Essential Steps to Building a Robust API Security Program

Anna Delaney • March 28, 2023

Recent high-profile breaches resulting from API attacks are "just the tip of the iceberg," said Gartner analyst Dionisio Zumerle. "What we have is a new way of exchanging information which is increasingly popular, and almost no organization has the recipe to secure that new way of communicating."

Finance & Banking

US Charges Bulgarian Woman in $4B OneCoin Fraud Case

Latest

Business Email Compromise (BEC)

Nigerian Sentenced to 4 Years for Scamming US Citizens

Mihir Bagwe • March 28, 2023

A U.S. federal judge sentenced a Nigerian national to four years in prison for running several cyber-enabled schemes aimed at defrauding U.S. citizens out of more than $1 million. The men were arrested four years ago and extradited to Arizona in 2022 from Malaysia and the United Kingdom.

Critical Infrastructure Security

Lawmakers Urge CISA to Devise Better Measures of Performance

Michael Novinson • March 28, 2023

Lawmakers urged Director Jen Easterly to devise metrics that quantify how effectively the Cybersecurity and Infrastructure Security Agency uses federal money to cut cyber risk. Rep. Dave Joyce wants CISA to more precisely measure the return on taxpayer spending given the agency's rising budget.

Events

'Stronger Together' - Preview of RSA Conference 2023

Tom Field • March 28, 2023

"Stronger Together" is the theme of RSA Conference 2023. In an exclusive preview of the event, Linda Gray Martin and Britta Glade explain why that theme was selected - and what attendees can expect to see from sessions, speakers and sponsors when they attend the annual gathering in San Francisco.

Blockchain & Cryptocurrency

North Korean Threat Groups Steal Crypto to Pay for Hacking

Rashmi Ramesh • March 28, 2023

North Korean hackers are stealing cryptocurrency to fund operations under an apparent mandate from Pyongyang to be self-sufficient, threat intel firm Mandiant says. The regime probably expected its hackers to pay their own way before 2020, but the novel coronavirus pandemic exacerbated its demands.

Cybercrime

Latitude Financial Admits 14M Customer Details Breached

Prajeet Nair • March 27, 2023

A hacking incident at Australian non-bank lender Latitude Financial affected a far greater number of individuals than initially disclosed, the company said Monday. It now estimates that its mid-March cybersecurity incident affected 14 million people although it has just over 2.8 million customers.

Fraud Management & Cybercrime

TikTok Faces Further Bans in Europe

Akshaya Asokan • March 27, 2023

The French government imposed a ban on TikTok and other social media apps after concluding that "recreational apps" lack sufficient "levels of cybersecurity and protection of data to be deployed on administrative equipment," said Stanislas Guerini, the minister of transformation and public service.

Fraud Management & Cybercrime

NY AG Hits Law Firm With $200K Settlement in Health Breach

Marianne Kolbasuk McGee • March 27, 2023

A New York medical malpractice law firm will pay $200,000 and implement data security improvements to settle a HIPAA enforcement action by the state attorney general's office following a 2021 ransomware attack by LockBit. Law firm Heidell, Pittoni, Murphy & Bach paid the hackers $100,000 in 2021.

Fraud Management & Cybercrime

Twitter Says Source Code Leaked on GitHub, Files Subpoena

Mihir Bagwe • March 27, 2023

Twitter says its source code was leaked by an unknown user on the popular open-source code collaboration platform GitHub. The social media giant requested a subpoena from a federal court Monday to force GitHub to provide details about the person behind the partial code leak.

Cyberwarfare / Nation-State Attacks

US Limits Government Use of Advanced Smartphone Spyware

David Perera • March 27, 2023

The U.S. government limited its use of advanced surveillance software such as Pegasus through an executive order prohibiting agencies from buying licenses for spyware used by foreign governments to spy on dissidents. The order does not outright stop the government from purchasing spyware.

Fraud Management & Cybercrime

Ransomware Groups Seek Fresh Tactics Following Hive Takedown

Mathew J. Schwartz • March 27, 2023

Stung by the FBI's infiltration and takedown of the Hive ransomware group, other ransomware operators have been retooling their approaches to make their attacks more effective and operations tougher to disrupt, says Yelisey Bohuslavskiy, chief research officer at threat intelligence firm Red Sense.

Artificial Intelligence & Machine Learning

ChatGPT Exposed Payment Card Data of Subscribers

Prajeet Nair • March 26, 2023

A now-patched bug that caused OpenAI to take down the ChatGPT chatbot for nine hours on Monday also revealed the last four digits of payment cards, the company disclosed Friday. One user said he saw the history of another account including the topics "phobia of rats" and "sexist music video clips."

Cybercrime

3-Year JS Injection Campaign Targets 51,000 Websites

Prajeet Nair • March 25, 2023

A widespread ongoing malicious JavaScript injection campaign first detected in 2020 has targeted over 51,000 websites, redirecting victims to malicious content such as adware and scam pages. Attackers are using several obfuscation tactics to bypass detection.