The threat headlines keep stacking up. |
Today’s news brings Chrome zero-days under active attack, a phishing breach inside Starbucks’ HR portal, ransomware threats against England Hockey… and an AI facial recognition mistake with real-world consequences. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Google Warns of Active Chrome Zero-Day Attacks |
Google issued emergency Chrome updates after discovering two zero-day vulnerabilities being actively exploited. The flaws impact Chrome’s Skia graphics library and V8 JavaScript engine — core components used to render web content and run applications. |
Researchers warn attackers could exploit them through malicious websites to crash browsers or execute code, potentially leading to deeper system compromise.
Patch to the latest version of Chrome, monitor EDR for suspicious browser behavior, and test incident response plans.
|
Starbucks Staff Data Exposed in Phishing Attack |
Starbucks disclosed a breach after attackers used phishing sites impersonating its employee portal to steal credentials and access HR accounts. The breach compromised 889 Partner Central accounts, exposing sensitive employee data including Social Security numbers, birth dates, and financial details. Starbucks continues to investigate the incident.
Enforce phishing-resistant MFA for employee portals, monitor authentication logs for suspicious login patterns, and deploy email security tools to block credential-harvesting phishing attempts before they reach users.
|
AI Facial Recognition Error Jails Innocent Woman |
A Tennessee grandmother spent nearly six months in jail after facial recognition software wrongly linked her to a bank fraud case more than 1,200 miles away.
Investigators in Fargo, North Dakota used AI facial recognition to analyze surveillance footage, which flagged Angela Lipps as a potential match despite her having no ties to the crime.
There have been other cases of AI errors over the past few years, which raises concerns about solely relying on AI identification, especially for criminal cases.
Require human verification and corroborating evidence for facial recognition matches, review confidence scores, and treat AI-generated identifications only as investigative leads — not probable cause. |
|
|
Should human review be legally required for AI facial recognition suspects? |
|
|
Yesterday's Pulse Check Results |
Wiper Attack Reality Check: If systems were wiped tonight… |
|
|
Security Tools You Can Use |
|
|
Ransomware Group Claims Data Theft from England Hockey |
England Hockey is investigating a potential cyberattack after the AiLock ransomware group claimed it stole 129GB of internal data and threatened to leak it online. If confirmed, the breach could expose sensitive membership and operational data linked to athletes and staff. |
The investigation into the incident is ongoing.
Maintain offline immutable backups, enforce MFA on critical systems, and monitor EDR and network logs for unusual encryption activity or large outbound data transfers that could indicate ransomware intrusion.
|
Loblaw Breach Exposes Customer Data |
Attackers breached part of Loblaw’s internal network, exposing customer contact data including names, phone numbers, and email addresses.
The retailer, which operates about 2,500 stores across Canada, said the breach involved a limited, non-critical system and found no evidence that financial or health data was accessed. Loblaw continues to investigate the incident.
Deploy endpoint detection and centralized monitoring tools, enforce MFA for customer and administrative accounts, and monitor network and authentication logs for signs of unauthorized access or data exfiltration. |
|
|
You’re busy running your business — and so are cybercriminals, using many of the same tools, processes, and tech. Step inside the day-to-day operations of modern cybercrime groups, see how they mirror legitimate enterprises, and gain practical insight into how attackers think so you can spot and disrupt them faster. |
|
|
Could AI Misidentify You? |
AI-generated fake IDs are complicating identity verification systems that increasingly rely on facial recognition across law enforcement, retail security, and online authentication. |
How to reduce the risk of AI misidentification: |
-
Limit public facial data by reducing high-quality photos posted online and tightening social media privacy settings to prevent images from being scraped for facial recognition datasets or identity spoofing.
-
Monitor identity activity using identity monitoring or fraud detection tools and challenge incorrect facial recognition matches quickly to reduce the risk of identity misuse or investigation errors.
-
Understand how biometric authentication systems collect and store facial data and advocate for human verification when automated facial recognition is used in investigations or security decisions.
|
AI tools can support security decisions, but maintaining oversight, limiting public biometric exposure, and monitoring your identity activity can help reduce the risk of being incorrectly flagged by automated systems. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
