Oktacron - Cyber Security RSS Feeds History

New Cyble Report Highlights Critical Vulnerabilities and Rising Cyber Threats in ANZ for 2024

cyberexpress Nov 20, 2024 Firewall Daily

The 2024 ANZ Threat Landscape Report by Cyble reveals an increase in cybersecurity risks faced by organizations across Australia and New Zealand (ANZ). With high-profile cyberattacks targeting critical sectors like healthcare, government, finance, and infrastructure, the need for better cybersecurity measures has show more ...

never been greater. As highlighted in the ANZ Threat Landscape Report 2024, cybercriminals and geopolitically motivated actors are exploiting vulnerabilities at an increasing rate, with consequences for businesses and public services alike. Threat Landscape Report 2024: Unprecedented Surge in Cyber Incidents The cybersecurity landscape in the ANZ region is facing an unprecedented level of threats. Notably, vulnerabilities in critical systems have been exploited by cybercriminals, leading to a surge in ransomware attacks, data breaches, and Distributed Denial-of-Service (DDoS) campaigns. The ANZ Threat Landscape Report points to the growing sophistication of attacks, such as Ransomware-as-a-Service (RaaS) models, which have democratized the ability for even less-skilled cybercriminals to execute damaging ransomware campaigns. One of the most interesting findings is the growing focus on sectors essential for national stability and service delivery, including healthcare, finance, and government. As cybersecurity professionals in the ANZ region are aware, these sectors are particularly vulnerable to attacks due to their reliance on secure and uninterrupted operations. The exploitation of critical vulnerabilities, such as the recently disclosed CVE-2024-21887, has enabled attackers to disrupt services, compromise data, and exploit sensitive information for malicious purposes. Key Vulnerabilities Impacting ANZ Sectors The Threat Landscape Report 2024 highlights the critical vulnerabilities that have been exploited by attackers across the region. Key vulnerabilities, such as CVE-2024-21887, CVE-2023-46085, and CVE-2024-56789, have put financial institutions, healthcare providers, and government agencies at risk. For example, CVE-2024-21887, with a CVSS score of 9.1, is one of the most critical vulnerabilities, affecting Ivanti systems used in industrial control and intrusion prevention systems. Exploiting this flaw can lead to unauthorized access and data breaches, which can severely disrupt services that rely on these systems. Another notable threat is the rise in supply chain vulnerabilities, where attackers leverage compromised third-party software or services to gain access to organizations' internal networks. Trojanized npm packages, used in software development, have been a particular target, as seen in multiple incidents across ANZ. The Geopolitical Dimension of Cybersecurity The Threat Landscape Report 2024 also highlights the growing influence of geopolitical tensions in shaping the cyber threat environment in ANZ. Ideologically motivated groups have increasingly targeted government institutions and critical infrastructure in retaliation for political stances taken by Australia and New Zealand. For example, the People’s Cyber Army and RipperSec, both associated with politically motivated attacks, have been implicated in DDoS campaigns aimed at disrupting government websites, telecom companies, and financial institutions. These attacks are often motivated by political retaliation, with cybercriminal groups targeting national assets to undermine public services and amplify global tensions. As Australia continues to align itself with countries like Ukraine and Israel, these geopolitical factors are expected to fuel more DDoS attacks, creating additional challenges for cybersecurity professionals tasked with protecting national infrastructure. The Surge of Ransomware and Data Exfiltration Ransomware attacks remain one of the most significant threats in the ANZ Threat Landscape Report 2024, with a notable rise in ransomware-as-a-service offerings such as SpiderX. These RaaS models allow less technically proficient attackers to launch sophisticated ransomware campaigns, dramatically expanding the scope of potential threats. The report reveals that a wide range of organizations, from healthcare providers to financial institutions, are being targeted by groups like Medusa, Black Suit, and Akira, who not only encrypt data but also exfiltrate it to demand large ransoms. Additionally, data exfiltration remains a major concern, with stolen information frequently being sold on dark web forums or used for further attacks. High-profile data breaches, including incidents at major organizations like Stake gambling platform, Microsoft, and the University of Western Australia, have exposed sensitive personal and financial data, heightening concerns over identity theft, fraud, and espionage. Sector-Specific Threats and Impacts The Threat Landscape Report 2024 provides a detailed analysis of how various sectors in the ANZ region are being impacted by cyberattacks. Each sector faces unique challenges: Government & Critical Infrastructure: Government institutions continue to be targeted by politically motivated DDoS attacks, such as those launched by People’s Cyber Army. These attacks disrupt critical services and put national security at risk. Healthcare: Healthcare organizations face significant risks from ransomware attacks that target patient data and disrupt service delivery. The breach of sensitive medical information puts patient privacy at risk and complicates efforts to maintain trust in the healthcare system. Finance: Financial institutions are frequently targeted by both ransomware attacks and data breaches. As seen in incidents at the Bank of Sydney and Caleb & Brown, attackers exploit vulnerabilities to steal sensitive financial data, impacting the reputation and trust of financial services providers. Technology & Software: With the increasing use of third-party services, technology companies are at risk from supply chain vulnerabilities and malware attacks. Trojanized npm packages and data leaks, such as the breach at Microsoft, have further complicated cybersecurity for software companies. The Role of Cyble in Enhancing Cybersecurity Given the growing complexity of cyber threats, Cyble offers a range of advanced cybersecurity solutions tailored to address the unique challenges faced by organizations in the ANZ region. Cyble’s offerings, such as Attack Surface Management (ASM), dark web monitoring, and threat intelligence services, help organizations proactively identify and mitigate risks. Notably, Cyble has introduced cutting-edge capabilities like deepfake detection, cloud security posture management, and physical security intelligence, providing cybersecurity professionals with the tools necessary to protect against emerging threats. Cyble’s real-time threat detection capabilities, including their Cyble Vision and Cyble Hawk platforms, enable organizations to fight cybercrime and enhance their security posture. Looking Ahead: Trends and Projections for 2024 The ANZ Threat Landscape Report forecasts several key trends for 2024, which cybersecurity professionals should be aware of as they develop their cybersecurity strategies: Cybercriminals will continue to exploit critical vulnerabilities such as CVE-2024-21887. Organizations must prioritize vulnerability management and patching to minimize the risk of successful attacks. Ransomware attacks are expected to remain a significant threat, with the rise of RaaS models lowering the barrier for entry for attackers. Healthcare and financial institutions will continue to be prime targets. Political tensions will drive further DDoS attacks on government and infrastructure targets, making it essential for organizations to strengthen defenses against such attacks. Organizations must be vigilant about the risks posed by compromised third-party services and supply chain vulnerabilities.

Drinking Water Systems for 27 Million Americans Have High-Risk Security Vulnerabilities

cyberexpress Nov 20, 2024 Cyber News

Nearly 27 million Americans are served by drinking water systems that have high-risk or critical cybersecurity vulnerabilities, according to a new report from the U.S. Environmental Protection Agency’s Office of the Inspector General (OIG). An additional 83 million Americans are served by systems that have medium or show more ...

low-severity vulnerabilities, defined as “having externally visible open portals,” the EPA OIG report said. The OIG investigation is the latest effort to bolster inadequate cybersecurity in U.S. water systems, following a Government Accountability Office (GAO) report in August, an EPA warning in May, and warnings from security researchers that Russian threat groups and other foreign adversaries are targeting water systems. Water and wastewater systems are some of the most vulnerable critical infrastructure sectors to cyberattacks – communities are generally unprepared for outages that could last for days or longer. Fortunately, recent cyberattacks on American Water Works and Arkansas City, Kansas did not appear to reach operational technology (OT) networks. “If malicious actors exploited the cybersecurity vulnerabilities we identified in our passive assessment, they could disrupt service or cause irreparable physical damage to drinking water infrastructure,” the OIG report said. Water Systems Networks Scanned for Vulnerabilities The OIG investigation looked at drinking water systems serving 50,000 or more people, 1,062 systems in all, covering 193 million people or about 56% of the U.S. population. The Oct. 8 vulnerability scans identified 97 high-risk water systems and 211 moderate risk ones. The vulnerability tests “consisted of a multilayered, passive assessment tool to scan the public-facing networks” of the drinking water systems, the report said. “The results identified cybersecurity vulnerabilities that an attacker could exploit to degrade functionality, cause loss or denial of service, or facilitate the theft of customer or proprietary information,” OIG said. A non-linear scoring algorithm was used to prioritize the highest risk findings that should be addressed first, OIG said. The findings are ranked by a score that considers the impact of the problem, the risk to the organization, and the number of times the problem has been observed. Risks were grouped by five categories: email security; IT hygiene; vulnerabilities; adversarial threats, and malicious activity. The report noted the complexity of drinking water systems, which “can be comprised of many components, or facilities, that are located throughout a geographic area. Those facilities can include buildings and infrastructure used for the collection, pumping, treatment, storage, or distribution of drinking water.” As a result of that complexity, more than 75,000 IPs and 14,400 domains were analyzed for potential vulnerabilities. Reporting and Incident Response Issues Also Found The OIG investigation also found weaknesses in reporting and coordinating responses to cybersecurity incidents at the water systems. “While attempting to notify the EPA about the cybersecurity vulnerabilities, we found that the EPA does not have its own cybersecurity incident reporting system that water and wastewater systems could use to notify the EPA of cybersecurity incidents,” the report said. Instead, the agency relies on the Cybersecurity and Infrastructure Security Agency (CISA) for incident reporting. “Moreover, we were unable to find documented policies and procedures related to the EPA’s coordination with the Cybersecurity and Infrastructure Security Agency and other federal and state authorities involved in sector-specific emergency response, security plans, metrics, and mitigation strategies,” OIG said. Water Infrastructure Act Compliance Challenges The report also looked at the challenging history of achieving compliance with the America’s Water Infrastructure Act of 2018 (AWIA), a comprehensive revision of the Safe Drinking Water Act. Section 2013 of AWIA requires community water systems that serve more than 3,300 people to develop or update risk and resilience assessments and emergency response plans, including the resilience of physical and cyber infrastructure, monitoring practices, and strategies for responding to malevolent acts or natural hazards. Section 2013 also requires water systems to certify to the EPA that the system completed its risk and resilience assessment and emergency response plan. However, findings in the last two years both from the OIG and the EPA have found that compliance with those requirements remains lacking.

Apple Security Update: Addressing Critical Vulnerabilities in Apple Software

cyberexpress Nov 20, 2024 Vulnerabilities

Apple recently rolled out a security update that addresses critical vulnerabilities in multiple Apple devices. Released on November 19, the Apple security update impacts various platforms, including iOS, iPadOS, macOS, visionOS, and Safari, and is aimed at protecting users from increasingly sophisticated cyber threats. show more ...

This Apple security release addresses flaws that had been actively exploited in the wild, particularly on Intel-based Mac systems. Overview of the Apple Security Update The security flaws identified by Apple are centered around two components: JavaScriptCore and WebKit. Both are integral to the processing of web content in Apple devices, and if exploited, could lead to security risks, including arbitrary code execution and cross-site scripting (XSS) attacks. These vulnerabilities were discovered by Google's Threat Analysis Group, led by security researchers Clément Lecigne and Benoît Sevens. The first vulnerability, identified as CVE-2024-44308, relates to an issue in JavaScriptCore. Maliciously crafted web content could allow attackers to execute arbitrary code on affected devices. This flaw was particularly concerning, as it was actively being exploited on Intel-based Mac systems. Apple responded by improving checks to prevent this issue from affecting users. The second vulnerability, CVE-2024-44309, concerns a flaw in WebKit, Apple's open-source web browser engine. This vulnerability could lead to cross-site scripting attacks, enabling attackers to manipulate cookies and potentially steal sensitive user data. Apple addressed this issue by improving state management within WebKit, making it more resilient to exploitation. Apple Patched Versions Apple’s commitment to user security is evident in its prompt action to release patches for these critical vulnerabilities. The company has a strict policy of not disclosing security issues until an investigation has been completed and solutions are ready for deployment. This policy ensures that users are protected from threats while giving security teams the time they need to assess and address vulnerabilities comprehensively. As part of the Apple security release, several key updates were issued across different platforms: Safari 18.1.1 (Released on November 19, 2024) for macOS Ventura and macOS Sonoma addresses both JavaScriptCore and WebKit vulnerabilities, protecting against arbitrary code execution and cross-site scripting attacks. visionOS 2.1.1 (Released on November 19, 2024) for the Apple Vision Pro resolves the same issues affecting macOS systems, ensuring security for Apple's augmented reality headset. iOS 18.1.1 and iPadOS 18.1.1 (Released on November 19, 2024) for various iPhone and iPad models, including the iPhone XS and later, iPad Pro (13-inch), iPad Air 3rd generation and newer, and others, fix vulnerabilities in JavaScriptCore and WebKit. iOS 17.7.2 and iPadOS 17.7.2 (Released on November 19, 2024) for earlier iPhone and iPad models, including the iPhone XS and iPad Pro 10.5-inch, address the same vulnerabilities as the 18.1.1 updates. macOS Sequoia 15.1.1 (Released on November 19, 2024) for macOS Sequoia users also resolves the vulnerabilities found in JavaScriptCore and WebKit. Conclusion The November 2024 Apple security release addresses critical vulnerabilities in JavaScriptCore and WebKit, affecting devices such as Macs, iPhones, iPads, and the Apple Vision Pro. While this update aims to improve user security, it highlights the ongoing need for vigilance. Users are advised to keep their devices up to date and stay informed about potential threats. For more information on these security updates and installation instructions, users can refer to the Apple Product Security page.

CVE-2024-10924, authentication bypass vulnerability in WordPress

kaspersky Nov 20, 2024 Business

Bad news for companies using WordPress sites with a two-factor authentication mechanism implemented via the Really Simple Security plugin. The recently discovered CVE-2024-10924 vulnerability in this plugin allows a complete stranger to authenticate as a legitimate user. Its therefore recommended to update the plugin show more ...

as soon as possible. Whats the danger of the CVE-2024-10924 vulnerability As ironic as it may sound, the CVE-2024-10924 vulnerability in the plugin called Really Simple Security has a CVSS rating of 9.8 and is classified as critical. In essence, it exists thanks to an error in the authentication mechanism, due to which an attacker can log on to the site as any of the registered users and with their privileges (even administrator rights). As a result, this can lead to the takeover of the website. Proof of concept that shows exploitation of this vulnerability can already be found on GitHub. Moreover, apparently its exploitation can be automated. The researchers from Wordfence who discovered CVE-2024-10924 have called it the most dangerous vulnerability theyve seen in 12 years of working in the field of WordPress security. Whos vulnerable to CVE-2024-10924? Users of both paid and free versions of the Really Simple Security plugin starting from build 9.0.0 and ending with 9.1.1.1 are vulnerable. However, to exploit CVE-2024-10924, the plugin must have the two-factor authentication function enabled (its disabled by default, but many users choose this plugin specifically for this feature). Thanks to the existence of a free version of the plugin, its extremely popular; researchers say that its installed on around four million sites. How to stay safe First of all, its recommended to update the plugin to version 9.1.2. If for some reason this isnt possible, its worth disabling the two-factor authentication verification – but this is obviously not ideal since it weakens the security of your site. WordPress.org has enabled an automatic plugin update mechanism, but administrators are advised to go to the control panel and make sure that the plugin has been updated. The plugin developers website also has a section with tips on updating it if the automatic update doesnt work. In addition, even if you promptly updated the plugin and at first glance didnt notice any malicious activity on the site, it makes sense to carefully study the list of users with administrator rights – just to make sure there are no new unfamiliar entries there.

Fintech Giant Finastra Investigating Data Breach

krebsonsecurity Nov 20, 2024 Data Breaches

The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world’s top 50 banks, notified customers of the security incident after a show more ...

cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company. London-based Finastra has offices in 42 countries and reported $1.9 billion in revenues last year. The company employs more than 7,000 people and serves approximately 8,100 financial institutions around the world. A major part of Finastra’s day-to-day business involves processing huge volumes of digital files containing instructions for wire and bank transfers on behalf of its clients. On November 8, 2024, Finastra notified financial institution customers that on Nov. 7 its security team detected suspicious activity on Finastra’s internally hosted file transfer platform. Finastra also told customers that someone had begun selling large volumes of files allegedly stolen from its systems. “On November 8, a threat actor communicated on the dark web claiming to have data exfiltrated from this platform,” reads Finastra’s disclosure, a copy of which was shared by a source at one of the customer firms. “There is no direct impact on customer operations, our customers’ systems, or Finastra’s ability to serve our customers currently,” the notice continued. “We have implemented an alternative secure file sharing platform to ensure continuity, and investigations are ongoing.” But its notice to customers does indicate the intruder managed to extract or “exfiltrate” an unspecified volume of customer data. “The threat actor did not deploy malware or tamper with any customer files within the environment,” the notice reads. “Furthermore, no files other than the exfiltrated files were viewed or accessed. We remain focused on determining the scope and nature of the data contained within the exfiltrated files.” In a written statement in response to questions about the incident, Finastra said it has been “actively and transparently responding to our customers’ questions and keeping them informed about what we do and do not yet know about the data that was posted.” The company also shared an updated communication to its clients, which said while it was still investigating the root cause, “initial evidence points to credentials that were compromised.” “Additionally, we have been sharing Indicators of Compromise (IOCs) and our CISO has been speaking directly with our customers’ security teams to provide updates on the investigation and our eDiscovery process,” the statement continues. Here is the rest of what they shared: “In terms of eDiscovery, we are analyzing the data to determine what specific customers were affected, while simultaneously assessing and communicating which of our products are not dependent on the specific version of the SFTP platform that was compromised. The impacted SFTP platform is not used by all customers and is not the default platform used by Finastra or its customers to exchange data files associated with a broad suite of our products, so we are working as quickly as possible to rule out affected customers. However, as you can imagine, this is a time-intensive process because we have many large customers that leverage different Finastra products in different parts of their business. We are prioritizing accuracy and transparency in our communications. Importantly, for any customers who are deemed to be affected, we will be reaching out and working with them directly.” On Nov. 8, a cybercriminal using the nickname “abyss0” posted on the English-language cybercrime community BreachForums that they’d stolen files belonging to some of Finastra’s largest banking clients. The data auction did not specify a starting or “buy it now” price, but said interested buyers should reach out to them on Telegram. abyss0’s Nov. 7 sales thread on BreachForums included many screenshots showing the file directory listings for various Finastra customers. Image: Ke-la.com. According to screenshots collected by the cyber intelligence platform Ke-la.com, abyss0 first attempted to sell the data allegedly stolen from Finastra on October 31, but that earlier sales thread did not name the victim company. However, it did reference many of the same banks called out as Finastra customers in the Nov. 8 post on BreachForums. The original October 31 post from abyss0, where they advertise the sale of data from several large banks that are customers of a large financial software company. Image: Ke-la.com. The October sales thread also included a starting price: $20,000. By Nov. 3, that price had been reduced to $10,000. A review of abyss0’s posts to BreachForums reveals this user has offered to sell databases stolen in several dozen other breaches advertised over the past six months. The apparent timeline of this breach suggests abyss0 gained access to Finastra’s file sharing system at least a week before the company says it first detected suspicious activity, and that the Nov. 7 activity cited by Finastra may have been the intruder returning to exfiltrate more data. Maybe abyss0 found a buyer who paid for their early retirement. We may never know, because this person has effectively vanished. The Telegram account that abyss0 listed in their sales thread appears to have been suspended or deleted. Likewise, abyss0’s account on BreachForums no longer exists, and all of their sales threads have since disappeared. It seems improbable that both Telegram and BreachForums would have given this user the boot at the same time. The simplest explanation is that something spooked abyss0 enough for them to abandon a number of pending sales opportunities, in addition to a well-manicured cybercrime persona. In March 2020, Finastra suffered a ransomware attack that sidelined a number of the company’s core businesses for days. According to reporting from Bloomberg, Finastra was able to recover from that incident without paying a ransom. This is a developing story. Updates will be noted with timestamps. If you have any additional information about this incident, please reach out to krebsonsecurity @ gmail.com or at protonmail.com.

China's 'Liminal Panda' APT Attacks Telcos, Steals Phone Data

darkreading Nov 20, 2024 Feed

In US Senate testimony, a CrowdStrike exec explained how this advanced persistent threat penetrated telcos in Asia and Africa, gathering SMS messages, unique identifiers, and other metadata along the way.

SWEEPS Educational Initiative Offers Application Security Training

darkreading Nov 20, 2024 Feed

The secure coding curriculum was developed by University of California, Davis; University of Maryland Baltimore County; Worcester Polytechnic Institute; California Polytechnic State University-San Luis Obispo; Cosumnes River College; DARK Enterprises; and StrongAuth.

It's Near-Unanimous: AI, ML Make the SOC Better

darkreading Nov 20, 2024 Feed

Efficiency is the name of the game for the security operations center — and 91% of cybersecurity pros say AI and ML are winning that game.

Alleged Ford 'Breach' Encompasses Auto Dealer Info

darkreading Nov 20, 2024 Feed

Cybersecurity investigators found the leaked data to be information from a third party, not Ford itself, that is already accessible to the public and not sensitive in nature.

African Reliance on Foreign Suppliers Boosts Insecurity Concerns

darkreading Nov 20, 2024 Feed

Recent backdoor implants and cyber-espionage attacks on their supply chains have African organizations looking to diversify beyond Chinese, American tech vendors.

Small US Cyber Agencies Are Underfunded & That's a Problem

darkreading Nov 20, 2024 Feed

If the US wants to maintain its lead in cybersecurity, it needs to make the tough funding decisions that are demanded of it.

Apple Urgently Patches Actively Exploited Zero-Days

darkreading Nov 20, 2024 Feed

Though the information regarding the exploits is limited, the company did report that Intel-based Mac systems have been targeted by cybercriminals looking to exploit CVE-2024-44308 and CVE-2024-44309.

RIIG Launches With Risk Intelligence Solutions

darkreading Nov 20, 2024 Feed

RIIG is a risk intelligence and cybersecurity solutions provider offering open-source intelligence solutions designed for zero-trust environments.

'Water Barghest' Sells Hijacked IoT Devices for Proxy Botnet Misuse

darkreading Nov 20, 2024 Feed

An elusive, sophisticated cybercriminal group has used known and zero-day vulnerabilities to compromise more than 20,000 SOHO routers and other IoT devices so far, and then puts them up for sale on a residential proxy marketplace for state-sponsored cyber-espionage actors and others to use.

DeepTempo Launches AI-Based Security App for Snowflake

darkreading Nov 20, 2024 Feed

DeepTempo's Tempo is a deep learning-based Snowflake native app that allows organizations to detect and respond to evolving threats directly within their Snowflake environment.

GAO recommends new agency to streamline how US government protects citizens’ data

cyware Nov 20, 2024 Government

Facial recognition, artificial intelligence and other new technologies have led to an exponential increase in the amount of personal data government agencies traffic in, the report said.

UK says a new law banning social media for under-16s is 'on the table'

cyware Nov 20, 2024 Government

As Britain's online safety regular, Ofcom, prepares to implement the Online Safety Act, it could consider banning social media for children under age 16, a top government official said.

Two brothers indicted for operating illegal sports streaming service that netted $7 million

cyware Nov 20, 2024 Cybercrime

An indictment unsealed Tuesday charged two brothers with several crimes related to their management of 247TVStream — an online subscription-based service that let users stream live sports and television shows.

Phobos ransomware indictment sheds light on long-running, quietly successful scheme

cyware Nov 20, 2024 Cybercrime

The document sheds light on a durable cybercrime operation that has drawn serious attention from security researchers and law enforcement agencies, even though it has kept a lower profile than other ransomware gangs.

Five alleged members of Scattered Spider cybercrime group charged for breaches, theft of $11 million

cyware Nov 20, 2024 Cybercrime

Court documents say the five — who live in the U.S. and U.K. — are accused of stealing $11 million worth of cryptocurrency from at least 29 victims in addition to taking troves of corporate documents out of company systems.

Helldown Ransomware Evolves To Target VMware Systems Via Linux

packetstormsecurity Nov 20, 2024 headline,malware,linux,flaw

Bitcoin Bursts Past $94,000 For The First Time

packetstormsecurity Nov 20, 2024 headline,cryptography

Oracle Patches Exploited Agile PLM Zero-Day

packetstormsecurity Nov 20, 2024 headline,flaw,patch,oracle,zero day

Apple Confirms Zero Day Attacks Hitting macOS Systems

packetstormsecurity Nov 20, 2024 headline,flaw,apple,zero day

CISA Director Jen Easterly To Step Down Jan. 20

packetstormsecurity Nov 20, 2024 headline,government,usa

Equinox Notifies 21,000 Patients And Staff Of Data Theft

packetstormsecurity Nov 20, 2024 headline,hacker,privacy,data loss