Latest Security News Collection
Public Transport at Risk: Free Wi-Fi on Buses Opens Door to Remote Hacking
Section titled “Public Transport at Risk: Free Wi-Fi on Buses Opens Door to Remote Hacking”#PublicTransportSecurity #BusWiFiRisks #RemoteHacking #IoTVulnerabilities #SmartMobility #CyberThreats #TransportCybersecurity #GPSManipulation #NetworkSegmentation #SecurityWeekReport
Cybersecurity researchers have uncovered serious vulnerabilities in public buses offering free Wi-Fi, revealing that attackers could remotely track, control, or spy on vehicles and passengers. The flaws lie in both onboard systems and remote management platforms, which often lack proper authentication and encryption. By exploiting these weaknesses, hackers could intercept communications, manipulate GPS data, or even disable critical functions. The study highlights the growing risks associated with poorly secured Internet of Things (IoT) devices in public infrastructure. As transport systems become increasingly connected, experts urge operators to implement stronger security protocols, including network segmentation, firmware updates, and secure access controls. The findings serve as a wake-up call for municipalities and transit providers to prioritise cybersecurity in smart mobility initiatives.
→ Read more on securityweek.com
Elder Fraud Losses Soar to $700 Million as Scammers Exploit Trust and Vigilance
Section titled “Elder Fraud Losses Soar to $700 Million as Scammers Exploit Trust and Vigilance”#ElderFraud #FTCWarning #ImpersonationScams #PhishingAlert #CryptocurrencyScams #SeniorSecurity #DigitalVigilance #FinancialProtection #Cybercrime2025 #ScamAwareness
The Federal Trade Commission (FTC) has reported a dramatic rise in elder fraud, with losses reaching $700 million in 2024—an eightfold increase since 2020. Most victims were aged over 60 and lost over $100,000 to impersonation scams, often involving fake security alerts or fraudulent calls from supposed government or tech representatives. Scammers exploited retirees’ vigilance by posing as trusted entities like banks, Microsoft, or Apple, initiating contact via phone calls, pop-ups, or emails. Alarmingly, 33% of victims paid in cryptocurrency, often via Bitcoin ATMs, while others used bank transfers, cash, or even gold. The FTC warns that these scams frequently begin with phishing and manipulate fears around identity theft and financial security. The report underscores the urgent need for targeted awareness and stronger protections for older adults in the digital age.
→ Read more on cybernews.com
Cyberattacks Grow More Targeted Despite Decline in Overall Incidents
Section titled “Cyberattacks Grow More Targeted Despite Decline in Overall Incidents”#CyberThreats2025 #TargetedAttacks #MyraSecurity #SlowlorisAttack #FinancialSectorSecurity #TechIndustryRisks #CloudInfrastructure #IPSpoofing #DigitalSovereignty #CyberSecurityGermany
A recent report by Myra Security reveals a paradox in Germany’s cyber threat landscape: while the number of documented attacks dropped by 18.5% in the first half of 2025, their precision and complexity have significantly increased. Attackers are now deploying more refined tactics and selecting targets strategically, indicating a rise in professionalisation. The financial sector remains the most affected, with 40% of attacks aimed at banks and financial services. Notably, a 16-hour coordinated assault in May used techniques like Slowloris to exhaust network resources. The tech industry follows closely, facing prolonged and intense attacks. Many threats originate from cloud infrastructures, masking the true source through IP spoofing and botnets. Experts warn that Europe’s reliance on non-European IT solutions poses a growing security risk, urging investment in digital sovereignty.
→ Read more on it-daily.net
ScarCruft Hacker Group Adds Ransomware to Espionage Arsenal in Evolving Threat Campaign
Section titled “ScarCruft Hacker Group Adds Ransomware to Espionage Arsenal in Evolving Threat Campaign”#ScarCruft #APT37 #NorthKoreaCyber #RansomwareShift #RoKRATMalware #CyberEspionage #PhishingCampaign #StateSponsoredThreats #YandexLinks #InfosecUpdate
The North Korean state-sponsored hacking group ScarCruft, also known as APT37, has reportedly incorporated ransomware into its cyber-espionage operations. Traditionally focused on intelligence gathering, the group is now blending financial motives with its geopolitical agenda. Recent campaigns targeted South Korean organisations using phishing emails disguised as invitations from think tanks and experts on North Korea. These emails contained Dropbox links that deployed malware via PowerShell commands, including RoKRAT—a tool capable of system surveillance and data exfiltration. Researchers also uncovered links to Russian Yandex email accounts, though their role remains unclear. The shift towards ransomware suggests a strategic evolution, possibly aimed at funding operations or increasing disruption. This development highlights the growing complexity of nation-state cyber threats and the blurred lines between espionage and cybercrime.
→ Read more on therecord.media
Bouygues Telecom Suffers Major Cyberattack Affecting 6.4 Million Customers
Section titled “Bouygues Telecom Suffers Major Cyberattack Affecting 6.4 Million Customers”#BouyguesTelecom #DataBreach #CyberAttack #TelecomSecurity #CustomerDataLeak #CNILNotification #FrenchCybersecurity #HackreadReport #CriticalInfrastructure #InfosecAlert
French telecom giant Bouygues Telecom has confirmed a significant cyberattack that compromised the personal data of approximately 6.4 million customers. The breach, which targeted the company’s customer management systems, exposed sensitive information including names, contact details, and account identifiers. While no financial data or passwords were reportedly leaked, the scale of the incident has raised serious concerns about data protection in the telecom sector. Bouygues Telecom has launched an internal investigation and notified the French data protection authority (CNIL). The company is also contacting affected customers and reinforcing its cybersecurity measures. This incident adds to a growing list of telecom breaches globally, highlighting the vulnerability of critical infrastructure to increasingly sophisticated cyber threats.
→ Read more on hackread.com
Australian Regulator Sues Optus Over Massive Data Breach Affecting 9.5 Million Customers
Section titled “Australian Regulator Sues Optus Over Massive Data Breach Affecting 9.5 Million Customers”#OptusDataBreach #AustralianPrivacyAct #AICLawsuit #CyberSecurity #DataProtection #PIIExposure #CarlyKind #TelecomSecurity #InfosecAustralia #RansomDemand
The Australian Information Commissioner (AIC) has filed a civil lawsuit against Optus for a 2022 data breach that exposed the personal information of 9.5 million Australians. The AIC alleges that Optus failed to implement adequate security measures to protect sensitive data, violating the Privacy Act 1988. The breach involved names, birth dates, addresses, contact details, and government-issued identifiers such as passport and Medicare numbers. Although payment details and passwords were not compromised, the attackers issued a ransom demand to prevent the data from being sold online. The AIC is seeking a civil penalty order, with the potential for fines reaching millions per individual affected. Privacy Commissioner Carly Kind emphasised the importance of robust data governance and warned of the risks posed by external-facing systems and third-party providers.
→ Read more on infosecurity-magazine.com
Hackers to the Rescue: DEF CON Volunteers Reinforce Cybersecurity in US Water Utilities
Section titled “Hackers to the Rescue: DEF CON Volunteers Reinforce Cybersecurity in US Water Utilities”#CyberSecurity #DEFCON2025 #FranklinProject #WaterSecurity #EthicalHacking #InfrastructureProtection #VoltTyphoon #SmallTownCyberDefence #CriticalInfrastructure #HackersForGood
In a bold initiative launched at DEF CON, hundreds of ethical hackers have volunteered to secure vulnerable water systems across the United States. The Franklin Project, named after Benjamin Franklin, began with five pilot deployments in Indiana, Oregon, Utah, and Vermont, offering free cybersecurity services to small-town utilities. These volunteers tackled basic security flaws—like unchanged default passwords and lack of multi-factor authentication—and conducted operational technology assessments and network scans. Despite initial scepticism from local operators, the project revealed that even small utilities are targets for sophisticated cyber threats, including Chinese state-sponsored groups like Volt Typhoon. With overwhelming interest and growing urgency, organisers aim to scale the programme nationwide, protecting thousands of critical infrastructure systems before year-end. This grassroots movement highlights the power of community-driven cybersecurity and the importance of defending even the smallest nodes in national infrastructure.
→ Read more on theregister.com
KLM and Air France Disclose Customer Data Breach Impacting Loyalty Programme Members
Section titled “KLM and Air France Disclose Customer Data Breach Impacting Loyalty Programme Members”#DataBreach #KLM #AirFrance #FlyingBlue #CyberSecurity #CustomerPrivacy #PhishingAlert #ThirdPartyRisk #TravelSecurity #DigitalTrust
KLM and Air France have revealed a data breach affecting members of their Flying Blue loyalty programme. The incident, which compromised personal details such as names, email addresses, and frequent flyer numbers, was traced to unauthorised access via a third-party platform. While no payment information was exposed, the airlines have urged customers to reset passwords and remain vigilant against phishing attempts. The breach highlights ongoing vulnerabilities in airline data ecosystems and the importance of robust third-party risk management. Both carriers are working with cybersecurity experts to investigate the breach and strengthen their defences. This incident adds to growing concerns over data protection in the travel industry, where customer trust and digital security are increasingly intertwined.
→ Read more on databreachtoday.com
Windows Under Siege: New Win-DDoS Flaws Turn Domain Controllers into Stealth Botnets
Section titled “Windows Under Siege: New Win-DDoS Flaws Turn Domain Controllers into Stealth Botnets”#WinDDoS #WindowsSecurity #LDAPFlaws #RPCExploits #CyberThreats #DEFCON33 #SafeBreach #DDoSAttack #MicrosoftPatch #StealthBotnet
Cybersecurity researchers from SafeBreach have unveiled a novel attack technique dubbed Win-DDoS, which exploits flaws in Windows’ LDAP and RPC protocols to transform public domain controllers (DCs) into powerful DDoS botnets. Presented at DEF CON 33, the attack requires no code execution or credentials, making it stealthy and highly scalable. By manipulating LDAP referral processes, attackers can redirect DCs to flood a target server with traffic, overwhelming it without leaving a trace. The technique leverages thousands of DCs globally, turning Windows into both victim and weapon. Microsoft has since patched the vulnerabilities, but the discovery underscores the fragility of core Windows services and the urgent need for robust network defences. The attack’s ability to crash systems or trigger blue screens further amplifies its threat potential.
→ Read more on thehackernews.com
Columbia University Cyberattack Exposes Personal Data of Nearly 870,000 Individuals
Section titled “Columbia University Cyberattack Exposes Personal Data of Nearly 870,000 Individuals”#ColumbiaUniversity #DataBreach #CyberAttack #IdentityProtection #StudentPrivacy #RansomwareThreat #ITSecurity #AcademicDataLeak #CyberDefence #SecurityAffairs
Columbia University has confirmed a major data breach affecting 868,969 individuals, including students, applicants, and employees. The incident, discovered following a technical outage, was caused by unauthorised access to parts of the university’s IT systems. Investigations revealed that sensitive data—such as Social Security numbers, academic records, financial aid details, and health information—was compromised. Although no malicious activity has been detected since 24 June, the university has not ruled out a ransomware attack, though no group has claimed responsibility. In response, Columbia is offering two years of free credit monitoring and identity protection services to those affected. The university has also implemented enhanced cybersecurity measures and continues to work with external experts to prevent future breaches. Community members are urged to remain vigilant and rely on official updates as the investigation continues.
→ Read more on securityaffairs.com
+49 89 360 5310 | security-awareness@metafinanz.de
The editors are not responsible for the content of each article.