Trust is a big attack surface |
Today’s news covers breached vendors, cloned cloud logins, exposed visitor data, and an AI initiative aiming to strengthen open source security.
Tell us what content you want to see on TechRepublic by taking this quick survey. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
26M Madison Square Garden Records Allegedly Leaked |
Threat actors claimed a Madison Square Garden data breach has exposed at least 26 million visitor records, including contact information, security reports, and facial recognition-related data.
If verified, the incident shows how retained surveillance and security records can create long-term privacy risks beyond a typical customer data breach. |
The alleged leak has prompted legal action and renewed scrutiny of Madison Square Garden’s facial recognition and data retention practices while the investigation continues. Review your organization's data retention policies for surveillance, biometric, and physical security systems to ensure sensitive records are deleted once they are no longer needed. |
Xsolis Breach Exposes 1.4 Million Patients |
A phishing attack on healthcare technology vendor Xsolis exposed protected health and personal information belonging to nearly 1.4 million people.
Because Xsolis supports more than 600 hospitals and healthcare organizations, the breach highlights the risks third-party vendors pose across the healthcare ecosystem. Although Xsolis found no evidence of data misuse, the exposed information could enable identity theft or targeted phishing, and eligible individuals are being offered 12 months of identity monitoring.
Prioritize phishing-resistant authentication, conduct regular third-party risk assessments, and verify that critical suppliers maintain strong credential management and IR capabilities. |
LastPass Hit by Klue Supply Chain Attack |
A Klue supply chain attack exposed LastPass customer contact and support data after stolen OAuth tokens were used to access its Salesforce environment.
Although password vaults and master passwords were not affected, the incident highlights how trusted third-party integrations can expose sensitive business systems. The exposed CRM and support records could fuel targeted social engineering attacks, and LastPass has since rotated affected tokens and removed its Klue integration.
Audit all third-party OAuth connections regularly, revoke unused application tokens, and limit vendor access to only the data and systems required for business operations. |
|
|
|
A venue you used last month suffers a data breach. What's your first thought? |
|
|
|
Yesterday's Pulse Check Results |
How far does your software supply chain visibility go? |
|
|
|
Security Tools You Can Use |
-
Build your skills — earn your CompTIA CSIE with CySA+, CASP, Security+, and Pentest+ training for 74% off.
-
Discover how leading organizations are unifying data, analytics, and AI to turn security data into faster, smarter decisions.
-
See which vulnerabilities are actually exploitable in production and stop attacks at runtime before damage occurs.
|
|
|
|
AWS Console Phishing Kit Steals MFA Codes |
Researchers uncovered an adversary-in-the-middle (AiTM) phishing campaign that spoofed AWS login pages to steal credentials and MFA codes. The campaign used cloned AWS login pages, victim-specific URLs, and legitimate email services to evade defenses and target software engineers. |
The infrastructure was also linked to earlier phishing campaigns targeting Salesforce, SendGrid, and cryptocurrency platforms.
Monitor DNS logs for newly registered lookalike domains, review AWS CloudTrail for unexpected ConsoleLogin events, and adopt phishing-resistant MFA methods such as FIDO2 security keys to reduce the effectiveness of AiTM attacks. |
OpenAI Targets Open Source Security |
OpenAI launched Patch the Planet, pairing AI with expert validation to help open source maintainers identify and fix vulnerabilities. Created with Trail of Bits and supported by HackerOne, the initiative helps open source projects validate and fix security flaws to reduce supply chain risk. Dozens of patches have already been accepted, but expanding expert review across open source projects remains a hurdle. Organizations that rely on open source software should actively track the health of critical dependencies. |
|
|
|
Are Your Cloud Defenses Ready? |
Cloud environments are a prime target for attackers, where a single misconfiguration or compromised identity can expose sensitive data. |
How to reduce cloud security risk: |
- Require phishing-resistant MFA, enforce least-privilege access, and securely manage secrets, API keys, and privileged credentials to reduce identity-based attacks.
- Use a Cloud-Native Application Protection Platform (CNAPP) to unify CSPM, workload protection, identity risk, and vulnerability management into a single cloud security solution.
-
Monitor cloud activity logs for suspicious behavior, encrypt sensitive data in transit and at rest, and remediate misconfigurations before attackers can exploit them.
|
Consistent identity controls, continuous monitoring, and secure cloud configurations remain foundational practices for reducing cloud security risk. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
