All news with #incident response tag

🔒 Boston Scientific disclosed a cyber incident identified on August 25 that caused network outages and disrupted access to certain operating systems and business applications. The company activated incident response protocols with third-party cybersecurity experts and reported impacts to order processing and shipping, while a full restoration timeline remains unknown. The SEC filing described the disruption as "global," and security experts warned of potential downstream effects on patient care and the importance of robust containment and segmentation.

🔒 The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a breach of a standalone system after the Qilin ransomware gang added the agency to its dark web leak portal. The ATF says the compromised system is separate from its enterprise network and critical systems, and it immediately terminated connections and launched an incident-response and forensic investigation with the Department of Justice. The agency reported no operational impact and requested public tips while the investigation continues.

🔒 Boston Scientific reported a cyberattack detected on August 25 that disrupted IT systems and caused global operational impacts, including difficulties processing and shipping customer orders. The company activated its incident response plan and engaged external cybersecurity experts to investigate and contain the intrusion. Boston Scientific said it does not yet know when all affected systems will be fully restored and continues to assess the scope and consequences of the incident. The SEC filing offered no details on the attacker, initial access, or whether data was exposed.

📈 Chubb’s 2026 Cyber Claims Report shows that average costs per cyber insurance claim rose markedly in 2025 even as claim volumes fell for large and middle-market companies. The insurer attributes the growing severity to higher data breach and privacy litigation costs and increased business interruption expenses. Regional differences were clear: the US saw much higher average costs than the UK and Europe, partly due to sizable third-party litigation expenses. SMEs experienced mixed trends, with claim frequency rising but costs moving in opposite directions across regions.

🔒 Chris Betz argues that as AI amplifies both attacker and defender capabilities, organizations must reinforce core security controls rather than abandon them. He emphasizes layered defenses—MFA, Zero Trust, patching, and detection and response—and describes how AI accelerates vulnerability discovery, threat modeling, and remediation. CISOs should combine technical rigor with strategic leadership to align security with business goals.

🛡️ CERT Polska warns that attackers are actively exploiting a critical Zimbra Collaboration Suite vulnerability (CVE-2026-73570). The flaw, patched in Zimbra 10.1.20 on July 20, enables unauthenticated remote code execution via command injection in the SNMP notification processing when SNMP notifications are enabled. Shadowserver reports over 12,100 Zimbra servers exposed online, and administrators are urged to check logs and specific directories for signs of compromise. Zimbra has been a frequent target of APT groups in past campaigns.

🤖 Deutsche Bank partnered with Google Cloud to build an agentic AI-driven resilience platform that modernizes regulatory tabletop exercises and incident analysis. The platform ingests architecture, logs, data flows, and telemetry to generate context-aware scenarios, audit-ready evidence, and structured session records. Using Gemini Enterprise Agent Platform, LangGraph, and Google ADK, the bank achieves both deterministic, traceable execution and adaptive investigation. This approach supports continuous, regulator-aligned resilience across complex, distributed systems.

🔒 The University of Texas San Antonio took several IT systems offline after detecting attempted unauthorized activity at the network edge, prompting containment measures by University Technology Solutions and partners. Officials say there is no evidence of data access or exfiltration so far, though the outage disrupted online registration, tuition payments and phone systems ahead of term start. Students were granted extensions and instructed to reset passphrases as remediation steps continue.

🛡️ During the chaotic first 24 hours after a cyber incident, teams often communicate in ways that later become damaging evidence. Operational notes, Slack messages and emails— even if legal is copied—may not be privileged unless their predominant purpose was legal advice. Courts scrutinize whether communications were created for legal counsel or for ordinary business operations, and widespread channels or AI tools that share data externally can undermine privilege.

🔐 Security leaders predict that by 2029 the CISO will shift from a primarily technical defender to a strategic business leader. Experts foresee CISOs enabling innovation, advising executives on risk, and coordinating enterprise-wide trust and resilience efforts while adapting to AI-driven speed and complexity. The role will vary by organization but will demand stronger business acumen, orchestration skills, and continuous validation of exposure.

🔍 Security teams should oversee risk rather than perform every remediation task. Assign clear roles: security maintains the authoritative risk inventory, prioritizes findings, escalates missed commitments and verifies closure, while infrastructure, cloud, application and business owners execute fixes. Executives resolve resource conflicts and accept residual risk. Backlogs typically reflect organizational failures in ownership, capacity and decision-making rather than purely technical deficiencies.

✈️ Delta Air Lines is investigating an unauthorized Wi‑Fi network that briefly appeared aboard Flight 591 from Las Vegas to Atlanta, carrying passengers who attended DEF CON 34. The carrier said the incident did not affect passenger safety or aircraft systems and that cabin crew disabled Wi‑Fi for about 30 minutes while authorities investigate. Federal law enforcement and aviation regulators will be involved in the probe.

🔒 A majority of IT and security leaders say they can detect malfunctioning AI agents, but few can trace and mitigate downstream impact quickly. A WanAware survey found 90% confident in detection while only 26% can trace impacts within minutes, and over 45% say it would take hours. Experts warn agents act at machine speed, spread via shared credentials and multiple platforms, and require built-in identities, narrow permissions, audit trails, and hard kill switches to contain incidents.

🔐 Unit 42 finds identity compromises underpin most modern incidents, with the 2026 Global Incident Response Report showing identity weaknesses in nearly 90% of investigations and 65% of initial access events. Attackers increasingly use phishing, social engineering, MFA manipulation and third-party account misuse to gain entry, then move laterally, escalate privileges and blend into administrative behavior. Unit 42 recommends correlating identity, endpoint, cloud and network telemetry, applying AI-driven correlation and centralized investigations, and investing in continuous threat hunting and SOC engineering to detect and contain identity-driven intrusions earlier.

🔒 Levi Strauss & Co. disclosed that attackers used social engineering on three employees to access company-issued machines and exfiltrate corporate data. The company says rapid response contained the intrusion and no consumer data was impacted, with no disruption to business operations. An investigation is ongoing and Levi’s will provide additional notifications as required; some reporting links the incident to voice-phishing campaigns.

🚨 Microsoft Defender’s attack disruption now includes device isolation, an automated response that isolates compromised endpoints. At QNET, Defender detected a multi-stage attack using mshta.exe and enforced isolation within 128 seconds, blocking a second-stage payload and preventing persistence or lateral movement. This action is AI-driven, time-limited, operator-controlled, and designed to work with user containment to reduce risk and speed SOC response.

📢 Next Tuesday, August 11, Cisco Talos Incident Responders will host a 30-minute, unrecorded webinar reviewing high-impact incidents from Q2 2026. The session will candidly cover timelines, containment, and remediation efforts rather than repeating the published trends report. Designed for security professionals at all levels, it emphasizes strategic takeaways, business impact, and enough technical detail to inform discussions. Registration is required to attend this exclusive briefing.

🔒 Analog Devices disclosed unauthorized access to some corporate systems discovered on June 23, 2026, and said it activated incident response procedures and engaged external cybersecurity experts. The company reported no evidence so far of leaked or fraudulently used data, informed law enforcement, and will notify affected parties and regulators. Analog Devices stated business operations remain unaffected and it does not expect a material impact on its finances; an unrelated cybersecurity matter and claims by the data extortion group ExfilSquad were also noted and are under assessment.

🎙️ Amy revisits past guests in a special Black Hat edition of Humans of Talos, exploring the varied career paths that led them to threat intelligence. From forensic labs and newsrooms to kitchen lines, the episode highlights personal stories and lessons that shape the field. Attendees can meet the team at Cisco and Splunk booth 2633 during Black Hat to discuss research and incident response and pick up the latest Snorty.

🔒 Cisco warns that a high-severity static credential flaw in Secure Firewall Management Center (FMC)—tracked as CVE-2026-20316—has been actively exploited in zero-day attacks to gain unauthorized access. The flaw stems from built-in static credentials for a low-privilege account, enabling unauthenticated remote login and access to account data. Cisco released hot fixes for multiple FMC releases and advises installing them immediately, noting no effective workarounds and recommending credential rotation if compromise is detected.