Latest cybersecurity reporting from selected sources.

Healthcare organizations should prepare for post-quantum cryptography without overreacting to hype, said John Frushour, CISO of New York-Presbyterian Hospital. Stronger encryption standards, commercial software support and attention to medical devices can help providers manage emerging risks.

2023 LockBit Attack Affected Nearly 9M People, Including ChildrenMCNA Dental, one of the largest providers of U.S. government-sponsored dental benefits to children, has agreed to a proposed multimillion dollar settlement to resolve class action claims stemming from a 2023 LockBit ransomware attack and data theft that affected nearly 9 million people.

Deal Combines Dragos OT Threat Detection With runZero, NetRiseAccenture is acquiring a majority stake in Dragos and full ownership of runZero and NetRise in a $4.2 billion deal to build an end-to-end OT cybersecurity platform for power grids, water systems, manufacturing plants and other critical infrastructure operators.

Also, Arch Linux Attack, Estonia Quarantines Russian Emails, Joomla FlawThis week, ShinyHunters leaked alleged Madison Square Garden data, a U.S. senator pressed CISA on regional staffing cuts, an Arch Linux supply-chain attack, Mackay Sugar began recovery from a ransomware attack, Novo Nordisk faced dueling breach claims - and more compelling cybersecurity news.

Your Controls Assume a Human Is Acting on the Data Being Accessed. But AI Isn't HumanAI is exposing a blind spot in enterprise security: Controls built for humans don't work on agents that never pause, filter or apply judgment. New CISO research shows many organizations can't track what AI is accessing - turning existing data gaps into machine-speed risk.

Understand Agentic AI Risks and Secure All MCP DeploymentsMCP has rapidly become the connective tissue of the agentic AI era and the standard for connecting AI agents to enterprise systems. But it also introduces new attack vectors, from tool poisoning to prompt injection. Here are six ways to reduce the risk.

Restrictions Highlight Growing U.S.-China AI Security TensionsJPMorgan Chase removed Anthropic's Claude models from its approved AI platform for employees in Hong Kong, following restrictions tied to Greater China access rules and underscoring how U.S. export controls and geopolitical concerns are reshaping enterprise AI adoption in global financial markets.

Ongoing Campaign May Be Grabbing Legacy Passwords From Fortinet FortiGate DevicesCybercriminals are selling access to 75,000 Fortinet FortiGate devices with VPN and web management interfaces, and the admin credentials appear to be legitimate and recently harvested as part of a still-live campaign, security experts warned.

Vital Service Providers Need a Plan to Work Through Internet Outages, CISA SaysCritical U.S. infrastructure like water, power and even banking systems will be successfully hacked by enemy cyber warriors in the event of a military confrontation with a peer adversary like Russia or China, officials from the nation's civilian cyber defense agency said.

CRM Data Theft Tied to OAuth Tokens Stolen From Third-Party Market Intelligence AppSalesforce disabled connections to its customer relationship management environment from third-party app Klue Battlecards as a response to a "security incident." Attackers breached Klue's platform, generated OAuth tokens for Salesforce and stole data, now being held to ransom.

Eset Links Group's Growth to Integrated Endpoint-Killing ToolsEset researchers say the rapidly growing Gentlemen ransomware operation differentiates itself by supplying affiliates with a standardized EDR-killer suite that disables security tools, quickly incorporates newly disclosed vulnerable drivers and helps scale attacks across multiple regions worldwide.

Richard Horne Seeks to Reframe Discussion of Cyber ExposureBritain's top cybersecurity official sought Wednesday to reframe digital defense as a contest against a constantly shifting opponent rather than a risk to be managed, calling today's spate of breaches and hacking incidents the opening salvos of a future war.

iRhythm: Patient Information and 'Proprietary' Data Breached, Held for RansomCardiac monitoring firm iRhythm Technologies has told the U.S. Securities and Exchange Commission that hackers recently stole proprietary data and patient health information from "certain" third-party-hosted business applications, and demanded a ransom. The company did not disclose whether it paid.

Microsoft-Owned GitHub, Which Runs npm, Previews Supply-Chain Security FixesThe popular Mastra AI framework, used to build artificial intelligence agents, workflows and retrieval-augmented generation pipelines, has been poisoned by attackers, and Microsoft-owned GitHub has advised all developers to downgrade Mastra, pending compromised packages being found and eradicated.

Cursor Engineers Gain Access to Colossus for Large-Scale Model TrainingSpaceX has agreed to acquire Cursor parent Anysphere for $60 billion in an all-stock transaction, combining one of the fastest-growing AI coding platforms with massive computing infrastructure to accelerate development of frontier AI models and autonomous software engineering agents.

Bank of Ireland's Francis Gorman Shares Strategies for Successful Quantum MigrationMost organizations give the migration to quantum-safe cryptography to the CISO. But that puts a cross-business change in the wrong hands. Accountability belongs with senior leaders who can influence the whole enterprise, says Francis Gorman, head of Bank of Ireland's security center of excellence.

Autonomous Remediation Tools AdvanceCloud computing mainstay Amazon Web Services has taken a look at the vulnerability apocalypse and pronounced it fit for a business opportunity. Today the Seattle company entered a new battleground of platforms with the launch of its new family of security agents that it calls Continuum.

Threat Actor Silently Forwarded Sensitive Emails Matching Strategic TopicsGoogle says Chinese espionage group UNC6508 compromised REDCap environments at North American research institutions, deployed custom malware, stole credentials and covertly forwarded strategically relevant emails through abused compliance rules to support long-term intelligence collection.

IBM Research Finds Tech Leaders Struggle With Agent SprawlA new IBM Institute for Business Value survey finds two-thirds of CIOs and CTOs are accountable for AI systems they don't fully control. The survey of 2,000 tech executives details rising AI agent incidents and recommends infrastructure, governance and financial fixes.

Startup Analyzes Endpoint Behavior to Stop Incidents Before Security Teams RespondEndpoint security startup Ent emerged from stealth with a $100 million seed round led by Decibel, betting that intent-aware AI running on endpoints can prevent increasingly automated AI-driven attacks before traditional detection and response tools have time to react.