In today’s cybersecurity news…
CrowdStrike catches insider feeding information to hackers
CrowdStrike has now confirmed that “an insider shared screenshots taken on internal systems. CrowdStrike emphasized that its systems were not breached as a result of this incident and that customers’ data was not compromised. They did not specify the threat group responsible for the image taking incident.
Spanish airline Iberia suffers breach and data leak
The company says this occurred as a result of unauthorized access to a supplier’s systems. The compromised data is alleged to consist of names and surnames of customers, along with email address and Iberia Club loyalty card (Iberia Club) identification numbers. The airline says customers’ Iberia account login credentials and passwords were not compromised, nor was any banking or payment card information accessed. The company is warning customers to be vigilant for suspicious communications.
AI is too risky to insure, say insurers
According to the Financial Times news outlet, major insurers such as AIG, Great American, and WR Berkley are “asking U.S. regulators for permission to exclude AI-related liabilities from corporate policies,” which one underwriter describes as “too much of a black box.” The fear, they say, is of thousands of simultaneous claims when a widely used AI model makes a mistake. The article quotes one executive from the insurance company Aon as saying, “insurers can handle a $400 million loss to one company. What they can’t handle is an agentic AI mishap that triggers 10,000 losses at once.” The article cites examples of the types of events that are spooking insurers. These include Google’s AI Overview falsely accusing a solar company of legal troubles, triggering a $110 million lawsuit back in March; Air Canada being forced to honor a discount invented by its chatbot; and the infamous $25 million deepfake heist that happened to the London-based design engineering firm Arup last year in Hong Kong.
SalesForce warns of data breach after third party activity
This warning was released last Wednesday evening after the company discovered unusual activity related to a third-party application called Gainsight, a platform designed to help customers track sales data and customer information. Salesforce emphasized that there was no indication that the issue resulted from any vulnerability in the Salesforce platform. Instead, the activity appears to be related to the app’s external connection to Salesforce,” the company said. Although the actors behind this have not been confirmed, it appears that this may be yet another attack by affiliates of the Scattered Spider ShinyHunters group.
Huge thanks to our episode sponsor, KnowBe4
That’s why KnowBe4’s Human Risk Management platform allows you to measure, quantify and actually reduce human risk across your organization.
With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks proactively.
Ready to move from awareness to action? Request a demo of HRM+ today at knowbe4.com.
SonicWall identifies SSLVPN flaw allowing firewall crashes
This is a high-severity buffer overflow flaw in SonicOS SSLVPN that lets attackers crash Gen7 and Gen8 firewalls. With a CVE number (CVE-2025-40601) and a CVSS score of 7.5 the issue comes from “a stack-based buffer overflow that can trigger a denial-of-service condition on vulnerable devices.” SonicWall is urging all customers to apply patches immediately. The flaw “ONLY impacts the SonicOS SSLVPN interface or service if enabled on the firewall,” and SonicWall is not aware of attacks in the wild exploiting this vulnerability.
Cox Enterprises discloses Oracle E-Business Suite data breach
The telecommunications giant is notifying impacted individuals of a data breach that exposed their personal data. The hackers breached the company network in August after exploiting a zero-day flaw in Oracle E-Business Suite. The company, however, did not detect the intrusion until late September following an internal investigation. No attackers have been named, but the Cl0p ransomware has taken credit for exploiting a CVE numbered as a zero-day vulnerability (CVE-2025-61882), long before Oracle released a patch on October 5. Cox The company has not specified what types of data were exposed.
Law enforcement agencies in Oklahoma and Massachusetts respond to cyber incidents
The Cleveland County Sheriff’s Office, just south of Oklahoma City, announced on Thursday that it was facing a ransomware attack affecting parts of its internal computer system. Officials confirmed there was no interruption to public safety services or 911 service. Meanwhile, the Massachusetts city of Attleboro also reported a cyberattack impacting the local government and the police department, affecting phone lines to the City of Attleboro and Attleboro Police Department and municipal email service citywide. Online bill payments are also temporarily unavailable.
Wind farm worker turns turbines into a crypto mine
From the “when you’re a hammer, everything looks like a nail” department, “a technical manager at the Dutch wind farm operator Nordex, has been sentenced to 120 hours of community service after it was discovered he had secretly installed cryptocurrency mining rigs at two wind farm sites, just as the company was recovering from a Conti ransomware attack. The unnamed employee, who is in his forties, used the turbines to power the cryptocurrency mining operation at two of the company’s sites. As Graham Cluley writes, this is not an isolated case, citing a 2018 instance in which “several scientists at a top-secret Russian nuclear warhead facility in Sarov were arrested for attempting to use one of the country’s most powerful supercomputers to mine Bitcoin, and in China, a school headmaster was arrested for stealing his school’s electricity to power a 24-hour a day cryptocurrency-mining rig.