Cybersecurity News: DOGE puts SS data at risk? CISA warns of exploited flaw, K-Pop attacker extradited to South Korea

By
Sarah Lane
-

DOGE Put Critical Social Security Data at Risk, Whistle-Blower Says

Charles Borges, chief data officer at the Social Security Administration, filed a whistle-blower complaint alleging the Department of Government Efficiency improperly uploaded SSA’s Numident database.. containing names, SSNs, addresses, and birthdates of nearly every American to a vulnerable cloud system. Borges warned this violates federal security rules and creates a “high risk” of identity theft and widespread harm if exposed, although no breach has been confirmed. (New York Times)

CISA warns of actively exploited Git code execution flaw

CISA says an arbitrary code execution vulnerability in Git is actively being exploited, due to mishandling carriage return characters in configuration files, letting attackers craft repositories with malicious submodules that execute code on users’ machines. Git patched the issue in versions 2.43.7 through 2.50.1. Federal agencies have to apply the fix by September 15th or follow mitigation steps, including avoiding untrusted recursive submodules or disabling hooks. CISA also added two Citrix Session Recording flaws to its Known Exploited Vulnerabilities catalog.  (Bleeping Computer)

Alleged mastermind behind K-Pop celebrity stock heist extradited to South Korea

South Korean authorities extradited a 34-year-old Chinese man from Thailand, suspected of a cyberheist targeting K-Pop celebrities, including BTS singer Jung Kook. Between August 2023 and January 2024, the attacker allegedly stole personal data from telecom firms to access victims’ financial accounts, embezzling more than 38 billion won ($27 million USD). The suspect admitted to some charges but denied others, with Interpol and Thai authorities involved in the investigation. (Bitdefender)

Hundreds of Salesforce customers impacted by attack spree linked to third-party AI agent

A data theft campaign compromised hundreds of Salesforce customers earlier this month after attackers exploited OAuth tokens stolen from Salesloft Drift, a third-party AI sales agent. Google’s Threat Intelligence Group linked the spree to threat group UNC6395, which automated data theft between August 8th-18th, targeting credentials for AWS, Snowflake, and VPNs. Salesloft and Salesforce revoked tokens on Aug. 20th. But Google warns affected customers to treat their data as compromised and rotate credentials. (CyberScoop)

Huge thanks to our sponsor, Prophet Security

Your security analysts didn’t sign up to chase false alarms all day. With Prophet Security’s AI SOC platform, they won’t have to. It works like a tireless teammate—triaging and investigating alerts around the clock. Less burnout. Better coverage. And more time for meaningful work. Learn more at prophetsecurity.ai.

ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners

A new campaign dubbed ShadowCaptcha is exploiting over 100 compromised WordPress sites, sending visitors to fake CAPTCHA pages that then trick them into running malicious commands. The attacks deliver information stealers, ransomware, and crypto miners using ClickFix social engineering and Windows tools. Researchers say site admins need to patch WordPress plugins, enable MFA, and train users against ClickFix lures. (The Hacker News)

Nissan confirms design studio data breach claimed by Qilin ransomware

Nissan confirmed its Tokyo-based design subsidiary, Creative Box Inc, suffered a data breach after the Qilin (chee-leen) ransomware group claimed to have stolen 4TB of sensitive files, including 3D vehicle models, financial documents, and VR design workflows. The attackers posted sample images online and threatened to leak all the stolen data. Nissan says it contained the incident and has notified authorities. (Bleeping Computer)

Auchan discloses data breach: data of hundreds of thousands of customers exposed

French retailer Auchan disclosed a data breach affecting hundreds of thousands of customers, with personal details tied to loyalty cards, including names, addresses, phone numbers, emails, and card numbers. Banking data, passwords, and PINs haven’t been exposed, but loyalty cards were deactivated and now have to be reissued in stores. This is Auchan’s second breach in less than a year. (Security Affairs)

Nevada state websites, phone lines knocked offline by cyberattack

A cyberattack disrupted Nevada state government systems, websites, and phone lines on Sunday, forcing offices to close Monday and leaving the state website offline. Governor Joe Lombardo said emergency services are still available and officials are using workarounds while working with federal, local, and tribal partners to restore services. No group has claimed responsibility.  (The Record)