Kirsten Doyle

A breach at a Dutch laboratory has exposed the personal and medical data of more than 485,000 women in the national cervical cancer screening programme. The attack hit Clinical Diagnostics NMDL, a Eurofins subsidiary in Rijswijk. The lab tests self-sample kits and smear test samples for Bevolkingsonderzoek Nederland (Population Research Netherlands). Bad actors accessed names, addresses, dates of birth, citizen service numbers, possible test results, and the names of participants’ healthcare providers  The ICT systems of Population Research Netherlands were not compromised. “We Are Extremely Shocked” Elza den Hertog, chair of the board at Population Research Netherlands, said: “We are…

Cybersecurity researchers at two companies have uncovered a jailbreak technique that bypasses ethical guardrails set up by OpenAI in its latest large language model (LLM), GPT-5, and produces illicit instructions.    AI security startup SPLX, used more than 1,000 adversarial prompts in different configurations and found that the raw, unguarded GPT-5 without a system prompt will fall for a whopping 89% of attacks. This shows an 11% overall performance score. OpenAI’s system prompt, a “basic prompt layer,” limits the success rate of attacks to 43%. Although this vastly improves hallucination handling and safety, the overall score is still very low, and…

A Google Calendar invite. That’s all it took. Researchers from SafeBreach Labs have shown that an LLM-powered assistant like Google’s Gemini can be tricked into running malicious commands, accessing sensitive data, and even manipulating physical devices in a victim’s home, without a single click. Their work introduces a new variant of Promptware, called Targeted Promptware Attacks. The concept is simple. An attacker embeds a malicious instruction inside a calendar event title or email subject line. When Gemini retrieves that data, for instance, when a user asks “What’s on my calendar?”, the hidden instruction slips into the model’s context and is…

Red Canary has published its mid-year update to the 2025 Threat Detection Report, and the message is that threat actors are shifting tactics, and identity is the new battleground. Based on detections gathered in the first half of the year, the update shows a marked rise in cloud and identity threats, along with troubling signs that even subtle user behaviour may now signal larger risks ahead. Some threats are obvious. Others creep in, masked as routine. Among the most striking findings is a 500% surge in Cloud Account detections compared to all of 2024.  According to Red Canary, much of…

The healthcare industry’s digital expansion may be exposing more than it protects. How would you feel if strangers online saw your MRI scan and knew your diagnosis, maybe even before you did? That’s not a hypothetical, it’s already happening. New research from Modat shows that more than 1.2 million internet-connected healthcare devices and systems are publicly accessible online, leaking private patient data (from brain scans to blood tests) through basic security lapses.  Many of these devices are misconfigured, poorly secured, or running on outdated software. Some don’t require authentication at all. Others are protected by default or weak passwords like…

Pandora, the world’s largest jewelry brand by revenue, has confirmed it was the target of a cyberattack that exposed customer data. The Danish company, known for its charm bracelets and global retail presence, said the breach occurred via a third-party platform it uses for customer services. The incident, first reported by Forbes, adds Pandora to an increasingly long list of luxury and high-street retailers affected by cybersecurity breaches in recent months. In a service email titled “This is an important service email from Pandora regarding a personal data breach,” customers were informed that basic personal details (names and email addresses)…

WhatsApp has removed nearly seven million accounts tied to global scams in just six months, the BBC reports.  According to parent company Meta, many of these accounts were traced back to scam centres in South East Asia, some operated by criminal networks using forced labour. The revelation comes alongside WhatsApp’s rollout of new anti-scam tools, including a warning system for users added to group chats by people outside their contacts.  Meta says its systems detected and disabled millions of accounts before scammers could make them operational. The tactic is part of a larger and more troubling pattern: bad actors pose…

Chanel has confirmed a data breach that affected its U.S. client care database. The news first came from WWD on Friday. The incident happened on July 25 and involved unauthorized access to a database managed by a third-party provider.  A company spokeswoman confirmed the incident, saying: “The investigation indicates that there was unauthorized access to this database. There was no malware deployed to our systems, and our operations remain unaffected.”  She added that Chanel immediately activated their incident response protocols and brought cybersecurity experts on board to aid their investigation.  The information exposed was limited. Names, emails, mailing addresses, and…

In August, cybersecurity firm CTM360 uncovered a large-scale scam targeting TikTok Shop users. Called “FraudOnTok,” this campaign combines phishing with malware. It uses a complex web of fake sites and apps to trick victims into handing over their credentials, and their money. The bad actors set up more than 15,000 lookalike domains. They mimic TikTok Shop, TikTok Wholesale, and TikTok Mall, using cheap domain extensions like .top, .shop, and .icu. These sites fool users into believing they’re on the official platform. Once there, victims are hit with phishing pages that steal login info, and are prompted to download trojanized apps…

By 2024, AI had done more than disrupt industries. It had quietly supercharged one: data brokerage. Few consumers ever meet a data broker and even fewer understand what they do. But their work touches nearly every person with a smartphone, a loyalty card, or an internet connection.  The Invisible Harvest Data brokers operate in silence. They gather, compile, and sort.  According to vpnMentor: “They often do this indirectly and without explicit consent, instead maximizing public records, traceable online activity, or other openly accessible channels.  Names, phone numbers, IP addresses. Birthdays, income brackets, voter registrations, browsing habits, shopping carts, and app…