Latest Cybersecurity News and Articles

---

Canadian Discount Retailer Giant Tiger Says Customer Data Was Compromised in Third-Party Breach

The retailer first learned of the security incident on March 4, and concluded that customer information was involved by March 15, the company wrote in an email to customers.

---

US Indicts Accused APT31 Chinese Hackers for Hire

U.S. federal prosecutors indicted seven Chinese nationals they accuse of hacking for a Beijing economic and intelligence espionage group whose operations reacted to geopolitical trends.

---

New Zealand Government Discloses Cyberattacks by China-Linked APT40 on Two Parliamentary Agencies

New Zealand's admission it's been on the receiving end came a day after the UK and United States detailed Chinese-supported attacks on government institutions – including the UK's Electoral Register.

---

New Tycoon 2FA Phishing Kit Raises Cybersecurity Concerns

An analysis by Sekoia revealed that the kit has emerged as one of the most prevalent AiTM phishing kits, with over 1,100 domain names detected between October 2023 and February 2024.

---

New ZenHammer Memory Attack Impacts AMD CPUs Based on Zen Architecture

Academic researchers developed ZenHammer, the first variant of the Rowhammer DRAM attack that works on CPUs based on a recent AMD Zen microarchitecture that maps physical addresses on DDR4 and DDR5 memory chips.

---

Hospitals Lobby Feds to Clarify Breach Duties in UHG Attack

The AHA is asking the Department of Health and Human Services' Office for Civil Rights for a "unified notification process" if a breach occurred in the February 21 cyberattack on UnitedHealth Group's Change Healthcare unit.

---

UK Privacy Watchdog Updates Guidance on Data Protection Fines

After suffering a data breach, organizations in the United Kingdom that work closely and transparently with regulators and cybersecurity officials will be treated with greater leniency if their case results in penalties and a fine.

---

U.S. Charges 7 Chinese Nationals in Major 14-Year Cyber Espionage Operation

The U.S. Department of Justice (DoJ) on Monday unsealed indictments against seven Chinese nationals for their involvement in a hacking group that targeted U.S. and foreign critics, journalists, businesses, and political officials for about 14 years. The defendants include Ni Gaobin (倪高彬), Weng Ming (翁明), Cheng Feng (程锋), Peng Yaowen (彭耀文), Sun Xiaohui (孙小辉), Xiong Wang (熊旺), and Zhao Guangzong (

---

Senator Demands Answers From HHS About $7.5 Million Cyber Theft in 2023

HHS has not issued a public statement about the incident, and its Office of the Inspector General declined to confirm or deny an investigation was underway when pressed about it in January.

---

Cybercriminals can leverage March Madness as bait for attacks

March Madness, like any other major public event, may provide a platform for malicious actors to work. 

---

Crafting Shields: Defending Minecraft Servers Against DDoS Attacks

Minecraft, with over 500 million registered users and 166 million monthly players, faces significant risks from distributed denial-of-service (DDoS) attacks, threatening server functionality, player experience, and the game’s reputation. Despite the prevalence of DDoS attacks on the game, the majority of incidents go unreported, leaving a gap in awareness and protection. This article explains

---

Scams are Becoming More Convincing and Costly

Scams directly targeting consumers continue to increase in both complexity and volume, according to Visa. Consumers are increasingly targeted by scammers, who rely on heightened emotions to create fraud opportunities.

---

St. Cloud Most Recent in String of Florida Cities Hit with Ransomware Attacks

The city of St. Cloud said Monday it discovered a ransomware attack affecting city services and warned that while “many” city departments are affected they are “operating as best as possible until the issue is resolved.”

---

95% of Companies Face API Security Problems

The ubiquity of APIs means they have become one of cybercriminals’ favourite gateways for account takeover attacks. In a recent survey by Fastly, 84% of respondents admitted to not having advanced API security in place.

---

CISA Urges Software Devs to Weed out SQL Injection Vulnerabilities

Parameterized queries are a better option for a secure-by-design approach compared to input sanitization techniques because the latter can be bypassed and are difficult to enforce at scale.

---

Report Urges Congress to Form an Armed Cyber Military Branch

The U.S. military requires a seventh branch to serve as an independent cyber armed service amid growing threats in cyberspace, according to a leading national security think tank.

---

CISA Adds Three Known Exploited Vulnerabilities to its Catalog

This includes CVE-2023-48788 in Fortinet FortiClient EMS, CVE-2021-44529 in Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA), and CVE-2019-7256 in Nice Linear eMerge E3-Series.

---

Update: Vans Says Cybercriminals Didn’t Nab Customers’ Financial Information

In an email to customers, VF Corporation promised that cybercriminals didn't swipe their credit card or bank account details. And, it added, there's "no evidence" suggesting any stolen personal information has been used for nefarious purposes.

---

GitLab Acquires Oxeye to Bolster SAST in DevSecOps Workflow

GitLab has bought a static application security testing startup led by an Imperva and Check Point veteran to improve application-layer risk detection and reduce false positives.

---

Shadow AI is the Latest Cybersecurity Threat You Need to Prepare For

Shadow IT – the use of software, hardware, systems, and services that haven’t been approved by an organization’s IT/IT Sec departments – has been a problem for the last couple of decades, and a difficult area for IT leaders to manage effectively.