Latest cybersecurity reporting from selected sources.

Solar Energy Spurt Comes Freighted With Chinese Nation-State Hacking WorriesThe European Commission froze funding for solar energy projects that use crucial components from Chinese companies such as Huawei, due to cybersecurity fears. The decision affects projects being funded by the European Investment Bank and other partner banks.

Also: Updates in KelpDAO, Drift, Hyperbridge HacksThis week, Grinex was exploited, a hacker laundered KelpDAO funds, Circle was sued over $280M Drift hack, Rhea Finance and Volo Protocol were exploited, update in Hyperbridge hack, sentencing in art scam case, a French home invasion for crypto theft and eth.limo hijack thwarted.

Stryker Has Said It Doesn't Carry Cyber insuranceStryker notified regulators that its March cyberattack will impact the medtech maker's first quarter financial results. The company also does not appear to have a cyber insurance policy in place to help cover costs associated with the disruptive incident claimed by Iranian hackers.

Also: Chinese Firms Indicted in Crypto-Linked Fentanyl Supply CaseThis week, charges filed in Uranium Finance hack, indictment of Chinese firms in fentanyl supply case, a class action lawsuit against Nvidia, Drift Protocol exploit, KuCoin operational barriers in the United States and a U.K. sanction filed against Xinbi.

HIPAA Settlement Small Compared to Many OthersU.S. federal regulators fined a dental practice software vendor with a seemingly lowball financial penalty for a high-stakes 2020 hack affecting 15 million individuals that the company failed to report. Maryland-based MMG Fusion agreed to $10,000.

Leaked Financial and Admissions Data Includes Contact Details for 'Top Donors'Harvard University has been named as a victim and doxed by hack-and-leak group ShinyHunters, apparently as a result of the cybercrime group's ongoing "live phishing" attacks that often attempt to trick IT help desks into giving attackers direct access to a victim's network and cloud-based data.

Leaked Financial and Admissions Data Includes Contact Details for 'Top Donors'Harvard University has been named as a victim and doxed by hack-and-leak group ShinyHunters, apparently as a result of the cybercrime group's ongoing "live phishing" attacks that often attempt to trick IT help desks into giving attackers direct access to a victim's network and cloud-based data.

Also: UK Fraud Investigators Make Arrests in $28M Basis Markets Rug-Pull ProbeThis week, World Liberty Financial scrambles to secure user funds, the U.K.'s Serious Fraud Office arrests two people over a $28M Basis Markets rug-pull probe, a Gana Payment hack drains $3.1M and Crypto Dispensers weighs a $100M sale following money-laundering charges against its CEO.

Financial Loss Tied to the Hack Estimated at 1.9B PoundsThe hack of Jaguar Land Rover will likely cost the British economy 1.9 billion pounds, making it the single most expensive cyber incident to have occurred in the United Kingdom. That number could go up if hackers damaged the operational technology controlling assembly lines.

Cybercrime Group ShinyHunters Advertises 160 Million Stolen RecordsVietnam's central bank is probing a hack attack that breached its credit reporting division, exposing personally identifiable information. The cybercrime group ShinyHunters claimed credit for the breach, advertising on a cybercrime forum 160 million stolen records for $175,000.

Also: Train Hack Risks Outed by CISA Alert; AI Comprehension Issues Won't Go AwayIn this week's update, four ISMG editors discussed the potential global implications of the Seychelles Commercial Bank data breach; the real-world threat of train hacks following an alert about a critical railway vulnerability; and growing concerns around AI's "comprehension problem."

Also: CISA Warns of Unpatched Train Brake VulnerabilityThis week: Louis Vuitton and Co-op confirm breaches, unpatched train brake flaw, Barclays fined £42M pounds for financial crime failures, secret U.K. program relocated thousands of Afghans, ex-soldier pleads guilty to hacking, Ukrainian hackers claim hit on Russian drone supplier.

Also: Scammer Gets 12-Year Sentence for Dodging RestitutionAbacus Market's suspected exit scam, crypto scammer gets 12 years for dodging restitution, GMX exploiter returns funds, BigOne's $27M hack, Arcadia Finance's $3.5M theft, NZ woman's trial for alleged murder and a DOJ crypto fraud filing's potential unmasking of MoonPay victims.

China's Hack-For-Hire Scene Disgorges Another LeakThe Chinese nation-state threat actor tracked as Salt Typhoon is operated by a clutch of private firms whose clients include multiple Chinese government agencies, finds analysis of leaked data by Spy Cloud. Researchers found a spreadsheet listing buyers, sellers and financial transaction details.

Disruption of Country's Biggest Bank Comes as Israel-Iran War IntensifiesA pro-Israel hacking group claims to have disrupted a major Iranian bank as hostilities between the two countries raged into their fifth day. Hacking group Gonjeshke said Tuesday morning it "conducted cyberattacks which destroyed the data of the Islamic Revolutionary Guard Corps' Bank Sepah."

Also, M&S Back Online, Mexican Education Platform Breached, Patch TuesdayThis week, a Roundcube flaw, Mexican student data hacked and Dutch cops scare straight Cracked users. Man imprisoned for hacking tax preparers. M&S update. UNFI ships on a limited basis. U.K. financial regulator staffers used personal emails. Weak web panel security on GPS devices. Patch Tuesday.

Hacker Demanded $20M Ransom to Delete Stolen Personal, Financial InformationA months-long data breach led to the theft of personal and financial information of nearly 70,000 Coinbase customers. Coinbase said the breach dates back to December and was aided by bribery schemes targeting the company's overseas customer support agents.

Retailer Continues to Recover From Ransomware IncidentBritish retailer Marks & Spencer was reportedly targeted by financial crime group Scattered Spider, who deployed ransomware on the company's VMware ESXi server. The retailer continues to recover from a cyber incident that disrupted operations in its online and offline stores.

Breach Affects Pediatric, Orthodontic and Dental Surgery Practices in 6 StatesA Nashville, Tennessee firm that provides HR and finance services to dozens of specialty dental practices across six states is notifying more than 173,400 people of a 2024 email hacking incident affecting children and other patients. The company already faces several lawsuits related to the breach.

Incident Spotted in March 2024 Is Yet Another Attack Against Medical Billing FirmsA Nebraska-based firm that provides revenue cycle management and billing services to healthcare firms is notifying tens of thousands of people and an undisclosed number of companies that their personal, health and financial information was compromised in a March 2024 hack.