This week I took vacation and celebrated with family as I hope you all did as well. This post will be shorter than usual.

Projects

• TryHackMe – John The Ripper – In Progress

Articles

• Prudential Financial now says 2.5 million impacted by data breach – Prudential Financial, a global financial services company, has revealed that over 2.5 million people had their personal information compromised in a February data breach.
• Australian charged for ‘Evil Twin’ WiFi attack on plane – An Australian man was charged by Australia’s Federal Police (AFP) for allegedly conducting an ‘evil twin’ WiFi attack on various domestic flights and airports in Perth, Melbourne, and Adelaide to steal other people’s email or social media credentials.
• 3 million iOS and macOS apps were exposed to potent supply-chain attacks – Apps that used code libraries hosted on CocoaPods were vulnerable for about 10 years.
• Twilio Confirms Data Breach After Hackers Leak 33M Authy User Phone Numbers – Twilio has confirmed a data breach after hackers leaked 33 million phone numbers associated with the Authy app.

Podcasts

• Smashing Security 378: Julian Assange, inside a DDoS attack, and deepfake traumas

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• TryHackMe – John The Ripper – In Progress

Videos

Articles

• Hacker claims to have 30 million customer records from Australian ticket seller giant TEG – A hacker is advertising customer data allegedly stolen from the Australia-based live events and ticketing company TEG on a well-known hacking forum.
• TikTok confirms it offered US government a ‘kill switch’ – TikTok says it offered the US government the power to shut the platform down in an attempt to address lawmakers’ data protection and national security concerns.
• LockBit lied: Stolen data is from a bank, not US Federal Reserve – Recently-disrupted LockBit ransomware group, in a desperate attempt to make a comeback, claimed this week that it had hit the Federal Reserve, the central bank of the United States.
• Lockbit group falsely claimed the hack of the federal reserve – The LockBit ransomware group seems to have lied when they announced the hack of the US Federal Reserve. The real victim is the Evolve Bank.
• Critical RCE Vulnerability Discovered in Ollama AI Infrastructure Tool – Cybersecurity researchers have detailed a now-patch security flaw affecting the Ollama open-source artificial intelligence (AI) infrastructure platform that could be exploited to achieve remote code execution.
• Four FIN9 hackers indicted for cyberattacks causing $71M in losses – Four Vietnamese nationals linked to the international cybercrime group FIN9 have been indicted for their involvement in a series of computer intrusions that caused over $71 million in losses to companies in the U.S.
• CoinStats says North Korean hackers breached 1,590 crypto wallets – CoinStats suffered a massive security breach that compromised 1,590 cryptocurrency wallets, with the attack suspected to have been carried out by North Korean threat actors.
• Push Notification Fatigue Leads to LA County Health Department Data Breach – The Los Angeles County Department of Health Services discloses a data breach caused by push notification spamming attack.
• Turkey’s biggest crypto exchange BtcTurk hacked – Turkey’s biggest cryptocurrency market BtcTurk said in an announcement on Saturday that their exchange had been hacked, while a popular Bitcoin analyst claimed that the amount of money stolen amounted to nearly 51 million euros.
• CDK Global says software outage will take several days to resolve – Retail software provider CDK Global says it will likely take several days for its software to be back online and operational, as the company grapples with a system outage that has paralyzed nearly 15,000 car dealerships across North America since Wednesday.
• Apple Patches AirPods Bluetooth Vulnerability That Could Allow Eavesdropping – Tracked as CVE-2024-27867, the authentication issue affects AirPods (2nd generation and later), AirPods Pro (all models), AirPods Max, Powerbeats Pro, and Beats Fit Pro.
• WikiLeaks Founder Julian Assange Returns to Australia a Free Man After US Legal Battle Ends – WikiLeaks founder Julian Assange returned to Australia, hours after pleading guilty to obtaining and publishing U.S. military secrets.
• Neiman Marcus Customers Impacted by Snowflake Data Breach – The high-end retailer is the latest company to confirm it was affected by the wide-ranging Snowflake data breach, which impacted more than 165 organizations.
• Diverse Cybersecurity Workforce Act Offers More Than Diversity Benefits – Our adversaries certainly have diversity — so cybersecurity teams need it, too.
• Los Angeles Unified confirms student data stolen in Snowflake account hack – The Los Angeles Unified School District has confirmed a data breach after threat actors stole student and employee data by breaching the company’s Snowflake account.
• Toys “R” Us riles critics with “first-ever” AI-generated commercial using Sora – AI-generated commercials are here, and critics are displeased—but human work is still key.
• Dangerous AI Workaround: ‘Skeleton Key’ Unlocks Malicious Content – Microsoft, OpenAI, Google, and Meta GenAI models could be convinced to ditch their guardrails, opening the door to chatbots giving unfettered answers on building bombs, creating malware, and much more.
• Hundreds of Thousands Impacted in Children’s Hospital Cyberattack – Though the Chicago-area hospital did not pay a ransom, a host of sensitive medical information is now at risk.
• Ticketmaster sends notifications about recent massive data breach – Ticketmaster has started to notify customers who were impacted by a data breach after hackers stole the company’s Snowflake database, containing the data of millions of people.

Podcasts

• The AI Fix – 1: AI doesn’t exist.
• Compromising Positions – 2: Christian Hunt
• Security Now 980 THE MIXED BLESSING OF LOUSY PRNG

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• TryHackMe – John The Ripper – In Progress

Videos

• Verizon Threat Research Advisory Center MIB – June: the Verizon Threat Research Advisory Center – for an exclusive threat intelligence briefing on Insider Threat, featuring a distinguished guest speaker from the CERT Division of the Carnegie Mellon University Software Engineering Institute. This event will provide deep insights into the latest research and effective strategies to mitigate the risks associated with insider threats, utilizing a socio-technical approach to reduce misuse of authorized access to critical assets. Attendees will learn about the latest trends, best practices, and actionable steps to safeguard their organizations from internal threats, ensuring robust defense mechanisms against one of the most significant security challenges today. Don’t miss this opportunity to enhance your cybersecurity posture with expert knowledge from a leading institution in the field.

Articles

• China-Linked Hackers Infiltrate East Asian Firm for 3 Years Using F5 Devices – A suspected China-nexus cyber espionage actor has been attributed as behind a prolonged attack against an unnamed organization located in East Asia for a period of about three years, with the adversary establishing persistence using legacy F5 BIG-IP appliances and using it as an internal command-and-control (C&C) for defense evasion purposes.
• Why Humans Pose a Bigger Corporate Risk than AI: Former Spy Shawnee Delaney Reveals Insider Threat Challenges – The application of artificial intelligence (AI) has extended across various sectors. AI has advanced and improved its capabilities in enhancing corporate security and aiding businesses in scaling operations. It is worth noting that AI can be a force for good. There are AI tools, such as data protection and data integrity tools, that can detect and predict changes in behavior that could indicate malicious insider threats.
• UK’s Total Fitness exposed nearly 500K images of members, staff through unprotected database – Health club chain headed for the spa on choose-a-password day
• Life360 confirms a hacker stole Tile tracker IDs and customer info – A hacker gained access to a Life360 internal tool used for responding to law enforcement requests.
• Security bug allows anyone to spoof Microsoft employee emails – A researcher has found a bug that allows anyone to impersonate Microsoft corporate email accounts, making phishing attempts look credible and more likely to trick their targets.
• Los Angeles United becomes latest US school district to ban smartphones – LAUSD Board of Education members voted yes to enact the ban which is expected to take effect at the beginning of 2025.
• Amtrak confirms crooks are breaking into user accounts, derailing email addresses – Rail company goes full steam ahead with notification letters to Rewards customers about spilled card details and more
• CDK Global investigating cyber incident, briefly shut all systems – Retail technology and software provider CDK Global was investigating a cyber incident and had briefly shut down all its systems proactively, it said on Wednesday.
• Kraken Crypto Exchange Hit by $3 Million Theft Exploiting Zero-Day Flaw – Crypto exchange Kraken revealed that an unnamed security researcher exploited an “extremely critical” zero-day flaw in its platform to steal $3 million in digital assets and refused to return them.
• Massachusetts 911 Outage Caused by Errant Firewall – A statewide outage of the Massachusetts 911 system was the result of a firewall that blocked calls from reaching emergency responders.
• New Government Ban on Kaspersky Would Prevent Company from Updating Malware Signatures in U.S. – The U.S. government has expanded its ban on Kaspersky software in a new move aimed at getting consumers and critical infrastructure to stop using the Russian company’s software products, citing national security concerns.
• T-Mobile denies it was hacked, links leaked data to vendor breach – T-Mobile has denied it was breached or that source code was stolen after a threat actor claimed to be selling stolen data from the telecommunications company.

Podcasts

• Smashing Security – 377: An unhealthy data dump, railway surveillance, and a cheater sues Apple

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• Udemy – Cyber Security SOC Phishing analysis from Scratch-2024 – Complete
• TryHackMe – Common Linux Privesc – Complete

Videos

Papers

ISC2 Annual Report

Articles

• Club Penguin fans breached Disney Confluence server, stole 2.5GB of data – Club Penguin fans hacked a Disney Confluence server to steal information about their favorite game but wound up walking away with 2.5 GB of internal corporate data, BleepingComputer has learned.
• Cleveland City Hall Shuts Down After Cyber Incident – As city officials continue to investigate, it’s unclear which systems were affected and whether it was a ransomware attack.
• RansomHub Brings Scattered Spider Into Its RaaS Nest – The threat group behind breaches at Caesars and MGM moves its business over to a different ransomware-as-a-service operation.
• New York Times source code stolen using exposed GitHub token – Internal source code and data belonging to The New York Times was leaked on the 4chan message board after being stolen from the company’s GitHub repositories in January 2024, The Times confirmed to BleepingComputer.
• Apple’s AI promise: “Your data is never stored or made accessible to Apple” – And publicly reviewable server code means experts can “verify this privacy promise.”
• Security firm Cylance says it has been hacked, data put up for sale online – Stolen Cylance data is being sold for $750,000
• Panera Notifies Employees of Compromised Data – Though the company is informing affected individuals of a breach, it’s keeping the nature and scope of the cybersecurity incident that led to it under wraps.
• Former IT employee gets 2.5 years for wiping 180 virtual servers – A former quality assurance employee of National Computer Systems (NCS) was sentenced to two years and eight months in prison for reportedly deleting 180 virtual servers after being fired.
• Scattered Spider hackers switch focus to cloud apps for data theft – The Scattered Spider gang has started to steal data from software-as-a-service (SaaS) applications and establish persistence through creating new virtual machines.
• Widespread Vishing Effort Impersonates CISA Staff – The cybersecurity agency issued a warning not to agree to any payment requests and to alert law enforcement or CISA after being contacted.
• U.K. Hacker Linked to Notorious Scattered Spider Group Arrested in Spain – Law enforcement authorities have allegedly arrested a key member of the notorious cybercrime group called Scattered Spider.

Podcasts

• Cyberwire – Ep 20 | 10.18.20 – Rosa Smothers: Secure the planet. [Intelligence]

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• TryHackMe – Common Linux Privesc – In Progress
• LinkedIn Learning – Holding Yourself Accountable – Complete
• Udemy – Teradata SQL for Data Science and Data Analytics – Complete
• Udemy – Cyber Security SOC Phishing analysis from Scratch-2024 – Complete

Videos

• SANS Cybersecurity Leadership Summit You tube Playlist: https://www.youtube.com/playlist?list=PLtgaAEEmVe6Bnuq43jxYufUue0R7jPhFk

White Papers

• Common Sense Guide to Mitigating Insider Threats

Articles

• Live Nation took 11 days to confirm the massive Ticketmaster data breach – Data allegedly belonging to 560 million Ticketmaster customers has been on sale all week, but the company stayed silent until Friday night.
• The NSA advises you to turn your phone off and back on once a week – Powering off your phone regularly, disabling Bluetooth when it’s not needed, and using only trusted accessories are just some of the NSA’s security recommendations.
• Police dismantle pirated TV streaming network that made $5.7 million – Spanish police have dismantled a network of illegal media content distribution that, since the start of its operations in 2015, has made over $5,700,000.
• Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions – Now-patched authorization bypass issues impacting Cox modems could have been abused as a starting point to gain unauthorized access to the devices and run malicious commands.
• ShinyHunters claims Santander breach, selling data for 30M customers – A threat actor known as ShinyHunters is claiming to be selling a massive trove of Santander Bank data, including information for 30 million customers, employees, and bank account data, two weeks after the bank reported a data breach.
• BBC Data Breach Impacts 25,000 Employees – The BBC has disclosed a data breach impacting over 25,000 current and former employees, but the incident did not involve ransomware.
• Massive 911 S5 Botnet Dismantled, Chinese Mastermind Arrested – The US announced that the 911 S5 (Cloud Router) botnet, likely the world’s largest, has been dismantled and its administrator arrested.
• Cox fixed an API auth bypass exposing millions of modems to attacks – Cox Communications has fixed an authorization bypass vulnerability that enabled remote attackers to abuse exposed backend APIs to reset millions of Cox-supplied modems’ settings and steal customers’ sensitive personal information.
• Major cyberattack sees NHS London hospitals declare critical incident with operations cancelled – Procedures have been cancelled at Guy’s, St Thomas’ and King’s College hospitals after a ransomware attack
• Leaked Google database reveals its secret privacy and security failures – The company confirmed to Engadget the authenticity of the data, acquired by 404 Media.
• Crooks threaten to leak 3B personal records ‘stolen from background check firm’ – Turns out opting out actually works?
• Celebrity TikTok Accounts Compromised Using Zero-Click Attack via DMs – Popular video-sharing platform TikTok has acknowledged a security issue that has been exploited by threat actors to take control of high-profile accounts on the platform.
• FBI warns of fake remote work ads used for cryptocurrency fraud – Today, the FBI issued a warning about scammers using fake remote job ads to steal cryptocurrency from job seekers across the United States while posing as recruiters for legitimate companies.
• Ransomware Group Claims Cyberattack on Frontier Communications – The RansomHub ransomware group claims to have stolen the information of over 2 million Frontier Communications customers.

Podcasts

• Smashing Security 374: Microsoft’s Recall controversy, and the North Korean insider threat

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• TryHackMe – Common Linux Privesc – In Progress
• Udemy – Splunk for Beginners

Videos

Articles

• Almost all citizens of city of Eindhoven have their personal data exposed – A data breach involving the Dutch city of Eindhoven left the personal information related to almost all of its citizens exposed.
• Merrill employee exposes Walmart pension plan members – An employee of Merrill, a division of Bank of America, made an email error that exposed nearly two thousand Walmart 401(k) Plan participants, revealing their personal data.
• 2.8 Million Impacted by Data Breach at Prescription Services Firm Sav-Rx – Pharmacy prescription services provider Sav-Rx says the personal information of 2.8 million was stolen in a cyberattack.
• Internet Archive and the Wayback Machine under DDoS cyber-attack – The Internet Archive, the nonprofit research library that’s home to millions of historical documents, preserved websites, and media content, is currently in its third day of warding off an intermittent DDoS (distributed denial-of-service) cyber-attack.
• BreachForums returns just weeks after FBI-led takedown – Website whack-a-mole getting worse
• ‘Largest Botnet Ever’ Tied to Billions in Stolen Covid-19 Relief Funds – The US says a Chinese national operated the “911 S5” botnet, which included computers worldwide and was used to file hundreds of thousands of fraudulent Covid claims and distribute CSAM, among other crimes.
• Google confirms the leaked Search documents are real – A collection of 2,500 leaked internal documents from Google filled with details about data the company collects is authentic, the company confirmed today. Until now, Google had refused to comment on the materials.
• AI Will Increase the Quantity — and Quality — of Phishing Scams – Gen AI tools are rapidly making these emails more advanced, harder to spot, and significantly more dangerous. Recent research showed that 60% of participants fell victim to artificial intelligence (AI)-automated phishing, which is comparable to the success rates of non-AI-phishing messages created by human experts. Companies need to: 1) understand the asymmetrical capabilities of AI-enhanced phishing, 2) determine the company or division’s phishing threat severity level, and 3) confirm their current phishing awareness routines.
• Mystery malware destroys 600,000 routers from a single ISP during 72-hour span – An unknown threat actor with equally unknown motives forces ISP to replace routers.
• Santander hit by massive cyberattack: All staff and ’30million’ customers have personal data stolen by gang ‘behind Ticketmaster hack’ – Hackers are attempting to sell personal data of all Santander staff and up to 30 million customers in the latest reported theft by cybercrime gangs.

Podcasts

• Smashing Security – 373: iPhone undeleted photos, and stealing Scarlett Johansson’s voice
• Federal Drive – How AI will exacerbate fraud against the government

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• TryHackMe – Common Linux Privesc – In Progress
• Udemy – Splunk for Beginners

Papers

Rapid 7 – 2024 Attack Intelligence Report

Videos

• Bull is available on Amazon Prime Video
• Lie to Me is available on Hulu

Articles

• Cyber Criminals Exploit GitHub and FileZilla to Deliver Malware Cocktail – A “multi-faceted campaign” has been observed abusing legitimate services like GitHub and FileZilla to deliver an array of stealer malware and banking trojans such as Atomic (aka AMOS), Vidar, Lumma (aka LummaC2), and Octo by impersonating credible software like 1Password, Bartender 5, and Pixelmator Pro.
• “Unprecedented” Google Cloud event wipes out customer account and its backups – UniSuper, a $135 billion pension account, details its cloud compute nightmare.
• Chinese hackers hide on military and govt networks for 6 years – A previously unknown threat actor dubbed “Unfading Sea Haze” has been targeting military and government entities in the South China Sea region since 2018, remaining undetected all this time.
• Northern Ireland police faces £750k fine after exposing staff info – The United Kingdom’s Information Commissioner Office (ICO) intends to impose a fine of £750,000 ($954,000) on the Police Service of Northern Ireland (PSNI) for exposing the entire workforce’s personal details by mistakenly publishing a spreadsheet online.
• A Leak of Biometric Police Data Is a Sign of Things to Come – Thousands of fingerprints and facial images linked to police in India have been exposed online. Researchers say it’s a warning of what will happen as the collection of biometric data increases.
• Fake Antivirus Websites Deliver Malware to Android and Windows Devices – Threat actors have been observed making use of fake websites masquerading as legitimate antivirus solutions from Avast, Bitdefender, and Malwarebytes to propagate malware capable of stealing sensitive information from Android and Windows devices.
• Courtroom Recording Platform JAVS Hijacked in Supply Chain Attack – With more than 10,000 installations across prisons, courts, and governments, impacted Justice AV Solutions users are urged to re-image affected endpoints and reset credentials.
• MIT Brothers Charged With Exploiting Ethereum to Steal $25 Million – The two MIT graduates discovered a flaw in a common trading tool for the Ethereum blockchain. Does it presage problems ahead for cryptocurrency?
• A root-server at the Internet’s core lost touch with its peers. We still don’t know why. – For 4 days, the c-root server maintained by Cogent lost touch with its 12 peers.

Podcasts

• Smashing Security 372: The fake deepfake, and Estate insecurity
• CyberWire Ep 2073 | 5.22.24 – Privacy nightmare or useful tool?

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• TryHackMe – Common Linux Privesc – In Progress
• Udemy – Splunk for Beginners

Videos

Top 5 Most Dangerous Cyber Threats in 2024 – SANS Institute experts weigh in on the top threat vectors faced by enterprises and the public at large.

Articles

• FBCS Collection Agency Data Breach Impacts 2.7 Million – Financial Business and Consumer Solutions (FBCS) says the personal information of 2.7 million was impacted in the recent data breach.
• Europol confirms web portal breach, says no operational data stolen – Europol, the European Union’s law enforcement agency, confirmed that its Europol Platform for Experts (EPE) portal was breached and is now investigating the incident after a threat actor claimed they stole For Official Use Only (FOUO) documents containing classified data.
• ‘Got that boomer!’: How cyber-criminals steal one-time passcodes for SIM swap attacks and raiding bank accounts
• Christie’s £670m art auctions hit by cyber attack – Auction house Christie’s attempts to sell art and other high-value items worth an estimated $840m (£670m) are being hampered by a cyber attack.
• Researchers Uncover 11 Security Flaws in GE HealthCare Ultrasound Machines – Security researchers have disclosed almost a dozen security flaws impacting the GE HealthCare Vivid Ultrasound product family that could be exploited by malicious actors to tamper with patient data and even install ransomware under certain circumstances.
• Personal Information Stolen in City of Wichita Ransomware Attack – The City of Wichita says files containing personal information were exfiltrated in a recent ransomware attack.
• BreachForums Shut Down in Apparent Law Enforcement Operation – The hacking forum BreachForums is displaying a notice claiming that the website is under the control of the FBI.
• Nissan North America data breach impacts over 53,000 employees – Nissan North America (Nissan) suffered a data breach last year when a threat actor targeted the company’s external VPN and shut down systems to receive a ransom.
• Brothers arrested for $25 million theft in Ethereum blockchain attack – The U.S. Department of Justice has indicted two brothers for allegedly manipulating the Ethereum blockchain and stealing $25 million worth of cryptocurrency within approximately 12 seconds in a “first-of-its-kind” scheme.
• D-Link Routers Vulnerable to Takeover Via Exploit for Zero-Day – A vulnerability in the HNAP login request protocol that affects a family of devices gives unauthenticated users root access for command execution.
• Unwanted Tracking Alerts Rolling Out to iOS, Android – Apple and Google have rolled out a new mobile feature that warns users of unwanted trackers moving with them.
• VMware makes Workstation Pro and Fusion Pro free for personal use – VMWare has made Workstation Pro and Fusion Pro free for personal use, allowing home users and students to set up their own virtualized test labs and play with another operating system at little to no cost.
• There Is No Cyber Labor Shortage – There are plenty of valuable candidates on the market. Hiring managers are simply looking in the wrong places.
• Hacker Conversations: Ron Reiter, and the Making of a Professional Hacker – Ron Reiter was a childhood hacker in Israel. He was recruited into the IDF’s elite Unit 8200 for his military service. Now he is CTO and co-founder of cybersecurity firm Sentra.
• MITRE EMB3D Threat Model Officially Released – MITRE announced the public availability of the EMB3D threat model for embedded devices used in critical infrastructure.
• 900k Impacted by Data Breach at Mississippi Healthcare Provider – Singing River Health System says the personal information of roughly 900,000 individuals was stolen in an August 2023 ransomware attack.

Podcasts

• Smashing Security 371: Unmasking LockBitsupp, company extortion, and a Tinder fraudster

Every week I publish interesting articles and ways to improve your understanding of cybersecurity.

Projects

• TryHackMe – Common Linux Privesc – In Progress

Videos

• SANS Institute published a playlist with 15 videos from their New2Cyber conference.

Articles

• Dropbox says hackers stole customer data, auth secrets from eSignature service – Cloud storage firm Dropbox says hackers breached production systems for its Dropbox Sign eSignature platform and gained access to authentication tokens, MFA keys, hashed passwords, and customer information.
• A million Australian pubgoers wake up to find personal info listed on leak site – Man arrested and blackmail charges expected after allegations of unpaid contractors and iffy infosec
• Novel attack against virtually all VPN apps neuters their entire purpose – TunnelVision vulnerability has existed since 2002 and may already be known to attackers.
• One year on, universities org admits MOVEit attack hit data of 800K people – Nearly 95M people in total snagged by flaw in file transfer tool
• Dell warns of data breach, 49 million customers allegedly affected – Dell is warning customers of a data breach after a threat actor claimed to have stolen information for approximately 49 million customers.
• Ohio Lottery ransomware attack impacts over 538,000 individuals – The Ohio Lottery is sending data breach notification letters to over 538,000 individuals affected by a cyberattack that hit the organization’s systems on Christmas Eve.
• Dark Reading ‘Drops’ Its First Podcast – Dark Reading Confidential, has officially launched. You don’t want to miss our first episode with the CISO and chief legal officer from Reddit and a cybersecurity attorney, who share their thoughts and advice for CISOs on the new SEC breach disclosure rules.
• UK confirms Ministry of Defence payroll data exposed in data breach – The UK Government confirmed today that a threat actor recently breached the country’s Ministry of Defence and gained access to part of the Armed Forces payment network.
• BetterHelp to pay $7.8 million to 800,000 in health data sharing settlement – BetterHelp has agreed to pay $7.8 million in a settlement agreement with the U.S. Federal Trade Commission (FTC) over allegations of misusing and sharing consumer health data for advertising purposes.

Podcasts

• Smashing Security 370: The closed loop conundrum, default passwords, and Baby Reindeer