← Cybersecurity Headlines
Cybersecurity Headlines
Episource Breach, Predatory Sparrow strikes again, Swiss banks data leak
00:07:30
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Thursday, June 19, 2025. I'm Rich Stroffelino. Over 5 million impacted by episource breach in a notice on its website, the healthcare technology services provider Episource disclosed that threat actors accessed ITS systems from January 27 through February 6, 2025, in disclosure filings with the U.S. department of Health and Human Services. It disclosed this impacted over 5.4 million people with information stolen, including Social Security numbers, insurance and Medicaid, Medicare numbers and medical records. The company is working with partner doctors and health plan providers to provide notice to all impacted victims. Episource urges victims to review benefit statements for fraud. Episource experienced a similar loss of data from a CyberAttack back in 2023. Predatory Sparrow strikes Iran Again the pro Israeli hacktivist group took another swipe at Iran's financial sector, stealing over $90 million in assets from Nobatex, the country's largest crypto exchange. Predatory Sparrow took credit for the attack on social media and threatened to release nobatex source code and other internal information. Researchers at Elliptic confirmed it saw a $90 million asset transfer with vanity addresses used, supporting Predatory Sparrow's claims. The attack comes a day after the group also took credit for an attack on a state owned bank data leak at Swiss banks. Both UBS and Paquette confirmed they had internal data leak through a breach at an external supplier identified by the Swiss newspaper Le Temps as the business service company ChainIQ. Leaked data includes employee data on tens of millions of UBS staff and direct internal phone lines to UBS executives and Paquette invoice information. Both banks said the attack did not compromise any client information. Attackers published data from the attack on illicit forums on June 12. Chain IQ said it would not disclose information on any negotiations or potential ransom demands. Microsoft 365 to block legacy AUTH Protocols Starting in mid July, Microsoft will begin changing security defaults on Microsoft 365 tenants to to block legacy authentication protocols across SharePoint, OneDrive and Office files. It estimates this transition will be completed by August. This will include blocking browser authentication for SharePoint and OneDrive using Relaying Party Suite or RPS, as well as blocking opening Office files with front page remote procedure call. Microsoft said these protocols are vulnerable to brute force and phishing attacks. The company will also update app consent policies to prevent users from granting third party apps file access by default without admin approval. And now thanks for our sponsor for today. Adaptive Security OpenAI's first cybersecurity investment as deepfake scams and Genai Phishing evolve, Adaptive equips security teams with AI powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI content creator turns threat intel and policy updates into interactive multilingual training. Instantly trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps you stay ahead of AI driven threats. Learn more at adaptivesecurity.com that's a D A P T I V E s E C U-R-I-T-Y.com State healthcare exchanges share data with Big Tech an investigation by the Markup and Calmatters found that four state run insurance marketplace sites share sensitive information through embedded advertising trackers on their sites. The investigation looked at exchanges operated by 20 states overall. Nevada's exchange shared prescription and dosage information with LinkedIn and Snapchat. Maine's and Rhode Islands exchanges shared the same information as well as doctors visited with Google. Massachusetts shared some disability and pregnancy information with Google. Part of the issue is that some exchanges used separate sites to connect users with insurance plans, and those services use embedded trackers. All exchanges removed the trackers when alerted by investigators, maintaining that they did not store any personally identifiable information. Linux Distro is vulnerable to LPE vulnerabilities Researchers at the Qualys Threat Research Unit discovered two new local privilege escalation, or LPE vulnerabilities impacting many prominent Linux distributions. One flaw in the Pluggable Authentication Modules framework on SUSE Linux 15 allows attackers to obtain allow active user privileges. The other impacts the udisk daemon, a default storage management service on most distributions that allows the same privilege escalation through a flaw in Libblock dev. While these can be chained easily to attack SUSE systems, the Researchers also created POCs to obtain root privileges on Ubuntu Debris, Debian and Fedora patches for both are now available. Fed sees crypto funds linked to investment scams the U.S. department of justice announced it filed civil forfeiture action to obtain over $224 million in cryptocurrency tied back to scams, fooling victims who believed they were investing in legitimate crypto ventures or through romance scams. A network of scammers worked at least 400 victims globally, including including dozens in the U.S. the U.S. secret Service and FBI worked with Tether to trace back the stolen assets. The Department of Justice hopes the successful forfeiture will eventually allow it to return funds to victims more details on Kir Giles hack Citizen Lab and Google Threat Intelligence Group separately released reports detailing a recent hacking campaign that successfully accessed the email of Russian military expert Keir Giles. Attributed to the Russian linked threat group UNC 6293. The campaign stood out for its particular slow role and focus on one individual rather than an organization. To that point, Citizen Lab senior researcher John Scott Railton said, it's as if they knew everything we'd been taught to expect from Russian hackers and then did the opposite. The whole report is worth a read and we have a link in the show notes. But the final step saw the attackers getting Giles to share a screenshot of an app specific password, which allowed them to compromise his Google accounts. It's almost time for this week's Super Cyber Friday discussion about hacking. What It Takes to Become a CISO should be a fascinating hour digging into what it takes to move from the technical world of cybersecurity and into security leadership. You need to register to join us, so head on over to our events page@cisoseries.com or look for the event on LinkedIn. If you have some thoughts about the news from today, or just about the show in general, remember you can reach out to us@feedbackisoseries.com we'd love to hear from you. Reporting for the CISO series, I'm Rich Stroffelino, reminding you to have a super sparkly day.
- [07:15]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines sat.