Announcer (0:02)

You're listening to the Cyberwire Network powered by N2K.

Dave Bittner (0:11)

Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring Fencing, you control how trusted applications behave, and with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. We've got a light hearted look back at 2025. One heck of a year and warm holiday wishes from all of us to all of you. It's December 24, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It is Christmas Eve. We're happy to have you with us here today. Another year, another avalanche of data breaches. At this point, the modern Internet user no longer asks whether their data was exposed, but rather how many times and by whom. Names, emails, medical records, location history, selfies, IDs, and the occasional deeply personal message continue to spill out of corporate servers with such regularity that it feels less like an emergency and more like background noise. To cut through that noise, the Electronic Frontier foundation once again handed out the Breechies its annual Tongue in Cheek Awards, honoring the most egregious, avoidable, and occasionally absurd privacy failures of the year. The unifying theme is depressingly familiar. Companies collect far more data than they need, keep it far longer than they should, and then act surprised when someone breaks in and takes it. If data minimization were fashionable, many of these breaches would amount to little more than a shrug. Instead, stolen information is repurposed for identity theft, extortion, stalking, and spam, while users are left assuming their personal details are just out there somewhere. So, looking at this year's awardees from the eff, Mixpanel earned the say Something Without Saying Anything award for a breach that was as vague as it was troubling. As an analytics company embedded invisibly into countless apps, Mixpanel quietly collected user data on behalf of others, and including companies like Ring and pornhub. When hackers accessed its systems, Mixpanel's public disclosure left more questions than answers. How many users were affected? What security controls failed? Did attackers demand a ransom? Silence. The most telling response came from OpenAI, which promptly dropped Mixpanel as a provider and revealed details Mixpanel itself had skipped. The real victims, of course, were users who never knowingly consented to sharing data with Mixpanel in the first place. Discord took home the we still told you so award, a sequel to last year's warning about age verification mandates. In September, Discord users age verification data was exposed through a breach at Zendesk, its customer support vendor. Names, selfies, government IDs, addresses, phone numbers, IP addresses, and partial billing information all spilled out. While Discord itself wasn't directly hacked, that distinction offered little comfort to users whose sensitive identity data was suddenly loose. It was a textbook example of how collecting IDs just in case creates irresistible targets and predictable outcomes. The T for 2 award went to T Dating Advice and TI on her two apps built around sharing dating safety information. T aimed at women, requires selfies or photo IDs to verify gender. In July, more than 70,000 such images were found exposed through an unsecured database. A week later, a second breach revealed over a million private messages discussing topics like abortion planning and infidelity. Meanwhile, Tonher, a similar app for men, managed to expose emails, usernames, IDs, and even admin credentials through a public Web address. Together, they offered a masterclass in why collecting biometric data should come with a very long pause. Blue Shield of California won the Just stop using Tracking tech award after discovering it had been sharing sensitive health data with Google for nearly three years. A misconfigured Google Analytics setup leaked names, insurance details, providers, and financial responsibility information for 4.7 million people. This wasn't a hack so much as a slow, accidental data giveaway. And it echoed nearly identical incidents in healthcare. Year after year. Tracking tools marketed as harmless analytics continue to leak medical data, proving once again that surveillance, advertising and healthcare make a terrible pairing. PowerSchool earned the hackers Hall Pass award after attackers accessed sensitive data on more than 60 million students and teachers. Social Security numbers, medical records, grades, and special education data were exposed nationwide, all because PowerSchool failed to implement basic security protections like multi factor authentication. Lawsuits followed, ransom payments were made, and the story took an extra twist when a Massachusetts student pleaded guilty to extorting the company from millions in Bitcoin. Sometimes the faceless hacker turns out to be a college kid with a password list. TransUnion claimed the worst customer service ever award after attackers accessed the personal data of 4.4 million people through a third party support application. Names, dates of birth and Social Security numbers were taken, though TransUnion reassured customers that core credit data was untouched. The breach underscored how third party vendors function as side doors into sensitive systems, doors customers never agreed to leave unlocked. Microsoft received its annual honorary mention, this Time for a SharePoint Zero Day that compromised over 400 organizations, including the National Nuclear Security Administration. While zero days happen to everyone, Microsoft's long history of them raises uncomfortable questions about monocultures and centralization. When one company's software becomes infrastructure, its failures scale accordingly. The Silver Globe award went to the Flat Earth, Sun, Moon and Zodiac app, which leaked personal details and precise location data. The irony of Flat Earth believers unknowingly sharing latitude and longitude was, as the EFF noted, hard to ignore gravy. Analytics won the I didn't even know you had my information award after hackers claimed to steal location data tied to advertising IDs from millions of phones. The breach revealed how location Data harvested through AdTech can expose military personnel, LGBTQ individuals and others to serious risk. The real scandal, however, was not the breach itself, but a business model that tracks a billion phones a day without most users ever knowing the company exists. TeslaMate earned the keeping up with My Cybertruck award when thousands of exposed dashboards revealed Tesla owners locations, travel habits and driving data. Self hosted tools turned cars into reality shows minus the consent or ratings. PACER took home disorder in the courts after hackers accessed federal court filing systems, potentially exposing confidential informants. The breach followed years of warnings that the system was outdated and unsafe, proving once again that critical infrastructure often limps along until it breaks. Cat Watchful won Only stalkers allowed for a breach that exposed not only stalkers accounts but also data from 26,000 victims phones. It was one of several stalkerware breaches this year, reinforcing calls to shut the industry down entirely. Plex received the why we're still stuck on unique Passwords award after leaking emails, usernames and hashed passwords. It was deja vu from a similar 2022 breach and and a reminder that password reuse remains one of the Internet's most reliable self inflicted wounds. Finally, Troy Hunt's mailing list earned the yes actually I have been pwned award after he fell for a phishing attack. If it can happen to the world's most famous breach tracker, it can happen to anyone. The takeaway is bleak but actionable. Use unique passwords, enable two factor authentication, delete old accounts, freeze credit, and watch medical bills closely. More importantly, companies must collect less data and secure what they keep, and lawmakers should pass meaningful privacy protections. Until then, the breachees will remain tragically easy to award. We'll have a link to the Electronic Frontier Foundation's post in our show notes, and we appreciate them for creating this year's Breachies Award.