Zack Whittaker

Security editor, TechCrunch
Email: zack.whittaker@techcrunch.com
Signal: zackwhittaker.1337
New York, NY

Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

NIP-05 Address

zackwhittaker@mastodon-social.mostr.pub

Profile Code

nprofile1qqs9eknh8x6wrd92kega8j6htj7nz79mwr7ment2kca0vj4ls526rsqppjgmw

Author Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

Show more details

Last Notes

2026-01-27 23:12:13

If you could pick one non-U.S. tech, product, or service to switch to, what would you recommend, and why? Open-source and self-hosting options welcome!
https://techcrunch.com/2026/01/27/amid-trump-attacks-and-weaponized-sanctions-europeans-look-to-rely-less-on-us-tech/

2026-01-26 14:01:35

After another massive database of usernames and passwords was found unprotected and exposed to the internet (without a password of its own, ironic!), I wrote some words about the underlying problem — infostealing malware — and why it powers much of cybercrime today.
Read online: https://this.weekinsecurity.com/another-huge-leak-of-passwords-is-the-tip-of-the-infostealing-iceberg/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-01-22 15:35:21

New, by me: Under Armour says it’s aware of data breach claims after 72M customer records were posted online.
A spox. told me a "small percentage" of customers had sensitive information compromised, but wouldn't say what kinds of data Under Armour considers "sensitive," nor provide an accurate figure of affected customers.
https://techcrunch.com/2026/01/22/under-armour-says-its-aware-of-data-breach-claims-after-72m-customer-records-were-posted-online/

2026-01-14 16:12:51

New, by me: Security researcher Eaton Zveare spent weeks trying to alert a little-known but critical U.S. cargo tech giant that their shipping systems and customers' data were exposed to the web.
After weeks of trying, Zveare asked TechCrunch for help. We were ignored, too. On the third time we emailed the firm's CEO, we included a partial copy of his password to show the seriousness of the flaws.
A couple of hours later, we got a response — from its law firm.
https://techcrunch.com/2026/01/14/us-cargo-tech-company-publicly-exposed-its-shipping-systems-and-customer-data-to-the-web/

2026-01-14 14:14:19

This is utterly insane, almost unheard of. This morning, the FBI *searched the home* of a Washington Post reporter, and seized her phone and smart watch, as part of an investigation into an alleged leak of classified info. by a government employee. (The federal case appears to be 1:26-mj-00045.)
https://www.washingtonpost.com/national-security/2026/01/14/washington-post-reporter-search/

2025-12-19 13:41:48

Online casino and betting site Stake.com has emailed customers saying their data was stolen during Mixpanel's breach. Stake says customers' username, email address, date of birth and phone number were compromised.
That's now OpenAI, CoinTracker, SwissBorg, SoundCloud, and Pornhub known to be affected so far.
#nevent1q…8n09

2025-12-18 15:00:03

One of those stupid autonomous Uber Eats delivery robots in our neighborhood looks like it got stuck in cold weather, frozen to the ground, not moving.
The future, everyone.
https://files.mastodon.social/media_attachments/files/115/741/161/416/492/381/original/916f71b72c33a950.jpg

2025-12-17 21:33:32

I'm thrilled to have been featured in the EFF's Breachies for uncovering security lapses in the info-sharing app TeaOnHer and stalkerware app Catwatchful, along with TechCrunch's security desk's coverage of data breaches at Blue Shield of California, PowerSchool, TransUnion, and more. Thanks, EFF!
https://www.eff.org/deeplinks/2025/12/breachies-2025-worst-weirdest-most-impactful-data-breaches-year

2025-12-17 19:17:28

This looks like a particularly spicy shituation affecting Cisco customers:
• 10/10 severity zero-day bug in popular Cisco products
• Cisco says China is exploiting bug to hack customers
• Cyberattacks discovered on Dec. 10; disclosed today
• No patches yet. Compromised devices must be wiped
https://techcrunch.com/2025/12/17/cisco-says-chinese-hackers-are-exploiting-its-customers-with-a-new-zero-day/

2025-12-16 21:33:46

With news that the data breach at web and phone analytics giant Mixpanel includes the viewing habits of Pornhub users, here's my TechCrunch story from early December about why this data breach is a big deal — and what sort of data Mixpanel tracks about millions of ordinary people every day.
https://techcrunch.com/2025/12/02/a-data-breach-at-analytics-giant-mixpanel-leaves-a-lot-of-open-questions/

2025-12-14 17:36:31

This is ~ this week in security ~, with all the stories from the week you need to know, featuring: U.S. wants visitors' social media history; Petco's lapses exposed data; tech giants patch zero-days; Coupang's CEO resigns after massive breach; and much more. Plus, a very cute cyber-cat.
https://this.weekinsecurity.com/this-week-in-security-december-14-2025-edition/

2025-12-12 16:46:32

NEW, by me: Home Depot exposed access to its internal systems for a year after an employee posted a private GitHub token online, likely by mistake.
When a security researcher found it and tried to alert Home Depot, he was ignored. I alerted the company, which revoked access, but wouldn't say if it has logs to detect if anyone else found the key.
More: https://techcrunch.com/2025/12/12/home-depot-exposed-access-to-internal-systems-for-a-year-says-researcher/

2025-12-10 13:49:54

- reply

We found the bug in how Vetco generates PDF documents for its customers. Its PDF page was public and was indexed by Google, which is how we found it. Worse, an IDOR bug in the URL meant it was possible for anyone to obtain customer data by changing the customer's unique ID by a single digit. 🤦
https://techcrunch.com/2025/12/10/petco-takes-down-vetco-website-after-exposing-customers-personal-information/

2025-12-10 13:44:43

NEW: Petco has taken down parts of its Vetco website after we discovered a masive data leak exposing customers' personally identifiable information (and their pets!) to the open web.
After flagging the leak, Petco still took four days to respond. We estimate millions of customers may be affected.
More: https://techcrunch.com/2025/12/10/petco-takes-down-vetco-website-after-exposing-customers-personal-information/

2025-12-07 00:10:09

If there's one thing from my ~two decades in journalism I still think about with the hatred that burns with the heat of a thousand suns, it's "stalkerware," a kind of phone surveillance used against millions of people around the world
When a documentary crew from my native U.K. reached out to me after reading some of my work investigating these illegal operations, I jumped at the chance to chat with them.
Here's what I've learned in five years reporting on stalkerware.
https://this.weekinsecurity.com/i-have-investigated-stalkerware-for-five-years-here-is-what-i-have-learned/

2025-12-06 01:57:27

Before you log off (or not, for the extremely online), sign up (or RSS) for my newsletter https://this.weekinsecurity.com for your comprensive guide to the week in cyber — featuring all the news you need to know, and all the stuff you might've missed, and more — hand curated by me. Out Sundays. 🐈‍⬛

2025-12-04 20:53:21

I've never understood why some data breach notices say things like, "We have no reason to believe that your information was misused..." Like, why do you think a Russian ransomware gang would steal reams of your customers' Social Security numbers? For shits and giggles? No, they're using it for crime. Lots of crime.

2025-12-03 18:57:24

New, by me: Fintech firm Marquis is alerting dozens of U.S. banks and credit unions after an August ransomware attack let hackers steal reams of customers' personal information and financial data, including their Social Security numbers.
Marquis allows financial institutions to "centralize all customer or member data in one place," and as such handles large amounts of bank customers' data.
At least 400,000 people known to be affected so far and likely to rise.
More: https://techcrunch.com/2025/12/03/fintech-firm-marquis-alerts-dozens-of-us-banks-and-credit-unions-of-a-data-breach-after-ransomware-attack/

2025-12-02 16:36:11

New, by me at TechCrunch: Mixpanel's pre-Thanksgiving blog post revealing a security incident could win awards for how *not* to handle a data breach.
We only know data was stolen because one of Mixpanel's customers, OpenAI, put out its own blog post revealing more about the cyberattack.
This is what you need to know about analytics giant Mixpanel and how the company tracks users' taps and clicks both inside popular apps and across the web.
More: https://techcrunch.com/2025/12/02/a-data-breach-at-analytics-giant-mixpanel-leaves-a-lot-of-open-questions/

2025-11-30 17:01:42

My latest cyber newsletter features all the big security stories from the week, including:
A prolific hacker was outed as a Jordanian teen; Gainsight downplays its data breach; Shai-Halud worm hacks thousands of devs; FCC warns hackers are hijacking emergency alert systems; a Mixpanel breach hits OpenAI, and more.
Plus: the happy corner of good news, and a brand new reader-submitted (and very cute!) cybercat.
Read online: https://this.weekinsecurity.com/this-week-in-security-november-30-2025-edition/
Sign up/RSS: https://this.weekinsecurity.com

2025-11-28 15:14:48

Business Insider reports that Oura is planning to expand its Oura wearable rings beyond health tracking to allow for payments, authentication, and more.
Well, Capitan Buzzkill (me) here wrote about Oura's security and privacy practices earlier this year, and found:
• Oura rings *don't* end-to-end encrypt users' health data;
• As such, Oura *can* access its users' data;
• Oura told me that the company *has* received U.S. government demands for users' data.
More: https://this.weekinsecurity.com/oura-ring-deal-raises-valid-concerns-about-users-health-data-security/

2025-11-26 13:26:24

New, by me: Router maker TP-Link faces a potential U.S.-wide ban over its alleged links to China. In my latest analysis, I dive into why a TP-Link ban is unlikely to make America meaningfully safer from Chinese cyberthreats (or anywhere). Please share!
Read more: https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com/

2025-11-25 01:42:51

My partner sometimes sends me links for my cyber newsletter, https://this.weekinsecurity.com.
Today she sent me this story from the Daily Mail about a leaked recording of Campbell's CISO allegedly criticizing his company's own food, with the comment, simply: "Cyber soup-curity," followed by, "C.I.S.Oh no."
https://files.mastodon.social/media_attachments/files/115/607/784/875/184/637/original/2b407c05d7d00c5e.png

2025-11-24 14:23:10

NEW: U.S. banking giants and mortgage lenders are scrambling to figure out how much of their customers' non-public banking data was stolen during a cyberattack on a financial tech firm earlier this month.
Customers of at least JPMorgan Chase, Citigroup, and Morgan Stanley are said to be affected.
https://techcrunch.com/2025/11/24/us-banks-scramble-to-assess-data-theft-after-hackers-breach-financial-tech-firm/

2025-11-21 19:11:41

New, by me and @nprofile…zds5: CrowdStrike has confirmed it fired a "suspicious insider" who passed screenshots of company systems to a prolific hacking group — which then went on to post them publicly.
More: https://techcrunch.com/2025/11/21/crowdstrike-fires-suspicious-insider-who-passed-information-to-hackers/

2025-11-17 13:56:16

New, by me: Protei, a Russian-founded telecoms provider and supplier of surveillance and web monitoring technologies, was breached, its website defaced, and its servers raided.
"Another DPI/SORM provider bites the dust," read the company's defaced website.
https://techcrunch.com/2025/11/17/surveillance-tech-provider-protei-was-hacked-its-data-stolen-and-its-website-defaced/

2025-11-16 14:00:51

Good morning! ☀️ There's still time to sign up for today's edition of my cyber newsletter https://this.weekinsecurity.com, which has all the news you need to know from the past week, the happy corner, and a new featured cyber-cat. 🐈‍⬛
Sign up (or RSS) for the free newsletter, or $10/month for blogs & more.

2025-11-13 12:55:02

My new hacker handle just dropped.
https://files.mastodon.social/media_attachments/files/115/542/490/455/215/406/original/0d3e95e8062dfbfc.png

2025-11-12 19:43:43

Looks like Elon Musk botched X's passkey and security key switchover, and users are reporting that they're getting stuck in endless loops and, in some cases, getting locked out of their accounts.
https://techcrunch.com/2025/11/12/elon-musks-x-botched-its-security-key-switchover-locking-users-out/

2025-11-11 13:00:36

According to Nevada's report into its recent ransomware attack, a state employee "searched Google for a system administration tool to download and was instead shown a malicious advertisement that led to a fraudulent website impersonating the legitimate project."
Yeah, that happens a lot! An ad-blocker is one of your top security and privacy defenses online. If you work in an enterprise org, consider rolling out an ad-blocker to your company network!
Here's more from me: https://this.weekinsecurity.com/why-ad-blockers-are-a-top-security-and-privacy-defense-for-everyone/

2025-11-10 21:40:27

Politico is reporting that the breach at the Congressional Budget Office is "ongoing."
“Do NOT click on any links in emails from CBO. Do NOT share sensitive information with CBO colleagues over email, Microsoft Teams, or Zoom at this time,” the email to CBO staff reads.
https://www.politico.com/live-updates/2025/11/10/congress/cbo-still-under-threat-00644930

2025-11-10 14:41:33

We used to think of government spyware targeting only a select few, like terrorists and organized criminals.
But over years, government spyware has been used to hack the phones of journalists, activists, lawyers, politicians, and seemingly regular people — and the pool of victims targeted by governments is quite wide, and larger than people might think.
Here's an explainer by @nprofile…zds5 as to why.
https://techcrunch.com/2025/11/10/why-a-lot-of-people-are-getting-hacked-with-government-spyware/

2025-11-09 15:40:30

Here's my latest edition of my weekly newsletter ~ this week in security ~ with all the cyber news you need to know, including: SonicWall's firewall data breach, CBO gets hacked, Korea Telecom's very bad breach, hackers hijacking cargo, Nevada's hack post-mortem, Meta earns billions from scam ads, Norway's backdoored buses, and more.
Plus: the happy corner, and a brand new reader-featured cybercat!
Read online: https://this.weekinsecurity.com/this-week-in-security-november-9-2025-edition/
Sign up/RSS/subscribe: https://this.weekinsecurity.com/

2025-11-07 20:02:14

New: Washington Post is the latest organization to confirm a data breach linked to the mass-hacks of Oracle E-Business apps, which companies use to store their business/HR data.
Google previously said that over 100 organizations have been hacked as part of the campaign.
https://techcrunch.com/2025/11/07/washington-post-confirms-data-breach-linked-to-oracle-hacks/

2025-11-07 12:13:00

NEW, by me: Researchers have discovered an Android spyware that specifically targeted Samsung Galaxy phones during a nearly year-long hacking campaign. The spyware relied on a zero-day bug triggered by sending a victim a malware-laced photo via messaging apps. Victims are likely in the Middle East.
https://techcrunch.com/2025/11/07/landfall-spyware-abused-zero-day-to-hack-samsung-galaxy-phones/

2025-11-06 23:21:36

- reply

In this story, I included this photo of one of my favorite stickers I used to send out to folks who supported my newsletter on Ko-fi!
If you want to sign up for my free weekly newsletter (or $10/month for articles and more), you can sign up over here: https://this.weekinsecurity.com
https://files.mastodon.social/media_attachments/files/115/505/312/431/212/600/original/8939fd6ec24f079f.jpeg

2025-11-06 23:18:51

ICYMI: I wrote a very, *very* long but extremely detailed article about the North Korean remote IT workers' threat, and why every business owner, founder, executive, and even open-source project developer, should be aware of it.
I also include a ton of guidance on what to look out for, including some unconventional but effective measures you can take.
Please read and share!
https://this.weekinsecurity.com/thousands-of-north-koreans-have-secretly-infiltrated-us-and-european-companies-as-remote-it-workers

2025-11-06 13:34:57

New, by me: I wrote ~3,700 of my finest words on North Korea's remote IT workers, who have infiltrated businesses across the U.S. and Europe and aren't slowing down. Probably the most pervasive cyber threats today.
Here's my primer on how to recognize & combat them. https://this.weekinsecurity.com/thousands-of-north-koreans-have-secretly-infiltrated-us-and-european-companies-as-remote-it-workers

2025-11-05 15:28:23

New: The University of Pennsylvania has confirmed a data breach after last week's cyberattack that saw a hacker mass-email thousands of students, staff and alumni saying, "We were hacked."
https://techcrunch.com/2025/11/05/university-of-pennsylvania-confirms-hacker-stole-data-during-cyberattack/

2025-11-04 13:43:06

ICYMI: Court documents and interviews with former staff reveal how ex-L3Harris Trenchant boss Peter Williams was able to steal highly sensitive exploits from L3Harris' highly secured and airgapped network, and sell them to a Russian buyer over the course of several years.
"No one had any supervision over him at all," one former Trenchant employee told @nprofile…zds5. "He was kind of allowed to do things the way he wanted to."
https://techcrunch.com/2025/11/03/how-an-ex-l3-harris-trenchant-boss-stole-and-sold-cyber-exploits-to-russia/

2025-11-03 19:59:15

U.S. prosecutors have charged two rogue employees of a cybersecurity company that specializes in negotiating ransom payments to hackers on behalf of their victims, with carrying out ransomware attacks of their own.
A third cybersecurity professional was also indicted as part of the scheme. 👀
More, from me: https://techcrunch.com/2025/11/03/doj-accuses-us-ransomware-negotiators-of-launching-their-own-ransomware-attacks/

2025-10-30 04:13:40

Thankful for my partner who, while I'm on the other side of the country, calls me to FaceTime with our cats.
https://files.mastodon.social/media_attachments/files/115/461/161/558/511/071/original/6a12e224c03b5539.png
https://files.mastodon.social/media_attachments/files/115/461/161/639/196/141/original/210bb3bc17310528.png

2025-10-29 17:45:10

🚨🚨🚨 Absolutely insane stuff here. @nprofile…zds5 spent months working on this story.
Peter Williams, former L3Harris Trenchant boss — the division that makes cyber exploits, zero-days and spyware for Western governments — has pleaded guilty to selling Trenchant's exploits to Russia.
https://techcrunch.com/2025/10/29/former-l3harris-trenchant-boss-pleads-guilty-to-selling-zero-day-exploits-to-russian-broker/

2025-10-29 05:13:31

SCOOP: On Mon, Kaspersky said it found new spyware called Dante targeting Windows users in Russia & Belarus, saying the spyware was developed by Milan-based Memento Labs.
Memento's CEO confirmed to TechCrunch's @nprofile…zds5 that Dante is its spyware, and blamed one of its government customers for getting caught.
https://techcrunch.com/2025/10/28/ceo-of-spyware-maker-memento-labs-confirms-one-of-its-government-customers-was-caught-using-its-malware/

2025-10-29 03:57:25

Welp. That's the third telco in South Korea to have reported a data breach in the past six months, after SK Telecom and KT. https://techcrunch.com/2025/10/28/lg-uplus-is-latest-south-korean-telco-to-confirm-cybersecurity-incident/

2025-10-25 15:08:28

- reply

Adding AI to a web browser massively increases the attack surface that hackers can use to steal your data from that browser — from your recent internet history to your saved passwords and credit card numbers — and potentially beyond, including the private data saved on your computer or phone.
More: https://this.weekinsecurity.com/ai-browsers-are-a-hot-mess-of-security-risks/

2025-10-25 14:13:10

I wrote some words for ~ this week in security ~ about the security and privacy risks with AI browsers, like Perplexity's Comet and OpenAI's ChatGPT Atlas, and why they should really come with enormous warning labels: "⚠️ Use at your own risk! ⚠️"
Read online: https://this.weekinsecurity.com/ai-browsers-are-a-hot-mess-of-security-risks/
Sign up for (or RSS) the weekly newsletter: https://this.weekinsecurity.com

2025-10-23 22:34:15

In case you haven't had enough cyber for one day...
I'm re-upping my deep-dive blog on why ad-blockers are critical for your online security and privacy, and what threats they can help defend against. Plus, I run through some of the best ad blockers out there, for your browser and beyond.
https://this.weekinsecurity.com/why-ad-blockers-are-a-top-security-and-privacy-defense-for-everyone/

2025-10-23 15:53:30

NEW: U.S. prosecutors have formally accused Peter Williams, the former general manager of hacking tool maker L3Harris Trenchant, of stealing trade secrets and selling them to buyer in Russia.
We reported this week that Trenchant was investigating a leak of internal hacking tools.
Incredible reporting by @nprofile…zds5: https://techcrunch.com/2025/10/23/u-s-government-accuses-former-l3harris-cyber-boss-of-stealing-trade-secrets/

2025-10-22 18:10:09

NEW: Apple has confirmed it pulled controversial apps Tea and TeaOnHer from its App Store, citing the apps' failures to meet its requirements around content moderation and user privacy.
Both apps had security lapses soon after their launches. Tea had a data breach that exposed thousands of users' IDs. And, I found that TeaOnHer was exposing users' government-issued IDs and selfies.
https://techcrunch.com/2025/10/22/apple-confirms-it-pulled-controversial-dating-apps-tea-and-teaonher-from-the-app-store/

2025-10-22 12:51:22

ICYMI from yesterday: A former Trenchant employee working in exploit development says he was wrongly accused of leaking internal tools and fired. Weeks later, he received a threat alert from Apple saying his own iPhone was targeted with mercenary spyware.
https://techcrunch.com/2025/10/21/apple-alerts-exploit-developer-that-his-iphone-was-targeted-with-government-spyware/

2025-10-21 11:57:01

It is nothing short of genuinely impressive how much money Microsoft makes, compared directly to how utterly shit to the core its software is to use.

2025-10-20 14:43:42

I wrote a few words about the ongoing(!) Amazon cloud outage, and how one company hosting about a third of the web is probably a bad idea.
Read online: https://this.weekinsecurity.com/amazon-cloud-outage-takes-much-of-the-internet-down-with-it/
Sign up/RSS: https://this.weekinsecurity.com

2025-10-20 11:48:14

- reply

This is probably your best reminder that Amazon Web Services is too big. So is Microsoft, and Google, and all of these companies that are gobbling up money, energy, and resources, only for things to go suddenly arse-up, like today, without being held accountable. There's no space for competition.

2025-10-20 11:29:27

It's always DNS. Except when it's AWS. (In this case, it was both.)
https://techcrunch.com/2025/10/20/amazon-dns-outage-breaks-much-of-the-internet/

2025-10-18 22:16:38

My favorite #NoKings sign seen in my neighborhood today.
https://files.mastodon.social/media_attachments/files/115/397/473/059/520/571/original/db6227086673d1d4.jpeg

2025-10-16 19:58:55

Oh wow. EFF is suing the Trump administration over the government's use of social media surveillance targeting legal residents and visa-holders. EFF says the government program "surveils the social media accounts of visa holders with the goal of identifying and punishing those who express viewpoints the government doesn't like."
https://techcrunch.com/2025/10/16/eff-unions-sue-trump-admin-over-alleged-mass-social-media-surveillance-of-legal-immigrants/

2025-10-15 15:55:31

This one's a wild/messy one: Cyber giant F5, which serves most of the Fortune 500, said unknown government hackers had 'long term' access to its network:
• stole source code, some customer data
• accessed undisclosed vulns in BIG-IP
• DOJ allowed F5 to delay public notice citing national security
More, from me:
https://techcrunch.com/2025/10/15/cyber-giant-f5-networks-says-government-hackers-had-long-term-access-to-its-systems-stole-code-and-customer-data/

2025-10-14 12:13:14

New, by me: If you're not using ad blockers, you should be! I wrote 2,000+ words on why you should use them and how to get started.
In this deep-dive blog, I explain why ad blockers are critical for your online security and privacy, what threats ad blockers can help defend against, and we'll look at some of the best ad blockers out there.
More: https://this.weekinsecurity.com/why-ad-blockers-are-a-top-security-and-privacy-defense-for-everyone/
You can also sign up for my weekly cybersecurity newsletter, out Sundays: https://this.weekinsecurity.com/

2025-10-13 12:59:15

We really have to stop uncritically accepting the batshit drivel that billionaires come up with. Their main qualification is exploiting people at scale to enrich themselves with power and money, and they will do and say anything to keep it that way, especially if they pitch it as "the future."
https://files.mastodon.social/media_attachments/files/115/366/924/749/266/087/original/ddcc221068177df9.png
https://files.mastodon.social/media_attachments/files/115/366/924/749/266/086/original/d82cc3b5cfed2549.png
https://files.mastodon.social/media_attachments/files/115/366/924/757/062/742/original/35e6cd2f8b054858.png
https://files.mastodon.social/media_attachments/files/115/366/924/776/767/366/original/0760688afae0197b.png

2025-10-13 00:17:20

Toby wishes everyone a peaceful evening.
https://files.mastodon.social/media_attachments/files/115/363/961/187/221/910/original/49ff9e7be92fbd7b.jpeg

2025-10-12 15:52:05

And here's this week's edition of https://this.weekinsecurity.com, featuring stories on Clop and ShinyHunters extorting dozens of companies; India exposed citizens' tax data; DHS reassigning CISA staff to assist ICE deportations; Microsoft warns of payroll pirates, and more. Plus: a brand-new cyber cat!
Read online: https://this.weekinsecurity.com/this-week-in-security-october-12-2025-edition/

2025-10-10 20:35:14

If you're a fan of cybersecurity news but don't know where to begin, my newsletter https://this.weekinsecurity.com is a weekly roundup of all the cyber news you need to know plus news you might've missed, plus the happy corner of good news, and a reader-submitted cyber cat.
No email open or link tracking! Out Sundays.

2025-10-07 17:10:28

Scoop, by @nprofile…ceah: A federal contract shows ICE spent $825,000 on vans equipped with fake cellphone towers known as cell-site simulators, which can be used to spy on nearby phones.
The Maryland-based company that integrates the cell-site simulators into their vans is called TechOps Specialty Vehicles.
https://techcrunch.com/2025/10/07/ice-bought-vehicles-equipped-with-fake-cell-towers-to-spy-on-phones/

2025-10-07 14:31:45

SCOOP: India's income tax authority has fixed a major bug that was exposing sensitive taxpayers' data to any other signed-in user, according to the researchers who found the bug.
TechCrunch's @nprofile…0xt9 verified the data exposure by asking the researchers to check his own records.
https://techcrunch.com/2025/10/07/security-bug-in-indias-income-tax-portal-exposed-taxpayers-sensitive-data/

2025-10-05 15:19:35

My weekly cyber newsletter is out, with stories on ShinyHunters' leak site claiming 1B stolen records; how the US government shutdown hits cyber; a flood of data breaches, including Red Hat and Discord; EU's Chat Control, and more. Plus: two-for-one cybercats!
Sign up/RSS: https://this.weekinsecurity.com
Read online: https://this.weekinsecurity.com/this-week-in-security-october-5-2025-edition/

2025-10-05 13:43:43

New Windows wallpaper just dropped.
https://files.mastodon.social/media_attachments/files/115/321/846/302/853/249/original/e5491b476819fe46.jpeg

2025-10-04 16:08:34

- reply

We verified the bug by uploading a new Partiful profile photo taken from outside of Moscone West in SF, which contained the photo’s precise location.
When we checked the metadata of the photo on Partiful’s server, it *still* had the photo's exact coordinates.
Servers usually strip this data from user-uploaded photos to prevent this kind of privacy leak.
More: https://techcrunch.com/2025/10/04/event-startup-partiful-wasnt-stripping-gps-locations-from-user-uploaded-photos
https://files.mastodon.social/media_attachments/files/115/316/757/716/452/768/original/cdc27379a3a744c4.png

2025-10-04 15:52:46

NEW, by me at TechCrunch: Event planning app Partiful was not stripping precise location data from user-uploaded images, including profile photos.
That means anyone using Partiful could have revealed the location of where a person’s profile photo was snapped, if the photo contained it.
Partiful fixed the bug at TechCrunch's request. The bug meant anyone using Partiful could've seen exactly where a person's profile photo was taken.
https://techcrunch.com/2025/10/04/event-startup-partiful-wasnt-stripping-gps-locations-from-user-uploaded-photos/

2025-10-04 14:04:57

My latest: Discord said late on Friday that hackers stole users' government-issued IDs (passports and driver's licenses) from one of its customer support databases.
I wrote a few words about the risks of age verification laws, and why collecting people's government IDs is bad for security and privacy.
https://this.weekinsecurity.com/discord-says-users-government-ids-used-for-age-checks-stolen-by-hackers/

2025-10-03 13:20:44

NEW: A notorious predominantly English-speaking hacking and extortion group, dubbed Scattered LAPSUS$ Hunters, has published a data leak site claiming the theft of 1 billion records from companies who store their customer data in Salesforce databases.
The hackers claim to have stolen data Qantas, Stellantis, FedEx, Hulu, and others.
w/ @nprofile…ceah
https://techcrunch.com/2025/10/03/hacking-group-claims-theft-of-1-billion-records-from-salesforce-customer-databases/

2025-10-02 14:59:52

NEW: Google says hackers associated with the Clop ransomware gang are sending extortion emails to executives at "numerous" organizations after claiming to have stolen their data from a suite of corporate business apps developed by Oracle.
https://techcrunch.com/2025/10/02/hackers-are-sending-extortion-emails-to-executives-after-claiming-oracle-apps-data-breach/

2025-09-30 20:10:11

New: Last night in the Senate, Ted Cruz blocked a bill that would have prevented data brokers from selling personal data on anyone in the United States, and not just federal lawmakers and government officials.
https://techcrunch.com/2025/09/30/ted-cruz-blocks-bill-that-would-extend-privacy-protections-to-all-americans/

2025-09-04 12:55:34

Over the years, I have read literally thousands of data breach notices. Unsurprisingly, many of them say very little.
So, while I'm out this week, I published a 3,500+ word explainer for my newsletter and blog ~ this week in security ~ on how to read and understand a data breach notice. This guide helps to parse even the most barebones notice, and what actions you can take to protect yourself and others.
Excited to share this piece with premium tier subscribers. ❤️
https://this.weekinsecurity.com/how-to-read-and-understand-a-data-breach-notice/

2025-08-31 16:02:07

My weekly cybersecurity newsletter is out, featuring stories on DOGE uploading the entire Social Security database to AWS, Salt Typhoon hacked 600+ companies globally, Salesloft's cyberattack affects all Drift customers, TransUnion's breach, and much more. Plus, good news, and a brand new cyber cat.
https://this.weekinsecurity.com/this-week-in-security-august-31-2025-edition/

2025-08-28 13:13:28

- reply

When reached this morning, a spokesperson for TransUnion refused to answer basic questions about the company's data breach, such as who hosted the third-party application that was breached, how the data was breached (if known), and what types of customers' personal data was stolen.
https://techcrunch.com/2025/08/28/transunion-says-hackers-stole-4-4-million-customers-personal-information/

2025-08-28 12:09:50

NEW: Credit reporting giant TransUnion has confirmed a data breach involving more than 4.4 million customers' personal information. TransUnion claims "no credit information was accessed" in the late-July breach, which it said involves its U.S. consumer support operations.
https://techcrunch.com/2025/08/28/transunion-says-hackers-stole-4-4-million-customers-personal-information

2025-08-28 11:20:20

Spot the two glaring typos in the White House's daily guidance and press schedule email sent out this morning.
"THE PRESIDENT recieves his Intelligence Brieifing."
https://files.mastodon.social/media_attachments/files/115/106/117/950/380/703/original/1bfac059964daaf3.png

2025-08-25 23:39:38

- reply

@nprofile…gqp6 thank you for including one of my stories :)

2025-08-25 17:29:11

NEW: w/ @nprofile…ceah: Phone spyware TheTruthSpy has yet another security flaw, allowing anyone to hijack customer accounts and steal their victim's phone data.
TheTruthSpy's developer won't fix the flaw, and so customers and their victims are at risk of data theft.
By our count, this is at least the 4th major security lapse involving TheTruthSpy.
https://techcrunch.com/2025/08/25/a-new-security-flaw-in-thetruthspy-phone-spyware-is-putting-victims-at-risk/

2025-08-21 12:37:56

NEW: Earlier this month, two hackers published their findings in Phrack magazine after hacking into the computer of a North Korean government hacker. Now, in speaking with @nprofile…ceah, the hackers explain why they went public — even though their breach was probably illegal.
https://techcrunch.com/2025/08/21/hackers-who-exposed-north-korean-government-hacker-explain-why-they-did-it

2025-08-21 12:03:23

Device searches of international travelers at the U.S. border reached a record high earlier this year, per new data.
https://techcrunch.com/2025/08/20/device-searches-at-the-us-border-hit-record-high-new-data-shows/

2025-08-20 20:02:08

Update your iPhones, iPads and Macs. A new Apple software update went out fixing a zero-day security flaw under attack.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals."
https://support.apple.com/en-us/124925
https://files.mastodon.social/media_attachments/files/115/062/872/963/699/076/original/2a973b69b2cbaaf9.jpg

2025-08-19 00:53:58

Some 1.1 million Allianz Life customers had personal information stolen in a recent data breach involving its Salesforce CRM database, according to Have I Been Pwned.
https://techcrunch.com/2025/08/18/allianz-life-data-breach-affects-1-1-million-customers/

2025-08-18 13:17:40

New: Workday has disclosed a data breach affecting a third-party CRM database, likely Salesforce.
Workday hasn't explicitly yet ruled out a breach of customer data, but says the information includes personal contact information.
Workday's data breach notice is also hidden from search engines using "noindex" code, making the notice more difficult to find.
https://techcrunch.com/2025/08/18/hr-giant-workday-says-hackers-stole-personal-data-in-recent-breach/

2025-08-17 13:49:46

My weekly newsletter just went out, featuring stories on Russia accused of hacking U.S. federal courts system (and a Norwegian dam), NetScaler hacks, more from Def Con, a data broker behind a huge SSN breach is back, and much more. Plus, good news in the happy corner and a brand new cyber cat.
Sign up: https://this.weekinsecurity.com/
Read online: https://mailchi.mp/weekinsecurity/this-week-in-security-august-17-2025-edition
Donate/support: https://ko-fi.com/thisweekinsecurity

2025-08-13 14:04:17

NEW, by me: Last week we reported TeaOnHer, a gossip dating app for men that rocketed to the top of Apple's App Store, was exposing users' data and driver's licenses, which users had to upload to sign up. The bugs now appear fixed.
This is how we found the data-exposing flaws in less than 10 minutes.
https://techcrunch.com/2025/08/13/how-we-found-teaonher-spilling-users-drivers-licenses-in-less-than-10-minutes

2025-08-12 14:40:53

- reply

@nprofile…r0kn @nprofile…dceh "Getting Defensive" dying of laughter

2025-08-12 12:46:53

ICYMI from Def Con: Security researcher Eaton Zveare found bugs in a carmaker's centralized dealer web portal's login flow that allowed "unfettered access" to customer data and systems inside. The portal allowed the remote controlling of some car functions, like door unlocking.
Zveare said the bugs, now fixed, highlight the risks of these web-connected data portals that contain gobs of customers' data.
https://techcrunch.com/2025/08/10/security-flaws-in-a-carmakers-web-portal-let-one-hacker-remotely-unlock-cars-from-anywhere/

2025-08-09 11:24:23

Sign up for my weekly cyber newsletter ~ this week in security ~ for your full roundup of all the cyber news from the week, including Black Hat & Def Con. Featuring all the stories you need to know, including good news in the happy corner and a weekly-featured cyber cat. Plus, no open/link tracking!
Newsletters land every Sunday.
https://this.weekinsecurity.com

2025-08-07 13:07:06

NEW: The Library of Congress told us in a statement that it messed up and blamed the missing text from the constitution on a coding error. A Library of Congress spokesperson said it was due to a missing XML tag in the code when the site was being updated to include analysis.
https://techcrunch.com/2025/08/07/library-of-congress-explains-how-parts-of-us-constitution-vanished-from-its-website/

2025-08-06 19:51:24

New: TeaForHer, an app designed for men to share photos and information about women they dated, has exposed users' personal information & government IDs, like driver's licenses.
TeaForHer launched in response to the Tea app, which may be best known for its own massive data breach last week.
by me & my TechCrunch colleague Amanda Silberling:
https://techcrunch.com/2025/08/06/a-rival-tea-app-for-men-is-leaking-its-users-personal-data-and-drivers-licenses/

2025-08-06 17:57:28

- reply

Library of Congress tweeted out a short while ago saying the sections from the Constitution were removed from its website due to a "coding error." We've asked for more details, including what the coding error was, if known. No response yet.
https://techcrunch.com/2025/08/06/key-sections-of-the-us-constitution-deleted-from-governments-website/

2025-08-06 15:31:00

Well here's a weird one...
Key sections from the U.S. Constitution have gone missing from the U.S. government's official website, including sections 8 through 10, which include legal provisions like habeas corpus (aka due process). The White House hasn't commented.
https://techcrunch.com/2025/08/06/key-sections-of-the-us-constitution-deleted-from-governments-website/

2025-08-06 12:06:10

NEW, by me: Google has confirmed that some of its customers' data was stolen in a recent breach of one of its Salesforce databases.
Google attributed the hack to ShinyHunters, a group known for hacking into Salesforce instances using voice phishing attacks.
https://techcrunch.com/2025/08/06/google-says-hackers-stole-its-customers-data-in-a-breach-of-its-salesforce-database/

2025-08-04 13:15:47

New: CrowdStrike says it has seen hundreds of incidents in the past year alone where North Korean spies posing as remote developers have gained employment to generate money for the regime's nuclear weapons program.
https://techcrunch.com/2025/08/04/north-korean-spies-posing-as-remote-workers-have-infiltrated-hundreds-of-companies-says-crowdstrike/

2025-08-02 12:36:08

If you (like me) need a round-up of all the cybersecurity news from the week you might've missed but need to know (plus lots more) my free newsletter ~ this week in security ~ goes out to thousands of readers every Sunday. There's good news, a reader-submitted cybercat, and no open/link tracking. ⬇️
Sign up: https://this.weekinsecurity.com

2025-07-30 12:42:17

Sometimes he just lies on the floor, melted and meowing, wanting to be noticed.
https://files.mastodon.social/media_attachments/files/114/942/232/108/654/416/original/38fc9b8eef60c684.jpg

2025-07-29 17:19:55

New, by me: Google refused to say if it received a secret UK court order, like Apple did, demanding the company build a backdoor for accessing encrypted user data.
Meta said it hasn't received one. Apple said it's barred from disclosing if it had one (it has!).
Google tried to dodge the question, and refused to explicitly state if it had not received a UK backdoor demand.
https://techcrunch.com/2025/07/29/google-wont-say-if-uk-secretly-demanded-a-backdoor-for-user-data/

2025-07-29 12:03:40

New by me: Sex toy maker Lovense has failed to fix two security flaws that allows anyone to reveal the email address of any other user, and takeover anyone else's account.
I verified the email disclosure bug w/ the researcher, who said they went public after Lovense claimed it needed a year to fix.
https://techcrunch.com/2025/07/29/sex-toy-maker-lovense-caught-leaking-users-email-addresses-and-exposing-accounts-to-takeovers/