Ransomware DataBreachToday.com

Why Millions of Cybersecurity Jobs Go Unfilled as Talent Struggles to Advance
Cybersecurity's hiring crisis extends beyond workforce shortages. Unrealistic job descriptions exclude newcomers, weak succession planning stalls future CISOs and burnout strains existing teams. Rethinking entry-level requirements and leadership development can help break the cycle.

Hims & Hers Defends Sharing Sensitive Health Data. America Shrugs and Clicks Agree.
Hims & Hers says its privacy policy warned users their sex lives could be used for advertising intelligence. The FTC alleges Meta got the data. But with most Americans resigned to losing their privacy, perhaps Silicon Valley's biggest achievement is convincing us to click "I Agree.

New Mexico, Ohio Ransomware Attacks Raise Concerns as Feds Settle Pennsylvania Case
Cyber incidents at university health systems in New Mexico and Ohio disrupted patient care and sparked data theft concerns and litigation. Meanwhile, a Pennsylvania health system faces an $800,000 HIPAA settlement over a 2023 ransomware attack that exposed sensitive cancer patient photos.

Financial Firms Face Pressure to Balance Customer Access With Data Protection
The lack of reliable ways to identify an artificial intelligence agent has caused many companies, especially banks and other financial institutions, to block most agent traffic amid rising interest in agents from enterprises and regular consumers.

Also: US Healthcare Faces New Risks, Anthropic's Cloud Dependence Raises AI Risks
In this week's panel, four ISMG editors discussed the PHP2Shell threat and the "Black October" attacks, U.S. healthcare cybersecurity and deregulation, and what Anthropic's newly disclosed financials reveal about its business model and dependence on major cloud providers.

French Startup Estimates RSA-2048 Could Fall in Three Days With 23,000 Qubits
French quantum computing startup Alice & Bob estimates that 23,000 cat qubits could break RSA-2048 encryption in three days, while 30,000 could defeat blockchain elliptic-curve cryptography in an hour, raising concerns about long-term data security and cryptocurrency exposure.

Compromised Provenance Platforms Could Let Counterfeiters Rewrite a Wine's Identity
Counterfeiters may not need a perfect forgery plan if they can alter the digital records that prove a wine is genuine. As provenance moves online, cybersecurity teams have a growing role in protecting the data that markets rely on to trust physical products.

Job Data Shows AI Skills Are Becoming Part of Everyday Security Work
AI is changing cybersecurity jobs faster than traditional training programs can adapt. Security professionals now need practical experience with AI workflows, automation and the human judgment that machines can't replace.

Extortion Group Holding to Ransom Data Stolen From Virtual Private Server Customers
Japan's GMO Internet Group is offering a bounty of up to $1 million for information that helps unmask whoever hacked the company's infrastructure, gaining access to over 25,000 virtual private servers and possibly infecting customers' home PCs with data-stealing malware when they remotely connected.

Report Finds Beijing Building Tools to Sabotage Cables Without Open Conflict
A report for the U.S.-China Economic and Security Review Commission warns that China is building the means to sabotage trans-Pacific undersea cables short of war and that losing one line could overwhelm direct U.S. routes to Taiwan, Japan or the Philippines - with repair ships in short supply.

Free 6-Month Program Aims to Bolster Cyber Resilience, Protect Patient Services
A new federal, state and private-sector pilot will provide free cybersecurity assistance to rural South Carolina hospitals. Experts say the initiative could offer a model for nationwide efforts, but funding, aging technology and clinical resilience remain major challenges.

Study Finds Analysts Followed AI Agents' Preferences in 86% of Decisions
When enterprises need to make decisions on more open-ended matters, they usually turn to human experts for the final call. But new research from Anthropic suggests human experts often rely on AI agents' recommendations even when the agent has a distinct point of view.

Enterprises Buy AI Like SaaS, but Its Failures Slip Past Every Dashboard
An AI assistant starts giving subtly wrong answers, and every team that checks reports its own systems healthy. Catching it takes correlated telemetry, signed model weights, ML engineers in incident response and full-stack talent, before the people who know how to debug across the stack leave.

Anthropic's Jason Clinton Urges Isolating AI, But GovNet Shows Why Cyber Walls Fail
Anthropic's Jason Clinton wants critical infrastructure isolated before a wave of AI-found flaws arrives. The objections that sank the government's GovNet plan in 2001 still apply. Identity controls, segmentation and monitoring will still do more than a building a wall.

Critics Say Limited Evidence Raises Questions About Cohere's Security Findings
Canadian enterprise artificial intelligence company Cohere found that an open-weight model from Alibaba ignored instructions and tried to upload proprietary information to a foreign cloud, raising questions about these models' safety.

JFrog CISO Paul Davis on Coding Agent Visibility, Vulnerabilities and Guardrails
AI coding tools are increasing code volume and compressing security timelines. JFrog Field CISO Paul Davis discusses how CIOs and CISOs can improve life cycle visibility, prioritize vulnerabilities in operational context, govern coding agents and manage costs without slowing delivery.

Federal Agencies May Combine Classical and Quantum-Resistant Algorithms
The National Institute of Standards and Technology outlined a phased transition to post-quantum cryptography, allowing temporary hybrid algorithms while prioritizing network encryption and setting a 2035 cutoff for quantum-vulnerable public-key algorithms under its standards.

Israeli Startup Says General-Purpose LLMs Are Too Costly for Specialized SOC Tasks
Tel Aviv-based Mave raised $34 million across seed and Series A rounds to develop specialized AI models, proprietary agent infrastructure and real-time security data integration, aiming to consolidate SOC workflows and compete with established SIEM and managed detection and response providers.

Why AI Agents With Shell Access Need Sandboxes, Managed Policy and Human Oversight
AI coding harnesses can read files, run shell commands, install software and push code with the authority of whoever launched them. Security teams need enforced sandboxes, managed permissions, short-lived credentials and auditable records before the tools spread across the enterprise.

Unrevoked Credential Exposed in May Enabled Repository Compromise in October
An attacker exploited an unrevoked LiteLLM master key to steal GitHub credentials, bypass release controls and publish a credential-stealing PyPI package downloaded roughly 50,000 times, exposing developer systems, cloud environments and AI provider secrets.