Although SonicWall has provided a patch for a vulnerability for its VPN affecting its Gen5, Gen6, and Gen7 firewall appliances (which allowed threat actors unauthorized access to SonicWall appliances), Rapid7 has reported that “an Akira ransomware campaign [recently] kicked off targeting SonicWall devices.” SonicWall has provided an advisory to customers related to the campaign, which
Privacy Tip #460 – Protecting Foster Youth from Identity Theft
I served on the Board, and am a big fan of Foster Forward, an amazing organization located in Rhode Island that provides services to foster children and youth and supports the child welfare system as a whole. During my many years of service on the Board, I learned about the challenges of foster children
Insider Threats Climb + Are Costly
For those of you who have been reading our blog posts for well over a decade (it’s been 18 years), you know I have always been a fan of Larry Ponemon. I follow his work closely, and he just came out with the 2025 Cost of Insider Risks Global Report sponsored by DTEX Systems.
As
CA, CT + CO AG’s + CPPA Band Together on “Joint Investigative Privacy Sweep”
The Attorneys General of California, Connecticut, and Colorado, along with the California Privacy Protection Agency (“the Coalition”) announced on September 9, 2025, that they are banding together as a coalition on an investigative sweep of “potential noncompliance” with Global Privacy Control (GPC), that provides businesses with “an easy-to-use browser setting or extension that automatically signals
Privacy Tip #459 –Beware of Malicious Facebook Ads
For those of you who are on Facebook, beware of a new malvertising ad campaign identified by Bitdefender analysis. The campaign “coerces unsuspecting users into installing a fake ‘Meta Verified’ browser extension” that includes video tutorials designed to “harvest sensitive user data, including session cookies, access tokens and IP addresses.” If victims follow the tutorial
Attack Against Salesloft Drift App Includes Google Workspace
An attack against Salesforce between August 8 and August 18 targeting data through its Salesloft Drift app “is more extensive than at first thought.” The attack targeted numerous Salesforce customers “systematically exfiltrating large volumes of data.”
Google affirmed that threat actors not only targeted the Salesforce integration with Salesloft Drift, but also targeted some Google
Privacy Tip #458 – FTC Alleges Robot Toy Maker Allows Third Party in China to Collect Children’s Geolocation Data
On September 3, 2025, the Department of Justice (DOJ) filed suit against Apitor Technology, which makes robotic toys, alleging that Apitor’s app “enabled a third party in China to collect geolocation information from children without parental consent.”
The DOJ filed suit following a referral from the Federal Trade Commission (FTC) that Apitor did not comply
CISA Issues Advisory on Chinese State-Sponsored Actors Targeting Critical Infrastructure
On August 27, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued a Cybersecurity Advisory entitled “Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System.” The Advisory warns that People’s Republic of China (PRC) sponsored advanced persistent threat (APT) actors “are targeting networks globally, including, but not limited to, telecommunications, government
DOJ Seizes $2.8M in Cryptocurrency + Cash From Zeppelin Operator
On August 14, 2025, the Department of Justice announced that it unsealed six warrants “authorizing the seizure of over $2.8 million in cryptocurrency, $70,000 in cash, and a luxury vehicle.” According to the press release, “all of the cryptocurrency was seized from a cryptocurrency wallet controlled by Ianis Aleksandrovich Antropenko, who is charged by indictment
Notetaker App in Litigation Crosshairs
On August 15, 2025, notetaker app Otter.ai, Inc. was named a defendant in litigation alleging that its artificial intelligence-powered meeting assistant called Otter Notetaker, which “engages in real-time transcription of Google Meet, Zoom, and Microsoft Teams meetings for Otter accountholders and other users…records, accesses and records the contents of private conversations between Otter accountholders who