Essential Reading
What can an attacker see in your Active Directory without logging in?
This article covers unauthenticated external enumeration, identifying domain technologies and services, and authenticated internal enumeration, focusing on the Active Directory structure.
Are your IoT devices ready to comply with PCI DSS? What every payments company needs to know
The article analyzes the application of PCI DSS to IoT payment devices, their risks, and protection measures against vulnerabilities.
The evolution of SWIFT security: Key takeaways for 2025 (Part 1)
We analyze the CSCF v2025, its components, principles, and controls, and how its adoption strengthens cybersecurity in financial institutions.
The evolution of SWIFT security: Key takeaways for 2025 (Part 2)
The security principles of the CSCF 2025 and the changes compared to the SWIFT 2024 version are examined.
Industry News
- Just Published: PTS POI v7.0
- PCI SSC Releases New Version of PCI Point-to-Point Encryption (P2PE) Standard
- Request for Comments: PCI Secure Software Standard v2.0
- Request for Comments: PCI Key Management Operations (KMO) v1.0
Incident Analysis
Hertz Confirms Data Theft Due to a Cyberattack on a Vendor
Personal data leak following an attack on vendor Cleo Communications. Credit card data, driver's licenses, passports, and contact details of Hertz, Dollar, and Thrifty customers were exposed. The Cl0p ransomware group is believed to be behind the incident, which occurred between October and December 2024.
Adidas Customers' Personal Data Stolen in a Cyberattack
A cyberattack on an external customer service vendor allowed unauthorized access to the personal data of Adidas customers. Information such as names, emails, phone numbers, gender, and dates of birth was leaked, but passwords and financial data were not compromised. The brand states that those affected are users who contacted customer service.
Allianz Insurance Division in the United States Hit by a Cyberattack
A cybercriminal gained access to a cloud-based CRM of an Allianz Life (US) vendor through social engineering, affecting the majority of its 1.4 million customers, employees, and advisors. Although internal systems were not compromised, Allianz notified the FBI and state authorities.
Trends
- Deploying AI as a New Shield Against More Complex Cyber Threats
- AI-Powered Phishing: A Rapidly Growing Threat
- Post-Quantum Cryptography: How to Protect Our Information in the Future
ISecWebinars
Discover what NIS2 entails, who it affects, how to prepare, and the consequences of non-compliance in our ISecWebinar Countdown to NIS2: Obligations, Risks, and Urgent Actions. An essential session for CISOs, legal officers, IT teams, and any organization managing critical digital infrastructure.