Welcome to today's issue of Secret CISO, where we delve into the latest developments in the world of cybersecurity.

Today, we're unpacking the RIBridges debacle, a cautionary tale of mismanagement that underscores the non-negotiable nature of data security. We're also looking at the fallout from a data breach at Douglas County's Winter Solstice Party, and the personal data loss suffered by WA man Nigel Boyce due to a misplaced USB. In international news, we examine the charges against a dual Russian and Israeli national for developing LockBit Ransomware, and the significant data security breach at Ascension Health that compromised the data of 5.6 million patients.

We also discuss the largest data breach of health information that has affected an estimated third of the U.S. population. In the wake of a deadly Christmas market attack in Germany, we explore the role of thermal security blankets and the identity of the suspect behind the attack. We also reflect on the changing landscape of data breaches, with a look back at the largest breach in history when Yahoo announced it in 2013. In the world of phishing, we examine the new FlowerStorm Microsoft phishing service and its potential security implications.

We also discuss the alleged data breaches into the Nottingham triple killer case, which have been branded as an "utter disgrace." Finally, we delve into the world of AI and security research, with a look at OpenAI's new o3 and o3 mini AI reasoning models, and the implications of a security breach that exposed the records of nearly a million Americans. We also highlight the latest vulnerabilities and exploits in the cybersecurity landscape.

Stay tuned for these stories and more in today's issue of Secret CISO.

Data Breaches

1. RIBridges Cyberattack: The recent cyberattack on RIBridges could have been mitigated or even prevented with better data security measures. The incident serves as a reminder that data security is not optional but essential for handling sensitive information. Source: Providence Journal
2. Douglas County Data Breach: Douglas County experienced a data breach, the details of which are yet to be disclosed. The incident was reported during the Winter Solstice Party held at Ursa Minor Brewing. Source: Fox21Online
3. Loss of Personal Data by Perth Lawyers: A data breach incident occurred when Perth lawyers lost a USB containing confidential information. The affected individual, Mr. Boyce, was notified of the breach by insurer CGU. Source: The West Australian
4. Eastern Washington University Data Security Breach: Eastern Washington University is currently investigating a data security breach. The extent and impact of the breach are yet to be determined. Source: KREM
5. TTUHSC Data Breach: A new filing revealed the extent of the data breach that affected UMC and the Texas Tech Health Sciences Centers in Lubbock and El Paso, impacting more than 650,000 individuals. Source: MSN

Security Research

1. OpenAI unveils o3 and o3 mini AI reasoning models: OpenAI has introduced new AI reasoning models, o3 and o3 mini, and is inviting safety and security researchers to apply for early access. The organization continues to prioritize safety in AI development. Source: FoneArena.com
2. Rapido Data Breach: User and Driver Information Exposed via Vulnerable Feedback Form: Security researcher Renganathan P discovered a data breach at Rapido, a bike taxi service, where user and driver information was exposed through a vulnerable feedback form. Source: The420.in
3. Help from CSIRO data experts on avoiding scams and deepfakes: Lauren Ferro, a Human-centric Security Research Scientist with the Data61 team, advises on verifying caller identities to avoid scams and deepfakes. Source: Cosmos Magazine
4. Researchers Exploit HTTP Range Header To Bypass Browser Restriction: Security researchers have discovered a technique that exploits the HTTP Range Header to bypass browser restrictions, transforming previously unexploitable reflected input vulnerabilities. Source: Cybersecuritynews.com
5. AI-driven gait analysis bridges health care and security fields: Researcher Kayne Duncanson is exploring the use of AI-driven gait analysis in both healthcare and security fields, demonstrating the potential for AI to bridge different sectors. Source: Tech Xplore

Top CVEs

1. CVE-2024-12884 - Codezips E-Commerce Website 1.0 Vulnerability: A critical vulnerability was discovered in Codezips E-Commerce Website 1.0, affecting an unknown functionality of the file /login.php. The manipulation of the 'email' argument can lead to SQL injection, with the potential for remote attacks. The exploit has been publicly disclosed. Source: Vulners.
2. CVE-2024-51463 - IBM i 7.3, 7.4, and 7.5 SSRF Vulnerability: IBM i versions 7.3, 7.4, and 7.5 are susceptible to server-side request forgery (SSRF). This vulnerability could allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Source: Vulners.
3. CVE-2024-11852 - Element Pack Elementor Addons Vulnerability: The Element Pack Elementor Addons plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This vulnerability could allow authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layouts. Source: Vulners.
4. CVE-2024-12891 - Online Exam Mastering System 1.0 Vulnerability: A critical vulnerability was found in the Online Exam Mastering System 1.0, affecting an unknown function of the file /account.php?q=quiz&step=2. The manipulation of the 'eid' argument can lead to SQL injection, with the potential for remote attacks. The exploit has been publicly disclosed. Source: Vulners.
5. CVE-2024-12890 - Online Exam Mastering System 1.0 Vulnerability: Another critical vulnerability was discovered in the Online Exam Mastering System 1.0, affecting some unknown processing of the file /update.php?q=quiz&step=2. The manipulation of the 'eid' argument can lead to SQL injection, with the potential for remote attacks. The exploit has been publicly disclosed. Source: Vulners.

Sponsored by Wallarm API Security Solution

Final Words

And that's a wrap for today's edition of Secret CISO. From the RIBridges debacle to the Winter Solstice Party data breach, we've covered a wide range of topics, all with the aim of keeping you informed and prepared in the ever-evolving world of data security. Remember, data security isn't optional - it's essential.

Whether you're a business owner, an employee, or simply an individual navigating the digital world, it's crucial to stay vigilant and proactive in protecting your sensitive information. If you found today's newsletter helpful, why not share it with your friends and colleagues?

You never know who might benefit from a daily dose of data security news. Stay safe out there, and remember - knowledge is power.

See you in the next edition of Secret CISO!