Latest

Critical Infrastructure Security

More Collins Aerospace Hacking Fallout

Akshaya Asokan  •  October 27, 2025

A Russian data extortion group threatened Sunday to release passenger data putatively stolen from the Dublin Airport days after its operator said it investigated a breach stemming from a September cybersecurity incident that affected airports across Europe.

3rd Party Risk Management

Back-Office Servicer Reports Data Theft Affects 10.5M

Marianne Kolbasuk McGee  •  October 27, 2025

Conduent Business Solutions LLC has told state regulators that a hacking incident discovered in January has affected more than 10.5 million patients. Clients affected include Blue Cross Blue Shield of Montana and Humana, as well as an undisclosed number of other organizations.

Data Security

ISMG Editors: US Federal Shutdown Complicates F5 Response

Mathew J. Schwartz  •  October 24, 2025

In this week's panel, four ISMG editors discussed how the U.S. government shutdown complicates F5 breach incident response, an apparent ransomware attack disrupting patient services at Massachusetts community hospitals, and backup and recovery firm Veeam's move to acquire Securiti AI.

Litigation

Fortinet Accused of Securities Fraud Over Firewall Forecasts

Michael Novinson  •  October 24, 2025

Public pension funds filed securities fraud lawsuits claiming Fortinet misled investors by overstating the value and timing of a major firewall refresh cycle. The lawsuits allege the refresh involved outdated products and had limited business impact, contradicting Fortinet's upbeat public messaging.

►

Business Continuity Management / Disaster Recovery

AWS Outage Exposes Cloud Dependency, Concentration Risks

Akshaya Asokan  •  October 24, 2025

The cascading outage across the U.S. East Coast triggered this week by a domain name system failure in an AWS DynamoDB service demonstrates the risks of deep architectural dependencies and the challenges of building true multi-region cloud resilience, said Forrester's Brent Ellis and Dario Maisto.

Data Privacy

Yale New Haven Health Will Pay $18M to Settle Hack Lawsuit

Marianne Kolbasuk McGee  •  October 24, 2025

Connecticut's largest healthcare network - Yale New Haven Health System - has agreed to pay $18 million to settle class action litigation filed in the aftermath of a March hack affecting nearly 5.6 million people. The incident ranks as the biggest health data breach reported so far in 2025.

Cybercrime

Infostealers Run Wild

Mathew J. Schwartz  •  October 24, 2025

The threat posed by information-stealing malware continues to rise, as it mass harvests ever-greater quantities of user credentials and offers them for sale across the cybercrime underground. Researchers have recently tracked 1.8 billion stolen credentials being sold across illicit marketplaces.

►

Governance & Risk Management

Advice to CISOs: Don't Let 'Any Cyber Crisis Go To Waste'

Joshua Cunningham-Marsh  •  October 24, 2025

Organizations must abandon prevention-only strategies and embrace comprehensive incident response planning for OT systems, as decades-old infrastructure and escalating threats make attacks inevitable rather than hypothetical, said Prashant Prashant, senior cyber security advisor at Enbridge.

Cybercrime

Breach Roundup: the Qilin Hack That Wasn't

Anviksha More  •  October 23, 2025

This week, Qilin didn't hack a Spanish tax agency, Nexperia standoff, Envoy Air confirmed a data compromise, Experian Netherlands fined 2.7M euros, ToolShell used to breach global networks, flaws in TP-Link Omada and Festa VPN routers and a New York firm settled a cybersecurity investigation.

►

Business Continuity Management / Disaster Recovery

Why Composure Matters Most in an OT Cyber Crisis

Joshua Cunningham-Marsh  •  October 23, 2025

During an OT cyber crisis, the first response shouldn't be technical, says Christian Miranda Moreira, BISO at McKesson Canada. The ability to maintain composure and follow documented response plans determines how well teams can contain incidents and recover critical business operations.

Governance & Risk Management

Dataminr to Buy ThreatConnect for $290M in Intelligence Push

Michael Novinson  •  October 23, 2025

Dataminr will acquire ThreatConnect, combining public data detection with internal intelligence to give CISOs an AI-powered, context-aware response platform. The deal is producing results for shared customers and is central to Dataminr's push toward predictive, client-specific cybersecurity tools.

Data Breach Notification

Montana Officials Looking Into BCBS Breach Tied to Vendor

Marianne Kolbasuk McGee  •  October 23, 2025

Montana regulators are investigating a breach affecting 462,000 Blue Cross Blue Shield of Montana members involving one of the insurer's service providers. The vendor, Conduent, in April notified the SEC that the data theft affected numerous clients and a "significant number" of people.