← Cybersecurity Headlines
Cybersecurity Headlines
DOGE puts critical SS data at risk? CISA warns of new exploited flaw, K-Pop stock heist attacker extradited to South Korea
00:07:10
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Wednesday, August 27, 2025. I'm Sarah Lane. Whistleblower says DOGE put Critical Social Security data at risk Charles Borges, chief data officer at the Social Security Administration, filed a whistleblower complaint alleging that the Department of Government efficiency improperly uploaded SSA's Numident Datab containing names, SSNs, addresses and birth dates of nearly every American to a vulnerable cloud system. Borges warned this violates federal security rules and creates a high risk of identity theft and widespread harm if exposed. Although no breach has been confirmed, CISA warns of actively exploited Git code execution Flawless CISA says an arbitrary code execution vulnerability in Git is actively being exploited due to mishandling carriage return characters in configuration files, letting attackers craft repositories with malicious sub modules that execute code on users machines. Git patch the issue in versions 2.43.7 through 2.50.1. Federal agencies have to apply the fix by September 15 or or follow mitigation steps including avoiding untrusted recursive sub modules or disabling hooks. SISA also added to Citrix session recording flaws to its known exploited vulnerabilities catalog Alleged mastermind behind K Pop celebrity stock heist extradited to South Korea South Korean Authorities extradited a 34 year old Chinese man from Thailand suspected of a cyber heist targeting K Pop celebrities including BTS singer Jungkook, between August of 2023 and January of 2024. The attacker allegedly stole personal data from telecom firms to access victims financial accounts, embezzling more than 36 billion won. That's around US$27 million. The suspect admitted to some charges but denied others with with Interpol and Thai authorities involved in the investigation. Hundreds of Salesforce customers impacted by a tax spree linked to third party AI agent A data theft campaign compromised hundreds of Salesforce customers earlier this month after attackers exploited OAuth tokens stolen from SalesLoft Drift, a third party AI sales agent. Google's Threat Intelligence Group linked the spree to threat group UNC 6395, which automated theft data between August 8th and the 18th, targeting credentials for AWS, Snowflake and VPNs. SalesLoft and Salesforce revoked tokens on August 20th, but Google warns affected customers to treat their data as compromised and rotate credentials. Huge thanks to our sponsor Profit Security. Your security analyst didn't sign up to chase false alarms all day, right? With Profit Security's AI SoC platform. They don't have to. It works like a tireless teammate triaging and investigating alerts around the clock. Less burnout, better coverage and more time for meaningful work. Learn more@profitsecurity.com Shadow Captcha exploits WordPress sites to spread ransomware, info stealers and crypto miners A new campaign dubbed Shadow Captcha is exploiting over 100 compromised WordPress sites, sending visitors to fake Captcha pages that then trick them into running malicious commands. The attacks deliver information stealers with ransomware and crypto miners using Click Fix, social engineering and Windows tools. Researchers say side admins need to patch WordPress plugins, enable MFA and train users against click Fix lures. Nissan confirms design studio data breach claimed by Qilin Ransomware Nissan confirmed its Tokyo based design subsidiary Code Creative Box Inc. Suffered a data breach after the Qilin ransomware group claimed to have stolen four terabytes of sensitive files, including 3D vehicle models, financial documents and VR design workflows. The attackers posted sample images online and threatened to leak all the stolen data. Nissan says it contained the incident and has notified authorities. AACHAN discloses data breach data of hundreds of thousands of customers exposed French retailer Auchan disclosed a data breach affecting hundreds of thousands of its customers with personal details tied to loyalty cards, including names, addresses, phone numbers, emails and card numbers. Banking data, passwords and PINs have not been exposed, but loyalty cards were deactivated and now have to be reissued within stores. This is Ajan's second breach in less than a year. Nevada State Websites phone lines knocked offline by cyber attack A cyber attack disrupted Nevada state government systems, websites and phone lines on Sunday, forcing offices to close Monday and leaving the state website offline. Governor Joe Lombardo said emergency services are still available and and officials are using workarounds while working with federal, local and tribal partners to restore services. No group has claimed responsibility. Have you checked out the latest episode of the CISO Series podcast this week? One of the show segments digs into why the current security vendor playbook is so vexing, leading to every CISO with an inbox full of cold calls and very few actual solutions to their problems, look for the episode. New study finds no email has ever found you. Well, wherever you get your podcasts and if you have thoughts on the news from today or about the show in general, do be sure to reach out to us@feedbackisoies.com we would love to hear from you. I'm Sarah Lane reporting for the CISO series. Thank you for listening and we'll talk to you next time.
- [06:55]
A
Cybersecurity headlines are available every weekday. Head head to cisoseries.com for the full stories behind the headlines.