Transcript
Dave Bittner (0:02)
You're listening to the CyberWire network powered by N2K.
Podcast Host / CyberWire Announcer (0:11)
Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring Fencing, you control how trusted applications behave and with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. Hit by a major wireless outage, Poland blocks an attack on its power grid. A massive database of French citizens is exposed. Microsoft shuts down a cybercrime as a service operation, the UK backs away from digital ID plans, CA probes Grok deepfakes, the FTC settles with GM over location data, Palo Alto networks patches a serious firewall flaw. Plus John Serafini of Hawkeye on modern signals intelligence and federal agents seize devices. From a Washington Washington Post reporter. It's Thursday, january 15th, 2026. I'm dave bittner and this is your cyberwire intel briefing. Thanks for joining us here today. It's great as always to have you with us. Verizon said it restored full service late Wednesday after a widespread wireless outage across the United States that lasted most of the day. The company apologized and said it would issue account credits but did not disclose the cause, adding earlier that there was no indication of a cyber attack. According to Down Detector, customers began reporting problems shortly before noon in New York, with complaints peaking at more than 177,000. The most affected cities included New York, Houston, Atlanta, Dallas and Miami. Smaller numbers of issues were reported by AT and T and T Mobile users, partly due to call routing effects. The FCC said it was monitoring the outage and and FCC member Anna Gomez called for an investigation. Experts noted such disruptions are often linked to external factors, including third party vendors or software deployment issues. Poland said it stopped what officials described as the most serious cyberattack on its energy infrastructure in years, narrowly avoiding a nationwide power outage. The late December attack targeted communications between renewable energy sites, including wind and solar installations and electricity distributors. Officials said the incident nearly caused a blackout and showed signs of coordinated sabotage, which they blamed on Russia. Ministers warned the tactic was new, could recur and reflects rising threats to Polish infrastructure since Russia's invasion of Ukraine. Security Researchers at Cybernews uncovered a massive exposed database containing tens of millions of records on French citizens, likely compiled from at least five separate data breaches. The archive, found on an unsecured cloud server in France, included voter and demographic data, healthcare registry records, contact details, financial information and vehicle data. Researchers believe a cybercriminal or data broker merged the data sets to increase resale value. The database was taken down after notification of but posed significant privacy and fraud risks. Microsoft said it has disrupted Red vds, a cybercrime as a service platform linked to fraud campaigns that caused more than $40 million in losses in the US alone. In coordinated legal action with partners in the US and for the first time, the UK Microsoft seized red VDS infrastructure on January 14th. The service sold low cost access to disposable virtual servers used for phishing and business email compromise scams impacting nearly 190,000 organizations worldwide, mainly in the US, Canada and the UK. Microsoft said attackers used generative AI, deepfake, video and voice cloning to create realistic scams. International law enforcement, including Europol, supported the takedown, and Microsoft urged victims to report incidents to help disrupt future cybercrime. The UK government has dropped plans to require workers to sign up for a new digital ID system to prove their right to work following political backlash and falling public support. Instead, labor ministers say existing right to work checks using documents such as biometric passports will be fully digitized by 2029. The reversal is the latest in a series of recent policy U turns, drawing criticism from opposition parties and frustration within labor's own ranks. Ministers insist mandatory digital checks will still apply, arguing they reduce fraud and illegal working compared to paper systems. The government now says digital ID should be framed more broadly as a tool to access public services, though details of how the system will operate remain unclear. California Attorney General Rob Bonta announced an investigation into XAI over the alleged proliferation of non consensual sexually explicit images generated by its AI model Grok. According to Bonta, Grok has been used at scale to create deepfake images that sexualize women and children without consent or often using publicly available photos and distributing the results online, including On X. Reports cite Grok's explicit spicy mode as a contributing factor. Bonta said the material has been used for harassment and may include child sexual abuse content, raising serious legal concerns. The investigation will examine whether XAI violated state laws. Bonta emphasized California's zero tolerance stance and reiterated his broader efforts to hold AI companies accountable for protecting children and preventing AI enabled abuse. The U.S. federal Trade Commission finalized a settlement with General Motors and its OnStar unit over allegations that they collected and sold drivers location and behavior data without consent. The FTC said millions of vehicles transmitted precise geolocation and driving data every few seconds via OnStar's Smart Driver feature, which was marketed as a self assessment tool. The data was sold to third parties, including insurers. The order bans certain data sharing for five years and requires explicit consent, greater transparency and consumer controls. For 20 years, Palo Alto Networks has patched a high severity vulnerability that could allow unauthenticated attackers to trigger denial of service attacks and force firewalls into maintenance mode. The flaw affects next generation firewalls running Panos 10.1 or later, as well as Prisma Access deployments with Global Protect enabled, the company said most cloud based Prisma Access customers have already been upgraded with with remaining upgrades scheduled. While nearly 6,000 Palo Alto firewalls are visibly online, there is no confirmation of active exploitation. Palo Alto Networks has released fixes for all affected versions and urges administrators to update promptly. The disclosure comes amid continued attention on Palo Alto firewalls, which have been repeatedly targeted in recent years by both zero day and denial of service attacks. Federal agents searched the home of Washington Post reporter Hannah Natanzin this week, seizing her personal and work devices in a leak investigation that's alarmed press freedom advocates and security professionals alike. The FBI says Natanzen is not a target, but the search was tied to a government contractor accused of improperly retaining classified materials and allegedly messaging the reporter. Such raids on journalists are exceptionally rare, and critics say they send a chilling message to reporters and sources. Beyond the constitutional concerns, the incident underscores a practical lesson for journalists and professionals encrypt both personal and work devices and assume sensitive data may one day face government scrutiny. With policy changes weakening long standing protections for reporters records, digital security is no longer just best practice, it is a frontline defense for press independence. Advocacy groups warned the move risks deterring vital reporting and eroding trust between journalists and their sources. Coming up after the break, John Serafini from Hawkeye360 discusses modern signals intelligence and when emails fail, try the CEO's password. Stay with us.