Security

19-year-old Peter Stokes was arrested in Finland and extradited to the US to face federal conspiracy charges related to the Scattered Spider hacking group. Stokes is accused of working with co-conspirators to breach a luxury jewelry retailer and demand an $8 million ransom.

Swedish-language site Flamman reported that Daniel Berntsson gave 5 million Swedish kronor to the Örebro Party. The VPN company responded to the news on X, and Mullvad’s co-CEO Fredrik Strömberg told TechRadar “I don’t like that he made this donation,” but that “we will continue to protect the universal right to privacy.”

In 2022, LastPass’ breach coughed up encrypted customer passwords spurring some crypto heists later.
Now it says a breach at Klue gave attackers access to its Salesforce data, along with that of other companies who, according to reports, are being extorted by “Icarus.” For LastPass, the stolen data includes customers’ names, phone numbers, and other data, but not the actual password vaults this time.

Tata Electronics, an India-based manufacturing partner for both companies, says it’s investigating a “cybersecurity incident” after the World Leaks ransomware group posted more than 200,000 component and specification documents on the dark web. The files reportedly include inspection ⁠standards for iPhone ​circuit board components, and drawings for the Model 3 revamp that Tesla launched in 2023.

Screenshots seen by Business Insider showed that data from Meta’s controversial AI training program — including employees’ private conversations, performance data, and transcriptions — could be accessed across the entire company. In a statement to the publication, Meta said:

The intelligence-sharing alliance says that Al models are anticipated to fundamentally transform offensive and defensive cyber capabilities in a matter of months, and that “breaches will occur” as previously unknown vulnerabilities emerge. “Adversaries are already using AI to move faster and more effectively,” said Five Eyes. “Defenders must do the same.”

A proposed class action lawsuit alleges MSG failed to protect the data of over 26 million guests. It comes just days after 404 Media reported that hackers claimed to have published data stolen from MSG, which is known for its extensive surveillance system.

The Cybersecurity and Infrastructure Security Agency (CISA) gained access to the limited release cybersecurity-focused model last week, Nextgov/FCW reports. It’s just a little late, since the rest of the world has mostly moved onto the drama around the Trump administration’s block of the safeguarded public version of the model, Fable.

The group behind Matter has released the next version of its Product Security Certification Program, a cybersecurity standard designed to provide a single security label for consumer IoT devices.

“Outsider Enterprise” allegedly distributes phishing templates that have scammed people out of millions of dollars. Google says over a million fraudulent URLs are linked to the group, and that over just two weeks, it sent 2.5 million messages to Android users with links to fraudulent websites.

According to The New York Times:

Despite last year’s $167 million verdict against NSO Group for its Pegasus software hacking some 1,400 WhatsApp users, Meta says it has detected new spear phishing attacks on its platform from the spyware maker, in violation of the court’s permanent injunction:

The smart ring company says on March 27th hackers used an internal analytics tool to access users’ contact and account details, transaction history, and “some fitness related data.” According to TechCrunch, the breach impacted 0.1 percent of Ultrahuman users, or an estimated 700 people.

With this expansion of Anthropic’s Project Glasswing initiative, organizations in “several industries that weren’t well represented” in the initial cohort, like power, water, and healthcare, will get access to the model so they can use it to find security vulnerabilities.

The @obamawhitehouse account briefly showed images of Iranian propaganda, which have since been taken down, as spotted earlier by TMZ. The account belonging to the US Space Force Chief Master Sergeant was also hijacked.

Attorney General Rob Bonta filed a lawsuit against Chrome Holding Co. — formerly 23AndMe — claiming that the company failed to protect user information, leading to the massive 2023 breach that included data belonging to 6.9 million users. In 2024, 23andMe agreed to pay $30 million to settle a class action lawsuit related to the breach.

The Aqara U500 lineup includes three separate models. There’s a “Rim Lock” for standard entrance and interior doors that doesn’t require a mortise, a “Gate Lock” for metal grille-style doors, and even a lock that’s designed for glass doors. They’re only available in Europe for now though.

Upon request, “qualifying” customers can use things like skills, a Claude harness, and a threat model builder, Anthropic says as part of a bigger update about Project Glasswing.

YouTuber Coffeezilla first reported the leak of customer details, now apparently fixed. Trump Mobile CEO Pat O’Brien has now confirmed to The Verge there was a breach, which he blames on “a third-party platform provider.”

A security bulletin from Nvidia breaks down new vulnerabilities found in some of its GPU drivers for Windows and Linux and vGPU software. As Digital Foundry and Club386 point out, they affect drivers prior to 596.36 on the current branch, so if you’re running the most recently released update (596.49, which was released on May 12th), you don’t have anything to do.

The company traced the incident to a “poisoned” VS Code extension on an employee’s device. While the hacking group TeamPCP has claimed responsibility for the breach, GitHub says it has since removed the malicious extension and that the exfiltration was limited to internal data, as reported by Bleeping Computer.