#data breach

Η υπόθεση παραβίασης της Snowflake αποδεικνύει ότι τα cloud συστήματα αποτυγχάνουν όταν οι επιχειρήσεις αγνοούν τα βασικά πρωτόκολλα ασφαλείας. Εμείς στο TechNoid εξετάζουμε πώς μια απλή αμέλεια οδήγησε σε διαρροή δεδομένων εκατομμυρίων χρηστών. Ο Καναδός Connor Riley Moucka ομολόγησε την ενοχή του για την υποκλοπή δεδομένων από 165 και πλέον οργανισμούς μέσω της Snowflake. Η πρόσβαση…

Η διαρροή δεδομένων της Unlimited Systems εκθέτει 3,8 εκατομμύρια ασθενείς Η παραβίαση των συστημάτων της Unlimited Technology Systems αποκαλύπτει τον κίνδυνο που κρύβουν οι πάροχοι ιατρικού λογισμικού τρίτων μερών. Εδώ θα δεις τι ακριβώς συνέβη και πώς επηρεάζονται τα ιατρικά σου δεδομένα. Η διαρροή επηρέασε 3.803.750 ασθενείς στις ΗΠΑ έπειτα από παραβίαση δεδομένων τον Οκτώβριο του 2025. Τα…

📌 Σύνοψη Άρθρου Η Framework επιβεβαίωσε διαρροή δεδομένων που επηρεάζει το σύνολο της πελατειακής της βάσης, μετά από κυβερνοεπίθεση σε τρίτο πάροχο business intelligence. Τα κλεμμένα δεδομένα περιλαμβάνουν ονόματα, email, τηλέφωνα και διευθύνσεις, ωστόσο τα οικονομικά στοιχεία και οι κωδικοί παρέμειναν ασφαλή. Η παραβίαση οφείλεται σε zero-day ευπάθεια στην cloud υπηρεσία της Metabase,…

Η Levi’s επιβεβαίωσε επίσημα ότι δέχθηκε στοχευμένη κυβερνοεπίθεση μέσω social engineering σε τρεις υπαλλήλους της. Εμείς στο TechNoid εξετάζουμε πώς η παραβίαση αυτή αποκαλύπτει τα κενά ασφαλείας στις σύγχρονες εταιρείες λιανεμπορίου. Η Levi’s αποκάλυψε επίσημη παραβίαση δεδομένων σε κατάθεση στην SEC, μετά από επίθεση social engineering σε 3 εργαζομένους. Σύμφωνα με τα στοιχεία του Reuters, η…

The trend in the last few weeks has been AI security testing running amok. I’ve covered the GPT-5.6 Sol breach of Hugging Face, and Anthropic’s voluntary review of their agentic tools to find unauthorized behavior. Just yesterday I covered AISI’s report on the two companies’ tools taking autonomous actions during testing. Now Meta has admitted that during an independent evaluation, conducted by Irregular, their AI broke containment. Their Muse Spark 1.1 model carried out the breach of an undisclosed organization’s systems and made unauthorized changes to its internal environment.

This is the second time Irregular has been at the heart of a containment escape. They were also involved with the Anthropic case, where a ‘misunderstanding’ between the two companies led to Opus 4.7, Mythos 5, and an unnamed internal research test model gaining internet access. This time the culprit is allegedly a misconfiguration in the test environment, leading to the same access to the open internet. As of publishing, it’s not clear if this was due to a known flaw or a zero-day. Meta says they are investigating and will provide a ‘full retrospective’ once they have all the facts.

Back to back incidents involving the same third party partner may be a coincidence, but I think it’s more likely that Irregular either doesn’t follow directions well or is simply in over their heads in terms of capability. I’m not alone in that assessment. Experts in the industry are criticizing the levels of competition evidently going around as tech giants tout their models as the most powerful, according to Infosecurity Magazine’s article on the subject. Alex Goller, Principal Solution Architect EMEA at Illumio, is paraphrased as saying that this series of similar incidents among the biggest players is getting ridiculous. And it is. The pattern emerging is one of willful negligence in security standards in order to make the biggest splash. Meanwhile real people and businesses are being targeted and you can be sure that actual threat actors are paying attention to how it’s being done.

Test environments are supposed to be isolated and monitored. That is the point of testing, after all. To see the results as they’re happening. What is instead occurring is the discovery of unauthorized activity by these tools after the fact. These aren’t isolated incidents anymore; they are a failure to execute baseline checks and balances with the proper oversight. I said in my report on the Hugging Face incident that OpenAI was lucky they were willing to work together to remediate the issue. How long is that tolerance for what amounts to AI-driven cybercrime going to last?

To be clear, this is not a case of AI tools intentionally choosing a life of crime. But with guardrails against these kinds of actions taken down for evaluation purposes...well, the models see every option as viable and part of the scope of their task, including credential harvesting, privilege escalation and exploitation of vulnerabilities. Yes, it’s important to know what unchecked AI tools can do; it gives tangible data in how to protect systems from exactly this kind of incursion. But there needs to be more (or just some) forethought in how they’re allowed to do it. What we are seeing right now is live activity carried out against real people and entities without all the variables accounted for, or informed consent from these possible victims. It’s sloppy. The next company to get hacked may not be so forgiving. And rightly so, in my opinion.

SEANTERONEWS.com – Meski dunia keamanan siber tengah diramaikan oleh ancaman serangan siber berbasis kecerdasan buatan (AI-powered), teknik peretasan klasik justru terbukti masih sangat efektif. Google melalui tim peneliti keamanannya mengungkap bahwa kelompok peretas misterius kini tengah menyasar firma keuangan dan investasi skala besar di Amerika Serikat menggunakan metode voice phishing atau…