In today’s cybersecurity news…
ADT says customer data stolen in cyberattack
The home security company ADT stated that Monday’s breach resulted in a “limited set” of customer and prospective customer information. This consists of basic PII and no payment data was stolen. An ADT spokesperson said, “customer security systems were not affected or compromised in any way.” This past Thursday, the ShinyHunters group claimed to have stolen 10 million records and threatened to leak the data if a ransom was not forthcoming.
SMS blasting comes to Toronto
We have reported on SMS blasting before. SMS blasters operate by “mimicking legitimate cellular base stations, effectively tricking nearby phones into connecting to them instead of official mobile networks, and are often fitted into cars, allowing cybercriminals to drive through densely packed cities and capture thousands of active cell numbers, in order to blast out spam messages. Now, police in Canada’s largest city have arrested three men in the country’s first known criminal case of this type. The investigation leading to the arrest began last November after being alerted to a suspicious device operating in downtown Toronto. Over the following months, “police tracked the device moving through several locations across the Greater Toronto Area…two suspects were arrested in March.” Authorities “seized a large amount of electronic equipment, including several mobile SMS blasters, and a third person turned themselves in to police last week.
Microsoft Windows Insider Program gets an overhaul
The revamped program has been announced as part of “broader plans to address reliability concerns in Windows 11.” The Windows Insider Program “is a beta testing program that allows members to test early Windows releases and provide feedback. Addressing the complaint that it had “has not really listened to all the feedback from testers,” Microsoft is now making the Program simpler and more transparent in the hope that it will help with the development of Windows 11.” In its blog post, the company admitted that the current channel structure is confusing.
New extortion group linked to surge of vishing attacks
This new and financially motivated hacking group known as BlackFile has been “linked to a wave of data theft and extortion attacks against retail and hospitality organizations since February 2026.” According to Palo Alto Networks Unit 42, working with the Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC), the gang’s members impersonate corporate IT helpdesk staff to steal employee credentials. Unit 42 also says this gang is likely linked to The Com, which is a network of cybercriminals “known for targeting and recruiting young people for extortion, violence, and other crimes. In this wave, the attackers use voice-based phishing (vishing) from spoofed VoIP numbers or fraudulent Caller ID Names (CNAM) as a social engineering technique.
Huge thanks to our sponsor, Guardsquare
ZionSiphon water infrastructure threat holds no water
Following up on a story we covered last week, the malware, called ZionSiphon, first identified by AI cybersecurity firm Darktrace, and described as targeting operational technology and industrial control system environments in Israel’s water infrastructure might not be anything more than hype. A malware analyst at Dragos, called the malware nothing more than “hype,” stating “whoever wrote the malware appears to have little knowledge of how operational technology works at Israeli water plants.” It appears the developers “used AI to generate significant portions of the code, leading to hallucinations, guesses, and errors….and so riddled with “logic errors and invalid assumptions” that it would have been inoperable. Dragos says there are “publicly less than 10 malware samples capable of threatening industrial control systems, and ZionSiphon is not one of them.
Researchers find pre-Stuxnet malware targeting engineering software
Researchers at SentinelOne have published a report on a new Lua-based malware that had been created years before the famous Stuxnet worm that had aimed to sabotage Iran’s nuclear program by destroying uranium enrichment centrifuges. This previously undocumented cyber sabotage framework dates back to 2005, “primarily targeting high-precision calculation software to tamper with results. It has been codenamed fast16.” It also precedes the earliest known samples of Flame (aka Flamer and Skywiper), making it the first strain of Windows malware to embed a Lua engine.
Carnival cruise lines suffers breach and extortion
Troy Hunt’s Have I Been Pwned has potentially identified 7.5 million unique email addresses belonging to a subsidiary of the world’s largest cruise company. The addresses appear to relate to the Mariner Society loyalty program run by Holland America Line, a subsidiary of Carnival Corporation. The exposed data includes “names, dates of birth, genders, and membership status details, the type of personal data attackers can easily repurpose for fraud or phishing.” Carnival has acknowledged a security incident, and meanwhile the ShinyHunters extortion crew published what it claims as “terabytes of internal corporate data” after negotiations with the company failed.
Microsoft now lets admins uninstall Copilot on enterprise devices
IT administrators can now uninstall the AI-powered Copilot digital assistant from enterprise devices using a new policy setting, which became available after the April 2026 Patch Tuesday. It’s called RemoveMicrosoftCopilotApp and “is available as a Policy CSP and Group Policy after deploying this month’s Windows security updates on endpoints managed via Microsoft Intune or System Center Configuration Manager (SCCM). This policy will only apply to Windows 11 25H2 devices where the Microsoft 365 Copilot and Microsoft Copilot are both installed, the user did not install the Microsoft Copilot app, and the Microsoft Copilot app was not launched in the last 28 days.”