Greetings, Digital Defenders! 🛡️ |
The headlines are heavy this week—and so are the implications. From a proposed $500M budget cut to CISA to a fresh wave of retail-targeted attacks, the cyber news keeps flowing. Let’s dive in. |
|
|
Here’s what you need to know: |
-
White House proposes $500M cut to CISA, putting critical infrastructure defense at risk
- TikTok fined €530M for illegally transferring EU user data to China
- WhatsApp’s new cloud AI feature sparks fresh privacy concerns
- Harrods joins M&S and Co-op as latest UK retail cyberattack victim
- Ledger users hit by phishing scam through physical mail
|
|
|
CISA on the Chopping Block: Trump Proposes $500M Budget Cut |
In a move that has stunned cybersecurity leaders, the Trump administration is looking to slash nearly half a billion dollars from the Cybersecurity and Infrastructure Security Agency’s 2026 budget. The proposed 16% cut would gut funding for divisions focused on countering online disinformation. |
Critics warn this reduction arrives at a time when federal agencies are already strained, battling foreign nation-state threats and ransomware campaigns. The White House, however, argues these measures are part of a broader effort to rein in discretionary spending and eliminate what it calls “censorship operations.”
With less federal muscle behind cyber defense and misinformation response, businesses and everyday users may have to take more of that burden on themselves. |
TikTok Hit With €530M GDPR Fine Over Data Transfers to China |
Ireland’s Data Protection Commission has fined TikTok a whopping €530 million (about $577 million) for secretly shipping EU user data to China. Investigators say TikTok not only transferred personal data without proper safeguards but also misled regulators on where that data was going.
The penalty follows mounting scrutiny over TikTok’s data practices, especially regarding teens. With six months to comply, TikTok now faces a monumental overhaul of its European data handling, or more fines could follow. |
WhatsApp’s AI Plans Raise Privacy Questions |
WhatsApp is testing private, cloud-based AI chats that let users interact directly with Meta’s large language models in the app. These chats will be isolated from regular conversations. Meta claims they are “private” and run in secure, encrypted cloud instances.
But the feature raises eyebrows among privacy watchdogs. While Meta emphasizes user control and transparency, it’s unclear how truly private these interactions will be—or whether end-to-end encryption will apply fully. As messaging apps race to integrate AI, WhatsApp’s move may mark a turning point in how “smart” and “secure” coexist. |
|
|
Harrods Joins Growing List of Retail Cyberattack Victims |
Luxury retailer Harrods is the latest UK business to get tangled in a cyber mess, following recent high-profile hits on Marks & Spencer and the Co-op.
While Harrods says its website and stores are still running, internal systems were knocked offline in the attack. Officials say no customer data appears to have been compromised. However, investigations remain ongoing. |
Source: Cyber Security News |
With all three retailers relying on SAP systems, experts are watching closely for signs of a linked supply chain compromise. Retailers should treat this as more than a coincidence and upgrade their defenses before the next wave hits. |
Ledger Users Get Scam Letters in the Mail |
Ledger hardware wallet users have begun receiving fraudulent letters by mail impersonating official company communications. The letters include Ledger branding and a QR code that directs recipients to a phishing site, where they’re prompted to enter their 24-word recovery phrase under the pretense of a required security validation.
Ledger has confirmed the campaign is a scam and believes the attackers may be using address information leaked during the 2020 data breach. The company reiterated that it never requests recovery phrases through any channel, including physical mail. If you use a hardware wallet or manage crypto assets, double-check what’s hitting your mailbox—and treat any unexpected requests for credentials as a red flag. |
Nullpoint-Stealer Malware Drops…and It’s a Data Vacuum |
A new info-stealer, Nullpoint, has surfaced on GitHub, packing enough functionality to prompt concern among security professionals.
Marketed as an “educational tool,” the C#-based malware snatches browser passwords, cookies, bookmarks, autofill data, and even desktop files. It also grabs crypto wallet details, VPN configs, and screenshots—basically anything you wouldn’t want in the wrong hands.
With a modular setup and easy customization, Nullpoint is ripe for abuse. With its full source code publicly accessible, experts warn that the release lowers the barrier for entry to data theft and credential harvesting at scale. |
|
|
🛡️ This section contains sponsored cybersecurity insights. |
|
|
Don’t Let Visibility Gaps Become Entry Points |
The TikTok fine, CISA budget cuts, and Ledger phishing scam all point to a shared problem: When organizations can’t clearly see where their data lives or how it flows, risk escalates quickly. A lack of visibility across systems, vendors, and even old customer data opens the door to breaches, missteps, and targeted scams. |
Source: Meridian Solutions |
To fend off cyber attackers, here’s what to do: |
-
Map your data flows: Track where sensitive data is stored, who has access to it, and how it moves across platforms. Where your map ends is exactly where bad actors begin.
- Vet third-party vendors: Regularly review vendors’ compliance and security posture, especially those with access to customer data or infrastructure components.
-
Minimize data retention: Don’t keep more data than you need. The Ledger mail scam stemmed from a 2020 breach—long-forgotten data is still exploitable if it sits around.
- Reinforce internal monitoring: With threats rising and CISA facing potential budget cuts, organizations need stronger internal detection and response systems.
-
Stay transparent with users: Whether it’s app AI features or system incidents, communicate clearly about what data is being collected and what steps are being taken to secure it.
|
Better visibility leads to better control. Don’t lose track of your risk surface. Attackers count on it. |
|
|
| Secure Links: The Must-Reads |
|
|
| Secure Links: The Must-Reads |
|
|
Black Kingdom Ransomware Developer Indicted in US |
A Yemeni national has been charged with creating and deploying Black Kingdom ransomware in attacks that hit over 1,500 systems in the U.S. and abroad. Victims included a medical billing company, a school district, a ski resort, and a health clinic. Prosecutors say he exploited Microsoft Exchange vulnerabilities to deliver the malware. |
Always remember: Unpatched software isn’t just an IT problem—it’s an open invitation for global cybercriminals to hit close to home. |
Raytheon, Nightwing Group Settle Cybersecurity Compliance Allegations |
Raytheon Company, RTX Corporation, and Nightwing Group LLC have agreed to pay $8.4 million to resolve allegations of non-compliance with cybersecurity requirements in federal contracts. The settlement addresses claims that the companies failed to meet mandated cybersecurity standards in contracts involving the Department of Defense between 2015 and 2021. The case serves as a reminder that when it comes to federal contracts, cybersecurity lapses don’t just lead to breaches—they can lead to big bills. |
|
|
|
Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting. |
|
|
|
Liz Ticong is a tech writer specializing in AI and software tools, known for turning complex topics into clear, actionable insights through hands-on testing and analysis. |
|
|
We're looking for talented writers to help shape Cybersecurity Insider. If you're passionate about cyber security, apply to join our team! |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA. |
|
|
|
