Vaults Cracked, Exchange Unpatched, and GPT-5 Jailbroken

📬 This Week’s Clickables

• 🚨 Major Breaches & Incidents — Air France/KLM, healthcare leak, Venice Film Festival hack, university breach
  🛡️ Emerging Threats & Vulnerabilities — U.S. court breach, OT economic risk, 29K unpatched Exchange servers
  🎯 Black Hat & DEF CON Highlights — Vault zero-days, Dell firmware flaws, GPT-5 jailbreak
  🕵️ Privacy Watch — CCPA opt-out evasion, women’s safety app leak
  🧭 Mitigation & Best Practices — Key steps for each risk

🚨 Major Breaches & Incidents

• Air France & KLM Supply-Chain Breach
  A third-party contact center platform used by Air France and KLM was compromised, exposing customer names, loyalty program details, and contact information. The airlines confirmed no payment or passport data was involved, but affected passengers have been notified. Investigations are ongoing into whether the breach data has been sold or misused.
  👉 Takeaway: Third-party integrations can be a weak link—minimize vendor data access and enforce strict breach disclosure timelines.

• Healthcare Data Leak Hits 485K Patients
  A U.S. cervical cancer screening program suffered a breach via its contracted laboratory partner, exposing personal and medical records for nearly half a million patients. Data exposed includes full names, birth dates, contact details, and screening results. This incident adds to the growing trend of healthcare vendors being targeted to reach sensitive health data.
  👉 Takeaway: Vet vendors handling PHI with HIPAA-grade security controls and mandate regular third-party audits.

• Venice Film Festival Database Breach
  Attackers infiltrated the event’s registration database, stealing personal details for attendees and journalists—including tax codes, email addresses, and phone numbers. Some of the stolen data has reportedly appeared on dark web forums. Organizers have not confirmed the attack vector, but the breach raises questions about cultural event cybersecurity.
  👉 Takeaway: Event and media platforms should encrypt attendee databases and require MFA for all admin accounts.

🎯 Black Hat & DEF CON Highlights

• HashiCorp Vault Zero-Days Expose Secrets
  Researchers disclosed nine critical vulnerabilities in HashiCorp Vault, including the platform’s first known remote code execution flaw. Attackers could exploit these bugs pre-authentication to steal or alter stored secrets. HashiCorp has released patches, but urges immediate rotation of all tokens and credentials.
  👉 Takeaway: Apply patches now, rotate all secrets, and audit access logs for unusual activity.

• CyberArk Conjur Vulnerabilities Enable Root Access
  Five newly disclosed vulnerabilities in CyberArk Conjur could allow attackers to bypass authentication and gain root privileges in environments managing sensitive application credentials. The flaws were presented at Black Hat as part of a broader analysis of secret management tools.
  👉 Takeaway: Update to the latest Conjur release, monitor for unauthorized secret retrievals, and enforce role-based access control.

• Dell ControlVault3 Firmware Flaws Persist Through Reinstalls
  Cisco Talos researchers identified five vulnerabilities in Dell’s ControlVault3 security chip that could allow persistent malware installation. Because the flaws reside in firmware, malicious implants can survive operating system reinstalls. Dell has issued firmware updates for affected models.
  👉 Takeaway: Apply firmware updates promptly and validate hardware integrity during forensic checks.

• GPT-5 Jailbroken at DEF CON
  Security researchers demonstrated methods to bypass GPT-5’s built-in safety controls, enabling the model to produce malicious or disallowed outputs. The jailbreak was achieved through carefully crafted prompts and prompt-injection techniques. These findings highlight ongoing risks in generative AI deployment.
  👉 Takeaway: Limit sensitive AI usage to controlled environments, implement guardrails, and monitor for prompt injection abuse.

🕵️ Privacy Watch

• Data Brokers Hide CCPA Opt-Out Pages
  An investigation found that over 30 U.S. data brokers were deliberately preventing their CCPA opt-out and data deletion pages from appearing in search results. This practice makes it harder for consumers to exercise their legal rights. Regulators have been alerted and may pursue enforcement action.
  👉 Takeaway: Include privacy compliance audits in vendor risk assessments and confirm opt-out process visibility.

• Women’s Safety App ‘Tea’ Leaks 72K ID Images
  A breach in the “Tea” safety app exposed over 72,000 user ID images and thousands of additional personal photos. Lawsuits are already being filed, with plaintiffs alleging negligence in securing sensitive data. This incident raises concerns about privacy in apps targeting vulnerable demographics.
  👉 Takeaway: Apps handling sensitive images must use encryption-at-rest and undergo regular third-party security reviews.

AI native CRM for the next generation of teams

Powerful, flexible, and intuitive to use, Attio is the CRM for the next-generation of teams.

Sync your email and calendar, and Attio instantly builds your CRM—enriching every company, contact, and interaction with actionable insights in seconds.

Join fast growing teams like Flatfile, Replicate, Modal, and more.

Start for free today.

🛡️ Emerging Risks & Warnings

• U.S. Court System Breached
  The federal judiciary confirmed a breach of its CM/ECF and PACER systems, exposing sealed court records and confidential informant information. The intrusion’s timeline remains unclear, but officials are fast-tracking security upgrades and seeking emergency funding. Russia is suspected to be behind the attack.
  👉 Takeaway: Critical national systems require multi-layered authentication, continuous monitoring, and rapid breach detection capabilities.

• OT Cyber Events Could Cost $330B Annually
  New research estimates that severe cyber incidents targeting operational technology (OT) could cost the global economy up to $330 billion each year. The report cites the increasing interconnection between IT and OT systems as a key driver of risk. High-impact industries include energy, manufacturing, and transportation.
  👉 Takeaway: Separate IT and OT networks, deploy OT-specific intrusion detection, and run regular recovery simulations.

• Over 29,000 Exchange Servers Unpatched Against High-Severity Flaw
  Security researchers warn that more than 29,000 Microsoft Exchange servers remain vulnerable to CVE-2024-38063, a remote code execution flaw rated 8.8/10 in severity. Exploitation could allow full system takeover and data theft. The bug was disclosed weeks ago, yet patch adoption remains alarmingly low.
  👉 Takeaway: Patch Exchange servers immediately and review logs for indicators of compromise dating back to the vulnerability’s disclosure.

🧭 Mitigation & Best Practices

Thanks for reading this week’s edition. Like what you see? Forward it!

Hate everything you see or have other feedback? Reply back to this email!