Kirsten Doyle

Getting locked out of your Google account is more than an annoyance, it can be a major headache. You can lose hours in endless recovery loops, and still end up nowhere. Now, Google says it’s found a simpler fix: you can call a friend for help. As CNET reports, Google’s new Recovery Contacts feature lets you nominate a trusted friend to verify your identity if you get locked out. Setup is simple: choose your most reliable ally (a partner, sibling, or friend) and send them an invite through your Google Account’s Security settings. Once they accept, they’ll be your backup lifeline. If you’re ever locked out, they’ll receive a prompt…

Sotheby’s has confirmed a data breach following unauthorized access to its internal systems, exposing sensitive personal information belonging to clients. The breach happened on 24 July 2025, and was discovered two months later, on 24 September. An investigation led by external forensic specialists found that an unknown actor had exfiltrated internal data.   The review process, downloading, cataloging, and analyzing the stolen files, ended in late September. While Sotheby’s has not disclosed how many individuals were affected, the compromised data possibly includes names, Social Security numbers, and financial account details. Only two Maine residents are confirmed among the victims, though the there may be many more. Founded in 1744, Sotheby’s is one…

When bad actors can weaponize trusted software so effectively that a vendor has to rewrite its own documentation, something fundamental has shifted. That’s exactly what happened when the China-backed advanced persistent threat (APT) group known as Flax Typhoon, maintained year-long access to an ArcGIS server without deploying a single piece of traditional malware.  “This was the first documented case of a malicious SOE being used in this way,” ArcGIS said after working with ReliaQuest investigators. “It prompted updates to our internal documentation.” Turning Trust into a Weapon For more than twelve months, Flax Typhoon quietly controlled a customer’s ArcGIS environment…

SimonMed Imaging, one of the largest outpatient medical imaging providers in the US, has confirmed that it fell victim to a cyberattack that potentially exposed sensitive patient information earlier this year.  The company said it was first alerted on 27 January 2025, when one of its vendors reported a security incident. A day later, SimonMed detected suspicious activity within its own network, prompting what it describes as an immediate and comprehensive response. In a statement, the company said it “promptly began an investigation and took steps to contain the situation,” including resetting passwords, tightening multifactor authentication, enhancing endpoint monitoring, and…

Identity failed more organizations this year, and the damage hit harder. The takeaway: without decisive action, leaders will see risks grow sharper, losses deeper, and recovery slower. That’s one of several warnings from the 2026 RSA ID IQ Report, which surveyed more than 2,000 global experts to understand how often identity security failed them, what it cost, and where they see the greatest threats ahead.  The data tells a clear story. The identity gap is widening. Most companies still depend on legacy tools that can’t keep pace with modern attacks. Passwords remain the dominant method of authentication, and the weakest…

In late September 2025, eSentire’s Threat Response Unit (TRU) found something new and dangerous. A Rust-based backdoor inside a financial services client’s network. They called it ChaosBot. ChaosBot uses Discord (the same chat service gamers and teenagers use every day) as its command center. A malefactor calling himself “chaos_00019” controlled it, sending instructions to infected machines through Discord’s normal channels. The malware didn’t target everyone. Its operators seemed to focus on Vietnamese speakers. Not exclusively, but often enough to notice. The Break-In The attack began with stolen credentials. One belonged to a VPN user, another to an over-privileged Active Directory…

The Civil Guard has dismantled one of Spain’s most active phishing networks, arresting a 25-year-old Brazilian developer known online as “GoogleXcoder.” He stands accused of designing and selling phishing kits that allowed other criminals to mimic banks, government agencies, and public institutions. Since 2023, a slew of phishing attacks have swept across Spain. Bad actors posed as trusted entities, fooling victims into revealing personal details. The losses ran into millions. Complaints surged and anxiety grew. The Civil Guard’s Cybercrime Unit began hunting for the scammers, as well as the author behind the code. Their trail led to “GoogleXcoder,” a developer…

Japan’s leading beverage company, Asahi, has suffered a significant disruption to its operations following a cyberattack that began on 29 September 2025. The attack has led to a complete system failure, halting production, order processing, shipping, and customer service activities across the company’s Japanese operations. Asahi said that there has been no confirmed leakage of personal or customer data to external parties. Asahi Group Holdings is known for its diverse portfolio of brands, including Asahi Super Dry beer, Nikka Whisky, and Mitsuya Cider. Established in 1889 and headquartered in Tokyo, the company operates 30 plants in Japan and has a…

Researchers from Palo Alto’s Unit 42 say a suspected group of Chinese actors infiltrated email servers used by foreign ministries. The attackers accessed Microsoft Exchange systems and combed through messages related to diplomatic activities. The threat, dubbed “Phantom Taurus” targets governments and telecoms across Africa, the Middle East, and Asia. Its operations align closely with China’s strategic interests. The group started as a faint pattern in telemetry, labeled CL-STA-0043. By 2024, it became a temporary group, TGR-STA-0043, or Operation Diplomatic Specter. After extended observation, Unit 42 concluded it is a distinct threat actor: Phantom Taurus. Its focus is precise: embassies,…

Noma Labs has uncovered a severe flaw in Salesforce’s Agentforce platform. The chain of vulnerabilities, dubbed ForcedLeak, carried a CVSS score of 9.4 and exposed customer data to theft through indirect prompt injection and a loophole in Salesforce’s Content Security Policy. The weakness lay in how Agentforce (an autonomous AI agent) processed instructions. Unlike conventional chatbots, these agents can act on data without constant oversight – an autonomy that created a wider, more dangerous attack surface. The Mechanics Bad actors slipped malicious instructions into Salesforce’s Web-to-Lead form, hiding payloads in the Description field. When staff later queried those leads through…