Latest cybersecurity reporting from selected sources.

Hackers Constantly Break 'Confirmation of Data Destruction' PromisesWhen a business that stores children's personal data gets hit by data-leaking extortionists, what should it do? For Instructure, which develops online learning platform Canvas, the answer was to pay a ransom, and tell victims, straight-faced, to have "digital confirmation of data destruction."

Ivanti's Endpoint Manager Mobile Flaws Under Active ExploitationThe European Commission fell victim to a cyberattack that could have allowed the theft of some staff personal information. The European Union's executive body said Friday it detected on Jan. 30 an attack on its "central infrastructure managing mobile devices."

Ivy League school warns more than 1,400 people after attackers siphon data via zero-day The University of Pennsylvania has become the latest victim of Clop's smash-and-grab spree against Oracle's E-Business Suite (EBS) customers, with the Ivy League school now warning more than a thousand individuals that their personal data was siphoned from its systems.…

Clop's Oracle EBS exploit spree shows no sign of slowing, claims nearly 30 more casualties in media, finance, and tech. Digital engineering outfit GlobalLogic says personal data from more than 10,000 current and former employees was exposed in the wave of Oracle E-Business Suite (EBS) attacks attributed to the Clop ransomware gang. The Hitachi-owned biz joins a growing roster of high-profile victims that also now includes The Washington Post and Allianz UK.…

Breach Notification Service Details Peer-to-Peer Lending Marketplace Victim CountHackers appear to have stolen personal information pertaining to more than 17 million individuals from peer-to-peer lending marketplace Prosper, including Social Security numbers, contact information and some income and financial details, says the Have I Been Pwned breach notification service.

Microsoft, PayPal, Docusign, and others are among the trusted brands threat actors use in socially engineered scams that try to get victims to call adversary-controlled phone numbers.

Cybersecurity researchers are calling attention to phishing campaigns that impersonate popular brands and trick targets into calling phone numbers operated by threat actors

Group Amassed Intelligence on CFO to Trick Help Desk and Gain Initial AccessHackers tied to the cybercrime group Scattered Spider have been taking down fresh victims, including a logistics firm first breached when attackers tricked its help desk, using personal information they amassed for the CFO, reports the security team that responded to the intrusion.

Breach Victim Tally Soars Since Firm Filed an Initial Breach Report in Early AprilKelly Benefits is notifying nine large clients and nearly 264,000 individuals that their sensitive personal information was potentially compromised in a December data theft incident. The tally of affected people has climbed eight-fold since the company’s first estimate earlier this month.

Financial technology giant Finastra is notifying victims of a data breach after their personal information was stolen by unknown attackers who first breached its systems in October 2024. [...]

Education software giant PowerSchool has started notifying individuals in the U.S. and Canada whose personal data was exposed in a late December 2024 cyberattack. [...]

Organized crime types tend not to be kind to those who go against them, so this is nasty A local Japanese government agency dedicated to preventing organized crime has apologized after experiencing an incident it fears may have led to a leak of personal information describing 2,500 people who reached out to it for consultation.…

DOJ Accuses Alleged Hackers of Stealing Terabytes of Data from Snowflake VictimsThe Justice Department unsealed an indictment against alleged hackers Connor Moucka and John Binns, accusing them of stealing data from the cloud platform Snowflake, extorting millions in bitcoin and stealing sensitive personal information from over 165 organizations and millions of individuals.

Breaches Often Have Harmful, Under-Acknowledged 'Ripple Effect' on Victims' LivesToo many breached organizations fail to acknowledge the detrimental impact their mishandling of people's personal data can have on affected individuals, and to treat victims with the "empathy" they deserve, said the U.K.'s privacy watchdog, the Information Commissioner's Office.

CERT-UA said the phishing campaign lures victims into downloading malware used to exfiltrate files containing sensitive personal data

Roadside assistance biz praised for deploying security monitoring software and reporting workers to cops Two former workers at roadside assistance provider RAC were this week given suspended sentences after illegally copying and selling tens of thousands of lines of personal data on people involved in accidents.…

Mobile users in Brazil are the target of a new malware campaign that delivers a new Android banking trojan named Rocinante

An Australian man has been charged with running a fake Wi-Fi access point during a domestic flight with an aim to steal user credentials and data

Evil twin Wi-Fi access points mimicked legitimate networks to capture personal data from unsuspecting victims who mistakenly connected to them