Good morning, Secret CISO readers! Today's newsletter is packed with the latest updates on data breaches and security incidents from around the globe. In San Diego, Graybill has parted ways with Palomar Health Medical Group following a data breach that affected PHMG's system back in May. Meanwhile, a Connecticut personal injury firm's insurance company is refusing coverage for a data breach, leaving the firm in a precarious situation. Across the pond, Ireland has fined Meta a whopping 91 million euros over a data breach, criticizing the tech giant for failing to implement adequate security measures to protect users' password data.

In the banking sector, Wells Fargo is grappling with a data breach that has exposed customers' bank account and social security numbers, with the extent of the breach still unknown. Tech giant Dell has also suffered a data breach, reportedly affecting over 10,000 employees. The hacker, known by the alias "grep", announced the breach on a hacking forum last week.

In legal news, multiple companies including Mattson Technology, Amgen, and New TSI Holdings are under investigation for data breaches, with sensitive information potentially exposed.

In a massive data breach, nearly one-third of the US population has had their sensitive personal data exposed, according to security researchers. In the world of academia, a new master's degree concentration in Interdisciplinary Security Studies is being offered, born out of research by counterterrorism experts.

In the realm of AI, security pros have identified GenAI as the most significant risk for organizations. Lastly, in a shocking revelation, all Dutch police officers' contact details have been stolen in a cyberattack. Stay tuned for more updates and remember, stay safe and secure!

Data Breaches

1. Graybill parts ways with Palomar Health Medical Group following data breach: A data security incident in May has led to Graybill separating from Palomar Health Medical Group. The breach's details remain undisclosed. Source: FOX 5 San Diego
2. Insurer Says No Coverage For Conn. Firm's Data Breach: A Connecticut personal injury firm's insurance company has denied coverage for a data breach, the details of which are yet to be revealed. Source: Law360
3. Ireland fines Meta 91 mn euros over EU data breach: Meta has been fined by the Irish Data Protection Commission for failing to implement appropriate security measures to protect users' password data. Source: wataugademocrat.com
4. Wells Fargo Customers' Bank Account and Social Security Numbers Exposed: A data breach at Wells Fargo has exposed an unknown number of customers' bank account and social security numbers. Source: dailyhodl.com
5. Dell data breach reportedly affects 10,000+ employees: A hacker known as "grep" has claimed that Dell suffered a "minor" data breach, affecting over 10,000 employees. Source: Top Class Actions

Security Research

1. Kia Dealer Portal Flaw Puts Millions of Cars at Risk of Remote Hacking: Independent security researchers have discovered significant vulnerabilities in Kia's dealer web portal, potentially exposing millions of vehicles to remote hacking. Source: tribune.com.pk
2. Security Pros Identify GenAI as the Most Significant Risk for Organizations: A report suggests that GenAI poses the most significant risk for organizations. AI red teaming, an external review process, is being used to safeguard AI models from risks. Source: insideainews.com
3. New Master's Degree Concentration Unlocks Critical Security Studies Education: A new Interdisciplinary Security Studies (ISS) concentration, born out of research by counterterrorism experts, is offering much-needed education in critical security studies. Source: unomaha.edu
4. US, Taiwan Look to Boost Drone Collaboration: The US and Taiwan are looking to boost drone collaboration. Hsu Chih-hsiang, a researcher at the Institute of National Defense and Security Research in Taipei, described drones as a combat force multiplier. Source: voanews.com
5. Microsoft's Maligned AI-Enabled 'Recall' Gets a Security Reboot: Microsoft's AI-enabled tool 'Recall' has received a security reboot after researchers warned that bad actors could access and scoop up records gathered by the tool. Source: yahoo.com

Top CVEs

1. CVE-2024-38809 - ETags Parsing Vulnerability: Applications parsing ETags from "If-Match" or "If-None-Match" request headers are susceptible to a DoS attack. Users of affected versions should upgrade to the fixed version or enforce a size limit on these headers. Source: CVE-2024-38809
2. CVE-2024-9281 - bg5sbk MiniCMS Vulnerability: A problematic vulnerability was found in bg5sbk MiniCMS up to 1.11, affecting unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The vendor did not respond to early disclosure. Source: CVE-2024-9281
3. CVE-2024-46859 - Linux Kernel Vulnerability: In the Linux kernel, a vulnerability has been resolved in the panasonic-laptop code. The code uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough, leading to out of bounds accesses. Source: CVE-2024-46859
4. CVE-2024-38796 - EDK2 Vulnerability: EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An attacker may cause memory corruption due to an overflow via an adjacent network, leading to a loss of Confidentiality, Integrity, and/or Availability. Source: CVE-2024-38796
5. CVE-2024-9294 - dingfanzu CMS Vulnerability: A critical vulnerability has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. The manipulation of the argument username leads to SQL injection. The exploit has been disclosed to the public. Source: CVE-2024-9294

Final Words

And that's a wrap for today's edition of Secret CISO. As we've seen, data breaches and security incidents continue to make headlines, affecting organizations across various sectors.

From Graybill parting ways with Palomar Health Medical Group to the massive fine Meta received over a data breach, it's clear that no organization is immune to these threats. It's also worth noting the increasing role of security researchers in uncovering vulnerabilities and helping organizations bolster their defenses. Whether it's the flaw discovered in Dell's data system or the vulnerabilities found in Kia's dealer web portal, these professionals are playing a crucial role in enhancing our digital security landscape.

Remember, staying informed is the first step towards ensuring your organization's security. So, don't forget to share this newsletter with your colleagues and friends to keep them in the loop. Stay safe, stay secure. See you in the next edition of Secret CISO!