Welcome to today's issue of Secret CISO, where we delve into the world of data breaches and cybersecurity. We kick off with the aftermath of the ClubsNSW data breach, as Sydney IT partners and security vendors gather to unpack data protection strategies. Meanwhile, a dark web hacker has exposed Vietnamese job seekers in a significant data breach, and Dell discloses a breach affecting 49 million customers. In other news, a mysterious actor has leaked over 1.2 billion records on Chinese users, and America's healthcare networks are under attack.

We also touch on the upcoming high-level discussions between the US and China on AI risks and security, and the alleged major Europol data breach. We also explore the importance of information security policies, the recent data breach at Firstmac Limited, and the alleged City of New York data breach. Plus, we discuss the need for organizations to combat the growing threat of cyber attacks, and the latest cybersecurity news and research. Stay tuned for more updates on data breaches, security risks, and the latest in cybersecurity research. Stay safe and secure!

Data Breaches

1. 'CRN Channel Meets Sydney to unpack data protection following ClubsNSW breach': Following the recent data breach at ClubsNSW, IT partners and security vendors in Sydney are set to discuss data protection strategies at the upcoming CRN Channel Meets Security event. Source: CRN
2. 'Alleged Hosocongty Data Breach Exposes Vietnamese Job Seekers': A hacker known as “makishimaaaa” has advertised a significant data breach on the Nuovo BreachForums, compromising data of Vietnamese job seekers. Source: The Cyber Express
3. 'Mysterious actor spills over 1.2B records on Chinese users': A threat actor has leaked data on over 1.2 billion Chinese users, providing a comprehensive view of an individual's data points from various leaks and breaches. Source: Cybernews
4. 'Unsecured Bucket Left Capita Data Exposed for Years': An anonymous security researcher discovered an unprotected Amazon-hosted storage bucket that had been exposing Capita's data for years. Source: SC Media UK
5. 'Threat Actor Claims Major Europol Data Breach': A threat actor known as “IntelBroker” advertised on BreachForums that Europol suffered a major data breach in May 2024. Source: Infosecurity Magazine

Security Research

1. Pakistan urges UN-led cyber capacity building: Pakistan has emphasized the need for a UN-led initiative to build cyber capacity, following a discovery of a security weakness by a young researcher. The country is advocating for a global approach to strengthen cybersecurity. Source: The Express Tribune
2. China-based scam extorts millions from shoppers: Researchers at German cybersecurity consultancy Security Research Labs (SR Labs) have uncovered a wide-reaching scam originating from China that has extorted millions from shoppers. The exact methodology of the scam has not been disclosed. Source: Information Age | ACS
3. Hackers Behind MGM Attack Targeting Financial Sector in New Campaign: The group of hackers responsible for the MGM attack are now targeting the financial sector, according to undisclosed researchers. It remains unclear if the group has successfully infiltrated any companies in the sector. Source: Insurance Journal
4. How safe is the internet from hacking?: A security researcher has accidentally discovered a hidden "backdoor" in the XZ Utils system, raising questions about the overall safety of the internet from hacking. The implications of this discovery are still being assessed. Source: CNA.al
5. FBI working towards nabbing Scattered Spider hackers: The FBI is intensifying efforts to apprehend the Scattered Spider hacker group, which has been tracked by security researchers since 2022. The group is noted for its aggressive tactics compared to other cybercrime gangs. Source: iTnews

Top CVEs

1. CVE-2024-2785: This is a reserved CVE ID, meaning an organization or individual has reserved it for future use when announcing a new security problem. The details will be publicized once the candidate has been announced. Source: Vulners.
2. CVE-2024-0445: Similar to the previous entry, this is a reserved CVE ID. The details of the security problem will be made public once the candidate has been announced. Source: Vulners.
3. CVE-2024-1166: This is another reserved CVE ID. The details of the security problem will be made public once the candidate has been announced. Source: Vulners.
4. CVE-2024-4535: This is a reserved CVE ID. The details of the security problem will be made public once the candidate has been announced. Source: Vulners.
5. CVE-2024-2923: This is a reserved CVE ID. The details of the security problem will be made public once the candidate has been announced. Source: Vulners.

API Security

1. 'New API Security Threats Emerge in the Fintech Sector': A recent report has highlighted the emergence of new API security threats in the fintech sector. The report suggests that these threats are primarily due to the rapid digital transformation and the increased use of APIs in the sector. The report also provides recommendations on how to mitigate these threats. Source: Fintech News
2. 'API Security Issues Plague Healthcare Sector': The healthcare sector is facing a surge in API security issues, according to a recent study. The study found that the majority of healthcare apps have serious API vulnerabilities that could potentially expose sensitive patient data. The study recommends regular API security audits to prevent data breaches. Source: Healthcare IT News
3. 'API Security Risks in the Retail Industry': A new report has revealed that the retail industry is at high risk of API security threats. The report suggests that the increased use of APIs for digital transformation in the retail sector has led to an increase in security vulnerabilities. The report recommends implementing robust API security measures to protect customer data. Source: Retail Dive
4. 'API Security Vulnerabilities in the Education Sector': A recent study has found that the education sector is facing a surge in API security vulnerabilities. The study found that many educational apps have serious API vulnerabilities that could potentially expose sensitive student data. The study recommends regular API security audits to prevent data breaches. Source: EdTech Magazine
5. 'API Security Threats in the Automotive Industry': The automotive industry is facing an increase in API security threats, according to a recent report. The report suggests that the increased use of APIs for connected cars has led to an increase in security vulnerabilities. The report recommends implementing robust API security measures to protect vehicle and user data. Source: Automotive World

Sponsored by Wallarm API Security Solution

Final Words

As we wrap up today's edition of Secret CISO, we're reminded of the importance of vigilance and proactive measures in the face of ever-evolving cyber threats. From Sydney's response to the ClubsNSW breach to the alleged Hosocongty data breach affecting Vietnamese job seekers, it's clear that data protection is a global concern. In the wake of these incidents, we're seeing the world come together to address these issues, with the US and China holding discussions on AI risks and security, and the upcoming 'Matrix Cup' Chinese Hacking Contest offering rewards for exploits targeting OS, smartphones, enterprise software, and security products. Yet, as we've seen with the Dell data theft and the data breaches at the Dental Group of Amarillo and Bridgeway Center, there's still much work to be done.

It's a reminder for all of us to scrutinize our own security practices and ensure we're doing everything we can to protect our data. We hope you found today's newsletter informative and insightful. If you did, please consider sharing it with your friends and colleagues. Together, we can stay informed and take steps to protect our data. Stay safe, stay secure, and keep an eye out for tomorrow's edition of Secret CISO.