TLDR INFORMATION SECURITY 2025-10-15

DOWNLOAD THE GUIDE

SIMONMED IMAGING: 1.27M INDIVIDUALS AFFECTED BY JANUARY 2025 CYBERATTACK

In early 2025, a cyberattack at SimonMed Imaging exposed the data of over 1.27 million patients, including medical and personal information, with the ransomware group Medusa claiming responsibility. Medusa likely received a ransom to prevent data release. SimonMed responded with improved security measures and offered credit monitoring and identity theft protection to impacted people.

SATELLITES FOUND EXPOSING UNENCRYPTED DATA, INCLUDING PHONE CALLS AND SOME MILITARY COMMS

Sensitive personal, corporate, and military data is being transmitted unencrypted via about half of Earth's geostationary satellites, according to researchers. Using a basic satellite receiver, they accessed voice calls, texts, and critical infrastructure communications, exposing serious privacy and security risks.

PIXEL-STEALING “PIXNAPPING” ATTACK TARGETS ANDROID DEVICES

“Pixnapping” is an advanced attack where a malicious Android app can secretly steal individual pixels from your device's screen—enabling it to extract sensitive data like 2FA codes, even from supposedly secure apps. The attack exploits Android's app messaging system and nearly invisible overlays.

WHY SIGNAL'S POST-QUANTUM MAKEOVER IS AN AMAZING ENGINEERING ACHIEVEMENT

Signal Messenger has rolled out a major upgrade to its encryption protocol, making it resistant to future quantum computer attacks. This technical overhaul adds a third layer—a quantum-safe ratchet—to its already-robust system to ensure strong privacy even if classical encryption breaks. Thanks to clever use of chunking methods and erasure codes, Signal's triple ratchet protects users' messaging by combining classic and quantum-safe security mechanisms, all without impacting everyday use.

WHY UNMONITORED JAVASCRIPT IS YOUR BIGGEST HOLIDAY SECURITY RISK

Client-side JavaScript attacks pose a critical blind spot for e-commerce security as 73% of sites load 50+ third-party scripts on checkout pages while only 23% use dedicated client-side monitoring, allowing attackers to steal payment data through browser-based skimmers that bypass WAFs and traditional server-side defenses entirely. Major 2024 attacks, including the Polyfill.io breach affecting over 500,000 websites and Cisco's Magecart incident, demonstrate how compromised third-party scripts and supply chain vulnerabilities enable data theft that often goes undetected for an average of 7.5 months, with incidents costing $2.4 million plus regulatory fines. Security teams should immediately implement Content Security Policy with nonces (avoiding ‘unsafe-inline'), deploy Subresource Integrity tags for third-party scripts, establish comprehensive script inventories with regular audits, and deploy specialized client-side monitoring tools to detect unauthorized data collection, DOM manipulation, and suspicious script behavior before the 2025 holiday shopping season.

HOW DO TIMING ATTACKS WORK?

Timing attacks that target string comparison work by measuring how long it takes a vulnerable server to verify a string, such as a password or other secret. When a vulnerable function compares two strings, it loops through each character to check for equality, causing the function to take slightly longer to complete with each correct character. The page includes a demo for how this attack works in practice.

See the difference and start shipping faster

MALTRAIL

Maltrail is a malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user-defined lists.

FORENSIC TIMELINER

Forensic Timeliner is a high-speed forensic processing engine built for DFIR investigations. It can quickly consolidate CSV output from tools to create a mini timeline, with built in filtering, artifact detection, keyword tagging, and deduplication.

MCP-SNITCH

MCP Snitch is a macOS application that intercepts and monitors MCP server communications, providing security analysis, access control, and audit logging for AI tool usage.

HERE'S HOW APPLE IS LOCKING DOWN IPHONES TO COMPLY WITH TEXAS' AGE VERIFICATION LAW

Starting next year, Texas will require companies to verify the ages of people who use their app stores. Apple has announced that beginning January 1, Texans trying to create a new Apple Account must confirm their age. If they are under 18, they must join a Family Sharing group. Parents and guardians will be required to give their consent to download apps or make in-app purchases, and developers will be required to implement the Declared Age Range API.

DISCORD BLAMED A VENDOR FOR ITS DATA BREACH — NOW THE VENDOR SAYS IT WAS ‘NOT HACKED'

Discord reported a breach impacting 70,000 users, claiming a third-party vendor, 5CA, was responsible, but 5CA denies any hacking of its systems or handling of government ID photos. The company argues the incident likely resulted from human error outside its systems, and both parties are conducting ongoing investigations to clarify further responsibility and the extent of affected data.

ASAHI BREACH LEAVES BITTER TASTE AS BREWER FEARS PERSONAL DATA SLURPED

Japanese beer maker Asahi suffered a ransomware attack in late September that disrupted operations across Japan and may have resulted in unauthorized access to personal information. The ransomware group Qilin claims to have stolen 27 GB of data, including employee and financial records.

Read the Case Study to Learn How

MASSIVE MULTI-COUNTRY BOTNET TARGETS RDP SERVICES IN THE US

A large-scale botnet comprising over 100,000 IP addresses is conducting coordinated attacks against Remote Desktop Protocol services in the United States.

UK NCSC REPORTS 429 CYBERATTACKS IN A YEAR, WITH NATIONALLY SIGNIFICANT CASES MORE THAN DOUBLING

The UK's National Cyber Security Centre reported 429 cyberattacks from September 2024 to August 2025, with significant incidents more than doubling from 89 to 204, and highly significant incidents rising nearly 50% to 18, posing severe risks to essential services.

WORKFORCE TERMINATION ORDERS AFFECT SEVERAL CISA DIVISIONS

Several divisions of CISA are facing job cuts as part of a government plan to reduce staff during a shutdown, amid criticism from the administration over its work combating misinformation.