Sax LLP, also known as Sax Advisory Group, disclosed a 2024 data breach affecting its systems, which impacted over 228,000 individuals nationwide. The financial services firm identified unusual network activity on August 7, 2024, and took steps to secure their systems.
Software providers' terms and conditions tend to be lengthy, complex documents filled with legal jargon, making them difficult for the average user to understand. Terms and conditions for SaaS products lead to confusion and a lack of informed consent.
There has been an observed social engineering campaign posing as delivery failure notifications from the United States Postal Service (USPS). The message is addressed to a generic “customer” and directs the user to click the provided link to update their address details.
Iranian state-sponsored cyber threat actors—including groups operating under the direction of the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS)—represent a persistent and strategically motivated threat.
The University of Phoenix discovered a data breach involving its Oracle E-Business Suite platform. An unauthorized threat actor exploited a previously unknown software vulnerability in Oracle EBS to exfiltrate data within the University’s Oracle EBS environment.
Advanced persistent threat (APT) groups are integrating generative artificial intelligence (AI) into their cyber operations to accelerate and scale campaign coordination. Public and private reporting shows AI-assisted techniques emerging across the cyberattack lifecycle.
There is a new Xfinity/Comcast phishing campaign in which an email states that access to the user’s mailbox and stored data may be permanently discontinued if the user does not update their email. They employ actions taken by some providers to delete inactive accounts.
In these campaigns, threat actors pose as human resources (HR) departments and send emails claiming to contain information on upcoming salary increases and yearly bonuses. They deceive users into downloading unknown files, RMM tools, and more.
The NJCCIC observed a Ledger-themed cryptocurrency drainer phishing campaign targeting New Jersey State employees. Although “Ledger” appears in the sender’s display name, the sender’s email address comes from a “.kr” top-level domain (TLD) for South Korea.
The Aspen Cyber Summit is the nation’s premier annual technology and cybersecurity policy gathering. Since 2016, this flagship Aspen Institute conference has hosted the most consequential cybersecurity discussions of our time. This year, it was held on November 18.
