Top 5 Cybersecurity Headlines to Know this Month
BARR Advisory Senior Consultant Sean Estrada has picked out top security and compliance headlines from the past month that you need to know. Take a look to find out what our consulting team has been reading this October—plus, scroll to see Sean’s CISO Pick of the Month for two highly anticipated events that we hope you can join us for.
New iPhone Exploit Targets Crypto Wallets
Researchers have uncovered a stealthy new variant of the DarkSword exploit kit that compromises iPhones to siphon sensitive credentials and cryptocurrency data. Once installed, the malware gives attackers remote control to run unauthorized commands and steal stored photos, notes, and cryptocurrency wallets. Threat actors are distributing the tool through hijacked online stores and fake crypto trading platforms to catch users off guard.
➡️ Read more
Patient Data Exposed in MedTech Breach
Medical equipment provider iRhythm is sending breach notifications to more than 360,000 individuals after hackers reportedly stole patient records from third-party business applications. The exfiltrated data includes names, contact details, dates of birth, insurance numbers, and cardiac device serial numbers. The attackers demanded a ransom under threat of leaking the files online, but iRhythm has said there is no evidence the information has been used for identity theft.
➡️ Read more
Karaoke Giant Hit by Malware
Japanese entertainment giant Daiichi Kosho disclosed that a malware infection at its contractor, Nippon Columbia, exposed personal records for more than 8.7 million customers and employees. The incident affects patrons of popular karaoke chains like Big Echo, compromising names, dates of birth, and contact information. Passwords and loyalty points were not impacted, the company said.
➡️ Read more
Update Now: Major Flaw in WordPress Plugin
A maximum-severity vulnerability in the Bricksforge WordPress plugin is being actively exploited. The flaw allows unauthenticated attackers to bypass MIME type validation by uploading a GIF/PHP polyglot file, ultimately achieving remote code execution. Once exploited, threat actors can seize total control of the affected website, deploy web shells, and establish persistent access. Site owners are strongly advised to update to version 4.0.1 immediately and audit their upload directories for unexpected PHP files.
➡️ Read more
Hackers Target Unpatched SonicWall Devices
Threat actors are actively targeting a severe flaw in SonicWall Secure Mobile Access appliances. The loophole allows remote hackers to trick exposed appliances into running unauthorized actions on their behalf without needing to log in first. Attackers can leverage that foothold to steal corporate credentials, bypass multi-factor authentication, and pivot deeper into internal company networks. SonicWall has released emergency updates to address the issue.
➡️ Read more
Sean Estrada
Senior Consultant, Cybersecurity Consulting
CISO Pick of the Month: The BARR Team is Hitting the Road 🚙
Members of the BARR team will be hitting the road next month for two exciting industry events:
- VantaCon: Nov. 10-12 in San Francisco
- HLTH: Nov. 15-18 in Las Vegas
We’re looking forward to connecting with like-minded professionals to chat about what’s new and what’s next in security, compliance, and risk management.
👀 Will we see you at these events? Schedule time to connect with us now so we don’t miss you.
Get The Scoop
Want to get these insights straight to your inbox? Subscribe to Take5, our monthly newsletter featuring top security and compliance headlines, events, and resources—brought to you by CISOs from BARR’s cybersecurity consulting team.