DataBreachToday.com

Authored by: Matt Kunkel, CEO, LogicGate
The Consumer Financial Protection Bureau (CFPB) recently finalized a set of rules that would bring a similar level of convenience to the financial world. These changes to Section 1033 of the Dodd-Frank Act make it significantly easier for customers to retain access to their financial history no matter which bank they transact with. For banks, that means it’s critical to ensure that the right data is being collected, and that it can be easily integrated with external systems.

Provision Emphasizes Existing Medicare Regs for Equitable Access to Health Services
The Centers for Medicare and Medicaid Services has issued proposed "guardrails" to help ensure that the use of artificial intelligence for Medicare Advantage insurance plans does not result in inequitable access to healthcare-related services. The proposed rule will go into effect in 2026.

Experts Warn China's Tech Rise Could Reshape Global Cybersecurity and Warfare
China has surged past the United States in critical technology research, according to a recent report published by the Australian Strategic Policy Institute. Experts warn the shift could have profound global implications, including risks to U.S. cybersecurity, innovation and global leadership.

Provision Emphasizes Existing Medicare Regs for Equitable Access to Health Services
The Centers for Medicare and Medicaid Services has issued proposed "guard rails" to help ensure that the use of artificial intelligence for Medicare Advantage insurance plans does not result in inequitable access to healthcare-related services. The proposed rule will go into effect in 2026.

Threat Actor Uses the Trojan as an Infostealer
A threat actor is targeting Taiwanese companies using phishing emails and long-standing vulnerabilities to deliver SmokeLoader malware. The threat actor uses plugins for the infamous malware to directly attack systems rather than using SmokeLoader, as its name suggests, as a loader for other malware.

Experts Warn China's Tech Rise Could Reshape Global Cybersecurity and Warfare
China has surged past the United States in critical technology research, according to a recent report published by the Australian Strategic Policy Institute, as experts warn the shift could have profound global implications, including risks to U.S. cybersecurity, innovation and global leadership.

Firm Focuses on Runtime Context, AI Enhancements to Counter Evolving Cloud Threats
With $100 million in Series A funding, Upwind plans to enhance its runtime and AI-powered cloud security platform. CEO Amiram Shachar outlines the company's investments in engineering, customer engagement and scaling solutions to address vulnerabilities such as misconfigurations and insecure APIs.

Linux-Targeting Bootkitty Appears More Proof-of-Concept Than Threat, Researchers Say
Cybersecurity researchers have discovered the first-ever UEFI bootkit designed to target Linux systems and subvert their boot process for malicious purposes. The "Bootkitty" malware, first uploaded to VirusTotal this month, appears to be more "proof of concept" than full-fledged threat, they said.

Suspected LockBit, Babuk Operator Mikhail Matveev Arrested in Russia
A prolific ransomware affiliate hacker and developer is facing criminal charges in Russia, Kremlin media reported Friday. Mikhail Pavlovich Matveev has been wanted by U.S. authorities since 2023 for his role in hacking activities as part of ransomware groups including LockBit, Hive and Babuk.

Linux-Targeting Bootkitty Appears More Proof-of-Concept Than Threat, Researchers Say
Cybersecurity researchers have discovered the first-ever UEFI bootkit designed to target Linux systems and subvert their boot process for malicious purposes. The "Bootkitty" malware, first uploaded to VirusTotal this month, appears to be more "proof of concept" than full-fledged threat, they said.

European Commission Opens Infringement Procedures Against 23 EU Member States
The European Commission on Thursday opened infringement procedures against 23 EU member states that missed a mid-October deadline for implementing the NIS2 Directive, as well 24 EU members that missed a Critical Entities Resilience Directive deadline.

Researchers Discover 20 Critical Flaws Attackers Could Exploit in a Variety of Ways
Researchers identified 20 critical vulnerabilities in a type of Advantech industrial-grade wireless access points that is widely deployed across critical infrastructure environments. Attackers could exploit the flaws to remotely executive code and create denials of service.

Key Steps for Navigating the Cybersecurity Transition to Quantum-Safe Cryptography
As quantum computing continues to evolve, cybersecurity professionals and enterprise leaders must grapple with a future where current encryption technologies - on which our entire digital infrastructure is built - may no longer be secure. What next steps must they take now?

Third-party access management poses significant cybersecurity risks in healthcare, but continuous identity management and monitoring can help mitigate those risks, said Jim Routh, chief trust officer at Saviynt.

PwC's Anirban Sengupta Details Privacy Landscape, Growing Awareness in India Market
The privacy vendor market in India is evolving rapidly, as many vendors move from offering point solutions to embracing more integrated, platform solutions that can handle a broader range of privacy requirements, said Anirban Sengupta, partner, risk consulting practice with PwC.

Thousands of unique IP addresses are potentially exposing medical devices, electronic medical records systems and other sensitive healthcare information to the internet, said security researcher Himaja Motheram of security firm Censys, which made the discovery.

President-Elect's Crypto Push Fuels Concerns Over Market Stability and Conflicts
President-elect Donald Trump's strong cryptocurrency support amid market volatility is raising concerns over potential conflicts of interest, with experts warning his agenda - including potential plans to appoint a White House crypto czar - could destabilize the economy and undermine public trust.

Also: Africa Busts Cybercrime Suspects; Many Smart Devices Lack Update Transparency
This week, Microsoft previews its latest attempt to introduce AI-enabled Windows Recall - now with added privacy features; over 1,000 cybercrime suspects busted in Africa; regulators report "smart" device update promises often missing; and Florida IT professional caught spying for China.

Linux-Targeting Bootkitty Appears More Proof-of-Concept Than Threat, Researcher Say
Cybersecurity researchers have discovered the first-ever bootkit designed to target Linux systems and subvert their boot process for malicious purposes. The "Bootkitty" malware, first uploaded to VirusTotal this month, appears to be more "proof of concept" than full-fledged threat, they said.

Also: Python Library Update Steals Credentials; Drug Cartels Launder With Tether
This week's cryptohack roundup includes a U.S. federal judge striking down the SEC's expanded "Dealer Rule," a Python crypto library update stealing credentials, why digital payment apps are being excluded from some types of federal oversight, and drug cartels laundering profits via Tether.