Security

A Department of Homeland Security memo, obtained by Property of the People through a freedom of information request, reveals the group — suspected to have links to China — “extensively compromised a U.S. state’s Army National Guard network” for nine months last year.

Cameron John Wagenius, aka kiberphant0m, had already pleaded guilty on two charges for hacking T-Mobile and Verizon, and could face 20 years in prison after pleading guilty Tuesday to additional conspiracy, extortion, and identity theft charges.

Security researchers Ian Carroll and Sam Curry broke into the backend of McDonald’s hiring system by entering the username and password “123456,” as reported by Wired. They were then able to view the data of the more than 64 million applicants who interacted with McDonald’s AI hiring bot, Olivia.

The company built Zero-Knowledge Proof (ZKP) into Google Wallet earlier this year, a technology that allows users to verify their age across different apps and platforms without linking it to their identity.

That’s according to FBI Cyber division head Brett Leatherman, who told Cyberscoop that the China-linked hackers are “largely contained” and “dormant” in telecom networks.

The airline says the Monday attack stole personal data of six million customers via a third-party service platform:

The idea is to make using passkeys a little more seamless. But this isn’t available to everyone just yet: Microsoft is initially rolling it out to Windows Insiders in the Dev Channel and you need to install the 1Password beta.

The original source of the report, Cybernews, says that since the start of the year, its researchers have “discovered 30 exposed datasets containing from tens of millions to over 3.5 billion records each. In total, the researchers uncovered an unimaginable 16 billion records.”

The tool, which is built into DuckDuckGo’s browser, displays a warning message when you click on potentially dangerous sites. In addition to blocking phishing sites, malware, and common online scams, DuckDuckGo has expanded the tool to protect against fake online stores, phony crypto exchanges, and those obnoxious sites that falsely claim your device has a virus.

A 2023 breach of genetic testing company 23andMe that leaked sensitive data for millions of customers already led to a $30 million settlement and, eventually, bankruptcy for the company once valued at $6 billion. Now the UK is layering on a fine of just over $3 million for failing to protect the genetic data of 155,592 UK residents. It comes just days after co-founder and former CEO Anne Wojcicki said she was buying back the company’s assets for $305 million.

The Wall Street Journal reports that on Sunday, an internal memo from executive editor Matt Murray notified employees about an attack on on its email system, possibly by a foreign government. It also cites unnamed sources saying that the Microsoft accounts targeted included reporters on the national security and economic policy beats including some who write about China.

The vulnerability, called “EchoLeak,” lets attackers “automatically exfiltrate sensitive and proprietary information” from Microsoft 365 Copilot without knowledge of the user, according to findings from Aim Labs.

Meta and Yandex were tracking Android users’ browsing data far more closely than they should have been, according to researchers. They bypassed the Android “sandbox” in some browsers, letting them de-anonymize users, track how they browse, and then use that data in native Facebook, Instagram, and Yandex apps.

The company behind the Murena 2 smartphone and de-Googled Pixel Tablet has announced a new version of its operating system: /e/OS 3.0. It will make better use of the larger screens on tablets and give parents new tools for limiting screen time and app access.

On the list of apparel-related data breaches, Adidas was early to the trend. Then, the Victoria’s Secret website was offline for a few days last week as it dealt with a “security incident.”

The company released a statement last week disclosing that an “unauthorized external party” managed to obtain “contact information relating to consumers who had contacted our customer service help desk in the past.”

The tumultuous year under the Trump administration continues for the Cybersecurity and Infrastructure Security Agency (CISA), as many senior officials across the agency have recently left, or will soon be leaving, according to a report by The Washington Post and cited by Cybersecurity Drive. These departures punctuate numerous setbacks the agency has faced since Trump took office, including being told to halt its election security efforts and almost lapsing the CVE program that some of the world’s biggest companies rely on to track cybersecurity vulnerabilities.