The IT Nerd

The MeetingTV lawsuit highlights a difficult reality in cybersecurity: once a domain or service is flagged as malicious, that designation can quickly spread across dozens of security products and become incredibly hard to undo. Whether AI was involved or not, the case shows the need for security vendors to have clear processes for validating findings, correcting mistakes, and ensuring legitimate organizations aren’t caught in the fallout.

You can catch up here: MeetingTV lawsuit

Eljan Mahammadli, Head of AI Provenance, Polygraf AI

“What stands out to me here isn’t the hallucination accusation, because the filings don’t actually prove a model wrote that finding, and that uncertainty is the whole problem. When threat intelligence ships without a record of how each conclusion was reached, nobody can audit it afterward, not the researchers and definitely not the company on the receiving end. A bad attribution takes seconds to publish and spreads across hundreds of blocklists almost immediately, but reversing it takes months, if it happens at all. That asymmetry is what the industry should be worried about, whether or not AI touched the report. If we’re going to let models do attribution work, the output has to carry its own evidence chain, so a finding can be contested on the record instead of in court.”

Gidi Cohen, CEO & Co-founder, Bonfy.AI

“The MeetingTV lawsuit should be a wake-up call: when threat intelligence is generated or enriched by AI, the stakes are no longer just about technical accuracy—they’re about business continuity and reputational harm for real companies caught in the blast radius.

This case highlights three responsibilities that security leaders and researchers can’t ignore:

• First, AI-assisted analysis does not change the obligation to validate findings with human judgment, especially when those findings can lead to long-term blocking of a legitimate service. “Protected speech” in research doesn’t absolve us from doing the hard work of verification.
• Second, the industry needs a clearer accountability model for distributed threat intelligence. Once a label is published, it is replicated across hundreds of feeds and controls, yet there is still no standard process—or SLA—for correcting mistakes and propagating those fixes downstream.
• Third, we have to treat false positives in AI-era threat intel as real incidents, not minor collateral damage. For a SaaS business, being silently tagged as malicious can have the same practical impact as a sustained DDoS or a major outage, and our governance models should reflect that.

Regardless of the legal outcome, the lesson is straightforward: if we use AI in security research, we must pair it with rigorous review, transparent methodology, and fast, industry-wide remediation when we get it wrong. Without that, AI doesn’t just help us find threats—it risks becoming one.”

Consider this a warning for organizations. Review everything that and AI does or end up in court. It truly is that simple when it come to either doing the review, or defending it in court.

This is something that needs to happen way more often. I’ll explain why in a second. But here’s what happened. The AG of NY State has hit US Radiology with a $450K fine for the following:

In an agreement announced on Wednesday, New York Attorney General Letitia James said US Radiology failed to remediate a vulnerability announced by security company SonicWall in January 2021.

US Radiology used the company’s firewall to protect its network and provide managed services for many of its partner companies, including the Windsong Radiology Group, which has six facilities across Western New York.

The vulnerability highlighted by the attorney general — CVE-2021-20016 — was used by ransomware gangs in several attacks. US Radiology was unable to install the firmware patch for the zero-day because its SonicWall hardware was at an end-of-life stage and was no longer supported. The company planned to replace the hardware in July 2021, but the project was delayed “due to competing priorities and resource restraints.”

The vulnerability was never addressed, and the company was attacked by an unnamed ransomware gang on December 8, 2021.

“Once the threat actor gained access to the VPN, they leveraged 101 additional credentials to access various network data folders over the following week,” New York prosecutors said.

That’s bad. But it gets worse:

“While a subsequent forensic investigation was unable to definitively determine how the threat actor initially obtained credentials to access the SonicWall VPN, the vulnerability identified by the NCC Group in January 2021 could have allowed the threat actor to capture username, password and other session information stored on the SonicWall server through a process known as a SQL injection.”

An investigation determined that the hacker was able to gain access to files that included the names, dates of birth, patient IDs, dates of service, provider names, types of radiology exams, diagnoses and/or health insurance ID numbers of 198,260 patients.

The data exposed during the incident also included driver’s license numbers, passport numbers, and Social Security numbers for 82,478 New Yorkers.

Now for why this needs to happen way more often. If companies know that not patching all the things will lead to you being slapped with a fine from a government organization 100%, you’re going to patch all the things without fail. I guarantee it. Thus I applaud New York Attorney General Letitia James for doing this and other AG’s in other states, not to mention in other places around the world, should follow her lead.

The Clop ransomware gang has been pwning organizations right, left and centre via vulnerabilities in the MOVEit file transfer software. And with the scale of these attacks growing by the day, you knew it was a matter of time to before a lawsuit was filed. And now we have a class action lawsuit:

On June 20, three Louisiana individuals headed up a class-action lawsuit filed in a Massachusetts district court against Progress Software, the Bedford, Massachusetts, makers of the MOVEit file Transfer and Cloud file transfer service that are used by thousands of entities and have been exploited over the past month to compromise an ever-growing list of companies and government agencies.

The plaintiffs represent more than 100 individuals who say Progress Software’s security practices were negligent, resulting in their personal data being exposed and stolen through the hack. The complaint characterizes this information as “a gold mine for data thieves” and the victims are seeking damages in excess of $5 million.

One of the lead plaintiffs, Shavonne Diggs, reportedly received “numerous phishing calls” following the breach from scammers who claimed she had signed up to attend different academic institutions, as well as an unauthorized charge on one of her payment cards.

“Armed with the Private Information accessed in the Data Breach, data thieves can commit a variety of crimes including … opening new financial accounts in Class Members’ names, taking out loans in Class Members’ names, using Class Members’ names to obtain medical services, using Class Members’ information to obtain government benefits, filing fraudulent tax returns using Class Members’ information, obtaining driver’s licenses in Class Members’ names but with another person’s photograph, and giving false information to police during an arrest,” lawyers for the plaintiffs wrote.

The company hasn’t really addressed this lawsuit. Instead they said that they are focused on helping those affected by these attacks. But I think it’s a safe bet that this will never go trial. Instead Progress will likely settle this out of court. Having said this, the repetitional damage to Progress will be huge.

Zoetop, the parent company behind retailers Romwe and Shein, have been ordered by the State of New York to pay $1.9 million over a data breach which affected millions of customers. Zoetop was found guilty of failing to secure customers’ data, not properly notifying customers and trying to keep the extent of the data leak under wraps. This penalty comes after an investigation by the New York Attorney General into a 2018 cyber attack in which credit card and personal information was stolen.

Before I give my thoughts on this, let’s hear from John Stevenson, Product Director at Cyren on this:

“Testament to the scale of the unsolved nature of social engineering attacks, every single of the millions of victims successfully targeted here now face phishing scams abusing their exposed PII in the pursuit of more valuable credentials. 

It is likely many customers’ credentials have already been sold to the highest bidder and may now be used to target their place of work. However, because employees are so busy, they cannot feasibly be expected to detect all fraudulent emails every time. Therefore, organisations must implement additional layers of technology and processes to continually hunt for targeted email attacks like spear phishing and business email compromise to automatically eliminate the threats once identified. 

A silver lining, however, is that hopefully expensive retributions for such failures to responsibly disclose and appropriately respond to a data breach is a step in the right direction towards creating a culture of compliance.”

My $0.02 worth. I am glad that the State of New York held Zoetop accountable for this and I hope that we see more of this going forward. Because if companies know that if they screw up they will get punished, they will take the steps required to make sure that they don’t get pwned.

This is the sort of story that I like writing about as it illustrates that companies who don’t seriously protect their customer’s data will be held to account. In this case Cafe Press who I’ve written about before has been fined $500,000 for a data breach that affected 23 million customers. You can read about it here, but I’ll hit the highlights for you:

• Residual Pumpkin and PlanetArt who now own Cafe Press have to implement multi-factor authentication
• They have to minimize the amount of collected and retained data
• They have to encrypt all stored Social Security numbers.
• PlanetArt is being ordered to alert buyers and sellers whose personal info was accessed or stolen during the security breaches and provide them with information on how they can protect themselves

All of this centers around a February 2019 breach of CafePress’ servers where unknown attackers gained access to, stole, and later put up for sale on the dark web personal information belonging to 23,205,290 CafePress users. Then CafePress tried to cover this up until it was reported by Bleeping Computer. And to top it all off, the company knew they had issues but didn’t do anything about it. And they also didn’t investigate any of the attacks. Which makes it pretty clear that dealing with Cafe Press is a bad idea. Though this fine may have them rethink how they handle customer data going forward.