Welcome to today's edition of Secret CISO, your daily dose of exclusive insights into the world of cybersecurity. Today, we're diving into the latest developments in data breaches, from the investigation into the alleged data breach at the London Clinic involving Princess Kate to the $7M class action settlement by Med-Data. We'll also explore the negligence claim in a data breach lawsuit against Cohen Cleary and the investigation into Indonesian engineers for a South Korean data leak attempt. Plus, we'll discuss effective ways to defend your business from data breaches and the latest research in cybersecurity. In the world of cybersecurity, knowledge is power. Stay informed, stay secure with Secret CISO.

Data Breaches

1. Princess Kate's Medical Data Breach: A data breach at the London Clinic, where Princess Kate was treated, is under investigation. Three staff members are suspected of trying to access her medical records. However, King Charles III's medical records were not compromised. Source: Sky News, YouTube, CNN.
2. Cohen Cleary Data Breach Lawsuit: A negligence claim in a data breach lawsuit against Cohen Cleary has been allowed to proceed. Most other claims in the lawsuit were dismissed. Source: Law.com.
3. Med-Data Data Breach Settlement: Med-Data has agreed to a $7 million settlement to resolve a data breach class action lawsuit, although the company has not admitted any wrongdoing. Source: Top Class Actions.
4. South Korean KF-21 Boramae Data Leak: Indonesian engineers are under investigation for a data breach involving the South Korean KF-21 Boramae. The South Korean police have executed a search and seize warrant at KAI. Source: The Aviationist.
5. Colorado State Public Defender Office Data Breach: The Colorado State Public Defender Office is facing a data breach following a ransomware attack. The scope of the breach is still being uncovered. Source: The Cyber Express.

Security Research

1. Over 800 npm Packages Found with Discrepancies, 18 Exploitable to 'Manifest Confusion': Security researcher Andrey Polkovnichenko discovered discrepancies in over 800 npm packages, with 18 of them being exploitable due to a vulnerability known as 'Manifest Confusion'. This vulnerability was first documented in July 2023. Source: The Hacker News
2. Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds: During the annual “hacker summer camp” in Las Vegas, security researchers demonstrated a technique that could unlock any of 3 million hotel keycard locks within seconds. This discovery highlights the potential security risks associated with these widely used locks. Source: WIRED
3. Microsoft Patches Xbox Vulnerability Following Public Disclosure: After initially dismissing a reported Xbox vulnerability as a non-issue, Microsoft has now released a patch to address it. This change of stance came after the vulnerability was publicly disclosed. Source: SecurityWeek
4. Netskope Named a Leader in Security Service Edge Solutions by Independent Research Firm: In a report by Forrester Research, Inc., Netskope was named as a leader in the Security Service Edge (SSE) Solutions market. The evaluation was based on 25 different criteria. Source: PR Newswire
5. Inside One of Ukraine's Secret Drone Factories: Security researcher and analyst Kyle Orton examined the expanding role of drones in Ukraine's defense strategy. This investigation took place amidst the ongoing conflict in the region. Source: National Review

Top CVEs

1. CVE-2023-45177 - IBM MQ Denial-of-Service Vulnerability: IBM MQ versions 9.0 LTS to 9.3 CD are susceptible to a denial-of-service attack due to an error in the MQ clustering logic. This vulnerability could allow an attacker to disrupt the availability of the service. Source: CVE-2023-45177
2. CVE-2024-2627 - Google Chrome Use-After-Free Vulnerability: Google Chrome versions prior to 123.0.6312.58 have a use-after-free vulnerability in the Canvas component. This could potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. Source: CVE-2024-2627
3. CVE-2023-46839 - PCI Phantom Functions Vulnerability: PCI devices can use a functionality called phantom functions, which allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This could potentially lead to unauthorized access or data leakage. Source: CVE-2023-46839
4. CVE-2024-2625 - Google Chrome Object Lifecycle Issue: Google Chrome versions prior to 123.0.6312.58 have an object lifecycle issue in V8. This could potentially allow a remote attacker to exploit object corruption via a crafted HTML page. Source: CVE-2024-2625
5. CVE-2024-2626 - Google Chrome Out of Bounds Read Vulnerability: Google Chrome versions prior to 123.0.6312.58 have an out of bounds read vulnerability in Swiftshader. This could potentially allow a remote attacker to perform out of bounds memory access via a crafted HTML page. Source: CVE-2024-2626

Final Words

That's all for today's edition of Secret CISO. We hope you found our insights helpful and informative. Remember, in the world of cybersecurity, knowledge is power. So, don't keep this power to yourself. Share this newsletter with your friends and colleagues to help them stay informed and secure. In tomorrow's edition, we'll delve into the latest developments in the Kate data breach case and explore how businesses can effectively defend themselves from data breaches. We'll also keep you updated on the latest cybersecurity research, vulnerabilities, and patches. Stay safe, stay informed, and remember - security isn't just about systems and technology, it's about people too. Until next time, [Your Name]