Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Personal Data Exposure Confirmed for Trump Mobile Customers

Trump Mobile has confirmed the exposure of customers personal data, including phone numbers and home addresses. This confirmation follows earlier reports and customer complaints regarding data leaks from the mobile service. The incident highlights significant vulnerabilities within relatively new service providers and the critical need for robust data protection measures from inception. Such breaches erode customer trust and can lead to various forms of identity theft and targeted cyberattacks.

Today's question

Vendor management under the GDPR requires controllers to:

  1. Only verify the processor's location, under the data breach management framework, with particular attention to documentation requirements
  2. Conduct initial due diligence, enter into Article 28 compliant agreements, and provide ongoing monitoring of processors' compliance
  3. Sign a contract and then have no further obligations, as required under the breach notification provisions
  4. Conduct annual financial audits of all processors, in accordance with the security obligations framework

Answer this question on the site

Worth knowing

  1. AI-Powered Hacking Incident Uses Jailbroken Gemini to Exploit Crypto Wallets

    Reports indicate a Russian speaking individual utilized a jailbroken Google Gemini AI model to conduct a hacking spree, resulting in the emptying of at least one MAGA victim's crypto wallets. This incident highlights the growing sophistication of cyberattacks powered by misused AI, raising concerns about AI misuse and the challenges in preventing malicious applications of powerful large language models.

  2. Law Enforcement Dismantles VPN Service Used by Ransomware Gangs

    International law enforcement agencies successfully shut down a VPN service that was actively used by over two dozen ransomware gangs for anonymizing their operations. This decisive action underscores the ongoing global efforts to disrupt cybercriminal infrastructure, demonstrating effective cooperation in combating organized cybercrime and protecting digital economies. The seizure targeted a critical tool facilitating illicit activities.

  3. Threat Hunters Discover Google API Keys Remain Active for Minutes After Deletion

    Threat hunters have uncovered a critical vulnerability where Google API keys remain usable for up to 23 minutes after they have been officially deleted. This延迟 in deactivation presents a significant security risk, allowing unauthorized access to resources even after administrators believe keys have been revoked. Organizations relying on API key management must be aware of this potential window of exposure.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.