A total of 27 breaches were found and analysed resulting in 19,114,750 leaked accounts containing a total of 25 different data types. The breaches found publicly and freely available included Lime Leads [2], Stealer Log 0425, My Wallet, Toys’R’Us - Israel and 45Minut. Sign in to view the full BreachAware Breach Index which includes, where available, reference articles relating to each breach.

SPOTLIGHT

A threat actor allegedly responsible for hacking and dumping a large amount of sensitive data from the psychotherapy center Vastaamo (largest network of private mental-health providers in Finland), has been apprehended. The hacker obtained thousands of private medical records, considered highly sensitive by the company. Authorities tracked down the individual after he posted a picture on a Finnish message board, inadvertently revealing his fingerprints on a can of Evian facial spray, leading to his arrest.

An independent European technology company specialising in data lookups as a service, catering to businesses and governments of all sizes, has been targeted. Last week, an email and several files containing information on the new SSL certificate for the website were leaked online. The leaked files, intended for support to overwrite the current certificate, pose a significant security risk when circulating on dubious hacking forums.

A conflict has emerged between the head of a prominent ransomware gang and the administrator of a Russian hacking forum. Allegedly, the gang leader's sale of a product through the forum's escrow service went awry, resulting in his reputation being tarnished and labeled as a "ripper." In response, he has threatened the forum administrator with dire consequences.

VULNERABILITY CHAT

Samsung issued an update to its Magician Software for Windows after discovering a "high severity" vulnerability that allowed improper privilege control, potentially enabling a local attacker to access privileged data. The prompt action aimed to mitigate the risk posed by the vulnerability.

Ivanti identified a new vulnerability in one of its products, necessitating an immediate patch from users. Rated with a severity score of 8.3, the vulnerability permits an attacker to access restricted resources without authentication. While it was identified internally during code review and testing, there is no evidence of active exploitation in the wild.

2 Common Vulnerabilities and Exposure (CVEs) were added to the CyberSecurity & Infrastructure Security Agency's (CISA) 'Known Exploited Vulnerabilities Catalog' last week including Google (Chromium V8 Engine). See the full catalog here: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

The National Vulnerability Database (NVD), the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP), published 10 scored vulnerability identifications and summaries last week, 3 of which had a CVSS (Common Vulnerability Scoring System) severity of High and 7 as Medium. For more information visit https://nvd.nist.gov/

INFORMATION PRIVACY HEADLINES

The French data privacy watchdog reported a massive security breach affecting nearly half of France's citizens through two third-party healthcare payment services, Viamedis and Almerys. Viamedis fell victim to a phishing attack targeting healthcare professionals, while Almerys faced a compromise through its provider portal, exposing sensitive data of numerous individuals.

Choice, a consumer advocate group, revealed that smart technologies integrated into new Toyota cars are collecting personal data and potentially sharing it with insurance companies and other entities. The "Connected Services" feature gathers vehicle location, driving data, fuel levels, and personal contact information, raising concerns over data privacy and user consent.