There’s a follow-up on one of the plastic surgery ransomware attacks this site first reported in October 2023 after the Hunters International threat actors added Jaime S. Schwartz, MD, to their leak site with proof of claims. At the time, Dr. Schwartz’s practice was one of a number of attacks on plastic surgery practices where…
Fortinet has patched a critical security flaw that it said has been exploited as a zero-day in attacks targeting FortiVoice enterprise phone systems. The vulnerability, tracked as CVE-2025-32756, carries a CVSS score of 9.6 out of 10.0. “A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera may allow a remote unauthenticated attacker…
Threat actors are leveraging an artificial intelligence (AI) powered presentation platform named Gamma in phishing attacks to direct unsuspecting users to spoofed Microsoft login pages. “Attackers weaponize Gamma, a relatively new AI-based presentation tool, to deliver a link to a fraudulent Microsoft SharePoint login portal,” Abnormal Security researchers Hinman Baron and Piotr Wojtyla said in
Employees screw up frequently. They fall for phishing attacks, or click on links they shouldn’t click on. And in some cases, funds get wired to fraudulent accounts. But how often have you read about an employee having to replace stolen funds? WKBN in Ohio reports: A Trumbull County judge has ordered County Auditor Martha Yoder…
Dan Medeiros and Emily Scherny report: The city’s public school computers will be down for the rest of the week after a cybersecurity attack infiltrated the district’s internal system — and a solution may cost the School Department out of pocket. At a joint meeting of the School Committee and City Council on Tuesday afternoon, Superintendent Tracy…
SolarWinds has released hot fixes to address a critical security flaw impacting its Web Help Desk software that, if successfully exploited, could allow attackers to execute arbitrary commands on susceptible systems. The vulnerability, tracked as CVE-2025-26399 (CVSS score: 9.8), has been described as an instance of deserialization of untrusted data that could result in code…
Ian Cheng reports: IT vendor Ezynetic has been fined $17,500 for failing to protect its clients’ data, which resulted in more than 190,000 individuals’ personal data being stolen and put for sale on the Dark Web. Ezynetic had failed to put in place reasonable security arrangements to protect the personal data in its possession or…
