Notices by Jon Greig (jgreig@ioc.exchange)

The ATF said it recently had a “major” cyber incident. The agency appeared on the Qilin ransomware leak site on Wednesday

An ATF spox told me the issue “involved a standalone computer system containing information about targets of ATF investigations.” 

https://therecord.media/doj-atf-cyberattack-qilin-ransomware

Trump’s FCC just removed cyber regulations governing telecoms that were put in place after Chinese hackers stole the call records of Trump and JD Vance last year

Several senators told me telecoms lobbied heavily for the rules to be removed

https://therecord.media/fcc-removes-biden-era-cybersecurity-rules-telecoms-salt-typhoon

Federal agencies have about 24 hours to patch two critical bugs in a line of Cisco firewalls

patch CVE-2025-30333 and CVE-2025-20362 asap

https://therecord.media/cisco-asa-firewall-bugs-cisa-federal-agencies-warning

Clorox is claiming in a lawsuit that a Cognizant help desk worker reset Okta and Microsoft passwords three different times for a cybercriminal without verifying who was asking

Clorox says it lost $380 million from the August 2023 hack

https://therecord.media/clorox-cyberattack-lawsuit-cognizant-it-contractor

we had an entire news cycle 12 months ago about how honorable it is that outlets didnt cover the Trump emails stolen by Iran

now the NYT is using documents stolen during a criminal cyberattack on Columbia University to try and undercut mamdani.

the hacker is a well-known bigot that the NYT allowed to remain anonymous for some reason

this is an absolute embarrassment to our profession

In a last minute change, #CISA extended its contract with #MITRE to run the #CVE Program until March 2026 but there are already multiple efforts to create alternative, international versions of the platform outside of the control of the US government

https://therecord.media/cisa-extends-cve-program-contract-with-mitre

there is absolutely no bottom. we’re not even six months into these people being in charge

This is disgusting

https://taskandpurpose.com/news/arlington-cemetery-scrubs-website-dei/

HHSGov has taken down nearly all of the pages about their recent fines targeting healthcare firms that exposed patient data during ransomware attacks

Why?

Trump's pick for DHS Secretary #Noem spent her hearing bashing CISA's work fighting foreign disinformation campaigns, pledging to make the agency "smaller, more nimble" amid several cybersecurity crises involving China and Russia.

Never felt less safe listening to this hearing. Deeply unserious folks now at the wheel pledging to remove what little protections we barely have now

https://therecord.media/kristi-noem-cisa-smaller-nimble

Costa Rica's state energy company was hit with ransomware last week, forcing the country to extend fuel purchase hours for manual payments

https://therecord.media/costa-rica-state-energy-company-ransomware

The United Nations and other international agencies have created an advisory body focused on the protection of submarine cables following several recent incidents

https://therecord.media/un-international-orgs-create-advisory-body-submarine-cables

The State Department has a duty to get Mech Dara out of jail after using his work to (rightfully) sanction Ly Yong Phat

https://therecord.media/cambodian-journalist-dara-cyber-scam-compounds-arrested

CISA conducted 143 cyber risk assessments in 2023, finding that stolen accounts are still the simplest way for hackers to breach federal networks

https://therecord.media/stolen-account-info-federal-agencies-cisa

As a Haitian-American I am appalled and terrified at what we're seeing today.

Elected officials, using their verified government accounts (even the US HOUSE JUDICIARY ACCOUNT) are spreading a story that is provably false in order to stoke violence against Haitians. This was literally outlined in the DOJ documents about the Russian efforts to spread misinformation.

Every Haitian in America that I know is terrified. I just don't know how we address something like this when half (if not more) of our country is willing to act on straight-up disinformation

What are we supposed to do? How can you ever get through to people that would believe stuff like this?

#LockBit has claimed the attack on Clay County, Indiana that forced government officials to file a local disaster declaration

h/t Dominic Alvieri

https://therecord.media/indiana-county-disaster-declaration-ransomware-attack-dallas

South Africa’s National Health Laboratory Service confirmed on Tuesday that it is dealing with a ransomware attack significantly affecting the dissemination of lab results as the country responds to an outbreak of mpox

https://therecord.media/south-africa-lab-ransomware-mpox-outbreak

https://therecord.media/live-nation-confirms-ticketmaster-breach-snowflake

@GossiTheDog it’s like they got a focus group of cybercriminals together when making this

Anne Neuberger said federal resources are being coordinated to help Ascension health network with a ransomware attack that is causing ambulance diversions and disruptions to care across the US

Ascension runs hundreds of hospitals and senior facilities

https://therecord.media/federal-agencies-helping-ascension-fbi-hhs