Iowa joins multi-state settlement over 23andMe data breach after company’s bankruptcy

The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times. The malicious Jscrambler package spanned releases 8.14, 8.16, 8.17, and 8.20 and included information-stealing malware that executed during the ‘preinstall’ hook. “Today, we identified the unauthorized publication of a…

Japan’s largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to shut down part of its infrastructure. The incident occurred over the weekend, early Saturday morning, and impacted operations, including the company’s taxi dispatch system, which remains offline as of today. Nihon Kotsu is Japan’s largest taxi…

Voting was already underway when the ICE agents arrived at a polling site in Syracuse, New York, during the state’s primaries in June. The agents were there to see Paigelynne Gonyea, a poll worker who says they were concerned about an Instagram post she had supposedly made in January “doxing” an ICE agent. The only…

AI governance is a key enterprise concern. Organizations are assembling councils, publishing principles, rolling out “approved AI tools” lists, and asking employees to opt in to acceptable use policies. In most enterprises, however, the reality is that AI is already widely embedded in employees’ daily work, often outside sanctioned channels and oversight. The visibility and…

In 2022 and 2023, the European Parliament’s PEGA Committee investigated spyware abuses across the European Union following journalistic revelations about government deployment of NSO Group’s Pegasus technology. Now, years later, it turns out that someone was using Pegasus spyware on one of the committee’s own.  In a report published Friday, the University of Toronto’s Citizen…

One of the most common pieces of anti-phishing advice is to double-check the website’s domain name before providing your credentials. Typically, a fraudulent domain stands out to the trained eye, differing from the official URL by at least a few characters. Recently, however, we encountered a campaign where attackers instruct victims to input data directly…