Kirsten Doyle

A tax credit consulting firm seems to have exposed the personal data of thousands of Americans after leaving a slew of sensitive documents unprotected online. The breach was discovered by cybersecurity researcher Jeremiah Fowler, who reported his findings to vpnMentor.  As outlined by Fowler, the unencrypted, non-password-protected database contained 245,949 records, which translated to nearly 287 GB of data. Among the files included: addresses, Social Security numbers, work history, and even DD214 U.S. Department of Defense discharge forms. Available to “Anyone With an Internet Connection” “In a limited sampling of the exposed documents, I saw files that detailed PII such…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four more security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, citing clear evidence of active exploitation in the wild.  The latest additions span a range of technologies, some dating back more than a decade. The vulnerabilities are:  CVE-2014-3931 (CVSS score: 9.8) – A buffer overflow vulnerability in Multi-Router Looking Glass (MRLG) that could allow remote attackers to cause an arbitrary memory write and memory corruption   CVE-2016-10033 (CVSS score: 9.8) – A command injection vulnerability in PHPMailer that could allow an attacker to execute arbitrary code within the context of…

Ingram Micro has confirmed a ransomware attack that has forced systems offline and disrupted core services across its global operations. The breach, first reported as an unexplained outage on 3 July has now been linked to the SafePay ransomware group, one of the more active players in the 2025 threat landscape. By 6 July, the IT distribution giant broke its silence: “Ingram Micro recently identified ransomware on certain of its internal systems,” the company said in a statement. “Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and…

The biggest threat to your business may no longer be malware or ransomware. It’s your people. Or rather, their identities. Between 2023 and the first quarter of 2025, identity-driven threats surged by 156%, now accounting for 59% of all confirmed cyber incidents, according to new research by eSentire’s Threat Response Unit (TRU). The findings mark a fundamental shift in how attackers gain access to organizations. Instead of breaking in, they log in. Where traditional attacks targeted software flaws or exposed ports, today’s adversaries are choosing the path of least resistance: valid user credentials. Often stolen. Sometimes bought. Occasionally given away.…

The ransomware crisis continues to deepen. In the first half of 2025, 3,627 attacks were logged worldwide, a 47% jump from the same period last year. But confirmation remains scarce. According to Comparitech, of those incidents, just 445 were publicly acknowledged by victims. The rest were claimed by threat actors on their leak sites, often without official word from the organizations themselves. Governments and schools are feeling the heat. Attacks on public-sector bodies rose nearly 60% year-on-year. Educational institutions also saw a marked increase, up 23%, with schools, colleges, and universities scrambling to keep up. Healthcare, long a favorite target,…

The infamous cybercrime group known as Scattered Spider is expanding its playbook, and laying the groundwork long before the breach. New findings from Check Point Research reveal a sprawling infrastructure of more than 500 phishing domains, many designed to impersonate enterprise login pages. It’s a quiet phase of attack planning, but one that holds critical value for defenders if they know what to look for. Login Pages with Malicious Intent Scattered Spider’s tactics are not new. Social engineering, MFA fatigue, and vishing have all featured in the group’s recent campaigns, including the July breach of Qantas, which affected six million…

Cisco has patched a critical flaw in its Unified Communications Manager (Unified CM) software that allowed unauthenticated remote attackers to log in using hardcoded root credentials. The vulnerability, tracked as CVE-2025-20309, carries a CVSS score of 10.0 (the highest possible) and affects select engineering special (ES) builds of version 15.0.  The issue stems from development leaving behind static SSH credentials. Cisco’s advisory says these credentials are tied to the root account and “cannot be changed or deleted.”  The bug, listed under Cisco Bug ID CSCwp27755, impacts Unified CM and Unified CM Session Management Edition (SME) releases 15.0.1.13010-1 through 15.0.1.13017-1. These…

Hunters International, a notorious ransomware gang with ties to past high-profile cyberattacks, says it’s closing shop. The group made the announcement Thursday via its darknet extortion site, claiming it would release free decryption tools to help past victims recover data.  “After careful consideration and in light of recent developments, we have decided to close the Hunters International project,” read the statement. No further detail was given on what those “developments” might be. The group added that the decision “was not made lightly.” Hunters International said it wanted to ensure that victims were able to recover their encrypted data without the…

Amazon Prime Day 2025 is almost here. So are the scammers. With global shoppers gearing up for deals on 8 July, bad actors are already laying traps. In June alone, researchers tracked more than 1,000 new domains mimicking Amazon. Nearly nine in ten were flagged as malicious or suspicious. Many used the phrase “Amazon Prime” to bait unsuspecting shoppers. One in every 81 of these risky domains contained the term. Check Point Research warns the threat is only ramping up. “Threat actors know shoppers are distracted and in a hurry. That’s when mistakes happen,” said Check Point. Why Prime Day…

The Schengen Information System II (SIS II) is meant to be a digital sentinel for Europe’s borders. It flags suspects, alerts officials, and logs biometric data in real time. But behind the promise lies a system riddled with security flaws. Bloomberg reviewed confidential documents showing thousands of unpatched vulnerabilities. Some date back years. In a 2024 audit, the European Data Protection Supervisor rated many as “high risk.” Most troubling of all are excessive admin access and inadequate oversight. No breach has been confirmed. But the doors appear wide open. Digital Eyes on Europe’s Borders SIS II is the EU’s largest…