TLDR INFORMATION SECURITY 2025-04-25

👀 Register to watch the recording

YALE NEW HAVEN HEALTH NOTIFYING 5.5 MILLION OF MARCH HACK

Yale New Haven Health System reported a major data breach affecting 5.5 million patients following a March 8 hack. Compromised information may include names, addresses, Social Security numbers, and medical record numbers. The health system has offered credit monitoring services and faces multiple lawsuits alleging negligence in data protection.

BREACH AT HEALTH INSURANCE GIANT BLUE SHIELD OF CALIFORNIA LEAKED HEALTH DATA OF MILLIONS TO GOOGLE - SEE IF YOU ARE AFFECTED

Blue Shield reported a data breach affecting 4.7 million members due to a misconfiguration of Google Analytics between April 2021 and January 2024. Protected health information, including insurance details, medical claims, and patient information, was inadvertently shared with Google Ads, though no Social Security numbers were exposed. Blue Shield has since implemented safeguards to prevent similar incidents from occurring.

KELLY BENEFITS DATA BREACH IMPACTS 260,000 PEOPLE

DESIGNING FOR SECURITY AND USABILITY: FIGMA'S MODERN ENDPOINT STRATEGY

Figma's security team developed an endpoint security strategy that emphasizes device quarantine, allowlisting, and access controls for improved usability and security. They implemented the Endpoint Security Baseline (ESB) using OSQuery to identify security risks, placing devices in quarantine if threats are detected until they can be resolved. Figma also deployed Santa for application allowlisting and Opal for just-in-time access to SaaS applications.

AUTOMATING AWS PRIVATE CA AUDIT REPORTS AND CERTIFICATE EXPIRATION ALERTS

AWS Private CA is a service that allows an organization to issue certificates via ACM without the need for a public certificate, which may disclose sensitive services. However, certificates generated via the console default to a 13-month validity period. In contrast, certificates generated using the SDK or CLI are more flexible, but they do not include certificate expiration notices. The solution in this post leverages Lambda functions to periodically generate a report of certificates and notify via email and Security Hub of any certificates that are expiring within 30 days.

EVERYTHING TO KNOW ABOUT RUNTIME REACHABILITY

Runtime reachability enables security teams to prioritize vulnerabilities that require immediate attention. It includes network reachability, package-loaded reachability, and function execution reachability. Package-loaded reachability may prioritize false positives, while network reachability might de-prioritize vulnerabilities in non-internet-accessible systems. Function execution reachability is the most robust but requires a (C)ADR.

AUGUR SECURITY (PRODUCT LAUNCH)

Augur scours the internet to identify early signs of malicious intent (e.g., infrastructure setup), profiles attacker behavior, and creates blocklists to protect customers' environments.

VEX2PDF

Vex2pdf converts CycloneDX JSON docs to PDF reports. It was designed to work with VEX reports but can also generate PDFs for standard Bill of Materials (BoMs).

BLOODHOUND-MCP-AI

BloodHound-MCP-AI is an MCP server that enables querying BloodHound using natural language queries to analyze Active Directory (AD) attack paths.

ASSASSIN'S CREED MAKER FACES GDPR COMPLAINT FOR FORCING SINGLE-PLAYER GAMERS ONLINE

The privacy group noyb filed a GDPR complaint against Ubisoft in Austria for requiring online connections for single-player games, specifically Far Cry Primal. Its investigation revealed data being transmitted to Google, Amazon, and Datadog servers. noyb seeks penalties of up to €92 million and plans to target other gaming companies with similar practices.

MICROSOFT CLAIMS STEADY PROGRESS REVAMPING SECURITY CULTURE

Microsoft's Secure Future Initiative progress report highlights significant security improvements, with 92% of employees using phishing-resistant multifactor authentication. The company has prioritized security across all operations, standardized development pipelines, and created a UX Toolkit to reduce user-targeted attacks. This overhaul follows criticism of Microsoft's security culture after the Storm-0558 breach in 2023.

VERIZON DISCOVERS SPIKE IN RANSOMWARE AND EXPLOITED VULNERABILITIES

According to Verizon's 2025 Data Breach Incident Report, the company observed a 47% increase in the rate of ransomware detected in data breaches. Verizon has observed a decrease in the average payout and the percentage of organizations that paid ransoms, but also noted that small-to-medium-sized businesses were particularly hard hit. It also stated that exploited vulnerabilities, serving as an initial access vector for breaches, surged over the past year, primarily due to attackers exploiting zero-day exploits in edge devices and VPNs.

VULNCHECK SPOTTED 159 ACTIVELY EXPLOITED VULNERABILITIES IN FIRST FEW MONTHS OF 2025

VulnCheck identified 159 actively exploited vulnerabilities in early 2025, revealing a troubling trend of quick exploitation targeting network edge devices, content management systems, and operating systems.

MICROSOFT NOW PAYS UP TO $30,000 FOR SOME AI VULNERABILITIES

Microsoft is offering up to $30,000 for finding Critical or Important AI vulnerabilities, as defined by the Microsoft Vulnerability Severity Classification for AI Systems, reproducible on a product or service listed in the In Scope Services and Products.

NEW SESSIONSHARK PHISHING KIT BYPASSES MFA TO STEAL OFFICE 365 LOGINS

SessionShark is a phishing kit that facilitates the theft of Office 365 credentials by circumventing multi-factor authentication through deceptive login pages and real-time notifications via Telegram.