Data breach incident management and recovery

China’s Volt Typhoon rebuilds botnet in wake of takedown

Nine months after its malicious botnet comprising legacy routers was disrupted by the Americans, Chinese APT Volt Typhoon is rebuilding and presents as persistent a threat as ever Continue Reading

By

• Alex Scroxton, Security Editor

Zero-day exploits increasingly sought out by attackers

Threat actors increasingly favour zero-day exploits to attack their victims before patches become available, according to the NCSC and CISA, which have just published a list of the most widely used vulnerabilities of 2023 Continue Reading

By

• Alex Scroxton, Security Editor

More data stolen in 2023 MOVEit attacks comes to light

Over a year since the infamous MOVEit Transfer cyber attacks affected thousands of organisations, more new victims have come to light after an anonymous threat actor leaked their data on the dark web Continue Reading

By

• Alex Scroxton, Security Editor

ESET shines light on cyber criminal RedLine empire

ESET publishes fresh data on the inner workings of the RedLine Stealer malware empire, which was taken down at the end of October Continue Reading

By

• Alex Scroxton, Security Editor

AI a force multiplier for the bad guys, say cyber pros

CIISec’s annual report on the security profession finds evidence of growing concern that artificial intelligence will ultimately prove more useful to threat actors than defenders Continue Reading

By

• Alex Scroxton, Security Editor

Post Office data breach caused by botched website upgrade

Data breach exposed personal details of the hundreds of former subpostmasters who had defeated the Post Office in the High Court Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

CISA looks to global collaboration as fraught US election begins

The US' CISA cyber agency has unveiled a two-year International Strategic Plan to advance collaboration and improve resilience against shared risks and threats Continue Reading

By

• Alex Scroxton, Security Editor

UK launches cyber guidance package for tech startups

The NCSC and NPSA, alongside agencies from the Five Eyes alliance, have issued guidance for startups on how to secure themselves against common cyber threats and targeted industrial espionage Continue Reading

By

• Alex Scroxton, Security Editor

Dutch critical infrastructure at risk despite high leadership confidence

Stark paradox in Dutch cyber security landscape has business leaders expressing high confidence in their IT infrastructure as cyber attacks rise Continue Reading

By

• Kim Loohuis

Detect ransomware in storage to act before it spreads

Anomaly detection and immutable copies can be frontline tools against ransomware – we look at the role storage can play against the latest techniques employed by ransomware gangs Continue Reading

By

• Stephen Pritchard

Democracy campaigner to sue Saudi Arabia over Pegasus and QuaDream spyware in UK court

Pro-democracy campaigner Yahya Assiri given permission to file legal action in London court against Saudi Arabia over its use of Israeli spyware Continue Reading

By

• Bill Goodwin, Computer Weekly

Danish government reboots cyber security council amid AI expansion

Denmark’s government relaunches digital security initiative to protect business sectors and society at large Continue Reading

By

• Gerard O'Dwyer

Can AI be secure? Experts discuss emerging threats and AI safety

International cyber security experts call for global cooperation and proactive strategies to address the security challenges posed by artificial intelligence Continue Reading

By

• Aaron Tan, TechTarget

What is tailgating (piggybacking)?

Tailgating, sometimes referred to as piggybacking, is a type of physical security breach in which an unauthorized person follows an authorized individual to enter secured premises while avoiding detection by an electronic or human access control (or alarm) system. Continue Reading

By

• Rahul Awati

NCSC chief warns of gap in cyber threats and defence capabilities

The UK and its allies must take collective action to improve their cyber resilience and repel the increasing volume of severe cyber attacks, says NCSC chief Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How to build an incident response plan, with examples, template

With cyberthreats and security incidents growing by the day, every organization needs a solid incident response plan. Learn how to create one for your company. Continue Reading

By

• Paul Kirvan

NCSC issues fresh alert over wave of Cozy Bear activity

The NCSC, FBI and NSA publish updated warning about Cozy Bear’s activities, highlighting a range of vulnerabilities the threat actor is using to set up its cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

Government launches cyber standard for local authorities

Local government bodies are being invited to take advantage of a new NCSC-derived Cyber Assessment Framework to help enhance their resilience and ward off cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

How Recorded Future finds ransomware victims before they get hit

Threat intel specialists at Recorded Future have shared details of newly developed techniques they are using to disrupt Rhysida ransomware attacks before the gang even has a chance to execute them Continue Reading

By

• Alex Scroxton, Security Editor

Internet Archive web historians target of hacktivist cyber attack

The Internet Archive nonprofit digital library and Wayback Machine operator has been attacked by pro-Palestinian hacktivists Continue Reading

By

• Alex Scroxton, Security Editor

Australia bolsters cyber defences with security bill

Legislation tackles IoT security and establishes a Cyber Incident Review Board to bolster Australia’s cyber resilience Continue Reading

By

• Stephen Withers

MoneyGram customer data breached in attack

MoneyGram confirms that customer data has been stolen in an incident that appears to have started with a social engineering attack on its IT helpdesk staff Continue Reading

By

• Alex Scroxton, Security Editor

Secureworks: Ransomware takedowns didn’t put off cyber criminals

The number of active cyber criminal ransomware gangs has surged by almost a third in the space of 12 months, according to the latest intelligence from Secureworks Continue Reading

By

• Alex Scroxton, Security Editor

UK’s cyber incident reporting law to move forward in 2025

The UK government says that enforced cyber incident and ransomware reporting for critical sectors of the economy will help to build a better picture of the threat landscape and enable more proactive and preventative responses Continue Reading

By

• Alex Scroxton, Security Editor

IBM: Data breach cost in ASEAN hits new high

The average cost of a data breach in ASEAN grew by 7% from last year, as organisations grapple with increasingly distributed IT environments and complex security systems Continue Reading

By

• Aaron Tan, TechTarget

UK telcos including BT at risk from DrayTek router vulnerabilities

A series of vulnerabilities in DrayTek's Vigor router product lines affects multiple comms service providers in the UK, according to new analysis Continue Reading

By

• Alex Scroxton, Security Editor

NCSC celebrates eight years as Horne blows in

Outgoing NCSC interim leader Felicity Oswald shares her thoughts on the body’s work over the past eight years as she hands over the reins to incoming CEO Richard Horne Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft files lawsuit to seize domains used by Russian spooks

Microsoft has been given permission to seize multiple domains used by the Russian state threat actor Star Blizzard as part of a coordinated disruption effort undertaken ahead of the US elections Continue Reading

By

• Alex Scroxton, Security Editor

SOC teams falling out of love with threat detection tools

Security operations centre practitioners are fed up of being flooded with pointless alerts and many no longer have much confidence in their threat detection tools, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

UK and Singapore to collaborate on supporting ransomware victims

At the fourth Counter Ransomware Initiative Summit in the US, both the UK and Singapore have committed to working on new guidance designed to better support victims and undermine cyber criminal business models Continue Reading

By

• Alex Scroxton, Security Editor

Unmasked: The Evil Corp cyber gangster who worked for LockBit

The NCA has named and shamed a prominent member of the Evil Corp cyber crime collective who also worked as an affiliate of the LockBit ransomware gang as the UK unveils new sanctions against 16 Russian cyber criminals Continue Reading

By

• Alex Scroxton, Security Editor

UK on high alert over Iranian spear phishing attacks, says NCSC

The NCSC and counterpart agencies in the US have issued a warning over enhanced Iranian spear phishing activity targeting politicians, journalists, activists and others with an interest in Middle Eastern affairs Continue Reading

By

• Alex Scroxton, Security Editor

Defaulting to open: Decoding the (very public) CrowdStrike event

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Elliott Wilkes, ACDS

Cyber companies need a best practice approach to major incidents.

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Andy Bridden and Ashley Barker, PA Consulting

Closing the curtain on cyber security theatre

Leaders must redefine expectations, rethink responsibility and eliminate unproductive practices to move towards real security, says Gartner vice-president analyst Richard Addiscott Continue Reading

By

• Richard Addiscott

Racist Network Rail Wi-Fi hack was work of malicious insider

Police have revealed that this week’s racist cyber attack on public Wi-Fi networks at stations across the UK appears to have been the work of a malicious insider, after arresting an employee of one of the service providers Continue Reading

By

• Alex Scroxton, Security Editor

Islamophobic cyber attack downs Wi-Fi at UK transport hubs

An apparent hacktivist attack disrupted public-facing Wi-Fi networks at UK rail stations to display Islamophobic content Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike apologises to US government for global mega-outage

CrowdStrike executive Adam Meyers appears before a US government committee to explain the series of errors that led directly to one of the biggest IT outages in history Continue Reading

By

• Alex Scroxton, Security Editor

Money transfer firm MoneyGram rushes to contain cyber attack

Money transfer specialist MoneyGram services remain down several days after a network outage developed into a full-blown cyber security incident Continue Reading

By

• Alex Scroxton, Security Editor

How to respond when your cyber company becomes the story

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Stephen McDermid

Microsoft shares progress on Secure Future Initiative

Microsoft has published a progress report on its Secure Future Initiative, launched last year in the wake of multiple security incidents, and made a series of commitments to improve its internal cyber culture Continue Reading

By

• Alex Scroxton, Security Editor

Powering Britain’s economy – datacentres gain in status

In this week’s Computer Weekly, the UK government has finally classified datacentres as critical national infrastructure – we ask, what took it so long? We assess the impact of the EU’s new energy efficiency rules on datacentre operators. And we discuss the power of information and diversity with the chief data officer at Legal & General. Read the issue now. Continue Reading

Security Think Tank: Win back lost trust by working smarter

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Vladimir Jirasek, Foresight Cyber

NCSC exposes Chinese company running malicious Mirai botnet

The NCSC and its Five Eyes allies have published details of the activities of a China-based cyber security company that is operating a Mirai IoT botnet in the service of government-backed intrusions Continue Reading

By

• Alex Scroxton, Security Editor

First CyberBoost Catalyse startup cohort named

The first group of companies named to a cyber incubator programme run by Plexal and the National University of Singapore includes two growing UK businesses Continue Reading

By

• Alex Scroxton, Security Editor

UN-backed cyber security report highlights global shortfalls in preparedness

In the three years since the UN-backed cyber security report was published, countries have been making a concerted effort to protect themselves from cyber threats, but there’s more to do Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Cyber workforce must almost double to meet global talent need

Research from ISC2 finds global cyber workforce needs additional 4.8 million people to fully secure businesses Continue Reading

By

• Clare McDonald, Business Editor

ICO and NCA sign MoU to provide joint support for cyber crime victims

UK data protection watchdog joins forces with law enforcement agency to provide more support for organisations that fall victim to cyber crime and ransomware attacks Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Longstanding Darktrace CEO Poppy Gustafsson to step down

Darktrace CEO Poppy Gustafsson is to leave the AI cyber company she helped build with Mike Lynch after more than a decade, following its acquisition by a private equity firm Continue Reading

By

• Alex Scroxton, Security Editor

NCSC and allies call out Russia's Unit 29155 over cyber warfare

The NCSC and counterpart agencies from the US and other countries have exposed a long-running campaign of Russian cyber espionage and warfare conducted by GRU Unit 29155 Continue Reading

By

• Alex Scroxton, Security Editor

Fog ransomware crew evolving into wide-ranging threat

The emergent Fog ransomware gang appears to be changing up its victimology in search of more cash-rich victims Continue Reading

By

• Alex Scroxton, Security Editor

Ongoing TfL cyber attack takes out Dial-a-Ride service

The Dial-a-Ride assisted transit service for disabled people had to temporarily suspend part of its operations as Transport for London deals with an ongoing cyber attack, but the service has now been recovered Continue Reading

By

• Alex Scroxton, Security Editor

Cyber firms need to centre their own resilience

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Niel Harper

Transport for London hit by cyber attack

London’s transport network provider TfL experiences cyber security incident, but reassures customers there is no impact on services Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Iranian APT caught acting as access broker for ransomware crews

Members of Iran-backed Pioneer Kitten APT appear to be trying to supplement their pay packets by helping Russian-speaking ransomware gangs to access their victims in exchange for a cut of the profits Continue Reading

By

• Alex Scroxton, Security Editor

Iranian APT Peach Sandstorm teases new Tickler malware

Peach Sandstorm, an Iranian state threat actor, has developed a dangerous new malware strain that forms a key element of a rapidly evolving attack sequence Continue Reading

By

• Alex Scroxton, Security Editor

Global cyber spend to rise 15% in 2025, pushed along by AI

Security spending will increase at pace in 2025, with artificial intelligence, cloud and consultancy services all pushing outlay to new highs, according to Gartner Continue Reading

By

• Alex Scroxton, Security Editor

How Kaspersky is driving growth in APAC

Kaspersky is leveraging its threat intelligence capabilities and local market knowledge to navigate geopolitical tensions and expand its footprint across the Asia-Pacific region Continue Reading

By

• Aaron Tan, TechTarget

Extending zero-trust principles to endpoints

By combining zero-trust principles with other security strategies and continuously monitoring and improving their security posture, organisations can effectively mitigate risks and protect their resources, says Gartner's Nikul Patel Continue Reading

By

• Nikul Patel

The US courts may have thrown a wrench into cyber regulation

A recent decision by the US Supreme Court to overrule the longstanding Chevron Deference has serious implications for global cyber security regulation Continue Reading

By

• Brian Arnold

Public education on security must be a top priority for Labour

With Labour returning to 10 Downing Street after 14 years, the Computer Weekly Security Think Tank panellists share advice and wish lists for the new government Continue Reading

By

• Petra Wenham

Palo Alto Networks bets on ‘precision AI’

Palo Alto Networks’ regional leader, Steven Scheurmann, explains how machine learning, neural networks and generative AI can help to prevent breaches in what it calls ‘precision AI’ Continue Reading

By

• Aaron Tan, TechTarget

New Qilin tactics a ‘bonus multiplier’ for ransomware chaos

Sophos X-Ops caught the Qilin ransomware gang stealing credentials stored by victims' employees in Google Chrome, heralding further cyber attacks and breaches down the line. Continue Reading

By

• Alex Scroxton, Security Editor

Podcast: Ransomware and what data storage can do about it

We talk to NetApp’s Chris McKean about ransomware attacks and the role of data storage in protecting against them Continue Reading

By

• Antony Adshead, Storage Editor

Phishing links becoming bigger threat than email attachments

Phishing techniques are evolving away from malicious email attachments, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Helsinki braced for elevated cyber attacks

The City of Helsinki is increasing its collaboration with cyber security and crime investigators following a major attack on its systems Continue Reading

By

• Gerard O'Dwyer

How might the UK's cyber landscape change under Labour?

With Labour returning to 10 Downing Street after 14 years, the Computer Weekly Security Think Tank panellists share advice and wish lists for the new government Continue Reading

By

• Dhairya Mehta and Cate Pye

Labour's first cyber priority must be the NHS

With Labour returning to 10 Downing Street after 14 years, the Computer Weekly Security Think Tank panellists share advice and wish lists for the new government Continue Reading

By

• Adam Button

US lawmakers seek to brand ransomware gangs as terrorists

Proposals from legislators in Washington DC could shake up the global ransomware ecosystem and give law enforcement sweeping new powers Continue Reading

By

• Alex Scroxton, Security Editor

Advanced faces fine over LockBit attack that crippled NHS 111

Advanced Software faces a multimillion pound fine for a series of failings which directly led to a 2022 LockBit ransomware attack that disrupted NHS and social care services across the UK Continue Reading

By

• Alex Scroxton, Security Editor

2024 seeing more CVEs than ever before, but few are weaponised

The number of disclosed CVEs soared by 30% in the first seven-and-a-half months of the year, but a tiny fraction of these have been exploited by threat actors, a reminder of the importance of focused security strategies Continue Reading

By

• Alex Scroxton, Security Editor

Migrating to S/4Hana – how the Co-op made its move

In this week’s Computer Weekly, as SAP users prepare for the deadline to move off the ECC platform, we find out how the Co-op is migrating to S/4Hana. Our latest buyer’s guide looks at how to manage SaaS and on-premise software licensing. And we talk to former NCSC CEO Ciaran Martin about the true risks from nation-state cyber attacks. Read the issue now. Continue Reading

World’s largest companies at near-universal risk of supply chain breach

Data from SecurityScorecard once again focuses on the interconnected nature of business supply chains and the risk posed to operational resilience by unexpected IT problems and cyber threats Continue Reading

By

• Alex Scroxton, Security Editor

Russia’s luxury car phish continues to prove effective

Government organisations and other bodies operating in Ukraine continue to be targeted by a relatively unsophisticated phishing campaign that has proven so effective for Russia’s cyber spooks that there are now multiple agencies involved Continue Reading

By

• Alex Scroxton, Security Editor

Cyber lessons, and priorities for the UK's new government

With Labour returning to 10 Downing Street after 14 years, the Computer Weekly Security Think Tank panellists share advice and wish lists for the new government Continue Reading

By

• Ameet Jugnauth and Mark Pearce

How CrowdStrike is leveraging AI to empower security teams

CrowdStrike CTO Elia Zaitsev explains how the company’s multi-agent AI architecture can help to enhance analyst efficiency and tackle cyber security challenges Continue Reading

By

• Aaron Tan, TechTarget

When critical cyber response becomes second nature

When alerts and headlines blare out warnings of critical vulnerabilities in widely-used software, the cyber security community needs to adopt a more decisive and clear-cut approach, says Huntress' Chris Henderson Continue Reading

By

• Chris Henderson, Huntress

Breach costs soar as record ransomware payment made

IBM publishes data on the spiralling costs of cyber attacks and data breaches, while researchers identify what appears to be the largest ransomware payment ever made Continue Reading

By

• Alex Scroxton, Security Editor

Basic failures led to hack of Electoral Commission data on 40 million people

UK government identifies Chinese state-linked hackers as likely to have been behind attack on the Electoral Commission Continue Reading

By

• Bill Goodwin, Computer Weekly

CISO mentoring – who to turn to when the worst happens

Those who get the role of a CISO may have overcome some professional hurdles, but are they ready to face what comes as part of the job? And who do they ask for advice? We look at the mentoring dilemma Continue Reading

By

• Dan Raywood

Core British Library services to return for new academic year

The British Library’s recovery from a devastating ransomware attack that laid waste to its IT systems continues - with hopes that some of its most popular services will be running again in September Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike blue screen bug serves a stark warning

In this week’s Computer Weekly, we analyse the lessons from the global IT outage caused by the blue screen bug in CrowdStrike security software. We talk to the data chief of Barilla, the €4bn pasta maker, about the benefits of asking, “So what?” And we find out how Finland is taking a lead on quantum computing. Read the issue now. Continue Reading

Cyber crisis? How good PR can save your brand

Cyber attacks and data breaches can happen to anybody and often bring reputational damage and a loss of customer trust. How organisations publicly respond to such incidents can make or break them, and the importance of a good PR strategy cannot be underestimated Continue Reading

By

• Ed Coram-James

Mimecast to buy insider threat specialist Code42

Mimecast is to buy fellow human-centred risk experts Code42 for an undisclosed sum to take advantage of its insider threat and data loss protection specialisms Continue Reading

By

• Alex Scroxton, Security Editor

NCSC: Beware of criminal CrowdStrike opportunists

Financially motivated cyber criminals are already conducting opportunistic attacks on organisations that leverage the CrowdStrike incident, and more targeted attacks are sure to follow Continue Reading

By

• Alex Scroxton, Security Editor

UK Cyber Bill teases mandatory ransomware reporting

In the Cyber Security and Resilience Bill introduced in the King's Speech, the UK's new government pledges to give regulators more teeth to ensure compliance with security best practice and to mandate incident reporting Continue Reading

By

• Alex Scroxton, Security Editor

Hackney Council reprimanded over 2020 ransomware attack

The London Borough of Hackney has been reprimanded by the ICO over a series of failures that led to a devastating cyber attack, but at the same time, the regulator praised the local authority for its response and commitment to making improvements Continue Reading

By

• Alex Scroxton, Security Editor

Strategic Defence Review must emphasise cyber security, says industry

Cyber security leaders say the new government's Strategic Defence Review needs to put digital security front and centre Continue Reading

By

• Alex Scroxton, Security Editor

NHS Trusts cancelled over 6,000 appointments after Qilin cyber attack

The two NHS Trusts most heavily impacted by the Qilin ransomware attack on pathology services provider Synnovis have cancelled over 6,000 appointments and procedures in the past five weeks Continue Reading

By

• Alex Scroxton, Security Editor

What is an intrusion detection system (IDS)?

An intrusion detection system monitors (IDS) network traffic for suspicious activity and sends alerts when such activity is discovered. Continue Reading

By

• Cameron Hashemi-Pour, Site Editor
• Ben Lutkevich, Site Editor

How Snowflake is tackling AI challenges

Snowflake’s regional leader Sanjay Deshmukh outlines how the company is helping customers to tackle the security, skills and cost challenges of AI implementations Continue Reading

By

• Aaron Tan, TechTarget

AT&T loses ‘nearly all’ phone records in Snowflake breach

Hackers have stolen records of virtually every call made by AT&T's customers during a six-month period in 2022, after compromising the US telco's Snowflake data environment Continue Reading

By

• Alex Scroxton, Security Editor

Public awareness of ID security grows, but big obstacles remain

Consumers are improving their awareness of the issues around digital identity security, but there are still some big issues preventing many from doing better, according to an Okta report Continue Reading

By

• Alex Scroxton, Security Editor

Dutch research firm TNO pictures the SOC of the future

In only a few years, security operations centres will have a different design and layout, and far fewer will remain Continue Reading

By

• Kim Loohius

Inside Israel’s cyber security operations

An emergency phone line allows cyber security analysts at the Israel Computer Emergency Response Team to map threats against national infrastructure Continue Reading

By

• Bill Goodwin, Computer Weekly

Chinese spies target vulnerable home office kit to run cyber attacks

China’s APT40 is ramping up targeting of victims using vulnerable small and home office networking kit as command and control infrastructure, according to an international alert Continue Reading

By

• Alex Scroxton, Security Editor

Synnovis attack highlights degraded, outdated state of NHS IT

More cyber attacks against the health service are likely, and will succeed if something isn’t done to address the increasingly elderly NHS IT estate, experts are warning Continue Reading

By

• Alex Scroxton, Security Editor

NCA’s Operation Morpheus targets illicit Cobalt Strike use

International law enforcement operation targets cyber criminals using the Cobalt Strike penetration testing framework for dodgy purposes Continue Reading

By

• Alex Scroxton, Security Editor

Cyber Essentials at 10: Success or failure?

The Cyber Essentials scheme passed its 10th anniversary in June 2024. CyberSmart's Adam Pilton reflects on progress and argues that more needs to be done to raise security awareness among Britain's small business community Continue Reading

By

• Adam Pilton

How Recorded Future is operationalising threat intelligence

Recorded Future is investing in APIs to enable automated security workflows, among other measures, to help organisations overcome the hurdles of operationalising threat intelligence Continue Reading

By

• Aaron Tan, TechTarget