaked Via A Supply Chain Attack

Posted in Commentary with tags on January 21, 2025 by itnerd

This hack is going to be big.

The Toronto District School Board disclosed via a letter to parents and guardians that it has been pwned by what looks like to be a supply chain attack and the impact is huge:

What Happened?
As you may recall, on Tuesday, January 7, 2025, PowerSchool notified TDSB and other school boards in Ontario and across North America that a PowerSchool system had experienced a data breach between December 22-28, 2024. TDSB’s cybersecurity team promptly activated our response plan, taking immediate steps to ensure that our critical systems remain operational. TDSB can confirm that our environment is secure, and that there is no ongoing unauthorized access to any data, either stored in PowerSchool’s Student Information System or elsewhere. 

What Information Was Impacted? 
While our investigation into the incident continues, we have now confirmed the types of personal information stored in PowerSchool’s Student Information System that may have been accessed and acquired by an unauthorized user. The information includes the following:

Students between September 1, 2017 and December 28, 2024

  • First, Middle & Last Names
  • Date of Birth
  • Gender
  • Health Card Number
  • Grade Level and School Information
  • Start/End Date as a Student
  • Ontario Education Number
  • EQAO Accommodation Information    
  • Medical Information (ie. allergies, conditions, injuries)
  • Home Addresses
  • Home Phone Numbers
  • TDSB Student Number
  • TDSB Email Address
  • First Nations, Métis, Inuit Information
  • Residency Status
  • Principal/Vice Principal Notes (including discipline notes) 

With respect to medical information, if you provided information to your child’s school about your child’s allergies, medical conditions or injuries when completing the start of school year forms, this information was included in the data that may have been accessed or acquired. Please note that medical information provided to members of TDSB’s Professional Support Services team (e.g. Psychologists, Occupational Therapists, Physiotherapists, Audiologists, Speech-Language Pathologists, and Social Workers) was not impacted by this incident. 

Students between September 3, 1985 and August 31, 2017

  • First, Middle & Last Names
  • Date of Birth
  • Gender
  • Health Card Number
  • Ontario Education Number    
  • Home Addresses
  • Home Phone Numbers
  • TDSB Student Number
  • TDSB Email Address
  • First Nations, Métis, Inuit Information 

This historical student information is kept in PowerSchool’s Student Information System in order to respond to requests for former student records. Parent/guardian/caregiver and emergency contact information (individuals connected to students who were registered from September 1, 2017 and December 28, 2024)

  • First, Middle & Last Names
  • Home & Mobile Phone Numbers
  • Email Addresses    
  • Relationship to Student
  • Home Addresses

Canada’s federal privacy watchdog and the Office of the Information and Privacy Commissioner of Ontario are both investigating the breach. But it goes without saying that this is bad. PowerSchool, the company who got pwned has a statement of their own where they will be offering free credit monitoring for those affected. Which is typical for situations like this. But doesn’t really give me the warm fuzzies. I say that because my wife and I went to TDSB schools and are in the second group of people who are affected by this. So this clearly concerns us. The types of information could be used to launch attacks against individuals, or be used to commit fraud. Thus anyone who is affected by this could be feeling the repercussions for years to come.

Leave a comment »

BPR Hub Raises $2.6M to Make World-Class Compliance Accessible to All Manufacturers

Posted in Commentary with tags on January 20, 2025 by itnerd

Every day, manufacturers wrestle with increasing complex regulatory requirements imposed by clients and regulatory bodies. Small and medium-sized manufacturers (SMEs) in particular struggle to stay compliant while managing day-to-day operations, hampered by limited bandwidth and lean teams. When compliance fails, the consequences are severe: significant penalties, missed business opportunities, and loss of eligibility for high-value contracts that can stall growth entirely. Today, BPR Hub, a San Francisco and Bangalore, India based company announced a $2.6 million seed funding round to help manufacturers finally solve this critical challenge.

The round was co-led by Accel and Kae Capital, with participation from a line-up of prominent angel investors in the manufacturing sector. This investment will accelerate BPR Hub’s mission to simplify compliance for manufacturers globally, with a key focus on scaling operations in North America.

The reality for most manufacturers today is chaos. Teams operate on spreadsheets, struggling to maintain collaboration across departments while juggling multiple certification requirements. Critical standards slip through the cracks as businesses are forced to choose between compliance and growth. BPR Hub changes this by consolidating Quality, Compliance, and Governance (QCG) into a single platform, automating up to 80% of these compliance tasks.

The system’s real-time updates and AI-driven document review completely transforms how manufacturers handle compliance. Through automated evidence evaluation and continuous monitoring, BPR Hub helps companies fast-track certification – turning a process that typically takes months into one that takes weeks. The platform streamlines the management of overlapping certification requirements, eliminating duplication and ensuring nothing falls through the cracks. What sets BPR Hub apart is its commitment to customer success through hands-on support. Rather than just providing software, the team actively guides and supports manufacturers through their entire compliance journey. This high-touch approach ensures that companies can fully leverage the platform’s capabilities while maintaining focus on their core business.

Beyond compliance, BPR Hub enhances manufacturing excellence by integrating quality assurance, production control, batch review, inventory management, and asset management into one user-friendly platform. This comprehensive approach ensures everyone from floor operators to leadership teams can effectively manage and monitor compliance requirements while maintaining focus on business growth.

The company was founded by three deep experts in compliance and manufacturing. Teja Edara (CEO) brings extensive IT compliance expertise, while Milanjeet Singh (COO) and Vinodh Peddi (CTO) collectively contribute two decades of experience in manufacturing compliance. 

With over 10 years of experience in manufacturing, compliance consulting, and auditing, Milanjeet saw firsthand how cumbersome compliance management could be. This inspired the inception of BPR Hub, a solution that could truly transform how manufacturers handle compliance to drive growth and reduce the operational burdens for manufacturers.

The impact is already clear. Customers report a 40% reduction in time-to-certification, leading to faster growth and improved operational efficiency. The platform’s partnerships with industry leaders in packaging and aerospace are driving rapid adoption across global markets.

The timing is critical. The increasing complexity of regulations in industries like aerospace, medical devices, and food manufacturing is driving urgent demand for more efficient compliance management solutions. Traditional solutions are prohibitively expensive, while information asymmetry between departments creates constant risk. When experienced employees leave, critical compliance knowledge often leaves with them, creating dangerous gaps in regulatory understanding. These challenges are particularly acute in highly regulated sectors like medical device manufacturing and aerospace, where a single compliance failure can have severe consequences.

 “The mobile version of BPR Hub will be a game changer,” notes Anthony Manella, CEO of ISO Certification Consultants. “It will streamline operations significantly, pushing training and standard compliance directly to employees’ cell phones, ensuring every team member remains aligned with our standards.”

Looking forward, BPR Hub will use the funding to scale its platform globally, expand its team, and develop new product features. With its QCG focus, BPR Hub aims to become the leading consolidated compliance solution for manufacturers, providing complete oversight into compliance requirements while ensuring seamless operational control. The platform is built specifically for manufacturers with limited resources and manpower, empowering them to focus on what they do best – growing their business.

“The manufacturing sector is experiencing remarkable growth fueled by rising global demand for diversified supply chains, India’s position as a hub for IP-driven, high-quality production, and the potential of AI technologies. This growth coincides with a period of heightened regulatory complexity and an urgent need for operational agility. Compliance is no longer just a box to check; it’s a competitive advantage when managed well. BPRHub is helping manufacturers navigate this shift by using AI to simplify and optimize compliance processes. This is the kind of innovation that will accelerate the future of manufacturing. We’re excited to partner with Teja, Milanjeet and Vinodh who understand the sector’s unique challenges, and are leading this shift on a global scale with BPRHub,” said Prayank Swaroop, Partner at Accel.

Abhishek Srivastava, General Partner, Kae Capital added: We are excited to back BPR Hub as they transform compliance, quality, and governance management in manufacturing. Their AI-led unified platform tackles a critical industry challenge by streamlining compliance processes. Having witnessed Teja’s success in scaling similar ventures, and with a robust founding team and a clear market opportunity, we are confident that BPR Hub will revolutionize how mid-market manufacturers manage compliance and governance.

Leave a comment »

Hammerspace Selected as a Finalist in Three Major Categories of theCUBE Technology Innovation Awards

Posted in Commentary with tags on January 20, 2025 by itnerd

Hammerspace, the company orchestrating the next data cycle, has been recognized as a finalist in three categories of theCUBE Technology Innovation Awards, including “Most Innovative Tech Startup Leaders” for CEO and co-founder David Flynn, the “HyperCUBEd Innovation Award – Private Company” and “Top Data Storage Innovation.” Winners will be announced on February 18. 

Judged by a panel of top-ranked enterprise technology analysts, the awards program recognizes the world’s most innovative companies, groundbreaking products and out-of-the-box thinkers driving the tech industry forward.

The Most Innovative Tech Startup Leaders honors exceptional individuals from a B2B tech company who have significantly advanced the industry through groundbreaking ideas, leadership and execution. 

Flynn is a recognized IT innovator known for architecting disruptive computing platforms. As founder and CEO of Fusion-io, he pioneered placing flash storage closer to the CPU, reducing latency and improving performance. His vision for Hammerspace was to create a standards-based platform that unifies high-performance file access and automates non-disruptive data orchestration to bridge existing storage silos from any vendor, and without requiring enterprises to abandon existing IT architectures.  

The HyperCUBEd Innovation Award recognizes companies that have consistently pushed the boundaries of technology and demonstrated unparalleled creativity in developing new solutions and demonstrated results. 

The Top Data Storage Innovation award recognizes a data storage solution that excels in providing robust, scalable and high-performance storage capabilities for modern enterprises as requirements for storing data evolve in the AI era or due to other factors.

Hammerspace’s Global Data Platform revolutionizes the management of data and storage in a world where digital assets can no longer be locked into a single vendor’s ecosystem. It enables organizations to use existing storage resources without compromising the ability to explore AI/DL and other next-generation uses to extract unrealized value from their data, wherever it may be.

The latest version of Hammerspace’s software unlocks a new tier of storage by transforming local NVMe storage on GPU servers into a Tier 0 of ultra-fast, persistent shared storage. By activating this previously “stranded” local NVMe storage seamlessly into the Hammerspace Global Data Platform, Tier 0 delivers data directly to GPUs at local NVMe speeds, unleashing untapped potential and redefining both GPU computing performance and storage efficiency.  

Learn More: 

Leave a comment »

Over 1500% Spike In VPN Usage In The USA after TikTok Shut Down 

Posted in Commentary with tags on January 20, 2025 by itnerd

VPN Mentor has published a report about an massive increase of VPN demand in the USA following the brief shut down of TikTok in the country. 

Their research team conducted an analysis of VPN demand data in the country observing a massive spike of 1566% just minutes after the app shut down and maintaining over 1400% in their last update. 

You’ll find all the details here: https://www.vpnmentor.com/news/tiktok-vpn-demand-surge/

Leave a comment »

BREAKING: TikTok Appears To Be Back Online As Trump Throws Them A Lifeline Of Sorts

Posted in Commentary with tags on January 19, 2025 by itnerd

Tt appears that TikTok is coming back to life. According to NBC and The New York Times (paywalled) TikTok has announced that it will be flipping the switch on the social media platform to let Americans use it. I’m sure that this will be good news to those who use the platform. But I am not sure it really changes anything. I say that because Trump has said he will give them a 90 day extension via said executive order. So does that mean that 90 days from now we’ll be in the same situation? I think so. But for those who suffer from TikTok brain rot, I am sure that they will be overjoyed that they don’t have to figure out what to do with their free time.

Leave a comment »

TikTok Goes Dark In The US…. And Apparently Other Places As Well

Posted in Commentary with tags on January 19, 2025 by itnerd

As expected, TikTok is no longer available to US users. When you try to log into TikTok, you get this message:

And this:

Clearly they are counting on incoming president Donald Trump to save them. And he’s indicated that he’s willing to give them a 90 day lifeline to sell themselves to a US entity. That’s closer to his view on TikTok the last time he was US President. But considering that the bill that banned TikTok had broad support from both Democrats and Republicans, and that TikTok’s corporate masters ByteDance have made it clear that they aren’t going to sell, I have to wonder if he will actually be able to get TikTok back online.

Speaking of TikTok being online, several threads have appeared on the Linus Tech Tips subreddit that TikTok is not accessible in other places. Canada and Thailand have been listed as places where TikTok no longer works. And a trip to the TikTok subreddit shows Mexico among other places cannot access TikTok either. I am going to guess that TikTok’s infrastructure likely is designed in such a way that a shut down in the US means a shut down for a lot of other places as well. But we’ll will have to see if that continues to be true in the coming hours and days. In the here and now, TikTok isn’t accessible for millions of people.

Leave a comment »

FTC Forces GM And OnStar To Stop Selling User Data Without Their Consent

Posted in Commentary on January 19, 2025 by itnerd

Back in 2023, I wrote about modern cars being rolling privacy nightmares. I’d like to highlight one thing that I said when it was discovered that car companies were collecting all sorts of data and selling it:

The car companies then sell this data, as it’s a revenue source for them. And opting out of this data collection isn’t an option for the most part. Consent is an illusion as simply stepping into a car with this sort of tech qualifies as consent. And finally, all car companies do this.

Well, the Federal Trade Commission has decided to do something about this. And they’ve targeted GM and OnStar to curtail this practise:

Under a proposed order settling the FTC’s allegations, General Motors LLC, General Motors Holdings LLC, and OnStar LLC, which are owned by General Motors Company, will be banned for five years from disclosing consumers’ sensitive geolocation and driver behavior data to consumer reporting agencies. They also must take other steps to provide greater transparency and choice to consumers over the collection, use, and disclosure of their connected vehicle data. This is the FTC’s first action related to connected vehicle data.

In its complaint, the FTC alleged that Michigan-based GM used a misleading enrollment process to get consumers to sign up for its OnStar connected vehicle service and the OnStar Smart Driver feature. GM failed to clearly disclose that it collected consumers’ precise geolocation and driving behavior data and sold it to third parties, including consumer reporting agencies, without consumers’ consent.

“GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,” said FTC Chair Lina M. Khan. “With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”

GM has offered OnStar as a service that will aid consumers during an emergency and provide hands-free voice assistance and real-time traffic and navigation. Over time, the company has increased the amount of data it collects through OnStar to include precise geolocation data—collected every three seconds for some users.

Tracking and collecting geolocation data can be extremely privacy invasive, revealing some of the most intimate details about a person’s life, such as whether they visited a hospital or other medical facility, and expose their daily routines.

When consumers bought a GM vehicle, they were encouraged to sign up for OnStar and its Smart Driver feature, which they were often told would be used to help them assess their driving habits. The FTC alleged, however, that GM’s enrollment process for the data collection for both its OnStar service and Smart Driver feature was confusing and misleading. In fact, some consumers were unaware that they had been signed up for the Smart Driver feature, according to the complaint.

In addition, GM failed to clearly disclose to consumers the types of information it collected through its Smart Driver feature, including that their geolocation and driving behavior data—such as every instance of hard braking, late night driving, and speeding—would be sold to consumer reporting agencies. These consumer reporting agencies used the sensitive information GM provided to compile credit reports on consumers, which were used by insurance companies to deny insurance and set rates.

And:

The proposed order would prohibit GM and OnStar from misrepresenting information about how they collect, use, and share consumers’ location and driver behavior data. Additional provisions of the proposed order require GM and OnStar to:

  • Not disclose covered driver data to consumer reporting agencies: The proposed order would ban GM and OnStar from disclosing consumers’ geolocation and driver behavior data to consumer reporting agencies for five years from the date the order is entered.
  • Obtain consent prior to collection: The companies must obtain affirmative express consent from consumers prior to collecting connected vehicle data, with some exceptions such as providing location data to emergency first responders.
  • Allow consumers to obtain and delete their data: The companies must create a way for all U.S. consumers to request a copy of their data and seek its deletion.
  • Allow consumers to limit data collection from their vehicles: The companies must also give consumers the ability to disable the collection of precise geolocation data from their vehicles if their vehicle has the necessary technology and provide a way for consumers to opt-out of the collection of geolocation and driver behavior data, with some limited exceptions.

Kudos to the FTC for smacking GM along with OnStar for being so shady when it comes to user data. This will hopefully put the rest of the car industry on notice that this is not acceptable. And if they were smart, they would be proactive and use this as a template to clean up their collective acts before the FTC knocks on their door to force them to do so.

1 Comment »

TikTok Will Go Dark On Sunday… An Interesting Pressure Tactic

Posted in Commentary with tags on January 18, 2025 by itnerd

So the question has been asked about what TikTok will do now that the US Supreme Court decided not to save them yesterday. We have are answer:

TikTok said the app will have to “go dark” in the United States on Sunday barring a last-minute intervention from the Biden administration to halt enforcement of a federal ban. 

The company said in a statement late Friday that President Joe Biden’s White House and the Justice Department had not provided enough “clarity and assurance” to guarantee the platform could continue operating once the law to force its sale takes effect.

That was followed by this posted to Twitter:

So why would TikTok take this approach? Well, they are clearly not going to sell to a US entity. So that means that they are using going dark to upset enough people that it will put pressure on US politicians to reverse this. I honestly don’t know if that will work because America just came out of an election cycle, so there may be no appetite to reverse this. Though there is a bill on the table to extend the amount of time that TikTok has to sell itself to a US entity. So who knows? All I know is that things are about to get really interesting on Sunday.

1 Comment »

2024 US Healthcare breaches: 585 incidents, 180 million compromised records 

Posted in Commentary with tags on January 17, 2025 by itnerd

SecurityWeek conducted an analysis of the US Department of Health and Human Services Office for Civil Rights (HHS OCR) healthcare breach database which stores information on incidents with over 500 victims.

The OCR was informed of about 585 incidents impacting the protected health information of roughly 180 million records between January 1, 2024, and December 31, 2024.

Of the total number of data breaches, the type of entities impacted included:

  • 73% – Healthcare providers
  • 17% – Healthcare business associates
  • 10% – Health plans 

Most incidents (86%) were described as ‘hacking/IT incident’, followed by incidents involving unauthorized access or disclosures. Almost 70% involved network servers and roughly 22% involved email. 

The biggest healthcare data breach of 2024 was of course the ransomware attack on Change Healthcare, resulting in the information of roughly 100 million individuals getting stolen.

Other notable incidents include:

  • Kaiser Permanente – 13.4 million
  • Ascension Health – 5.5 million
  • HealthEquity – 4.3 million
  • Concentra Health Services – 3.9 million
  • Centers for Medicare & Medicaid Services – 3.1 million
  • Acadian Ambulance Service – 2.8 million
  • A&A Services, dba Sav-Rx – 2.8 million
  • WebTPA – 2.5 million
  • Integris Health – 2.3 million
  • Medical Management Resource Group – 2.3 million
  • Summit Pathology – 1.8 million
  • Geisinger – 1.2 million

Emily Phelps, Director, Cyware:

“The number of healthcare data incidents reported in 2024 underscores the opportunity to strengthen security practices across the sector. In 2025, adopting approaches like real-time intelligence sharing and operationalizing threat intelligence can help healthcare entities work more effectively. By fostering collaboration and integrating automation and orchestration, healthcare organizations can streamline their defenses, improving their ability to identify and respond to threats quickly. A collective defense model enables organizations to share insights and best practices, building a more resilient and connected ecosystem that better protects sensitive patient information and ensures uninterrupted care.”

This is a reminder that the health care sector is a target rich environment for threat actors. This needs to change and ASAP. Otherwise I will have a similar story next year for you to read.

Leave a comment »

It’s Official, TikTok Is Screwed…. Probably

Posted in Commentary with tags on January 17, 2025 by itnerd

The Supreme Court just handed TikTok a virtual death sentence in the US by upholding a law that bans them effective Sunday:

The U.S. Supreme Court on Friday unanimously upheld the federal law banning TikTok, beginning Sunday, unless it’s sold by its China-based parent company, holding that the risk to national security posed by its ties to China overcomes concerns about limiting speech.

TikTok’s parent company, China’s ByteDance, was given until Sunday to find an American owner for the app or face going dark in the U.S., under bipartisan legislation signed last year by outgoing President Joe Biden.

Now there is a possibility that Donald Trump who takes over as President of the United States as of Monday could save TikTok. Which is interesting as he was anti TikTok the last time he was president. So we will have to see if he is able to do so. But as it stands now, it looks like TikTok will be dead in the US as of Sunday. And one has to wonder if other countries will follow suit.

UPDATE: Here’s some commentary from some industry experts:

Lawrence Pingree, VP, Dispersive

“I think that there are some valid concerns about the involvement of government agencies in espionage and influence operations that are important issues to address. Things like data sovereignty, isolation networks and access, regular trusted third-party audits, background checks, authentication of remote employees, and, potentially, source code review are all prudent measures to require. Bans need to consider the totality of the situation and the politics of the time.”

Ted Miracco, Approov CEO

“Liberty can only thrive when paired with accountability. As the Supreme Court shutters TikTok, it’s a reminder that safeguarding freedom of speech means not just shouting into the void, but doing so with transparency and responsibility. Regardless of where a platform originates, our online spaces must be protected from manipulation to uphold the integrity of our perspectives.”

Willy Leichter, CMO, AppSOC

“If you peel back all the politics, international negotiations, and social media hype, the TikTok ban came from genuine concerns about privacy and national security. To say that banning one platform will permanently affect free speech seems like a stretch. The fickle social media market will quickly find many alternative ways to share content and amuse themselves. Assuming this ruling doesn’t get watered down by the Trump administration, it’s an example of pursuing and acting upon serious security issues.”

Leave a comment »

« Older Entries
Newer Entries »