Security

The airline says the Monday attack stole personal data of six million customers via a third-party service platform:

The idea is to make using passkeys a little more seamless. But this isn’t available to everyone just yet: Microsoft is initially rolling it out to Windows Insiders in the Dev Channel and you need to install the 1Password beta.

The original source of the report, Cybernews, says that since the start of the year, its researchers have “discovered 30 exposed datasets containing from tens of millions to over 3.5 billion records each. In total, the researchers uncovered an unimaginable 16 billion records.”

The tool, which is built into DuckDuckGo’s browser, displays a warning message when you click on potentially dangerous sites. In addition to blocking phishing sites, malware, and common online scams, DuckDuckGo has expanded the tool to protect against fake online stores, phony crypto exchanges, and those obnoxious sites that falsely claim your device has a virus.

A 2023 breach of genetic testing company 23andMe that leaked sensitive data for millions of customers already led to a $30 million settlement and, eventually, bankruptcy for the company once valued at $6 billion. Now the UK is layering on a fine of just over $3 million for failing to protect the genetic data of 155,592 UK residents. It comes just days after co-founder and former CEO Anne Wojcicki said she was buying back the company’s assets for $305 million.

The Wall Street Journal reports that on Sunday, an internal memo from executive editor Matt Murray notified employees about an attack on on its email system, possibly by a foreign government. It also cites unnamed sources saying that the Microsoft accounts targeted included reporters on the national security and economic policy beats including some who write about China.

The vulnerability, called “EchoLeak,” lets attackers “automatically exfiltrate sensitive and proprietary information” from Microsoft 365 Copilot without knowledge of the user, according to findings from Aim Labs.

Meta and Yandex were tracking Android users’ browsing data far more closely than they should have been, according to researchers. They bypassed the Android “sandbox” in some browsers, letting them de-anonymize users, track how they browse, and then use that data in native Facebook, Instagram, and Yandex apps.

The company behind the Murena 2 smartphone and de-Googled Pixel Tablet has announced a new version of its operating system: /e/OS 3.0. It will make better use of the larger screens on tablets and give parents new tools for limiting screen time and app access.

On the list of apparel-related data breaches, Adidas was early to the trend. Then, the Victoria’s Secret website was offline for a few days last week as it dealt with a “security incident.”

The company released a statement last week disclosing that an “unauthorized external party” managed to obtain “contact information relating to consumers who had contacted our customer service help desk in the past.”

The tumultuous year under the Trump administration continues for the Cybersecurity and Infrastructure Security Agency (CISA), as many senior officials across the agency have recently left, or will soon be leaving, according to a report by The Washington Post and cited by Cybersecurity Drive. These departures punctuate numerous setbacks the agency has faced since Trump took office, including being told to halt its election security efforts and almost lapsing the CVE program that some of the world’s biggest companies rely on to track cybersecurity vulnerabilities.

On Monday, a report from 404Media found that a hacker obtained direct messages and CBP contact information from TeleMessage after Mike Waltz was spotted using the company’s modified version of Signal.

Donald Trump announced Thursday that he would remove Michael Waltz as National Security Advisor and appoint him as ambassador to the United Nations. CBS reported earlier that Trump did not want to explicitly fire Waltz, the person who accidentally added The Atlantic’s Jeffrey Goldberg to the group chat, but waited several weeks before he could spin the demotion as part of a reorganization strategy at the National Security Council.

The increase in AI tools, deepfake technology, and fully remote jobs following the covid pandemic has enabled a new kind of scam: workers who take jobs with US and European companies under false identities and send their salaries to the North Korean government.

Dutch right-wing activist Eva Vlaardingerbroek reported receiving a message from Apple, saying the company “detected a targeted mercenary spyware attack against your iPhone.” The message adds, “This attack is likely targeting you specifically because of who you are or what you do.”