Zack Whittaker

Security editor, TechCrunch
Email: zack.whittaker@techcrunch.com
Signal: zackwhittaker.1337
New York, NY

Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

NIP-05 Address

zackwhittaker@mastodon-social.mostr.pub

Profile Code

nprofile1qqs9eknh8x6wrd92kega8j6htj7nz79mwr7ment2kca0vj4ls526rsqppamhxue69uhkummnw3ezumt0d5q3vamnwvaz7tmjv4kxz7fwv35hgar09ec82c30c3lfas

Publishing to

nostr.mom

relay.ditto.pub

Author Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

Show more details

Last Notes

2026-08-08 22:57:05

FYI, probably the busiest https://this.weekinsecurity.com newsletter in a while dropping tomorrow, plus bonus bits on the blog and more. 🐈‍⬛
Sign up/RSS. (No email open/link tracking, because ew.)

2026-08-07 22:05:19

Microsoft wins "lamest vendor response" award at this year's Pwnie Awards, for publishing a blog post earlier this year threatening security researchers with legal action if they published zero-days.
Also: Meta wins "epic fail" award after its Meta AI hijack bug.
By me: https://this.weekinsecurity.com/microsoft-wins-lamest-vendor-at-pwnie-awards-2026-for-threatening-security-researchers-with-legal-action/

2026-08-07 21:12:47

Two researchers scanned Poland's internet out of a sense of patriotism and a desire to make it more secure, and found thousands of gov't and public bodies were at risk of very easy hacks. One bug let them take over two-thirds of Poland's court websites.
More: https://techcrunch.com/2026/08/07/security-researchers-scanned-the-polish-web-and-found-courts-hospitals-and-airports-at-risk-of-hacks/
(Bypass for ad-blockers: https://archive.is/pDB7Q)

2026-08-07 13:15:27

This was really important, powerful reporting by @nprofile…9hwj.
The US military’s cyberwarfare unit is scrutinizing an unusually high number of deaths by suicide among personnel over a month-long period this summer, according to government officials and other people familiar with the matter.
https://www.bloomberg.com/news/articles/2026-08-06/us-military-s-cyber-command-unit-grapples-with-cluster-of-deaths-by-suicide

2026-08-04 21:28:37

Another AI test gone awry, U.K. edition.
"An agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project's maintainer to approve the code."
More: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

2026-08-04 20:29:23

- reply

I wrote a very deep-dive for subscribers about how ad-blockers work, and why they're so effective at preventing web tracking, location surveillance, and malvertising. I also offer my favorite ad-blocker, and explore browser extensions and network-level ad-blockers. Check it out.
More: https://this.weekinsecurity.com/why-ad-blockers-are-a-top-security-and-privacy-defense-for-everyone/

2026-08-04 12:15:22

By me: A major online ads company that claims to serve 1.5 billion ads a day was hacked and began serving malware designed to steal a person's crypto. This is the latest perfect example why you should use an ad-blocker.
More: https://this.weekinsecurity.com/online-advertising-giant-adform-was-hacked-proving-once-again-why-ad-blockers-are-necessary/
Sign up (or RSS!) for the weekly newsletter: https://this.weekinsecurity.com

2026-08-04 11:18:54

If there's one thing I've learned from publishing this story is that there is a very, very, very wide chasm between what the law says about all this... and what people *think* the law says and/or *should* say.
#nevent1q…eygt

2026-08-03 19:53:14

After Anthropic and OpenAI both admitted to their AI models hacking other companies, @nprofile…ynf4 and I wanted to find out: Who is legally to blame when an autonomous AI agent hacks something? Lawyers say it's really complicated; one called it "uncharted territory."
Read more: https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/
Bypass for ad-blockers: https://web.archive.org/web/20260803194912/https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/

2026-08-03 12:36:35

New, by me: Samsung has banned smart TV apps that enlist owners' internet connections into residential proxy networks, which are increasingly linked to cybercrime. Samsung told me it's also removing apps containing resproxy code.
This comes as new research by Mnemonic found Samsung promoted barebone apps as "editor's choice," which allowed outsieders to rent access to a Samsung smart TV's internet connection.
Read more: https://techcrunch.com/2026/08/03/samsung-bans-smart-tv-apps-that-share-users-internet-connections-with-strangers/
Bypass for ad-blockers: https://web.archive.org/web/20260803121659/https://techcrunch.com/2026/08/03/samsung-bans-smart-tv-apps-that-share-users-internet-connections-with-strangers/

2026-07-31 11:01:40

- reply

@nprofile…524c we don't know that it hasn't happened already!

2026-07-31 11:00:08

- reply

Anthropic said its investigation was consistent with its "blameless postmortem culture." Bullshit! There's absolutely blame here; both OpenAI and Anthropic published blog posts literally detailing their crimes. If companies can't keep their own dangerous tech safe, they should face the consequences.

2026-07-31 10:47:50

I'd be interested to see if any of the companies that were hacked by OpenAI or Anthropic will sue them. Someone has to take responsibility for this, and the blame is almost entirely on the leaders of these AI companies. Alternatively, hacking is just legal now until a court says otherwise? What a fucking mess.
https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/

2026-07-30 20:35:06

CareCloud, which stores patients' medical records for 45,000+ hospitals & healthcare providers across the U.S., has begun notifying hundreds of thousands of people that their data was stolen in a March breach. The notices reveal new details, and the number of affected people is expected to rise.
More, by me: https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/
Bypass for ad-blockers: https://web.archive.org/web/20260730203017/https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/

2026-07-24 18:08:25

- reply

The person's attorney said feds are using a rarely used federal statute, and security experts said they hadn't heard of similar cases. This raises fresh questions about constitutional rights and device searches at the U.S. border.
Also: the DOJ's indictment had a notable typo. Read on for more.
https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search

2026-07-24 18:06:18

New, by me: The Justice Department is prosecuting an American for allegedly providing U.S. border agents with a "duress" passcode that wiped the contents of his phone when they entered it. We've confirmed the phone was running GrapheneOS.
Read more: https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search
Bypass for ad-blockers: https://web.archive.org/web/20260724175443/https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/

2026-07-22 12:03:33

Most popular smart watches and fitness trackers aren't end-to-end encrypted, nor say how often governments demand access to users' data.
My argument: If wearable makers don't want to disclose that they're turning over users' data to the feds, then the obvious fix is to end-to-end encrypt it.
More: https://this.weekinsecurity.com/most-fitness-wearables-lack-end-to-end-encryption-and-lack-transparency-reports/

2026-07-21 14:59:36

Woof. That data breach at Suno last year, but only just disclosed last week, affected over 55 million users, including their names, physical addresses, and phone numbers, according to Have I Been Pwned.
More: https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/
Bypass for ad-blockers: https://web.archive.org/web/20260721144937/https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

2026-07-20 15:04:53

New, by me: A tech company called Craneware says it was hacked and that a "significant" amount of data stolen, including its customers. The company provides software to thousands of U.S. clinics, hospitals, and pharmacies around the world, sparking fears of a data breach of patient data.
More: https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/
Bypass for ad-blockers: https://web.archive.org/web/20260720150203/https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/

2026-07-19 15:09:28

In this week's ~ this week in security ~
Spy vans are coming to U.S. police departments, how a London crew pulled off a brazen datacenter theft, Iran exploited phone bugs to track U.S. troops, Finnish therapy hacker wanted, and most fitness trackers lack basic security features. Also: WordPress bugs under active attack, and why librarians are helping people avoid AI. Plus: A brand new cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-july-19-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-07-17 15:42:27

This is really bad on its own, but again — it's an absolute travesty that a private company like Thomson Reuters can collect and store massive databases of Americans' private and personal data — from names, addresses, Social Security numbers, ethnicity, social media posts, and location information — and the government can just buy that data, no warrant needed. The data broker industry needs be shut down and privacy rights in the U.S. regulated. https://www.404media.co/ice-to-pay-thomson-reuters-125-million-to-find-voter-fraud/
#nevent1q…3ftq

2026-07-16 22:42:31

Today's dystopia is sponsored by BritBox, apparently.
https://files.mastodon.social/media_attachments/files/116/932/066/752/682/050/original/9d95361edc632194.jpeg

2026-07-16 21:30:19

New: Coca Cola discloses ransomware attack on its Fairlife dairy subsidiary, says it's "temporarily suspended" U.S. operations after its production systems were hit. Disruption to dairy systems could see potential product shortages on shelves.
More: https://techcrunch.com/2026/07/16/coca-cola-suspended-production-at-its-fairlife-dairy-after-a-ransomware-attack/
Bypass for ad-blockers: https://web.archive.org/web/20260716212310/https://techcrunch.com/2026/07/16/coca-cola-suspended-production-at-its-fairlife-dairy-after-a-ransomware-attack/

2026-07-16 14:42:32

- reply

Also, this was great reporting by BBC's @nprofile…43u5 on Mozilla's latest research out today on the many privacy problems with period trackers.
@nprofile…djff, who did the app testing for Mozilla, found one period tracker, Stardust, was sharing users' health data with a third-party.
More: https://www.bbc.com/future/article/20260715-how-period-trackers-share-womens-private-details

2026-07-16 13:00:35

Fantastic work by @nprofile…lx5n at EFF looking at the state of fitness tracker privacy.
Most wearable makers don't end-to-end encrypt your data, so police/feds (and hackers!) can get your health data — and almost none publish a transparency report, so we may never know if they do.
https://www.eff.org/deeplinks/2026/07/most-smart-watches-rings-and-bands-lack-basic-transparency-reports-and-key-privacy

2026-07-13 20:05:16

New, by me: Core to its complaint against OpenAI, Apple accused a former employee of allegedly exploiting a security bug to steal reams of confidential files from Apple's network over several weeks while working as an OpenAI employee
“LOL, I found out I can access the [network storage], so funny,” the ex-Apple employee allegedly wrote.
Read more: https://techcrunch.com/2026/07/13/apple-says-former-employee-exploited-rare-bug-to-download-confidential-files-after-leaving-for-openai/
(Bypass for ad-blockers: https://archive.is/rmPlh)

2026-07-13 14:26:33

New: The LAPD, the third-largest police department in the United States, let its contract with surveillance giant Flock expire this weekend, citing "serious concerns" with civil liberties and privacy.
Flock said it was surprised by the move, but it's not clear if the company's license plate readers will immediately cease recording.
More: https://techcrunch.com/2026/07/13/lapd-lets-contract-with-surveillance-giant-flock-expire-citing-serious-concerns-over-civil-liberties-and-privacy/
(Bypass link for ad-blockers: https://archive.is/zUou2)

2026-07-09 12:50:17

I think this raises an important point. I moved to the U.S. a few years ago to become a U.S. journalist. I've been very fortunate to have workplaces that let me do my job uninhibited. In America, a person's ability to access healthcare for themselves and their family is almost always linked to their employer. This means U.S. companies, including media outlets, hold way too much power & control over their employees. It's all the more crucial to support independent media.
https://mastodon.social/@randahl/116889333585143994
#nevent1q…04ac

2026-07-08 16:31:26

There's been *yet another* majot breach of U.S. driver's license numbers. Insurance giant AssuranceAmerica confirmed a breach affecting over 6.9 million people, making it the largest known spill of Americans’ driver’s license data this year.
By me at TechCrunch: https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/
Bypass for ad-blockers: https://web.archive.org/web/20260708162100/https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/

2026-07-08 12:15:20

Smart glasses with cameras and microphones built-in and facial recognition to come are the latest fad in surveillance tech.
For my blog & newsletter ~ this week in security ~ I wrote about why the backlash against smart glasses — aka "pervert glasses" — is justified from a security and privacy perspective. Please read and share!
More: https://this.weekinsecurity.com/reframing-smart-glasses-as-pervert-glasses/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-07-07 13:18:55

The U.S. Army has fixed two of its websites that were hacked to display messages calling President Trump a "pedophile" and a "thief."
More: https://techcrunch.com/2026/07/07/hacktivists-call-out-trump-by-hacking-and-defacing-us-army-websites/
Bypass for ad-blockers: https://web.archive.org/web/20260707131135/https://techcrunch.com/2026/07/07/hacktivists-call-out-trump-by-hacking-and-defacing-us-army-websites/

2026-07-07 01:17:53

Took a photo of this license plate a few days ago while on vacation in Maine, seems apt today.
https://files.mastodon.social/media_attachments/files/116/876/054/582/649/826/original/eff43c120f8718da.jpeg

2026-07-06 14:52:27

New, by me: Canada's top eavesdropping agency said it conducted "active cyber operations" during 2025 against drug traffickers, a violent extremist group, and a ransomware gang, using offensive hacking operations to disrupt or degrade their ability to function and cause harm.
Read more: https://techcrunch.com/2026/07/06/canadian-spy-agency-says-it-hacked-drug-traffickers-extremists-and-a-ransomware-gang-last-year/
Bypass for ad-blockers: https://web.archive.org/web/20260706144429/https://techcrunch.com/2026/07/06/canadian-spy-agency-says-it-hacked-drug-traffickers-extremists-and-a-ransomware-gang-last-year/

2026-07-06 14:15:53

Layoffs are a failure of leadership.
https://www.theverge.com/news/961528/microsoft-layoffs-july-2026-sales-xbox

2026-07-05 15:21:56

In my latest ~ this week in security ~ newsletter, I have stories on SCOTUS' geofence warrant ruling, a DHS intel system was breached, a lawmaker investigating Pegasus got hacked... with Pegasus, U.S. lawmakers are gunning for a national age verification law, Canadian spies disclose their latest cyber ops, and more. Plus, of course, a brand new cyber cat and the happy corner of good news. 🐈‍⬛
Read more: https://this.weekinsecurity.com/this-week-in-security-july-5-2026-edition/
Sign up/RSS/support: https://this.weekinsecurity.com

2026-07-03 11:23:49

New, by me: A politician who was part of a European Parliament committee tasked with investigating spyware abuses had his own phone hacked with Pegasus spyware. Stelios Kouloglou told me the hacking was "reckless" and likely due to his work. He plans to sue NSO, which develops Pegasus.
More: https://techcrunch.com/2026/07/02/politician-who-investigated-spyware-abuses-had-his-phone-hacked-with-pegasus-spyware/

2026-07-02 22:40:22

Sign up (or RSS!) for my newsletter https://this.weekinsecurity.com for all the cybersecurity news you need to know from the week, plus stuff you might've missed, and much more — including a new reader-submitted cat (or friend) in every edition. It's handwritten by me, no slop.
Here you can see my cat Theo who likes to "help" me write. Out Sundays — and no email open/link tracking!
https://files.mastodon.social/media_attachments/files/116/852/786/371/158/520/original/72780e2b4b3a829f.jpeg

2026-06-22 19:32:08

Use Claude? Anthropic might want you to upload your government-issued ID. https://techcrunch.com/2026/06/22/anthropic-says-claude-may-want-to-see-your-id/

2026-06-21 19:32:21

To anyone and everyone who also has complicated or painful feelings on days like today for Mother's or Father's Day, you are seen and you are loved.

2026-06-18 11:50:46

My adorable large adult cat son Theo had high blood pressure (what reason does he have to be stressed? he's a cat, he doesn't even pay rent). After some medication, he's doing great.
Still something hilarious about cats having their own blood pressure machines. His brother Toby was being very sweet.
https://files.mastodon.social/media_attachments/files/116/770/956/632/179/822/original/a0618bd3cd38c83d.jpeg
https://files.mastodon.social/media_attachments/files/116/770/956/678/121/825/original/43e39052f7e677c8.jpeg

2026-06-10 14:15:23

New, by me: ServiceNow appears to have notified some enterprise customers that there was outside access to their data, after a security bug left instances exposed to the web.
The company has hidden its notice behind a login wall, but was shared by network defenders on Reddit.
https://techcrunch.com/2026/06/10/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet/

2026-06-07 23:38:27

- reply

@nprofile…0hde thanks for all you do, Em. 🙌

2026-06-07 14:17:19

My ~ this week in security ~ newsletter is out, featuring hacks affecting 20,000+ Instagram users, password manager Dashlane, and wearable ring maker Ultrahuman.
Plus: A surge in ClickFix attacks, and story about a CIA officer allegedly caught with $40M in gold bars at his home is eyebrow raising. 👀
Read more: https://this.weekinsecurity.com/this-week-in-security-june-7-2026-edition/
Sign up/RSS and become a paying member for exclusive articles and more at https://this.weekinsecurity.com

2026-06-06 21:56:01

ICYMI: In a data breach notice filed by Meta overnight, the company said its Meta AI chatbot "worked properly and functioned as intended," despite hackers abusing the chatbot to hijack literally thousands of Instagram accounts over a months-long campaign.
By me: https://this.weekinsecurity.com/meta-confirms-thousands-of-instagram-accounts-were-hacked-by-abusing-its-ai-chatbot/

2026-06-06 11:52:21

New, by me: Meta has filed a data breach notice confirming that *thousands* of people had their Instagram accounts hacked as part of a months-long campaign abusing its Meta AI chatbot.
Meta's breach notice shows the hacks were far more widespread than first thought.
More: https://this.weekinsecurity.com/meta-confirms-thousands-of-instagram-accounts-were-hacked-by-abusing-its-ai-chatbot/
Sign up/RSS for my free weekly newsletter: https://this.weekinsecurity.com/

2026-06-05 00:55:17

I wrote about Filtr, a new feature in the popular ad blocker Wipr, which now blocks ads in almost every iPhone, iPad, and Mac app — and not just the Safari browser.
Uses a new feature in iOS/macOS 26 to block ads at the network level. (Yes, I realize the irony that TechCrunch blocks ad-blockers. 😑)
https://techcrunch.com/2026/06/04/filtr-is-a-new-privacy-tool-that-blocks-ads-in-almost-every-iphone-and-mac-app

2026-06-04 20:37:43

Last year I said this, and it's still true.
"If there's one thing I've learned about covering cybersecurity over the past decade or so, is that the cybersecurity community (the fixers and breakers) and the cybersecurity industry (profits above all else) are two very, very different things."
#nevent1q…crlc

2026-06-04 20:33:34

Personally I think Dashlane's update to its 2FA-busting data breach notice is still lackluster and doesn't explain that much beyond its original post. That said, @nprofile…ss8w does a solid job of reading between the lines and filling in the gaps. tl;dr: Bruteforcing Dashlane customer account 2FA codes was relatively easy.
https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/

2026-06-04 15:07:00

You know things are bad when Chinese spies are *also* spending their entire day on LinkedIn.
https://techcrunch.com/2026/06/04/chinese-spies-are-using-linkedin-to-lure-westerners-into-sharing-sensitive-information/

2026-06-02 15:45:52

New, by me: Password manager giant Dashlane said hackers obtained some customers' password vaults during a weekend cyberattack by defeating the company's two-factor security protections.
https://techcrunch.com/2026/06/02/password-manager-dashlane-says-hackers-stole-some-customers-password-vaults/

2026-05-30 12:48:37

It's rare to see near-universal condemnation from the infosec community, but Microsoft threatening a security researcher has done it.
Notable exceptions: When Keeper Security sued Ars Technica over a story (2017); NSA's mass surveillance uncovered (2013); and FBI demanding an Apple backdoor (2016).
https://techcrunch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher-with-criminal-investigation/

2026-05-30 02:34:02

PostHog says it's currently experiencing a security incident. The analytics company said it's "rotating keys after a security research team was able to confirm an exploit in one of our AWS environments," referring to Amazon Web Services.
Incident page: https://www.posthogstatus.com/incidents/01KSV6HJYKG5QJAP8HVTSQVSM1
https://files.mastodon.social/media_attachments/files/116/661/186/596/263/969/original/72cc7c1dc9632d5f.jpeg

2026-05-29 17:09:09

NEW: Microsoft is facing heavy criticism from the cybersecurity community for threatening to take legal action and call the cops on a security researcher who published unpatched bugs online.
Cybersecurity veterans warned that Microsoft's approach here could result in a chilling effect.
https://techcrunch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher-with-criminal-investigation/

2026-05-28 12:22:42

Oura has announced a new wearable ring. This is a good time to remind you that Oura receives government demands for users' sensitive data stored on its servers, but won't say how many demands it gets — or how often it gives that data to authorities.
From me, last week: https://this.weekinsecurity.com/oura-says-it-gets-government-demands-for-user-data-will-it-share-how-many/

2026-05-27 18:29:37

NEW: UK Visa Portal, a website that lets people apply for a UK visa, spilled thousands of applicants' passports, selfies, and location data online.
The data exposure is now fixed, but not before the company sent attorneys and a public relations firm our way — which is very weird!
My updated story: https://techcrunch.com/2026/05/27/uk-visa-portal-spilled-thousands-of-applicants-passports-and-selfies-online-and-hasnt-fixed-the-leak/

2026-05-27 16:59:57

Condé Nast shit the bed so hard when it fired four journalists last year that it's now settled with the union and given three out of the four reporters "two years’ pay and furnished [them] with positive letters of recommendation."
UNIONS, PEOPLE. UNIONS!
https://www.hollywoodreporter.com/business/business-news/conde-nast-union-settlement-fired-four-exclusive-1236606293/
https://files.mastodon.social/media_attachments/files/116/647/596/398/326/862/original/34d063439c6fa0ad.png

2026-05-25 23:06:06

Really enjoyed chatting with @nprofile…40zt at @nprofile…0jjs about the consumer-grade spyware industry, aka stalkerware, which I've spent much of my career investigating. We talked about the massive scale of the stalkerware problem, why stalkerware keeps getting hacked, and what I've learned from my reporting over the years.
https://www.youtube.com/watch?v=BLb46310iLs

2026-05-24 14:04:54

And my latest weekly cyber newsletter is now out, looking at: GitHub's hack, CISA exposed government cloud keys, EU authorities seized a VPN server, Google published exploit code for an unfixed Chromium bug, wrench attacks are on the rise, an SMS blaster at Eurovision(?!), and much more.
Thanks so much for reading; it really means the world to me.
Read online: https://this.weekinsecurity.com/this-week-in-security-may-24-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-05-23 12:40:16

New, by me: Health wearable giant Oura says it has received government demands for users' information (because Oura does not use end-to-end encryption).
Will Oura say how often it gets demands for user data, and how often Oura hands over users' data to authorities?
Read online: https://this.weekinsecurity.com/oura-says-it-gets-government-demands-for-user-data-will-it-share-how-many/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com/

2026-05-23 02:03:11

"I have been a professional tech journalist for nearly fifteen years, and before today, I cannot think of a single time when a Bing search result was more valuable than the Google equivalent. There really is a first time for everything!"
https://techcrunch.com/2026/05/22/you-can-no-longer-google-the-word-disregard/

2026-05-23 01:37:11

If someone wants to leak me a copy of this app (either .apk or .ipa), please reach out on Signal — my username is zackwhittaker.1337 — and I would be keen to run this app through Burp Suite to see how it works. Happy to grant anonymity.
https://www.govexec.com/management/2026/05/white-house-ordering-agencies-place-its-new-app-all-employees-government-phones/413738/

2026-05-22 12:41:33

Oh no! BASED APPAREL, the online store run by FBI director Kash Patel (for some reason?), was hacked to serve ClickFix attacks (🎻).
Website visitors see a fake Captcha-style screen, and are then tricked into hacking themselves by copying and pasting malware code.
How this hack works: https://this.weekinsecurity.com/clickfix-attacks-are-increasingly-devious-dangerous-and-can-get-you-hacked-in-an-instant/
https://files.mastodon.social/media_attachments/files/116/618/263/548/131/332/original/015943dfd2b15c9b.png
https://files.mastodon.social/media_attachments/files/116/618/268/327/259/606/original/cfad64c2e49ca61b.png

2026-05-21 12:00:57

- reply

These emails are pretty crude (see below) and can be easy to spot as phishy. But abusing this legitimate Microsoft account typically used for real account notifications means that these emails are landing in users' inboxes and not getting flagged as spam.
Read more: https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam/
From last week:
https://mastodon.social/@zackwhittaker/116562360000833298
#nevent1q…mrpf

2026-05-21 11:56:18

New, by me: Scammers are abusing a legitimate internal Microsoft account (used for sending critical account alerts and MFA codes to users logging in) to send spam and scam emails.
We first saw a flood of these emails last week, but anti-spam project Spamhaus says this has been going on for months.
More: https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam/

2026-05-20 13:27:41

GitHub says thousands of its internal repos were compromised in a recent attack. The Microsoft-owned company said it "detected and contained a compromise of an employee device involving a poisoned VS Code extension."
https://techcrunch.com/2026/05/20/github-says-hackers-stole-data-from-thousands-of-internal-repositories/

2026-05-20 12:07:39

For my newsletter & blog, I wrote about why many in cybersecurity are talking about AI — but crucially, why I think it's also all the more important to *not forget* about the cybersecurity basics and best practices, which are still the leading causes of damaging breaches.
More: https://this.weekinsecurity.com/ai-can-find-bugs-and-flaws-but-do-not-forget-the-cybersecurity-basics/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-05-18 16:38:20

New: NYC Health and Hospitals says a data breach earlier this year affects 1.8 million people. Hackers stole personal info, medical data, government-issued IDs, Social Security numbers — and *biometrics*, including fingerprints and palm scans.
Already one of the largest healthcare breaches of 2026.
https://techcrunch.com/2026/05/18/nyc-health-and-hospitals-says-hackers-stole-medical-data-and-fingerprints-during-breach-affecting-at-least-1-8-million-people/

2026-05-18 12:24:23

We have yet to normalize booing billionaires in public, but we should definitely start.
https://techcrunch.com/2026/05/17/if-youre-giving-a-commencement-speech-in-2026-maybe-dont-mention-ai/

2026-05-17 15:14:45

And the latest edition of my newsletter ~ this week in security ~ is out: Canvas software maker Instructure paid the hackers who catastrophished it, while Grafana did not. A million more IDs leak online. Trump and Xinping chat cyber, AI, and spying during state visit. And a decades-old nuclear sabotage secret is uncovered. 🐈‍⬛
Read online: https://this.weekinsecurity.com/this-week-in-security-may-17-2026-edition/
Sign up/RSS for the weekly dispatch (no email open/link tracking!): https://this.weekinsecurity.com

2026-05-16 15:45:33

- reply

Bonus cyber cat from my local neighborhood eatery, who can be seen here strictly enforcing the "bathroom for customers only" policy.
More cyber news and a new reader-submitted cyber cat (or friend) in every newsletter, out Sundays. https://this.weekinsecurity.com
https://files.mastodon.social/media_attachments/files/116/585/026/588/173/501/original/23abcc6a17e5828d.jpeg

2026-05-16 13:15:25

Sign up (or RSS!) for my weekly cybersecurity newsletter https://this.weekinsecurity.com for all the cyber news from the week that you need to know but might've missed. Parsed and hand-written by me, and no email open or link traffic, because privacy! Out Sundays.
My site also features an online archive of my weekly newsletters dating back to 2018, documenting 7+ years of cybersecurity news for anyone to read.
I also regularly blog analysis for subscribers. 👀

2026-05-15 21:11:25

CNN's Sean Lyngaas back once again with a belter story: Iranian hackers are behind a series of breaches of systems that monitor the amount of fuel in storage tanks serving gas stations in multiple U.S. states.
Per Lyngaas: the hackers "exploited automatic tank gauge systems that were sitting online and unprotected by passwords."
A little louder for the folks in the back:
...."UNPROTECTED BY PASSWORDS."
https://www.cnn.com/2026/05/15/politics/iran-hackers-tank-readers-gas-stations

2026-05-15 20:41:45

I wrote back in November about how easy it was to find leaked passport photos and driver's licenses online. The spills have only gotten worse in the months that age verification laws rolled out. We're reaching a point (if not already) where our government IDs aren't worth shit in the digital world.
https://this.weekinsecurity.com/it-is-far-too-easy-to-find-leaked-passports-and-drivers-licenses-online/

2026-05-15 19:47:45

Filed under "shit I can't believe is still happening in 2026 but here we are": 1+ million photo IDs and selfies from a hotel check-in system left publicly exposed online for anyone to find.
This is the latest example of a company leaking government-issued IDs in recent months.
https://techcrunch.com/2026/05/15/a-hotel-check-in-system-left-a-million-passports-and-drivers-licenses-open-for-anyone-to-see/

2026-05-13 14:41:14

New, by me: U.S. lawmakers want answers from the chief executive of Instructure, which makes the Canvas software for schools, about the company's data breach and the defacement/extortion shitshow that followed.
Millions of students' data stolen in the breach. Instructure paid the hackers' ransom.
https://techcrunch.com/2026/05/13/us-lawmakers-demand-answers-from-instructure-after-canvas-data-breaches/

2026-05-13 14:05:06

U.S. President Donald Trump, as quoted by the White House pool report:
"I don't think about Americans' financial situation. I don't think about anybody. I think about one thing, we cannot let Iran have a nuclear weapon. That's all."
I want to embroider this quote onto a tea-towel for my in-laws.
https://files.mastodon.social/media_attachments/files/116/567/641/010/094/732/original/d8b67e62c5c21918.png

2026-05-13 12:15:49

This is so fucked up. Trans rights are human rights. NYU hasn't said yet if it will challenge the demand. https://news.bloomberglaw.com/health-law-and-business/doj-targets-nyu-with-criminal-subpoena-for-trans-health-records
https://files.mastodon.social/media_attachments/files/116/567/214/760/078/359/original/1bc16483febe9ddf.jpeg

2026-05-12 17:04:19

New: Google has a new Android security feature for Pixel phones to help uncover spyware attacks.
The feature, dubbed Intrusion Logging, records errors and collects evidence when something goes wrong with the software, with the aim of providing visibility into suspected spyware attacks.
https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks/

2026-05-12 15:41:03

Looks like hackers/scammers/asshats are abusing Microsoft's systems to send out crude phishing messages as two-factor emails.
Emails are sent from msonlineservicesteam@microsoftonline[.]com, which is a legitimate Microsoft email used to send out about account notifications, and look like this.
https://files.mastodon.social/media_attachments/files/116/562/355/988/416/854/original/6bd8200b17e0a93a.png
https://files.mastodon.social/media_attachments/files/116/562/356/033/300/617/original/7f0198d1a59491c8.png

2026-05-11 13:07:02

In this 3,000+ word deep-dive for my blog and newsletter ~ this week in security ~ I explore the most pressing threats to face the internet this year. This includes surveillance and choking online access to governments going rogue, and more, and why they pose a risk.
https://this.weekinsecurity.com/the-most-dangerous-threats-to-the-internet-in-2026/

2026-05-09 22:16:58

Edtech giant Instructure was hacked (twice) — and finally put up a security incident page after the mass-defacement of Canvas school login pages.
But you might not find the page because right now it has a "noindex" tag in the page's HTML code, which prevents it from being listed in search results.
The page is here, FYI: https://www.instructure.com/incident_update

2026-05-08 14:47:10

What did you (or someone you know) do this week that you're incredibly proud of?

2026-05-07 15:17:04

Police arrested three men accused of driving around an SMS blaster across downtown Toronto, which allegedly blasted tens of thousands of phones with spammy text messages over several months.
https://techcrunch.com/2026/05/07/police-arrest-sms-blaster-crew-that-sent-malicious-messages-to-thousands-across-toronto/

2026-05-06 18:24:39

A U.S. court sentenced a member of a Russian ransomware gang to 8+ years in prison.
Prosecutors said the Karakurt gang "fueled corruption" in the Russian government, and relied on access to Russian government databases to intimidate its victims. Russian officials allowed the gang to avoid paying tax and dodge the military draft.
(h/t @nprofile…f33n)
https://techcrunch.com/2026/05/06/doj-says-ransomware-gang-tapped-into-russian-government-databases/

2026-05-06 16:11:14

I heard more from Disc-Soft, the maker of Daemon Tools, which was backdoored by suspected Chinese-language hackers and used to compromise thousands of users.
Disc-Soft tells me the backdoor was "limited to the free DAEMON Tools Lite" and v12.6 removes the backdoor; investigation ongoing.
My earlier story: https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

2026-05-06 13:53:18

This cracks me up because kids just think up these things so brilliantly, but also this proves that age verification laws are complete dogshit and don't even work.
https://techcrunch.com/2026/05/06/some-kids-are-bypassing-age-verification-checks-with-a-fake-mustache/

2026-05-06 11:21:17

- reply

@nprofile…vuvh this is so freaking cool to see, Tinker. amazing community vibes.

2026-05-05 15:25:16

NEW: Kaspersky says hackers planted and activated a backdoor in the popular Windows disk imaging app Daemon Tools a month ago, infecting thousands of computers around the world in a n ongoing, "widespread" attack.
The attack appears to be ongoing. A representative for Disc Soft, which makes Daemon Tools, said it was aware of Kaspersky's report and was investigating.
This is the latest supply chain attack targeting software used by a large number of people.
https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

2026-05-05 01:02:38

By me: I'm suing the U.S. government under the Freedom of Information Act.
https://this.weekinsecurity.com/plot-twist-i-am-suing-the-justice-department-and-fbi

2026-05-04 11:04:36

Excellent reporting, alarming findings. Bloomberg's @nprofile…kj6p et al found U.S. state government health websites are sharing people's personal info (sex, citizenship & race data) with tech giants via pixel-sized webpage trackers. Several states pulled the trackers after Bloomberg disclosed.
ALWAYS USE AN AD-BLOCKER. But really!
https://www.bloomberg.com/features/2026-healthcare-advertising-trackers-privacy/
https://files.mastodon.social/media_attachments/files/116/515/976/653/674/081/original/1a8d2e5a2585b1ee.png

2026-05-04 10:45:40

- reply

@nprofile…ydzz a malicious screensaver?! what is this, 1997?

2026-05-03 11:29:56

Busy week? Need to catch up with all the cyber news? I got you covered!
My weekly cyber newsletter https://this.weekinsecurity.com has all the big news, analysis, breaches, hacks, and attacks you need to know. Plus, every week there's good news in the happy corner, and a reader-submitted featured cyber cat. 🐈‍⬛
No email tracking. Sign up/RSS. Out Sundays. (The latest issue goes out later today!)

2026-05-02 12:06:11

For my blog and newsletter, I wrote about a growing trend of regular consumers finding security bugs, flaws, and data leaks but having no way to report them to the companies.
In this blog, I make the case why *every* organization should make it easy for anyone to alert them to security issues. You might also avoid getting an alarming email from an inquiring reporter like me...
Thanks for sharing! ❤️
Read: https://this.weekinsecurity.com/why-every-organization-should-make-it-easy-to-report-security-flaws/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-04-30 19:40:47

NEW: Hackers are exploiting a bug in the popular web server administrator software cPanel and WHM, used in millions of websites around the world.
The bug allows hackers to bypass login screens and gain full server access. One web host said they've seen evidence of attacks dating back to February.
https://techcrunch.com/2026/04/30/hackers-are-actively-exploiting-a-bug-in-cpanel-used-by-millions-of-websites/

2026-04-29 13:44:47

New, by me: The Sri Lankan government was hit by not one, but *at least* two suspected business email compromise attacks that redirected some $3 million in payments to the bank accounts of hackers. Australia reportedly said it's missing a payment from Sri Lanka, too.
https://techcrunch.com/2026/04/29/sri-lanka-discloses-another-missing-payment-days-after-hackers-stole-2-5m-from-its-finance-ministry/

2026-04-25 13:39:01

Deluged by an endlesss stream of cyber headlines? My free weekly newsletter https://this.weekinsecurity.com serves up all the cyber news from the week that you need to know but might've missed. Also includes the happy corner of good news, and a reader-submitted cyber cat. 🐈‍⬛
Out Sundays! Sign up/RSS:

2026-04-23 11:43:46

I'll save you a click, but toy maker giant Hasbro is *still* down after a cyberattack on March 28. The company said in an 8-K filing today that the "unauthorized access has been contained and the Company is making progress in fully restoring its systems and operations."
https://www.sec.gov/ix?doc=/Archives/edgar/data/46080/000004608026000016/has-20260423.htm

2026-04-22 15:41:37

New: Cosmetics giant Rituals has confirmed a data breach involving its customer membership database. Won't say how many customers had personal information stolen (names, addresses, phone numbers, and more) but its website says it has 41M+ total customers.
Breach affects EU, UK and US customers.
https://techcrunch.com/2026/04/22/cosmetics-giant-rituals-confirms-data-breach-of-customer-membership-records/

2026-04-22 14:17:43

U.K. intelligence says at least 100 countries now have access to government spyware, up from around 80 countries in 2023. The rise shows that spyware continues to proliferate and that the bar to obtaining spyware is lower.
https://techcrunch.com/2026/04/22/uk-government-says-100-countries-have-spyware-that-can-hack-peoples-phones/

2026-04-22 11:01:17

So... Anthropic spent weeks claiming that it couldn't publicly release its Mythos AI model because of its alleged offensive hacking capabilities and.... some AI nerds from Discord just found it and accessed it? Anthropic is a fucking joke. https://www.bloomberg.com/news/articles/2026-04-21/anthropic-s-mythos-model-is-being-accessed-by-unauthorized-users
https://files.mastodon.social/media_attachments/files/116/448/005/664/062/992/original/f9deb4fa7bd1acba.png