Ransomware DataBreachToday.com

Hitachi Energy Security Head Joe Doetzl on Common Tools and Practices
While IT and OT environments were traditionally seen as two separate parts of the organization, security teams can use common tools and practices to protect both areas, said Joe Doetzl, head of cybersecurity at Hitachi Energy. The company designated a single leader for IT-OT environments years ago.

Mapping Platform Exposed Addresses and Medical Assistance Plans
The Illinois Department of Human Services is notifying more than 700,000 people of a breach involving "incorrect privacy settings" left in place for several years that exposed online data pertaining to Medicare, Medicaid and rehabilitation services recipients.

$740M SGNL Acquisition Boosts Dynamic Identity Enforcement for Humans and AI Agents
With the $740M acquisition of SGNL, CrowdStrike aims to deliver dynamic access control for human and nonhuman identities. The real-time enforcement layer expands CrowdStrike's identity capabilities amid a market shift toward zero standing privilege and agentic workforce security.

Also: Turning AI Data Into AI Defense, Autonomous Border Patrol Robots
In this week's panel, ISMG editors discussed how basic security failures are still opening the door to major breaches, how researchers are rethinking data protection in the age of artificial intelligence and the implications of robots with AI patrolling national borders.

Also, Sedgwick Confirms Breach, Romanian Power Firm Hit, D-Link Flaws Exploited
This week, Moody's said firewalls will be obsolete, Romanian critical infrastructure hacked, Sedgwick breach and a D-Link DSL flaw. Finland seized the Fitburg. Microsoft said Direct Send not to blame for Exchange phishing. Malicious Chrome extensions, European hotels targeted and health breaches.

Also, Sedgwick Confirms Breach, Romanian Power Firm Hit, D-Link Flaws Exploited
This week, Moody's said firewalls will be obsolete, Romanian critical infrastructure hacked, Sedgwick breach and a D-Link DSL flaw. Finland seized the Fitburg. Microsoft said Direct Send not to blame for Exchange phishing. Malicious Chrome extensions, European hotels targeted and health breaches.

OpenAI: Tool Will 'Securely' Connect With Medical Records, But How Will That Work?
OpenAI is rolling out a new version of ChatGPT dedicated to health that the company said will also "securely" connect users' medical records and wellness apps to better personalize responses. OpenAI says more than 230 million people each week ask ChatGPT wellness and health related questions.

CISA Warns of Retaliatory Cyber Action From Hostile State Actors After Venezuela
Federal cybersecurity officials are warning of a likely uptick in retaliatory cyber activity from China and Russia-linked threat actors after the U.S. military raid in Venezuela, urging infrastructure operators to brace for disruptive probing and attacks.

Blackstone-Led Funding Round Expands R&D and Partnerships to Address AI Threats
With AI adoption outpacing security readiness, Cyera secured $400 million at a $9 billion valuation to protect data in an agentic AI landscape. The company plans to expand engineering efforts and partner with tech giants to create a control plane for enterprise AI use.

Targeted Threat Intel Firm Shares Details With Police After Honeypot Hit
Getting owned by deception technology isn't good news for one's criminal brand or ability to remain at large. Just ask the band of young hackers behind "Scattered Lapsus$ Shiny Hunters," when one of their ilk fell into a security firm's honeytrap, revealing his actual IP address in the process.

Congress Holds Cyber Funding at 2024 Levels Across Key Civilian Agencies
The fiscal year 2026 budget deal largely locks in federal cybersecurity funding at 2024 levels, stalling growth across key civilian agencies even as lawmakers call for global technology leadership as the U.S. government faces mounting nation-state cyber threats.

Patent Board Decision Invalidating 3 Orca Patents Weakens Case, Leads to Dismissal
After 30 months of legal sparring, Wiz and Orca Security have agreed to dismiss all claims in their cloud security patent dispute. The end of the case comes after a significant setback for Orca: A federal board invalidated three of its asserted patents.

2023 Incident Affected More Than 650,000 Patients, Employees
An upstate New York orthopedic practice has agreed to pay state regulators a $500,000 settlement and implement stronger security practices following a 2023 hack involving the theft of 650,000 individuals' sensitive information. Cybercrime group INC Ransom reportedly claimed credit for the incident.

Agency: Guidance Favors Market Innovation Over Federal Scrutiny
New artificial intelligence-enabled health wearable devices and clinical decision support software will not face U.S. Food and Drug Administration regulatory scrutiny, providing the technology meets certain criteria, such as being "low-risk," the agency said this week.

Deal Represents Return to Tuck-In M&A for Palo After 3 Multi-Billion Dollar Deals
Palo Alto Networks is in talks to buy Washington D.C-based endpoint security startup Koi for $400 million. Koi is focused on securing extensions, AI models, code packages and containers, and its differentiation lies in mapping, assessing risk and govern the software landscape at enterprise scale.

Why Human-Centric Zero Trust Models Fail in a World of Autonomous AI Agents
Zero trust was built for humans, not autonomous AI agents. As organizations adopt agentic AI at scale, human-centric security assumptions break down - creating a paradox between utility and least privilege that traditional zero trust models cannot resolve.

Why Are Third-Party Vendor Breaches So Hard to Figure Out?
The victim tally of a 2024 hacking incident at back office services provider Conduent again soared after a new regulatory disclosure by the company, in this case to Texas authorities. The company told Lone Star state officials the breach affected nearly 14.8 million Texans, alone.

FCC Lacks Lead for Cyber Trust Mark Program After UL Solutions Steps Down From Post
UL Solutions has exited its role as lead administrator of the FCC's Cyber Trust Mark, leaving the flagship consumer IoT labeling program without oversight just months after internal security reviews raised concerns over foreign influence in program management.

Geopolitics Puts OT at Greater Risk From Nation States, Criminals and Hacktivists
Attacks against critical infrastructure are expected to increase in scope and intensity including hacks on operational technology systems. State actors are now looking for ways to cause damage and disrupt operations, rather than simply steal secrets, according to cybersecurity experts.

Treasury Submissions Want Broader Coverage; Gaps Could Weaken Protections
Australia's proposed Scams Prevention Framework leaves key scam-enabling entities outside its initial scope, raising questions about whether the model can deliver the consumer protection it promises.