Transcript
Kathleen Peters (0:02)
You're listening to the Cyberwire network. Powered by N2K.
Dave Bittner (0:14)
The DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington, D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington D.C. region is the beating heart of cyber innovation. Visit DMVRising.com to secure your spot. Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproofio to see how leading teams are transforming their GRC programs. A suspected ransomware attack disrupts hundreds of Swedish municipalities Google warns Gmail users of emerging cyber attacks tied to the Shiny Hunters group. A malicious supply chain attack hits the MPM registry. Senators press AFLAC for answers. Following a data breach, law enforcement takedowns splinter the ransomware ecosystem. The FBI and Dutch police take down a major online fake ID marketplace. Florida proposes requiring healthcare providers to strengthen data breach preparedness and reporting. Our guest is Kathleen Peters, Chief Innovation Officer at Experian North America, explaining why AI is both accelerating and mitigating fraud and an affiliate army pushes fake casinos worldwide. Foreign August 29, 2025 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. Happy Friday. It's great to have you with us. A suspected ransomware attack on Swedish IT supplier Meliodata has disrupted Systems across nearly 200 municipalities and regions. Miljo Datta provides HR software used for sick leave, medical certificates and workplace injury reports. The attack detected on Saturday is now under police investigation, with extortion attempts reported. Civil Defense Minister Carl Oskar Bohlin confirmed the government is closely monitoring the situation, though the full impact remains unclear. CERT SE and the National Cybersecurity center are assisting both Meliodata and affected municipalities. Meliodata's CEO Eric Hollen said external experts are working to restore functionality and assess damage. With 290 municipalities in Sweden, the scale of the disruption is significant. Bohlin emphasized the need for stronger national cybersecurity, noting a forthcoming bill that would impose stricter security requirements. Google has issued an emergency warning to Gmail users after cyberattacks tied to the Shiny Hunters group emerged following a Salesforce data breach. While Google's own systems remain secure, hackers are exploiting stolen business data through social engineering, particularly by impersonating IT staff in phone based vishing attacks. Google's Threat Analysis Group detected the activity in June, confirming several successful intrusions by August through compromised passwords. Shiny hunters, active since 2020 have a track record of high profile breaches at companies like Microsoft, AT&T and Ticketmaster, often leaking or selling stolen records. Impacted users were notified on August 8. With Gmail serving over 2.5 billion people, Google urges all users to strengthen defenses by updating passwords and enabling two factor authentication. TransUnion is notifying over 4.4 million people of a July 28 data breach exposing names, Social Security numbers and birth dates. The compromised data came from a third party application used for US Customer support, though not from core credit files. Victims are being offered two years of free credit monitoring and fraud assistance. Hackers linked to Shiny Hunters, reportedly tied to the broader Salesforce breach campaign claim additional data like addresses and emails were stolen. The incident follows similar Salesforce related breaches at major global firms. A malicious supply chain attack hit the NPM registry on Aug. 26 when attackers published compromised versions of NX, a popular open source build platform. NPM is a massive public database of JavaScript software packages. Eight versions contained malware that stole developer secrets, SSH keys, GitHub and NPM tokens, and even cryptocurrency wallets. The malware abused AI CLI tools like Claude Gemini and Amazon Q to scan systems, then exfiltrated data to GitHub by creating repositories under victims own accounts. Within just five hours, thousands may have been exposed. Step Security later confirmed a second wave. Attackers weaponized stolen GitHub CLI OAuth tokens, converting private repos into public ones and forking them for persistence. Researchers call this the first known supply chain attack that hijacked AI developer tools for data theft, urging urgent credential resets and repo audits. The US Senate Health, Education, labor and Pensions Committee is pressing insurance giant AFLAC for answers after a recent cyber attack exposed personal and health Data. In an Aug. 22 letter, Senators Bill Cassidy, Republican from Louisiana, and Maggie Hassan, a Democrat from New Hampshire, asked CEO Daniel Amos to detail the company's security protocols, how protected health information was safeguarded and what measures are planned going forward. AFLAC first disclosed the breach to the SEC on June 20, calling it part of a cybercrime campaign targeting insurers. Regulators later confirmed that HIPAA protected data for at least 500 individuals was compromised. Lawmakers compared the incident to last year's Change Healthcare breach and warned of rising cyber risks in healthcare, which cost organizations nearly $10 million per incident and disrupt patient care. The ransomware ecosystem is splintering as law enforcement takedowns scatter affiliates and force criminal rebrands. Malwarebytes reports that between July 2024 and June of this year, 41 new groups emerged, pushing the total over 60 active gangs for the first time. This doubling over three years has fueled a surge in attacks aided by leaked ransomware code, commoditized tools and even AI, which lowers barriers to entry. Large ransomware as a service groups like Lockbit, Hive and Alpha have been disrupted, but affiliates often rebrand or form new crews. Researchers note that trust within the cybercriminal underground is eroding, leading to infighting exit scams and stolen data being sold across multiple leak sites. With dominance, more fleeting small groups now drive attacks, fragmenting the ecosystem further. The FBI and Dutch police have shut down Veriftools, a major online marketplace selling fake IDs for as little as nine. The site offered counterfeit driver's licenses, passports and other documents from all 50 US states and several countries. Criminals used the IDs for fraud, IT job scams and bank help desk cons while teens exploited them to buy alcohol. On August 27, Dutch police seized Verif tool servers in Amsterdam while the FBI took its domains offline. Investigators linked the Marketplace to about $6.4 million in illicit proceeds. Undercover agents even purchased fake New Mexico licenses using cryptocurrency during the probe, which began in 2022, authorities said. The takedown marks a major step against fraud and identity theft, though users and admins remain under investigation. Florida's Agency for Healthcare Administration has proposed a new rule for requiring healthcare providers to strengthen data breach preparedness and reporting. Providers would need a written contingency plan to ensure critical operations and patient care continue during IT incidents, including secure redundant data backups within the US and verified restorability. The rule defines incidents broadly, covering cyber attacks and insider misuse. Providers would have to report incidents to the administration within 24 hours. These requirements would supplement existing HIPAA rules. A workshop is scheduled for September 17th. Coming up after the break, Kathleen Peters from Experian North America explains why AI is both experience accelerating and mitigating fraud and an affiliate army pushes fake casinos worldwide Stay with US Compliance regulations, Third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually Slowing you down. If you're thinking there has to be something more efficient than spreadsheets, screenshots and all those manual processes, you're right. GRC can be so much easier and it can strengthen your security posture while actually driving revenue for your business. You know, one of the things I really like about Vanta is how it takes the heavy lifting out of your GRC program. Their trust management platform automates those key areas. Compliance, internal and third party risk, and even customer trust so you're not buried under spreadsheets and endless manual tasks. Vanta really streamlines the way you gather and manage information across your entire business. And this isn't just theoretical. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. That's a pretty impressive number. So what does it mean for you? It means you get back more time and energy to focus on what actually matters, like strengthening your security posture and scaling your business. Vanta GRC Just imagine how much easier trust can be. Visit vanta.com cyber to sign up today for a free demo. That's V a n t a dot com cyber@new balance, we believe if you.