The Daily Index — Friday, September 12, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

100,000 IMPACTED BY CORNWELL QUALITY TOOLS DATA BREACH

Cornwell Quality Tools has disclosed a ransomware-driven data breach that impacts over 100,000 people. Hackers accessed sensitive information like Social Security numbers and financial data in December 2024. The Cactus group claimed responsibility and leaked corporate docs, though it's unclear if all of the data was released.

securityweek.com · 2 min

TLDR InfoSec

LNER URGES CUSTOMERS TO BE VIGILANT AFTER PASSENGER DETAILS ACCESSED IN CYBER-ATTACK

A cyber-attack on LNER's third-party supplier exposed customers' contact information and some journey records, but no payment or password data. LNER's train services remain unaffected. The company has advised vigilance against suspicious communications and stresses that the breach does not compromise sensitive banking details.

theguardian.com · 2 min

TLDR InfoSec

WHAT THE SALESLOFT DRIFT BREACHES REVEAL ABOUT 4TH-PARTY RISK

The SalesLoft Drift breach demonstrates the emerging threat of "fourth-party" risk, where organizations are compromised through their vendor's acquired company (Drift) rather than direct vendor relationships. Attackers exploited legacy OAuth tokens that had been dormant for 18 months since SalesLoft's 2024 acquisition of Drift, allowing access to hundreds of Salesforce instances and Google Workspace accounts. This incident highlights how M&A activities can inherit hidden security risks that extend organizations' attack surfaces far beyond what they can directly assess or control through traditional security measures.

csoonline.com · 6 min

TLDR InfoSec

HOW PIXEL AND ANDROID ARE BRINGING A NEW LEVEL OF TRUST TO YOUR IMAGES WITH C2PA CONTENT CREDENTIALS

Google Pixel 10 is the first smartphone to implement C2PA Content Credentials in its native camera app, automatically attaching cryptographically-signed metadata to all photos that documents their creation and editing history. The feature uses hardware-backed security through Tensor G5 and Titan M2 chips to achieve C2PA Assurance Level 2, ensuring tamper-resistant verification while preserving privacy through anonymous attestation and one-time-use cryptographic keys. Google Photos will display this provenance information to help users distinguish between authentic images and AI-generated or edited content, with the capability rolling out gradually to other Android and iOS devices.

security.googleblog.com · 7 min

TLDR InfoSec

THE FRAGILE BALANCE: ASSUMPTIONS, TUNING, AND TELEMETRY LIMITS IN DETECTION ENGINEERING

When developing detection rules, assumptions are inevitably made that may lead to false positives. When tuning an alert for false positives, detection engineers may run up against telemetry limitations that force them to reconsider their initial assumptions. These limitations may lead the team to recreate the rule from a different data source, accept some amount of false positives, aggressively filter the rule and accept a certain amount of potential misses, or altogether scrap the rule.

links.tldrnewsletter.com · 7 min

TLDR InfoSec

EVICTION STRATEGIES TOOL

The Eviction Strategies Tool is a tool, maintained by CISA, designed to help incident responders during the containment and eviction phases. It is comprised of a stateless webapp and a database of post-compromise countermeasures mapped to adversary tactics, techniques, and procedures (TTPs).

cisa.gov · 3 min

TLDR InfoSec

HUSH SECURITY (PRODUCT LAUNCH)

Hush Security is a platform that eliminates credential-based threats by replacing secrets and vaults with just-in-time, policy-based access for machines, removing the need for credentials entirely.

hush.security

TLDR InfoSec

MICROSOFT ADDS MALICIOUS LINK WARNINGS TO TEAMS PRIVATE CHATS

Microsoft Teams will begin automatically alerting users when they send or receive a private message containing links that have been flagged as spam, phishing, or malware for all Microsoft Defender for Office 365 and Microsoft Teams enterprise customers. The feature will enter preview this month. It will be enabled by default when it reaches general availability in November.

bleepingcomputer.com · 2 min

TLDR InfoSec

THE US IS NOW THE LARGEST INVESTOR IN COMMERCIAL SPYWARE

The United States has surpassed all other nations in funding commercial spyware, driving a rapidly expanding global market. New research reveals that US investors now dominate this space by channeling money through hedge funds and pension plans into companies involved in spyware surveillance. Current regulations largely fail to address these financial flows, highlighting growing accountability and policy gaps.

arstechnica.com · 5 min

TLDR InfoSec

KIDS IN THE UK ARE HACKING THEIR OWN SCHOOLS FOR DARES AND NOTORIETY

A surge in UK school cyber breaches is driven by students, who are responsible for over half the incidents. These breaches often result from weak passwords, misplaced logins, or staff security lapses. They usually do it as a dare, revenge, or attention-seeking, though some cases involve sophisticated attacks.

techcrunch.com · 2 min

TLDR InfoSec

DDOS DEFENDER TARGETED IN 1.5 BPPS DENIAL-OF-SERVICE ATTACK

A European DDoS mitigation service provider was hit by a massive distributed denial-of-service attack that reached 1.5 billion packets per second.

bleepingcomputer.com · 1 min

TLDR InfoSec

SENATOR BLASTS MICROSOFT FOR 'DANGEROUS, INSECURE SOFTWARE' THAT HELPED PWN US HOSPITALS

Senator Ron Wyden has urged the FTC to investigate Microsoft after a ransomware attack on major US hospitals exposed flaws in Windows security.

theregister.com · 2 min

TLDR InfoSec

CHINESE APT HITS PHILIPPINE MILITARY FIRM WITH NEW EGGSTREME FILELESS MALWARE

EggStreme is a new fileless malware framework used by a China-based APT group to target Philippine military organizations and APAC entities.

hackread.com · 3 min