In today’s cybersecurity news…

Vercel confirms breach, stolen data for sale

Vercel disclosed an incident involving unauthorized access to internal systems after an employee’s Google Workspace account was compromised at AI platform Context.ai, then pivoted into Vercel environments. The attacker accessed some customer environment variables that weren’t marked as sensitive and not encrypted at rest, enabling further escalation, though core services and open-source projects like Next.js weren’t impacted. The company is investigating with incident response experts, advising customers to rotate secrets, and review configuration. A threat actor claiming to be ShinyHunters is attempting to sell alleged stolen data. (BleepingComputer)

ZionSiphon targets water infrastructure

Darktrace researchers identified ZionSiphon malware targeting water treatment and desalination systems that activates under certain geographic and environmental conditions. The malware can scan ICS networks, interact with industrial protocols, and attempt to manipulate chlorine dosing and pressure settings. Key components are still incomplete and a coding flaw can prevent execution. So while not fully operational, the tool highlights growing attacker interest in developing malware against critical infrastructure. (Infosecurity Magazine)

Bluesky blames outage on DDoS

Bluesky said a “sophisticated” distributed denial-of-service attack caused a widespread outage beginning April 15th, disrupting core features like feeds, notifications, and search as traffic overwhelmed its systems. The company said services stabilized by April 16th despite ongoing attacks and didn’t find evidence of unauthorized access to user data. An Iran-linked group known as 313 Team claimed responsibility. (The Record)

Scattered Spider hacker pleads guilty

Tyler Robert Buchanan, a British man accused of leading the Scattered Spider group, pleaded guilty in the U.S. to wire fraud and aggravated identity theft tied to more than $8 million in cryptocurrency theft via SMS phishing and SIM-swapping attacks. Prosecutors said the group targeted multiple companies, stealing credentials to hijack email accounts and crypto wallets, with members using tactics like MFA fatigue and social engineering to breach networks. Buchanan faces up to 22 years in prison. (BleepingComputer)

Huge thanks to our sponsor, ThreatLocker

French document agency personal data exposed 

A cyberattack on France’s National Agency for Secure Documents (ANTS) exposed personal data from user accounts on its identity and driver’s license portal after a security incident detected on April 15th. The compromised data may include login credentials, names, emails, birthdates, and unique identifiers, with some cases also involving addresses and phone numbers, though uploaded documents weren’t affected and access to accounts wasn’t enabled. Authorities haven’t identified the attacker or scope of the breach. (The Record)

Serial-to-IP flaws expose legacy systems

Forescout researchers uncovered 20 vulnerabilities in Lantronix and Silex serial-to-IP converters, devices that are widely used to connect legacy industrial and healthcare systems to networks, exposing them to remote exploitation. The flaws enable attacks including remote code execution, firmware tampering, data manipulation, and denial-of-service, with demonstrated scenarios such as disrupting medical devices or falsifying industrial sensor data. Both vendors have released patches following disclosure. CISA also issued an advisory. (SecurityWeek)

Seiko USA website defaced

Attackers defaced Seiko USA’s website, claiming they breached its Shopify backend and exfiltrated a full customer database, replacing a site section with a ransom note demanding negotiations within 72 hours. The alleged data includes names, contact details, order history, shipping addresses, and account information, though the claims haven’t been independently verified and no threat actor has come forward. Seiko removed the defacement but hasn’t confirmed the breach publicly. (BleepingComputer)

Italian regulator fines national postal service orgs

Italy’s data protection regulator fined Poste Italiane and its payments unit Postepay a combined €12.5 million for illegally processing user data through their mobile apps. The regulator said the apps collected extensive device-level data, including installed and running apps, in ways deemed overly invasive and unnecessary for fraud prevention. Authorities also cited failures around transparency, security safeguards, and excessive data retention. (The Record)