Kirsten Doyle

Japan’s leading beverage company, Asahi, has suffered a significant disruption to its operations following a cyberattack that began on 29 September 2025. The attack has led to a complete system failure, halting production, order processing, shipping, and customer service activities across the company’s Japanese operations. Asahi said that there has been no confirmed leakage of personal or customer data to external parties. Asahi Group Holdings is known for its diverse portfolio of brands, including Asahi Super Dry beer, Nikka Whisky, and Mitsuya Cider. Established in 1889 and headquartered in Tokyo, the company operates 30 plants in Japan and has a…

Researchers from Palo Alto’s Unit 42 say a suspected group of Chinese actors infiltrated email servers used by foreign ministries. The attackers accessed Microsoft Exchange systems and combed through messages related to diplomatic activities. The threat, dubbed “Phantom Taurus” targets governments and telecoms across Africa, the Middle East, and Asia. Its operations align closely with China’s strategic interests. The group started as a faint pattern in telemetry, labeled CL-STA-0043. By 2024, it became a temporary group, TGR-STA-0043, or Operation Diplomatic Specter. After extended observation, Unit 42 concluded it is a distinct threat actor: Phantom Taurus. Its focus is precise: embassies,…

Noma Labs has uncovered a severe flaw in Salesforce’s Agentforce platform. The chain of vulnerabilities, dubbed ForcedLeak, carried a CVSS score of 9.4 and exposed customer data to theft through indirect prompt injection and a loophole in Salesforce’s Content Security Policy. The weakness lay in how Agentforce (an autonomous AI agent) processed instructions. Unlike conventional chatbots, these agents can act on data without constant oversight – an autonomy that created a wider, more dangerous attack surface. The Mechanics Bad actors slipped malicious instructions into Salesforce’s Web-to-Lead form, hiding payloads in the Description field. When staff later queried those leads through…

Harrods says attackers made contact after a breach compromised data belonging to 430,000 customers. The luxury department store said it will not be engaging with them. The information was taken from a third-party provider. In a statement, Harrods said: “We proactively informed affected e-commerce customers on Friday that the impacted personal data is limited to basic personal identifiers including name and contact details, where this information has been provided. It does not include account passwords or payment details. “Affected customer records may also have labels related to marketing and services delivered by Harrods. “These labels may include tier level or…

Federal civilian agencies must immediately patch critical Cisco firewall vulnerabilities being exploited by an “advanced threat actor.”   The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive ordering immediate action. The vulnerabilities (CVE-2025-20333 and CVE-2025-20362) affect Cisco Adaptive Security Appliances (ASA). One allows remote code execution, the other privilege escalation. Bad actors have been seen chaining the two. The first carries a severity score of 9.9, the second 6.5. Cisco released patches last Thursday. Acting CISA Director Madhu Gottumukkala stressed the urgency. “Threat actors can exploit these vulnerabilities with alarming ease, maintain persistence, and gain access to a network,”…

A phishing lure opened the door.  At first glance it looked ordinary: a ZIP file, a signed PDF reader, a misplaced DLL. The DLL sideloaded itself into a trusted process and set the rest in motion.   According to Huntress, what followed was a deliberate climb from simple Python scripts to a polished, modular remote access trojan called PureRAT. The path matters, but the method matters more. The chain used several steps, each of which removed friction for the attacker and increased resilience for the implant. No single control would have stopped it. The Detail The email held a ZIP and…

Every digital interaction begins with a question: Who are you? The answer may be simple like a name and an email to join a newsletter. Or it may be complex, like a government-issued ID, biometric scan, or third-party verification service. But as the tools of identity verification expand, so too do the risks to privacy. To explore this tension, we spoke with two experts: Ross Moore, Information Security Researcher, and Chloé Messdaghi, Founder & Principal Advisor at Thornbridge Advisory. Their perspectives highlight both the history that brought us here and the future we are building. A future where convenience, trust,…

The phishing wave hasn’t stopped. It has only shifted.  This week, PyPI users are the target. Attackers are sending emails that look official, asking recipients to “verify their email address” for “account maintenance and security procedures.” The message warns of suspension if ignored. The link, however, points to pypi-mirror.org, a domain unaffiliated with PyPI or the Python Software Foundation. If you clicked and entered your credentials, act fast: change your PyPI password and review your Security History for unusual activity. Any signs of compromise should be reported to [email protected]. The tactic isn’t new. Earlier this year, PyPI saw a nearly…

Ransomware payments are down. Attacks are not.  Ontinue’s 2025 half-year threat intelligence report shows a 35% decline in reported ransomware payments compared to last year, from $1.25 billion to $813 million. Yet the number of claimed breaches tells another story. In the first six months of 2025, 4,071 ransomware incidents were recorded across 109 countries. Ninety active groups drove that wave, led by CL0P, AKIRA, and QILIN. Services, manufacturing, IT and communications, and retail were hardest hit. Affiliate networks kept operating even after takedowns, rebranding, and resurfacing. LockBit, for example, re-emerged in updated 4.0 and 5.0 forms, showing how quickly…

Stellantis, the parent of Citroën, FIAT, Jeep, Chrysler, and Peugeot, has confirmed a data breach affecting customers in North America. The company said on Sunday it detected unauthorized access through a third-party service provider that supports its customer service operations. Stellantis did not disclose how many people were affected. The compromised data included customer names, addresses, phone numbers, and email addresses. Stellantis stressed that no financial details or other sensitive personal information were exposed. “Upon discovery, we immediately activated our incident response protocols … and are directly informing affected customers,” the company told Reuters. Federal authorities have been notified. Stellantis…