BankInfoSecurity.com

Insurer's Hack Could Rank as Largest US Health Data Breach Reported in 2025
Supplemental health insurer Aflac is notifying 22.65 million people whose sensitive health and personal information, including Social Security numbers, was potentially compromised in a June data theft incident. The incident will likely rank as the biggest U.S. health data breach reported in 2025.

Critics of South Korea's Coupang Dismiss Offer as Marketing More Than Compensation
After suffering a data breach that exposed personal data for two-thirds of South Korea' population, online retailer Coupang promised to distribute $1.2 billion in vouchers to "restore customer trust." But critics have accused the move of being more about marketing than true compensation.

Cyber Command Involved in Strikes on Caracas
Here's what we don't know: Whether the Caracas grid outage triggered by the U.S. incursion was caused - or at least aided - by a cyberattack. A coordinated attack involving a cyber component against an adversarial electrical grid wouldn't be unprecedented.

Investors Increasingly See Each Security Technology Category as Winner-Take-All
The chasm between the cyber "haves" and cyber "have nots" widened in 2025, with most large security companies recording stock price gains while smaller companies logged losses. Of the 11 public cyber vendors with valuations exceeding $14.9 billion, the stock price rose for nine of those companies in 2025.

Insurer's Hack Could Rank as Largest US Health Data Breach Reported in 2025
Supplemental health insurer Aflac is notifying 22.65 million people whose sensitive health and personal information, including Social Security numbers, was potentially compromised in a June data theft incident. The incident will likely rank as the biggest U.S. health data breach reported in 2025.

The Campaign Compromises Open-Source Vulnerability to Hack IoT Devices at Scale
Security firm CloudSEK has uncovered a botnet campaign that is exploiting the React2Shell vulnerability in the Meta-developed, open-source React framework across a variety of devices since December. The security firm attributed the campaign to RondoDox.

Visibility Gaps Increase the Risk of Certificate-Driven Outages
Moving to 47-day TLS and SSL certificate renewal cycles by 2029 will turn certificate management into an enterprise risk. "Automation and crypto-governance are now board-level imperatives. Enterprises can prepare for continuous renewal cycles without losing resilience," says Sectigo CEO Kevin Weiss.

Also: Leadership Decisions Shaping Cybersecurity in 2026
Security leaders are heading into 2026 facing growing pressure from AI-driven risks, limited resources and an increasingly complex threat landscape. Sean Mack, who leads ISMG's CXO Advisor practice, joined ISMG editors to discuss how these forces are reshaping security.

Indian Police Arrests Ex-Coinbase Staffer Over Data Breach Charges
This week, a $7 million Trust Wallet extension hack, arrest of an ex-Coinbase support agent, the U.S. sued alleged perpetrators of a $14M scam, Polymarket hack update, early release scheduled for former Alameda CEO, backlash on Flow's post-exploit rollback plan and Grubhub-linked holiday Bitcoin scam.

Also: China-Linked APT Hijack Updates, Condé Nast Data Leaked, La Poste Hit
This week, a Clop-linked vendor breach hit Korean Air, a China-linked APT hijacked software updates, a critical zero-day flaw remained unpatched, Condé Nast faced a data leak, La Poste was disrupted and Korean police extradited a malware operation suspect.

Finnish Border Guard Seize Cargo Ship Suspected of Causing Disruption
Finnish police on Wednesday seized a cargo ship sailing from Russia suspected of rupturing an undersea telecommunication cable connecting Helsinki to Estonia, a region of the Baltic Sea that is the site of a slew of suspected Russian cable sabotage incidents.

Systems Thinking, Not Tools, Increasingly Separates Senior Talent From Peers
The Six Degrees of Kevin Bacon game shows how quickly distance disappears once connections are traced. Cybersecurity careers work the same way. Advancement depends on understanding how your work connects to indirect risk, supply chain failures and business outcomes beyond your role.

Ransomware Attackers Grabbed Customer Data Stored by Marquis Software Solutions
More financial services firms are reporting breaches of customer data that trace to an August ransomware attack against Marquis Software Solutions, which provides marketing and compliance software used by over 700 banks and credit unions. At least 1.4 million consumer appear to be affected.

Experts on Cyberattacks, Deepfakes, AI and Geopolitical Strife in the Year Ahead
Cyberattacks, nation-state hacking and geopolitical shifts dominated 2025, but the year will also be remembered as a turning point - where AI blurred the lines between real and fake and AI agents introduced new enterprise risks. Our panel of experts discusses the top 10 trends to watch in 2026.

A Look Back at 3 Key Identity Fraud Trends in 2025
Fraudsters stick to the basics, because the basics work. Synthetic identities, fake accounts and tried-and-tested account takeovers still work, even in an age of artificial intelligence-related threats. Scammers are happy to keep on stealing the old-fashioned way.

Large language models have a well-earned reputation for making things up. But for AI cybersecurity architect Erica Burgess, rather than being a bug, GPT hallucinations can be a threat-modeling feature. "I like to think of the hallucinations as just ideas that haven't been tested yet," she said.