In partnership with
| ~7 MIN READ |
|
The biggest risks this week weren't shiny new tools. They were old trust: vendor portals, "anonymous" tip lines, forgotten updaters and patches nobody finished applying. PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe → |
In this edition
|
Data Breach / Healthcare The Lab That Serves One in Three US Adults Is Back to Paper Requisitions Intro Quest Diagnostics says it serves half of US doctors and hospitals and one in three American adults each year. Last week, its customers went back to paper. What Happened Quest learned October 21 that an intruder had gotten into Quanum Lab Services Manager (LSM), the online platform clinicians use to order tests, track status and view results. In an SEC filing, it said it believes some patient data was exposed; which data, and how many people, is still unknown. Quest shut LSM down, paused Essential Insights and LabHQ, pointed customers to paper requisitions or Quanum eLabs, and informed law enforcement. No group has claimed it. Why It's Important Lab results are among the most sensitive data in healthcare, and Quest is still in litigation over the 2019 AMCA billing-vendor breach that exposed about 11.9 million of its patients. Baylor Genetics recently disclosed a breach of more than 2.8 million patients, too. The Other Side Quest says customer-facing operations weren't disrupted, labs connected through direct LIS or EMR interfaces weren't affected, and the incident is unrelated to the recent PHP bugs.
TL;DR: An intruder got into the portal clinicians use to order Quest lab tests, and some patient data was exposed. Further reading: BleepingComputer |
|
How Jennifer Aniston’s LolaVie brand grew sales 40% with CTV ads
For its first CTV campaign, Jennifer Aniston’s DTC haircare brand LolaVie had a few non-negotiables. The campaign had to be simple. It had to demonstrate measurable impact. And it had to be full-funnel.
LolaVie used Roku Ads Manager to test and optimize creatives — reaching millions of potential customers at all stages of their purchase journeys. Roku Ads Manager helped the brand convey LolaVie’s playful voice while helping drive omnichannel sales across both ecommerce and retail touchpoints.
The campaign included an Action Ad overlay that let viewers shop directly from their TVs by clicking OK on their Roku remote. This guided them to the website to buy LolaVie products.
Discover how Roku Ads Manager helped LolaVie drive big sales and customer growth with self-serve TV ads.
The DTC beauty category is crowded. To break through, Jennifer Aniston’s brand LolaVie, worked with Roku Ads Manager to easily set up, test, and optimize CTV ad creatives. The campaign helped drive a big lift in sales and customer growth, helping LolaVie break through in the crowded beauty category.
|
|
|
A deal has two sides. Your stack only sees one.
Aligned shows you the other half. See what buyers actually do between meeting. See what they open, revisit, and share; so you know the exact next step to move things forward. And your champion gets everything they need to win internally when you're not in the room.
 Strange but real Researchers Hacked Millions of Forgotten Popcorn Time Installs, Just to Turn Them Off Intro Most people who find a way into millions of computers sell it. Eye Security used it to shut the door. What Happened Time4Popcorn, an abandoned Popcorn Time fork, shipped Windows and macOS updaters that checked the lapsed domain popcorntimeupd.xyz over plain HTTP and ran whatever came back as SYSTEM or root (CVE-2026-30612). Eye Security registered it and saw up to 3 million Windows and 350,000 macOS clients calling in, including from corporate, government and military networks. From November 2025 to March 2026 it pushed an "update" that only stopped and disabled the updater: 2 million downloads, and requests fell 98% by March 1. Why It's Important Forgotten software is still running software. "If we were able to send an update, we could potentially get code execution on millions of systems," the researchers wrote. The Other Side Pushing code to strangers' machines without asking is exactly what attackers do, and antivirus flagged the fix. Android users are still exposed, since updates there need a tap.
TL;DR: Researchers grabbed an abandoned app's update domain and used it to disable the updater on millions of PCs. Further reading: BleepingComputer |
Your search bar is ghosting shoppers with “0 results found.” Gladly understands what your shoppers mean and turns dead ends into product recommendations.