Compliance Roundup - July 5, 2025

Top 2 Critical Compliance Alerts

• Global Data Breaches and Cyber Attacks in June 2025: Over 16 billion records exposed — In June 2025, over 23 million records were compromised in newly revealed attacks, excluding a mass credential dump of 16 billion user credentials compiled from previous breaches. Read more
• How ISO 42001 supports EU AI Act compliance — ISO 42001 can help businesses build a structured, future-proof approach to AI compliance, manage AI risks, meet legal requirements and support innovation. Read more

Continue reading

Security Threat Summary - July 5, 2025

Critical Security Alert

• Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros — Two security flaws in Sudo could allow local attackers to escalate privileges to root. Read more

Threat Intelligence

• NightEagle APT Exploits Microsoft Exchange Flaw to Target China's Military and Tech Sectors — A previously undocumented threat actor, NightEagle (APT-Q-95), is targeting Microsoft Exchange servers using a zero-day exploit chain. Read more
• Hunters International ransomware group shuts down – but will it regroup under a new guise? — The ransomware-as-a-service operation has announced its closure and is offering free decryption tools. Read more

Security Breaches & Incidents

• Catwatchful stalkerware app spills secrets of 62,000 users – including its own admin — Stalkerware app exposed details of its users and victims' devices. Read more
• Technical difficulties or cyber attack? Ingram Micro's website goes down just in time for the holiday weekend — Ingram Micro's website outage raises questions about a potential cyberattack. Read more
• Google Ordered to Pay $314M for Misusing Android Users' Cellular Data Without Permission — Google has been ordered to pay $314 million for misusing Android users' cellular data. Read more

Emerging Security Technologies

• Your AI Agents Might Be Leaking Data — Watch this Webinar to Learn How to Stop It — AI agents and GenAI workflows are creating new ways for sensitive enterprise data to leak. Read more

Continue reading

🚨 Alert: New Breach Reported via HaveIBeenPwned on July 4, 2025

Catwatchful

Domain: catwatchful.com

Breach Date: 2025-06-09

Record Added: 7/3/2025, 11:04:01 PM

Modified Date: 7/3/2025, 11:04:01 PM

Total Records Exposed: 61,641

Description

In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records. The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the system.

Data Compromised

• Email addresses
• Passwords

Verified Breach: Yes

Continue reading

Compliance Roundup - July 4, 2025

Critical Compliance Alert

• CMMC 2.0 Creates New Compliance Calculus for Defense Contractors — Simplified framework poses challenges for defense contractors. Read more

Continue reading

Privacy Insights Digest - July 4, 2025

Top 5 Critical Privacy Alerts

• Record-Breaking $1.55M CCPA Settlement Against Health Information Website Publisher — California Attorney General announces a record $1.55M settlement against Healthline Media LLC for CCPA violations. Read more
• Data breach reveals Catwatchful 'stalkerware' is spying on thousands of phones — A security vulnerability exposed Catwatchful's database, revealing customers and stolen data from tracked phones. Read more
• Ninth Circuit Reviews Website Tracking Class Actions and the Reach of California's Privacy Law — The Ninth Circuit reviewed class actions against Papa John's, Converse, and Bloomingdale's concerning website tracking and CIPA. Read more
• Google Trackers: What You Can Actually Escape And What You Can't — Google's infrastructure tracks users across the web, even when they avoid Google's direct services. Read more
• US healthcare offshoring: Navigating patient data privacy laws and regulations — HIPAA's extraterritorial flexibility impacts the privacy and security of patient health information when healthcare is offshored. Read more

Privacy Laws & Regulations (GDPR, CPRA, CCPA, AI Acts)

• Record-Breaking $1.55M CCPA Settlement Against Health Information Website Publisher — California Attorney General announces a record $1.55M settlement against Healthline Media LLC for CCPA violations. Read more
• Ninth Circuit Reviews Website Tracking Class Actions and the Reach of California's Privacy Law — The Ninth Circuit reviewed class actions against Papa John's, Converse, and Bloomingdale's concerning website tracking and CIPA. Read more
• US healthcare offshoring: Navigating patient data privacy laws and regulations — HIPAA's extraterritorial flexibility impacts the privacy and security of patient health information when healthcare is offshored. Read more

Data Minimization & User Consent

• Google Trackers: What You Can Actually Escape And What You Can't — Google's infrastructure tracks users across the web, even when they avoid Google's direct services. Read more

Regulatory Fines & Enforcement Actions

• Record-Breaking $1.55M CCPA Settlement Against Health Information Website Publisher — California Attorney General announces a record $1.55M settlement against Healthline Media LLC for CCPA violations. Read more

Continue reading

Security Threat Summary - July 4, 2025

Critical Security Alert

• Critical Cisco Vulnerability in Unified CM Grants Root Access via Static Credentials — A flaw in Cisco Unified Communications Manager could allow an attacker to gain root access. Read more

Threat Intelligence

• Chinese Hackers Exploit Ivanti CSA Zero-Days in Attacks on French Government, Telecoms — A Chinese hacking group exploited zero-day vulnerabilities in Ivanti Cloud Services Appliance (CSA) to target governmental, telecommunications, media, finance, and transport sectors in France. Read more
• Over 40 Malicious Firefox Extensions Target Cryptocurrency Wallets, Stealing User Assets — Researchers discovered over 40 malicious Firefox extensions designed to steal cryptocurrency wallet secrets from platforms like Coinbase and MetaMask. Read more
• Attackers Impersonate Top Brands in Callback Phishing — Threat actors are impersonating brands like Microsoft and PayPal in socially engineered scams to trick victims into calling adversary-controlled phone numbers. Read more
• Criminals Sending QR Codes in Phishing, Malware Campaigns — Attackers are increasingly using QR codes to conduct phishing attacks and trick users into downloading malware. Read more

Security Breaches & Incidents

• Big Tech's Mixed Response to U.S. Treasury Sanctions — U.S. government sanctioned a Chinese national for operating a cloud provider linked to virtual currency investment scams, but tech companies still allow them to operate accounts. Read more
• Massive Android Fraud Operations Uncovered: IconAds, Kaleidoscope, SMS Malware, NFC Scams — A mobile ad fraud operation, IconAds, consisting of 352 Android apps, has been disrupted for loading out-of-context ads and hiding app icons. Read more

Security Tools & Best Practices

• New Cyber Blueprint Aims to Guide Organizations on AI Journey — Deloitte's new blueprint aims to bridge the gap between AI adoption and preparedness among leaders and employees. Read more
• IDE Extensions Pose Hidden Risks to Software Supply Chain — Malicious extensions can bypass verification checks in popular integrated development environments, posing risks to the software supply chain. Read more

Emerging Security Technologies

• The Hidden Weaknesses in AI SOC Tools that No One Talks About — Many AI-powered SOC platforms rely on pre-trained AI models that may not be suitable for modern security operations. Read more

Continue reading

Compliance Roundup - July 3, 2025

Top 5 Critical Compliance Alerts

• Integreon Launches AI-Enabled Legal & Regulatory Compliance Services — Integreon has launched AI-enabled legal and regulatory compliance services powered by ContractPodAi's Leah intelligence platform to automate compliance processes and contract governance. Read more
• SpeakUp Launches AI Phone Agent and Disclosure Management Platform — SpeakUp has launched an AI-powered disclosure and approval management platform called SpeakUp Paths and an AI voice agent for phone-based reporting, expanding into a comprehensive ethics and compliance suite. Read more
• Riskonnect Launches AI Governance Solution for Risk Management — Riskonnect has launched an AI governance solution integrated within its risk management platform to help organizations manage AI-related risks and compliance requirements. Read more
• Secureframe Integrates Fleet as Default Agent for Security Compliance — Secureframe has integrated Fleet's open-source platform as the default agent within its security compliance automation system, enhancing device management capabilities. Read more
• Compliance Risk Concepts Acquires Oyster Consulting — Compliance Risk Concepts acquired Oyster Consulting, creating CRC-Oyster, a combined risk and compliance consulting firm serving financial services organizations. Read more

Compliance Frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS)

• 7 Steps to a Successful ISO 27001 Risk Assessment – Updated for 2025 — Risk assessments are central to ISO 27001 compliance, ensuring an effective ISMS. The article outlines seven steps for conducting a successful ISO 27001 risk assessment in line with current best practices, incorporating updates from ISO 27001:2022 and ISO 27002:2022. Read more

Regulatory Updates (SEC, DORA, RBI, MAS, NIST)

• Fraud in the Modern Era and a Proactive Approach to Anti-Fraud Practices — The FBI's 2025 Internet Crime Report highlights over $16 billion in losses due to internet-related crimes. ISO 37003 provides guidelines for managing fraud risks, helping organizations comply with legal standards and mitigate liability. Read more

Audit & Monitoring Tools

• Integreon Launches AI-Enabled Legal & Regulatory Compliance Services — Integreon launched AI-enabled services using ContractPodAi's Leah platform to automate compliance and contract governance with real-time analysis and remediation. Read more
• SpeakUp Launches AI Phone Agent and Disclosure Management Platform — SpeakUp launched an AI-powered disclosure management platform and an AI voice agent for phone-based reporting as part of an expansion into a comprehensive ethics and compliance suite. Read more
• Secureframe Integrates Fleet as Default Agent for Security Compliance — Secureframe has integrated Fleet's open-source platform as the default agent within its security compliance automation system, enhancing device management capabilities. Read more
• Managing the Employee Benefit Plan Audit Deadline & Beyond — HR professionals wear multiple hats in the audit process, from documentation gathering to compliance assurance and post-audit improvements. Read more

Policy & Governance Updates

• Riskonnect Launches AI Governance Solution for Risk Management — Riskonnect launched an AI governance solution integrated within its risk management platform to help organizations manage AI-related risks and compliance requirements. Read more

Continue reading

Privacy Insights Digest - July 3, 2025

Top 5 Critical Privacy Alerts

• Oregon Amends Its Comprehensive Privacy Statute — Oregon has amended its comprehensive privacy statute, extending the cure period to July 1, 2026, for certain controllers. Read more
• Kids are making deepfakes of each other, and laws aren't keeping up — Schools and lawmakers are struggling with peer-on-peer image-based sexual abuse via deepfakes, disproportionately targeting girls. Read more
• 20 States Sue HHS to Stop Medicaid Data Sharing with ICE — Twenty states are suing HHS to prevent the disclosure of Medicaid beneficiaries' personal health information to ICE. Read more
• Wisconsin Supreme Court's Liberal Majority Strikes Down 176-Year-Old Abortion Ban — Wisconsin Supreme Court struck down the state's 176-year-old abortion ban, ruling it was superseded by a newer law. Read more
• Do your technology and outsourcing contracts properly address liability for cyber incidents? — Most cyber incidents originate from the customer's service provider, highlighting vulnerabilities in their systems. Read more

Privacy Laws & Regulations (GDPR, CPRA, CCPA, AI Acts)

• Oregon Amends Its Comprehensive Privacy Statute — Oregon has amended its comprehensive privacy statute, extending the cure period to July 1, 2026, for certain controllers. Read more

Data Minimization & User Consent

• 20 States Sue HHS to Stop Medicaid Data Sharing with ICE — Twenty states are suing HHS to prevent the disclosure of Medicaid beneficiaries' personal health information to ICE. Read more

Privacy-Enhancing Technologies (PETs, anonymization)

• Kids are making deepfakes of each other, and laws aren't keeping up — Schools and lawmakers are struggling with peer-on-peer image-based sexual abuse via deepfakes, disproportionately targeting girls. Read more

Regulatory Fines & Enforcement Actions

• Do your technology and outsourcing contracts properly address liability for cyber incidents? — Most cyber incidents originate from the customer's service provider, highlighting vulnerabilities in their systems. Read more

Cross-Border Data Transfers

• 20 States Sue HHS to Stop Medicaid Data Sharing with ICE — Twenty states are suing HHS to prevent the disclosure of Medicaid beneficiaries' personal health information to ICE. Read more

Continue reading

Security Threat Summary - July 3, 2025

Top 5 Critical Security Alerts

• Initial Access Broker Self-Patches Zero Days as Turf Control — A China-nexus threat actor exploits and patches Ivanti vulnerabilities to control victim networks. Read more
• US Treasury Sanctions BPH Provider Aeza Group — Aeza Group, linked to ransomware groups like BianLian and Lumma Stealer, faces U.S. sanctions. Read more
• Russian APT 'Gamaredon' Hits Ukraine With Fierce Phishing — Gamaredon APT targets Ukrainian government entities using spear-phishing and network-drive weaponization. Read more
• ClickFix Spin-Off Attack Bypasses Key Browser Safeguards — A new threat vector exploits browser HTML saving to bypass security and deliver malware. Read more
• North Korean Hackers Target Web3 with Nim Malware and Use ClickFix in BabyShark Campaign — North Korean actors target Web3 and crypto businesses with Nim-based malware, using process injection on macOS. Read more

Threat Intelligence (APT, malware, ransomware)

• Swiss government warns attackers have stolen sensitive data, after ransomware attack at Radix — Sensitive data was stolen from the Swiss government after a ransomware attack on a third-party service provider. Read more
• US Treasury Sanctions BPH Provider Aeza Group — Aeza Group, linked to ransomware groups like BianLian and Lumma Stealer, faces U.S. sanctions. Read more
• Russian APT 'Gamaredon' Hits Ukraine With Fierce Phishing — Gamaredon APT targets Ukrainian government entities using spear-phishing and network-drive weaponization. Read more
• North Korean Hackers Target Web3 with Nim Malware and Use ClickFix in BabyShark Campaign — North Korean actors target Web3 and crypto businesses with Nim-based malware, using process injection on macOS. Read more
• PDFs: Portable documents, or perfect deliveries for phish? — Callback phishing techniques leverage PDFs, VoIP anonymity, and QR codes. Read more

Security Breaches & Incidents

• Qantas Airlines Breached, Impacting 6M Customers — Passengers' personal information was accessed via a third-party platform, excluding passport or credit card details. Read more

Security Tools & Best Practices

• 1 Year Later: Lessons Learned From the CrowdStrike Outage — Organizations need resilience and anti-fragility to proactively respond to vulnerabilities and threats. Read more
• That Network Traffic Looks Legit, But it Could be Hiding a Serious Threat — Cyber threats mimic legitimate user behavior, requiring SOCs to differentiate between safe and dangerous traffic. Read more

Emerging Security Technologies (AI, XDR, CNAPP)

• Vercel's v0 AI Tool Weaponized by Cybercriminals to Rapidly Create Fake Login Pages at Scale — Threat actors are using Vercel's v0 AI tool to generate convincing fake sign-in pages for phishing. Read more

Continue reading

Compliance Roundup - July 2, 2025

Top 2 Critical Compliance Alerts

• Flying Blind on AI: The New Normal for Compliance Teams — Compliance officers face the challenge of governing AI use as organizations adopt the technology without clear policies. Risk-based frameworks are being developed to manage AI usage, addressing issues like employee use of ChatGPT versus Copilot and the accountability of AI agents. Read more
• Fraud in the Modern Era and a Proactive Approach to Anti-Fraud Practices — Fraud presents significant risks, with the FBI reporting over $16 billion in losses from internet crimes in 2025. ISO 37003 provides guidelines for managing fraud risks through prevention, detection, and response, helping organizations comply with legal standards and mitigate liability. Read more

Policy & Governance Updates

• Flying Blind on AI: The New Normal for Compliance Teams — Compliance officers face the challenge of governing AI use as organizations adopt the technology without clear policies. Risk-based frameworks are being developed to manage AI usage, addressing issues like employee use of ChatGPT versus Copilot and the accountability of AI agents. Read more
• Fraud in the Modern Era and a Proactive Approach to Anti-Fraud Practices — Fraud presents significant risks, with the FBI reporting over $16 billion in losses from internet crimes in 2025. ISO 37003 provides guidelines for managing fraud risks through prevention, detection, and response, helping organizations comply with legal standards and mitigate liability. Read more

Continue reading

Privacy Insights Digest - July 2, 2025

Top 3 Critical Privacy Alerts

• U.S. Government Issues Cybersecurity Warning to Critical Infrastructure Operators and Others — CISA, FBI, DC3, and NSA warn of heightened cyber attacks from Iran-affiliated actors targeting critical infrastructure. Read more
• Kids are making deepfakes of each other, and laws aren't keeping up — Schools and lawmakers are struggling to address image-based sexual abuse via deepfakes, disproportionately affecting girls. Read more
• Texas Enacts AI Consumer Protection Law — Texas Governor Greg Abbott signed the Texas Responsible AI Governance Act (TRAIGA) into law, effective January 1, 2026. Read more

Privacy Laws & Regulations (GDPR, CPRA, CCPA, AI Acts)

• Texas Enacts AI Consumer Protection Law — Texas Governor Greg Abbott signed the Texas Responsible AI Governance Act (TRAIGA) into law, effective January 1, 2026. Read more

Regulatory Fines & Enforcement Actions

• U.S. Government Issues Cybersecurity Warning to Critical Infrastructure Operators and Others — CISA, FBI, DC3, and NSA warn of heightened cyber attacks from Iran-affiliated actors targeting critical infrastructure. Read more

Cross-Border Data Transfers

• Do your technology and outsourcing contracts properly address liability for cyber incidents? — Cyber incidents often originate from service providers' vulnerable systems, highlighting the need for robust contract terms addressing liability. Read more

Continue reading

Security Threat Summary - July 2, 2025

Top 5 Critical Security Alerts

• Critical Vulnerability in Anthropic's MCP Exposes Developer Machines to Remote Exploits — A flaw (CVE-2025-49596, CVSS 9.4) in Anthropic's Model Context Protocol (MCP) Inspector project allows remote code execution. Attackers could gain complete access to the hosts. Read more

Threat Intelligence (APT, malware, ransomware)

• U.S. Sanctions Russian Bulletproof Hosting Provider for Supporting Cybercriminals Behind Ransomware — The U.S. Treasury has sanctioned Aeza Group for assisting cybercriminals, including those behind ransomware attacks. Sanctions extend to its subsidiaries. Read more
• Silver Fox Suspected in Taiwanese Campaign Using DeepSeek Lure — Attackers are using sideloading to deliver a Gh0stRAT variant, posing as a DeepSeek LLM installer. Read more
• TA829 and UNK_GreenSec Share Tactics and Infrastructure in Ongoing Malware Campaigns — Proofpoint has flagged tactical similarities between RomCom RAT actors (TA829) and UNK_GreenSec, who are delivering TransferLoader. Read more
• DoJ Disrupts North Korean IT Worker Scheme Across Multiple US States — The US conducted searches of 29 "laptop farms" across 16 states and seized 29 financial accounts used to launder funds from North Korean IT workers. Read more
• Scope, Scale of Spurious North Korean IT Workers Emerges — Microsoft warns thousands of North Korean workers have infiltrated tech, manufacturing, and transportation sectors to steal money and data. Read more

Security Breaches & Incidents

• Chrome Zero-Day, 'FoxyWallet' Firefox Attacks Threaten Browsers — Separate threats targeting Chrome (zero-day) and Firefox (malicious extensions) highlight the growing security risk for enterprises. Read more

Security Tools & Best Practices

• LevelBlue Acquires Trustwave, Forms World's Largest Independent MSSP — The combined entity will offer cyber consulting, managed detection and response, and incident response services. Read more
• How Businesses Can Align Cyber Defenses With Real Threats — Companies that understand attacker motivations and position themselves ahead of the competition will better protect their operations and reputation. Read more
• We've All Been Wrong: Phishing Training Doesn't Work — Teaching employees to detect malicious emails isn't effective; organizations need alternative options. Read more
• Ransomware Reshaped How Cyber Insurers Perform Security Assessments — Cyber insurance companies adapted to address security weaknesses highlighted by the ransomware surge. Read more

Cloud & Network Security

• That Network Traffic Looks Legit, But it Could be Hiding a Serious Threat — Nearly 80% of cyber threats mimic legitimate user behavior, making detection challenging for SOCs. Breaches at edge devices and VPN gateways have risen significantly. Read more

Emerging Security Technologies (AI, XDR, CNAPP)

• Vercel's v0 AI Tool Weaponized by Cybercriminals to Rapidly Create Fake Login Pages at Scale — Threat actors are using Vercel's v0 AI to generate functional phishing sites from simple text prompts. Read more
• Like SEO, LLMs May Soon Fall Prey to Phishing Scams — Attackers could use techniques similar to SEO poisoning to manipulate LLM responses from user prompts. Read more

Continue reading