The security & privacy stories our desk judged worth your time, written so anyone can follow them.
Researchers published working attack code for a patched, critical FortiSIEM flaw that needs no login, so companies that have not updated are at risk.
Read more: Public attack code now exists for a serious Fortinet security flawRansomware gangs are still using a Palo Alto firewall flaw, patched in May, to sneak past multi-factor login and get into company networks.
Read more: Ransomware gangs exploit patched Palo Alto firewall flaw to skip login checksA scam phone call gave hackers a way into Central Ohio Primary Care Physicians, exposing Social Security numbers and health data for 1.4 million patients.
Read more: Phone scam leads to breach of 1.4 million Ohio patients' recordsA new report says scam calls are falling, but the average victim now loses more, and many phone companies still lag on caller verification.
Read more: Fewer scam calls, but people who get scammed lose more moneySecNews.gr published a 10-point checklist for spotting fake online shops, which copy real stores to take your payment and card details.
Read more: How to spot a fake online shop before you payYahoo Finance warns that safety checks on AI shopping tools may lag behind fraudsters just as holiday buying picks up, so shoppers and stores should prepare now.
Read more: Holiday fraud season is near, and AI shopping helpers may not be readyConduent has proposed an $80 million settlement over a breach that exposed health and personal data on about 62.2 million people. A court still has to approve it.
Read more: Conduent Proposes $80 Million Settlement Over Huge Health Data BreachCedar Park police say scam callers are claiming residents skipped jury duty. The goal is to scare people into acting fast, so a pause can protect your money.
Read more: Police warn of scam calls claiming you missed jury dutyA Chinese-speaking criminal used AI agents to attack over 1,200 company websites with little help. Any business with a public site should check that it is updated.
Read more: Criminal used AI agents to break into websites of over 100 companiesA new Medium series explains why a fraud-spotting AI can score 98% on accuracy and still catch none of the fraud. Here is what to ask before you trust one.
Read more: Why an AI That Is 98% Accurate Can Still Miss Every Fraud CaseVersion 6.1 of the CJIS security rules asks agencies to prove their logins, accounts and logs are locked down, not just say so. Here is what it covers.
Read more: Police and justice agencies face stricter login and audit rulesA Nigerian man got eight years in prison for phishing US tax preparers and using stolen client data to steal more than $3 million. Here is what it means for firms holding client files.
Read more: Hacker gets 8 years for phishing tax preparers and stealing $3 millionThe US Payments Forum will devote its fall meeting to AI agents that shop for you, raising questions about who pays when software makes a mistake.
Read more: AI shopping helpers are about to change how payments workA new LexisNexis study says each $1 lost to fraud costs U.S. financial firms $5.47 overall, up from $4.00 in 2021, and customers may feel the extra security.
Read more: Every $1 lost to fraud now costs U.S. banks $5.47 in totalAn Arizona real estate agent is speaking out about AI-powered property fraud, which can fake documents, voices and listings. Here is how to protect a home deal.
Read more: An Arizona real estate agent is fighting AI-powered property fraudA new report says fake online stores now look polished and run paid ads, so a shop that seems real may not be. Check it before you enter card details.
Read more: Fake online stores now look real, just in time for the holidaysA joint US, German and UK advisory says the SafePay ransomware group has hit at least 600 victims. Here is how it gets in and what to check.
Read more: US government warns of SafePay ransomware attacks on businessesEmployees are building AI tools that touch customer data, and security teams often never see them. Here is why the usual fixes fall short and what works better.
Read more: Staff-built AI workflows are spreading faster than IT can track themGo's emergency update makes programs refuse connections tied to eight certificate keys, so rebuilt software could suddenly fail to reach some sites and services.
Read more: Go update blocks eight certificate keys, may break some connectionsA survey finds 21% of UK 18 to 24 year olds say their bank account was taken over, against 2.1% of people 65 and over. Scam warnings should reach every age.
Read more: Young Brits report far more bank account hijackings than older adultsA reporter nearly fell for a fake sheriff's sergeant. One wrong word, "Department" instead of "Office," gave the scam away, and it shows what to listen for.
Read more: A wrong word exposed a fake sheriff's call to this reporterWrongly declined cards and clunky checkout checks may cost online shops far more than fraud does, according to a payments consultant writing in The Paypers.
Read more: Shoppers want online card security they never have to noticeAttackers swapped download files for five versions of OVHcloud's command-line tool for 94 minutes. Anyone who installed it in that window may need to change passwords.
Read more: Hackers swap five OVHcloud tool downloads for password-stealing malwareA Chinese AI agent is reportedly being used to hack companies in South Korea and Japan for as little as $5, which could put small firms at greater risk.
Read more: Cheap AI hacking agent from China aims at Korean and Japanese firms
