190M impacted by Change Healthcare breach, security leaders discuss

A recent update from Change Healthcare estimates that around 190 million individuals were impacted by the cyberattack occurring in 2024. This number nearly doubles the previous estimate and may include data such as: 

  • First and last name 
  • Address
  • Email address 
  • phone number 
  • Health insurance information
  • Medical information 
  • Billing and claims information

Below, security leaders discuss the implications of this update. 

Security leaders weigh in 

Mr. Piyush Pandey, CEO at Pathlock:

As this incident demonstrates, data breaches involving sensitive data, such as patients’ health insurance information, medical records, billing and payment information, as well as sensitive personal information, can have far-reaching implications. Currently, HIPAA does not strictly require healthcare organizations to enforce multi-factor authentication (MFA), however, the Change Healthcare ransomware attack clearly demonstrates how not having MFA greatly increases risk and can lead to disastrous consequences. Lawmakers should introduce more stringent compliance requirements in this area, and not only require MFA, but also mandate that organizations invest in processes for proactive visibility into who has access to what and implement continuous access controls monitoring so they can prevent such attacks from spreading across their entire organization.

Darren Guccione, CEO and Co-Founder at Keeper Security:

The revelation that 190 million Americans were affected by the Change Healthcare ransomware attack is a stark reminder of the magnitude of modern cyber threats. This update also underscores the complex and prolonged nature of investigating incidents like these. The sheer volume of sensitive personal and healthcare data stolen highlights the critical need for more robust cybersecurity measures across the healthcare sector. 

Determining the true impact of an attack of this scale often takes months or even years as organizations must uncover the full extent of data exposure, verify the accuracy of the breach reports and navigate evolving regulatory requirements. Threat actors complicate this, using sophisticated tactics to prolong detection and response times.

This incident reinforces the importance of adopting proactive cybersecurity measures. Prioritizing robust encryption, a zero-trust architecture and employee training can minimize exposure to risks. A privileged access management solution is critical to protect access to an organization’s most sensitive assets. This breach also serves as a wake-up call for individuals to protect their data by vigilantly monitoring for suspicious activity and enabling strong account protections. The scale of this breach demands a systemic overhaul of how healthcare organizations manage and secure the sensitive information they hold.

https://www.securitymagazine.com/articles/101340-190m-impacted-by-change-healthcare-breach-security-leaders-discuss



Privacy dei dati: la maggior parte degli utenti teme una violazione

Gen 30, 2025 Approfondimenti, Gestione dati, In evidenza, News, Privacy, Privacy, RSS 0

Quando si parla di dati e di privacy, gli utenti si dicono particolarmente preoccupati per le violazioni: secondo l’indagine “Privacy dei dati nel 2025: un sondaggio per conoscere l’opinione degli utenti sulla Cyber Protection” di Acronis, il 64% degli intervistati ha segnalato i data breach come principale fonte di preoccupazione per la riservatezza delle informazioni.

Il timore è tutt’altro che infondato: il report evidenzia infatti che, nonostante il livello di consapevolezza sia aumentato negli ultimi anni, il 25% degli utenti ha subito un furto o una perdita di dati, mentre il 12% non è in grado di affermare se ha subito o meno una violazione.

privacy dati

L’educazione digitale è in aumento: il 44% degli intervistati si avvale di video informativi sulla cybersecurity per apprendere le best practice di sicurezza. Nonostante ciò, c’è un divario significativo tra consapevolezza e azione: se oltre il 60% degli intervistati ritiene la sicurezza dei dati “molto importante”, solo il 40% modifica regolarmente le password e quasi il 70% usa reti Wi-Fi pubbliche anche per attività delicate.

Gli utenti sono invece abbastanza preparati dal punto di vista del backup: il 66% degli intervistati esegue regolarmente il backup, mentre solo il 9% non esegue questa operazione.

Dal punto di vista della sicurezza dell’autenticazione, il 68% degli intervistati afferma di usare password robuste e univoche, ma meno della metà (46%) sfrutta l’autenticazione a due fattori per proteggersi dalle violazioni. Non tutti gli utenti, inoltre, hanno riconosciuto l’importanza dei sistemi di sicurezza per i dispositivi mobili: il 35% degli intervistati non ha familiarità con questi strumenti.

È da notare che quasi il 30% degli utenti trova difficile usare strumenti di sicurezza, mentre il 25% sostiene che il principale ostacolo alla loro adozione sia il costo elevato.

Nonostante i consumatori percepiscano chiaramente i rischi digitali a cui sono esposti e le aree d’azione, manca l’effettiva applicazione delle best practice di base, come i backup regolari, l’uso dell’autenticazione a due fattori e l’uso di app di sicurezza.

“Il sondaggio di Acronis dedicato agli utenti evidenzia un paradosso critico dell’odierna sicurezza informatica: le persone sono sempre più consapevoli dei rischi, ma molte non hanno gli strumenti o le conoscenze necessarie per proteggersi in modo efficace” ha affermato Gerald Beuchelt, CISO di Acronis. “A livello globale, le violazioni dei dati rappresentano una delle maggiori preoccupazioni, rendendo fondamentale la disponibilità di soluzioni di cybersecurity più semplici e accessibili, abbinate al backup dei dati, e di attività educational più efficaci che aiutino le persone a proteggere la propria vita digitale. Tutto ciò può contribuire a colmare il divario tra consapevolezza e azione“.

Condividi l’articolo

Articoli correlati

Altro in questa categoria

https://www.securityinfo.it/2025/01/30/privacy-dei-dati-la-maggior-parte-degli-utenti-teme-una-violazione/?utm_source=rss&utm_medium=rss&utm_campaign=privacy-dei-dati-la-maggior-parte-degli-utenti-teme-una-violazione



Vulnerability management simplified: The core essentials

In light of today’s evolving threat landscape and high-profile cybersecurity breaches, organizations are facing growing pressure to strengthen their security foundations. These incidents highlight the urgent need for proactive strategies to address vulnerabilities in applications, infrastructure and data. CISOs and security teams can take action now to prepare for potential threats, focusing on a few essential priorities. 

Strengthening foundational security measures to reduce exposure and improve resilience

It all starts with assets. What are you protecting? Asset management is one of the most fundamental and critical enterprise requirements of a strong vulnerability management program. How can you protect what you don’t know about? Most organizations I have worked with over my career struggle to define or understand their asset inventory with any level of confidence. As a result, this leads to unknown or end of life applications and infrastructure on the network exposing vulnerabilities leaving the virtual doors and windows to your organization open for a potential malicious insider or adversary to take advantage of.

While I’m not suggesting the security team should own and maintain the enterprise asset management program, they certainly are a key stakeholder and should be consulted to provide key requirements. For example, a strong asset management program should at a minimum, include key attributes such as location, internal/external facing, versions, owner, and associated risk level which feeds into assigning criticality of that asset. These key asset attributes along with a criticality label allow the organization to not only prioritize and appropriately define controls but also help save remediation time and money in those critical moments during a breach or critical vulnerability event. Know your assets!

Preparing for inevitable breaches with strong recovery plans and scenario planning

In the digital world we now live in, it is not a matter of if, but rather when an organization will have to respond to a breach. The more you are prepared and demonstrate your ability to quickly respond and recover, it will go a long way with maintaining the trust of your customer base as well as external regulatory bodies. Organizations should look no further than our military institutions for guidance and model behavior of how to be prepared for any event. Rest assured, they are not sitting around waiting for an attack and figuring it out on the fly. Just as they understand their adversaries and how they behave, they regularly run through exercises to practice responding to every potential scenario.

At a minimum, organizations should be regularly conducting table top exercises based on relevant and timely threats and events. As an example, given the very rampant and routine occurrences of ransomware attacks, organizations should routinely be walking through their incident response playbooks of how to respond. Do we pay or not pay threat actors? Do we have reliable recovery plans and data backup? How quickly can we recover? These are just a few of the questions that you should be looking to have answers to prior to a real-world incident. It is critical to adhere to the playbook and procedures as they are written throughout the tabletop exercise to ensure they are accurate and effective. As a result of the exercise, any noted deficiencies during the exercise should be addressed and the playbooks and procedures need to be updated. As the organization incident response capabilities mature, the scenarios and exercises should increase in size and complexity. You will only get out what you put into these. Exercise. Exercise. Exercise.

Clarifying roles and responsibilities during incidents to ensure seamless coordination

The dreaded incident call comes in on a Friday evening at 6 p.m. the night before a holiday weekend. For those who have worked in the incident response space, this is the way it always happens. It’s now time to put all that time and effort that have gone into developing playbooks and running through exercises into real world action. Just as important as the technical procedures to contain and eradicate the situation, are the clearly defined roles and responsibilities to ensure seamless coordination. Make no mistake, there will always be some level of chaos no matter how prepared you are. However, strong coordination and communication during an incident will keep the chaos to a minimum and allow the team to stay focused on controlling and eradicating the incident.  

It is noteworthy that strong incident response plans define roles and responsibilities well outside of the technology areas. For example, internal and external legal counsel, public relations and local, state and federal law enforcement and possibly your regulators. In an ideal situation, standing up the incident command center and executing the communication plan should be second nature and go a long way to managing the chaos and avoid creating incidents within the incident. Know your role!

Aligning risk tolerance across the organization to enable faster, more effective responses

We now know our assets. We have well written incident response plans that include clearly defined roles and responsibilities. How do we now prioritize our response and recovery activities in the heat of the moment? This is where an organization’s defined risk tolerance combined with well documented asset management including criticality ratings pays off. Not all assets are created equal. The systems used to publish and display the menu of the day in the cafeteria is obviously not as critical as the systems and infrastructure that run our core customer facing portal and applications. Sound risk management and asset management practices are also pivotal to an effective vulnerability management program. It allows the vulnerability management teams to monitor, report and prioritize remediation activities using a risk-based lens.  

While important to focus on maintaining our critical assets, in the mindset of a threat actor, a vulnerability is a vulnerability. The low hanging fruit for an adversary are those end-of-life applications and devices that cannot be patched and remain connected to our network. These applications and devices expose critical vulnerabilities allowing easy access to an adversary to exploit and move laterally across our networks and applications. This is a reminder that we can focus on our most critical assets, but bad asset and vulnerability management hygiene can undermine the best laid plans and programs. Going back to managing the chaos during an incident, knowing our critical assets and infrastructure will also allow the incident response teams to prioritize and focus on critical systems first. This can potentially be a life saver and minimize critical data loss and customer impact. Risk management can be complicated. However, complexity kills. Do your best to keep it simple!

Mike monday headshot

Mike Monday is Managing Director of Protiviti’s Security & Privacy Practice. Image courtesy of Monday

https://www.securitymagazine.com/blogs/14-security-blog/post/101339-vulnerability-management-simplified-the-core-essentials



Simplify your security toolkit


h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:5px;margin-top:16px;margin-bottom:16px}
.w3-card{box-shadow:0 2px 5px 0 rgba(0,0,0,0.16),0 2px 10px 0 rgba(0,0,0,0.12)}

As threats continue to emerge and develop, organizations find themselves spending more and more to protect themselves. This often leads to tool sprawl as organizations add on protections without considering how they’ll work together. How do security leaders manage tool sprawl? What threats do security leaders need to worry about?

Answer these questions and more with Corey Nachreiner, Chief Information Security Officer at WatchGuard.

The Security Podcasts logo

Simplify your security toolkit

What threats do security leaders need to worry about? Answer this question and more with Corey Nachreiner, CISO at WatchGuard.

Listen to more from The Security Podcasts.

Or check it out on our Apple Podcasts or Spotify channels. Don’t forget to like, follow, and rate and review our podcasts! 

https://www.securitymagazine.com/articles/101335-simplify-your-security-toolkit



DeepSeek: What to know about the Chinese artificial intelligence model

A Chinese startup, DeepSeek, has announced its latest AI model. Below, cyber experts discuss the implications of DeepSeek’s emergence and capabilities. 

What is DeepSeek? 

DeepSeek is an open-source large language model (LLM). DeepSeek’s AI Assistant (also called R1) claims to operate at a lower cost than United States models, such as OpenAI. Furthermore, the application reached the top-rated free application on the Apple App Store in the United States, surpassing ChatGPT.

Technology stocks dropped as a result. Many U.S. tech companies faced financial losses, including AI company Nvidia, whose loss amounted to $593 billion. This marks a single-day record loss for any company on Wall Street. 

Steve Povolny, Senior Director of Security Research & Competitive Intelligence at Exabeam, shares, “The release of Chinese-developed DeepSeek has thrown U.S. tech markets into turmoil; this is both justifiable and also perhaps, a bit overblown. The emergence of a technology that ultimately optimizes chip usage and efficiency is likely to apply pressure on existing large chip vendors, which is a very good thing. As the adage goes, ‘Pressure yields diamonds.’ In this case, I believe competition in this market will drive global optimization, lower costs, and sustain the tailwinds AI needs to drive profitable solutions in the short and longer term.”

Why is the security industry talking about DeepSeek? 

Gal Ringel, Co-Founder and CEO at Mine, explains, “The emergence of Chinese alternatives to ChatGPT, Deepseek, poses a critical security challenge for U.S. businesses that extends beyond previous concerns about consumer data privacy; it expands to the potential exposure of proprietary business information, trade secrets, and strategic corporate information. Just as TikTok raised red flags about personal data exposure, DeepSeek’s AI tools apply the same rules of risk to sensitive corporate information. Organizations must now urgently audit and track their AI assets to prevent potential data exposure to China. This isn’t just about knowing what AI tools are being used; it’s about understanding where company data flows and ensuring robust safeguards are in place so it doesn’t inadvertently end up in the wrong hands. The parallels to TikTok are striking, but the stakes may be even higher when considering the potential exposure of business data ending up in adversarial hands.”

Cyberattacks against DeepSeek: What are the implications? 

As DeepSeek has risen in prominence and popularity, it has also experienced cyberattacks that caused it to limit registrations. 

Toby Lewis, Global Head of Threat Analysis at Darktrace:

The reported cyber-attack on DeepSeek likely falls into one of several scenarios, with the most probable being simply a victim of their own success — what we in tech circles call the ‘Slashdot effect,’ where their infrastructure buckled under unexpected user demand following their viral moment on the App Store.

However, we shouldn’t dismiss security concerns. Given the rapid deployment of their platform, there’s a real possibility that opportunistic cybercriminals identified and exploited potential vulnerabilities that more established platforms have had time to address. 

This incident serves as another reminder that security cannot be an afterthought — it must be woven into the very foundations of these systems from the outset. As AI platforms continue to scale rapidly and handle increasingly sensitive data, robust security frameworks aren’t just nice to have features, they’re essential.

Stephen Kowski, Field CTO at SlashNext Email Security+:

The surge in DeepSeek’s popularity, particularly overtaking ChatGPT on Apple’s App Store, naturally attracts diverse threat actors ranging from hacktivists to sophisticated state-sponsored groups seeking to exploit or disrupt this emerging AI platform. While DDoS attacks are an obvious concern, the more insidious threats likely involve probing URL Parameters, API endpoints, and input validation mechanisms to manipulate or compromise the AI model’s responses potentially. The motivations span from competitive intelligence gathering to potentially using the infrastructure as a launchpad for broader attacks, especially given the open-source nature of the technology. The high-profile success and advanced AI capabilities make DeepSeek an attractive target for opportunistic attackers and those seeking to understand or exploit AI system vulnerabilities.

Eric Schwake, Director of Cybersecurity Strategy at Salt Security:

The swift ascent of DeepSeek and its R1 AI model has stirred significant excitement in the tech sector, underscoring the potential for major upheavals within the AI environment. Although the company’s assertions regarding cost-effectiveness are notable, the abrupt surge in popularity alongside subsequent outages raises questions about the trustworthiness and security of their AI model.

From an API security standpoint, these outages and cyberattacks emphasize the crucial need to safeguard AI-enabled applications and services. DeepSeek’s API presumably served a vital function in delivering its AI assistant, and the outages hint at possible vulnerabilities within the API that attackers may have exploited.

Enterprises contemplating integrating AI models, particularly from fledgling startups, must prioritize API security. This involves performing comprehensive security evaluations, establishing robust authentication and authorization protocols, and maintaining ongoing vigilance for possible vulnerabilities.

The swift embrace of AI models also brings up issues surrounding data privacy and intellectual property. Organizations should meticulously examine the terms of service for AI solutions, ensuring the protection and appropriate use of their data.

What is next? 

Dan Schiappa, Chief Product and Services Officer, Arctic Wolf:

People are already concerned around how much data social media firms have access to, most recently shown by rulings on TikTok, just imagine what the risks could be with Chinese Foundational models being trained on all your data. Considering DeepSeek is already limiting its registrations due to a cyber attack, you have to wonder whether they have the appropriate security and policies in place to maintain your privacy. Likewise, China could continue their trend of IP theft and replicating U.S. and European technologies. 

There is no doubt this will start an AI arms race. President Trump already highlighted the $500 billion investment coming to America with a partnership of Softbank, Oracle and OpenAI, and many others will jump on board. In short, this will force an innovation boom. However, the Sputnik description is a perfect analogy. While Russia was first to space, the West dominated after that, and through the nuclear arms race with Russia and the Strategic Defense Initiative under Reagan, the Soviet Union was bankrupted. While China will be near impossible to bankrupt, the West can collectively out-innovate them and hope that companies who wish to maintain their security will be hesitant to use an AI Chatbot from China — which will no doubt steal their data and be vulnerable to an attack as we are already seeing.

Andrew Bolster, Senior R&D Manager at Black Duck:

The release of DeepSeek undeniably showcases the immense potential of open-source AI. By making such a powerful model available under an MIT license, it not only democratizes access to cutting-edge technology but also fosters innovation and collaboration across the global AI community.

However, DeepSeek’s rumored use of OpenAI Chain of Thought data for its initial training highlights the importance of transparency and shared resources in advancing AI. In the context of ‘Open Source AI,’ it’s crucial that the underlying training and evaluation data are open, as well as the initial architecture and the resultant model weights. 

DeepSeek’s achievement in AI efficiency (leveraging a clever Reinforcement Learning-based multi-stage training approach, rather than the current trend of using larger datasets for bigger models), signals a future where AI is accessible beyond the billionaire-classes. Open-source AI, with its transparency and collective development, often outpaces closed source alternatives in terms of adaptability and trust. As more organizations recognize these benefits, we could indeed see a significant shift towards open-source AI, driving a new era of technological advancement.

https://www.securitymagazine.com/articles/101337-deepseek-what-to-know-about-the-chinese-artificial-intelligence-model



Security research discovers vulnerabilities in popular travel service

Research from Salt Labs reveals a vulnerability in a popular online travel service, specializing in hotel and car rentals while integrating with airline services. 

The flaw discovered is an account takeover vulnerability, which could allow a malicious actor to gain unauthorized access to an account and impersonate the user. From there, a malicious actor could perform a variety of actions, including: 

  • Cancelling booking information 
  • Editing booking information 
  • Booking rentals with the users airline loyalty points 

This vulnerability can be leveraged via a malicious link evading the travel services security measures. This link may be distributed through text messages, emails or a website controlled by the threat actor. Upon a user clicking the link and authenticating into the online service, the malicious actor gains full access to their account. 

Mr. Akhil Mittal, Senior Manager at Black Duck, comments, “This vulnerability shows a growing and recurring issue in API security — convenience often takes priority over security. Travel platforms are built to provide seamless user experiences, but that ease of use can create blind spots. Here, attackers didn’t use sophisticated techniques; they exploited weak validation processes and a failure to manage trust between integrated systems.

“What stands out to me is the lack of granular access controls and proper token validation. These are basics in API security, but they’re often overlooked in favor of faster integrations or simpler designs. Organizations need to step back and ask: Are we truly enforcing strong authentication at every step? Are we watching for unusual behaviors, like spikes in link activity or unexpected account access? And are we taking the time to understand the risks our third-party partners might bring into the mix?

“This isn’t just about fixing a technical issue or patching vulnerabilities. When systems are interconnected, the risks don’t just add up; they multiply. One flaw in an API can quickly spread, putting millions of users at risk. That’s why APIs need smarter security, like dynamic trust validation, validate behavior and detect anomalies in real time to prevent exploitation.” 

https://www.securitymagazine.com/articles/101338-security-research-discovers-vulnerabilities-in-popular-travel-service



PlushDaemon: un nuovo gruppo APT cinese colpisce la Corea del Sud. Il report di ESET

Gen 29, 2025 Attacchi, In evidenza, Malware, News, RSS 0

I ricercatori di ESET hanno scoperto PlushDaemon, un nuovo gruppo APT affiliato al governo cinese che ha colpito la supply chain di un provider VPN della Corea del Sud. 

“Nel maggio 2024, abbiamo notato delle rilevazioni di codice dannoso in un installer NSIS per Windows che gli utenti della Corea del Sud avevano scaricato dal sito web del legittimo software VPN IPany. Analizzando ulteriormente, abbiamo scoperto che l’installer distribuiva sia il software legittimo che la backdoor” ha affermato Facundo Muñoz, il ricercatore che ha scoperto la campagna.

PlushDaemon

Credits: ESET

Il gruppo ha sostituito l’installer legittimo della VPN con uno che distribuiva SlowStepper, una backdoor con oltre 30 componenti e funzionalità in grado di raccogliere grandi volumi di dati, anche dal browser, scattare foto, scansionare documenti, spiare gli utenti tramite audio e video e sottrarre le credenziali.

La backdoor non è nuova: secondo l’analisi di Muñoz, esistono diverse versioni di Slowstepper, di cui la prima risale al 31 gennaio 2019. La più nuova è stata compilata il 13 giugno 2024 (versione 0.2.12) ed è ad oggi la versione più completa in termini di funzionalità. Nell’attacco al provider di VPN, PlushDaemon ha utilizzato una versione antecedente, la 0.2.10 Lite; il nome suggerisce che questa backdoor abbia meno funzionalità di quelle in altre versioni.

“Le numerose componenti del toolset di PlushDaemon e la sua ricca storia di versionamento dimostrano che, anche se in precedenza sconosciuto, questo gruppo APT affiliato al governo cinese ha operato assiduamente per sviluppare un’ampia gamma di tool, rendendoli una minaccia significativa dalla quale proteggersi” avvisa ESET.

Dopo la scoperta, la compagnia ha informato il fornitore VPN riguardo la compromissione e l’installer dannoso è stato rimosso dal loro sito.

Condividi l’articolo

Articoli correlati

Altro in questa categoria

https://www.securityinfo.it/2025/01/29/plushdaemon-un-nuovo-gruppo-apt-cinese-colpisce-la-corea-del-sud-il-report-di-eset/?utm_source=rss&utm_medium=rss&utm_campaign=plushdaemon-un-nuovo-gruppo-apt-cinese-colpisce-la-corea-del-sud-il-report-di-eset



Game-day defense: Next-gen threat protection for sporting events

Big league sports inspire passion and pride — from the electrifying atmosphere of game day to the galvanizing community fostered among fans. They are arguably both a cornerstone of culture and an economic force to be reckoned with. Safeguarding national and international sporting events is essential for public safety and confers economic benefit on all involved. In the United States alone, upwards of $52 billion is spent annually by sports travelers, contributing to local businesses with direct spending, creating hundreds of thousands of jobs, and providing billions in tax revenues. 

Top sporting leagues are increasingly using a combination of measures, including threat intelligence tools, to prevent major security incidents. Also known as open-source intelligence (OSINT), the insight from these tools is used in concert with other efforts to ensure the security of venues, players, and fans on game days, such as the championship football game played annually between the winners of the American and National Football Conferences, referred to as “the Big Game.”

Per the U.S. Chamber of Commerce, 77% of Americans tuned in to “the Big Game” in February 2024. The national event has transcended the realm of sports with its eclectic high-energy entertainment consisting of iconic halftime shows, elaborate commercials, and extravagant tailgating, making it a key event for brand sponsorship.

Holistic threat awareness: A proactive, data-driven approach

High-profile sporting events are increasingly being targeted by those seeking to cause disruption or harm. One recent example is the 2024 Paris Olympics, which faced more than 140 cyberattacks that were thwarted due to the French authorities’ able management. 

Protecting sports franchises, team members, fans and venues is complex due to the diverse range of potential threats. These include physical assaults, cyberstalking, doxing, credential theft, impersonation, extortion and reputation damage. Online threats originate from social media platforms, message boards, and even the dark web, making comprehensive security measures essential. 

According to the Hetherington Group, “Just as in other industries, the threats to security in the sports sector are now technologically sophisticated and methodical. Often, bad actors leave abundant evidence of their harmful intent over many weeks, months, even years via social media, chat rooms, and the dark web. They activate misinformation campaigns, obtain personal identifiable information (PII) about athletes, referees, and team executives and dox their residential addresses, the schools and colleges the sports figures’ children attend, and the work addresses of spouses, using information obtained from public databases.”

Sports event organizers and venue operators have come to understand the critical importance of proactive, thorough monitoring and access to detailed, real-time data to inform and support best-in-class security operations. Threat intelligence, which involves the process of collecting, analyzing, and interpreting information from publicly available information (PAI) to support decision-making, now plays a vital role in risk mitigation.

Meanwhile, the automation enabled by artificial intelligence (AI) platforms makes it possible to process vast amounts of data, resulting in a distillation of relevant information and signals that can be reviewed by decisionmakers who can apply the real-world expertise, contextual understanding, and critical thinking necessary to make informed decisions that quickly transform data into action. 

Securing the biggest games

Sports leagues must gain a broad understanding of threat actors, their potential actions, and the context in which they are acting as well as what motivates them. OSINT provides the valuable insights needed to gain a proper understanding of possible threats, such as planned attacks, protests, or disturbances. It can also assist in managing and protecting brand and player reputations.

Key capabilities include:

  1. Threat monitoring: Organizations can leverage open-source threat intelligence solutions to monitor known bad actors and track keyword-based threats tied to sporting events. This proactive approach enables security teams to identify potential risks early and implement preventive measures before incidents arise.
  2. Mapping threat actors in advance: Venue security teams can enhance their understanding of threat groups and individuals targeting sporting events by having pre-collected data readily available in response to major events and breaking news. This should involve mapping social media networks to identify potential threat actors and relevant topics. By mapping the threat landscape in advance, security teams can develop more informed, comprehensive monitoring and mitigation strategies.
  3. Real-time threat detection: Modern threat intelligence solutions can quickly identify and assess online discussions, social media posts, and other open-source indicators, and provide alerts around emerging threats to the event, players, management, or attendees.
  4. Easy, seamless integration: OSINT solutions seamlessly integrate with existing venue security systems and workflows, often via API, enabling security teams to incorporate threat intelligence into established processes and protocols. Working with law enforcement and federal agencies, this collaboration enhances overall security efforts, ensuring better protection for sports fans, players, and VIPs.

Threat intelligence solutions should be part of every high-level sporting event playbook for threat protection. With the Big Game fast approaching, key stakeholders will be on high alert, with holistic game-day threat protection measures in place. Leveraging these tools as part of a broad security strategy is essential for monitoring, assessing, and mitigating risks, and informing security teams to make the right calls, play by play. 

https://www.securitymagazine.com/articles/101336-game-day-defense-next-gen-threat-protection-for-sporting-events



Apple chips can be hacked to leak secrets from Gmail, iCloud, and more

Apple-designed chips powering Macs, iPhones, and iPads contain two newly discovered vulnerabilities that leak credit card information, locations, and other sensitive data from the Chrome and Safari browsers as they visit sites such as iCloud Calendar, Google Maps, and Proton Mail.

The vulnerabilities, affecting the CPUs in later generations of Apple A- and M-series chip sets, open them to side channel attacks, a class of exploit that infers secrets by measuring manifestations such as timing, sound, and power consumption. Both side channels are the result of the chips’ use of speculative execution, a performance optimization that improves speed by predicting the control flow the CPUs should take and following that path, rather than the instruction order in the program.

A new direction

The Apple silicon affected takes speculative execution in new directions. Besides predicting control flow CPUs should take, it also predicts the data flow, such as which memory address to load from and what value will be returned from memory.

The most powerful of the two side-channel attacks is named FLOP. It exploits a form of speculative execution implemented in the chips’ load value predictor (LVP), which predicts the contents of memory when they’re not immediately available. By inducing the LVP to forward values from malformed data, an attacker can read memory contents that would normally be off-limits. The attack can be leveraged to steal a target’s location history from Google Maps, inbox content from Proton Mail, and events stored in iCloud Calendar.

SLAP, meanwhile, abuses the load address predictor (LAP). Whereas LVP predicts the values of memory content, LAP predicts the memory locations where instruction data can be accessed. SLAP forces the LAP to predict the wrong memory addresses. Specifically, the value at an older load instruction’s predicted address is forwarded to younger arbitrary instructions. When Safari has one tab open on a targeted website such as Gmail, and another open tab on an attacker site, the latter can access sensitive strings of JavaScript code of the former, making it possible to read email contents.

https://arstechnica.com/security/2025/01/newly-discovered-flaws-in-apple-chips-leak-secrets-in-safari-and-chrome/



Acting FBI director named, pending confirmation of Trump’s pick

The White House has named Brian Driscoll, a veteran agent, to serve as acting FBI director. This appointment is pending the Senate confirmation of Kash Patel, who President Donald Trump selected as director, and follows the retirement of Paul Abbate, who had been expected to serve as acting director.

Driscoll has stated that Robert Kissane, a counterterrorism official, will serve as acting deputy director. Driscoll and Kissane operate as Special Agents in Charge (SACs), possessing field leadership experience.

“As active Agents, Driscoll and Kissane have a deep understanding of the Bureau’s mission, and the challenges faced by Agents which will serve both the FBI and the nation well during this transition,” said the Federal Bureau of Investigations Agents Association in a statement. “The FBIAA stands ready to support Acting Director Driscoll and Acting Deputy Director Kissane in these important roles.” 

https://www.securitymagazine.com/articles/101332-acting-fbi-director-named-pending-confirmation-of-trumps-pick