Kirsten Doyle

A British national accused of operating under the alias “IntelBroker” has been charged in the U.S. with a sweeping cybercrime campaign that caused more than $25 million in damages worldwide. Kai West, 25, allegedly led a prolific hacking operation that targeted over 40 organizations, including a U.S. telecom provider, a municipal health agency, and an internet service company. The scheme, prosecutors say, ran from 2023 to 2025. West, who also used the name “Kyle Northern,” is said to have operated a hacking group known as CyberN[——], selling stolen data on an underground forum. Information for sale included customer records, marketing…

Cisco has released urgent security fixes for two vulnerabilities affecting its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC). Both flaws, CVE-2025-20281 and CVE-2025-20282, carry a CVSS severity rating of 10.0. Through this exploit, an attacker could gain root access to systems that control identity and access management. Access would enable lateral movement, privilege elevation, and persistence for an extended duration. These two vulnerabilities are unrelated but as severe as each other. Both affect different API elements in ISE releases 3.3 and 3.4. (CVE-2025-20281 affects ISE and ISE-PIC releases 3.3 and later, while CVE-2025-20282 affects version 3.4 alone.) Cisco…

Ahold Delhaize USA has confirmed that personal, financial, and health information belonging to over 2.2 million individuals was compromised during a cybersecurity breach in November last year. Details of the breach were formally disclosed in a filing with the Maine Attorney General’s office on 26 June 2025. The incident, attributed to an external system intrusion, is now known to have affected exactly 2,242,521 individuals, including 95,463 residents of Maine. The breach happened on 5 November and was discovered the following day. While Ahold Delhaize acknowledged the attack at the time, this latest filing unveils the scale and sensitivity of the…

More than 2,000 government-issued laptops, phones and tablets were lost or stolen across Whitehall departments over the past year, as reported by The Guardian. The estimated replacement cost? £1.3 million. The broader cost to national security is a lot harder to calculate. Departments including the Ministry of Defence (MoD), the Department for Work and Pensions, and the Cabinet Office reported hundreds of missing devices in 2024 and early 2025. In just the first five months of this year, the MoD alone reported 103 laptops and 387 phones gone missing. The Home Office, Treasury, and Bank of England were among other…

A Canadian online gambling provider has fallen victim to a highly targeted cyberattack involving a fake Zoom support tool, part of a broader social engineering campaign orchestrated by BlueNoroff, a financially motivated North Korean APT subgroup tied to the Lazarus Group. Investigators from Field Effect Analysis revealed that the incident began on 28 May 2025, during what appeared to be a routine Zoom call between the victim and a known contact. When audio issues arose, the victim was urged to run a so-called Zoom audio repair script, actually a malicious payload disguised to blend seamlessly into the victim’s workflow. The…

Oxford City Council has confirmed it was the target of a cyberattack that led to the unauthorised access of personal information belonging to individuals involved in council-run elections over the past two decades. The breach was quickly detected by the council’s automated security systems. It triggered an immediate response that limited the threat attackers’ access. “Unfortunately, the attackers were able to access some historic data on legacy systems,” the Council said in a statement. “We have now identified that people who worked on Oxford City Council-administered elections between 2001 and 2022, including poll station workers and ballot counters, may…

American insurance giant Aflac has disclosed a cyberattack on its U.S. network, part of what it describes as a broader campaign targeting the insurance sector. The intrusion was detected on 12 June and stopped within hours, with no ransomware deployed and no disruption to operations. The company says it remains fully operational and continues to underwrite policies and process claims. However, preliminary findings suggest that a sophisticated cybercrime group used social engineering tactics to gain access. Aflac says it has engaged external cybersecurity experts to support its response and containment efforts. While the investigation is still in its early stages,…

Krispy Kreme has disclosed that its November 2024 data breach affected 161,676 people.  In a breach notification shared this week, the company said exposed data varies by person, but the list is long and deeply personal. It includes names, Social Security numbers, dates of birth, and driver’s license or state ID numbers. In some cases, it extends to financial account details, login credentials, debit and credit card data (including security codes), passport numbers, digital signatures, and biometric identifiers. Also potentially compromised: military ID numbers, USCIS or Alien Registration Numbers, and sensitive health or insurance information. The disclosure comes months after…

As the public feud between Elon Musk and Donald Trump heats up online, cybercrooks are wasting no time cashing in on this clash of egos. According to new findings from BforeAI’s PreCrime Labs, at least 39 malicious domains were registered within 48 hours of Musk’s widely publicized 4 June remarks criticizing Trump’s proposed trade legislation.   These domains are designed to impersonate betting sites, fake giveaways, and crypto multipliers, all under the guise of the Musk vs. Trump rivalry. The tactic isn’t new. Threat actors have long exploited celebrity disputes and political theater to bait users into scams. But this campaign…

Swiss banks UBS and Pictet confirmed this week that a third-party cyberattack led to a leak of internal company data, highlighting the growing threat of supply chain vulnerabilities in financial services.  The breach stemmed from an attack on Chain IQ, a Baar-based procurement services provider. Chain IQ said it was one of 20 organisations targeted in a sophisticated intrusion that leveraged techniques “never before seen on a global scale.” UBS moved quickly to reassure stakeholders. “A cyber attack at an external supplier has led to information about UBS and several other companies being stolen. No client data has been affected,”…