Latest cybersecurity reporting from selected sources.

Also: npm Packages Infiltrated, FBI Issues Fraud Alert, Campbell's Soup Cans CISOThis week, a recently fixed Oracle flaw is being actively exploited, Shelly tackled Pro 4PM DoS bug, "Shai-Hulud 2.0" hit npm, the FBI warned of rising bank account takeover scams, regulators fined Comcast over a vendor breach, Iberia reported a supplier incident and Campbell's canned its CISO.

Deal Adds Live Fraud Red Teaming, Adversarial Testing to Neovera's Cyber PortfolioNeovera has acquired Greenway Solutions, a Charlotte-based fraud red-teaming vendor serving top banks, to expand its cyber capabilities. The Washington D.C.-area services provider plans to tailor services for community banks and credit unions using automation and selective testing.

Arizona-based Western Alliance Bank is notifying nearly 22,000 customers their personal information was stolen in October after a third-party vendor's secure file transfer software was breached. [...]

Also: Zero-Days Affect Financial Markets, SailPoint IPO Signals Market TrendsIn this week's update, ISMG editors discussed the latest "Modern Bank Heists" report and the evolving threats to financial institutions, fallout from the U.S. Department of Government Efficiency's AI-driven government shake-up, and what SailPoint's IPO signals for the cybersecurity vendor market.

InfoSys McCamish Systems Earlier Alerted 57,000 Bank of America Clients of BreachInfosys McCamish Systems, an insurance software product and services vendor, is notifying nearly 6.1 million people of a 2023 ransomware incident that potentially comprised their sensitive data, including Social Security numbers, medical treatment, and financial and biometric information.

The private information of more than 28,000 people may have been accessed by unauthorized actors, thanks to a cyber incident at service provider Infosys McCamish — the same third party recently responsible for the Bank of America breach.

Bank of America is warning customers of a data breach exposing their personal information after one of its service providers was hacked last year. [...]

Fined $4m for mess, for which it blames unnamed archiving vendor's retention settings JP Morgan has been fined $4 million by the US Securities and Exchange Commission (SEC) for deleting millions of email records dating from 2018 relating to its Chase Bank subsidiary.…

Banking and financial services organizations are the targets of a new multi-stage adversary-in-the-middle (AitM) phishing and business email compromise (BEC) attack, Microsoft has revealed