The attack surface keeps expanding. |
From extortion groups causing chaos to AI governance and deepfake risks, today's stories highlight how quickly security challenges are changing.
Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
ShinyHunters Claims Kodak Data Theft |
Kodak is investigating a data breach involving unauthorized access to company information. While Kodak says the incident involved only a limited amount of data and did not impact operations, the ShinyHunters extortion group claims it stole more than 2.2 million records containing customer PII and internal corporate information.
|
The conflicting accounts highlight the uncertainty organizations face when threat actors publicize large-scale data theft claims before forensic investigations are complete.
Organizations should monitor dark web leak sites and threat intelligence feeds for mentions of their brand, and test incident response plans. |
Malicious JetBrains Plugins Harvest AI API Keys |
Researchers uncovered at least 15 malicious JetBrains Marketplace plugins that masqueraded as developer tools while secretly stealing AI API keys.
According to Aikido Security, the plugins were installed nearly 70,000 times and targeted API keys for services including OpenAI, DeepSeek, and SiliconFlow, transmitting credentials to a remote server when users saved their settings. The campaign raises concerns about the trust placed in IDE marketplaces, potentially exposing developers and organizations to unauthorized API usage, data access, and unexpected costs. Audit all installed IDE plugins and rotate any AI API keys entered into JetBrains extensions, especially if the plugin requests direct credential storage rather than using secure authentication methods. |
Council of Europe Investigates ShinyHunters Claims |
ShinyHunters claims it stole 297GB of data from the Council of Europe and is threatening to publish the files. This alleged dataset includes payroll records, employee information, medical files, contracts, and other HR-related documents spanning more than a decade. The Council of Europe has not confirmed the claim at the time of publication.
Review data retention policies, encrypt data in transit and at rest, and use DLP tools. |
|
|
|
How confident are you that law enforcement can take down extortion gangs like ShinyHunters?
|
|
|
|
Yesterday's Pulse Check Results |
Your primary AI model goes offline overnight. Biggest concern? |
|
|
|
Security Tools You Can Use |
-
Discover how continuous AI-powered penetration testing helps uncover exploitable risks before attackers do—at a fraction of traditional testing costs.
-
See which vulnerabilities are actually exploitable in production and stop attacks at runtime before damage occurs.
-
Simplify compliance — get ready-to-use security policies to help protect your business without the cost or complexity of an enterprise, all for under $100.
|
|
|
|
AI Agents Drive New Governance Demands |
As AI agents gain more autonomy, organizations face growing pressure to govern them responsibly. Drata found that nearly 90% of organizations cannot clearly explain how their AI agents are governed, creating potential challenges during audits. |
As AI adoption accelerates, organizations are focusing on controls such as continuous monitoring, least-privilege access, and audit trails to ensure AI agents operate within approved policies and accountability frameworks.
Create an inventory of every AI agent in production and assign a named business owner to each one because if ownership is unclear, governance gaps likely exist as well. |
Deepfakes Challenge Enterprise Trust |
A recent LinkedIn Live demonstration by HYPR showed how attackers can create convincing deepfakes in minutes using free tools and public photos. The demonstration highlights how AI tools are making impersonation attacks more accessible, enabling threat actors to create increasingly realistic representations. As deepfake technology improves, organizations need to strengthen identity verification controls to reduce the risk of fraud, account compromise, and unauthorized transactions. Require a secondary verification step for all high-risk requests by using a pre-approved communication channel, such as a callback to a verified number or a secure messaging platform, before authorizing. |
|
|
| Are your defenses ready for deepfakes? |
As deepfake technology continues to improve, organizations are facing new challenges in verifying identities and preventing impersonation-based fraud and social engineering attacks. |
How to protect against deepfake attacks: |
- Verify high-risk requests through a separate communication channel and use phishing-resistant authentication such as passkeys or security keys.
-
Reduce impersonation risks by limiting public voice/video content and using verification passphrases for sensitive requests.
- Deploy deepfake detection tools and train employees to recognize AI-powered impersonation and social engineering tactics.
|
Effective deepfake defense means turning identity verification into a repeatable control, not a judgment call left to employees under pressure. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
