Paul Kunert reports: Beijing will soon expect Chinese network operators to ‘fess up to serious cyber incidents within an hour of spotting them – or risk penalties for dragging their feet. From November 1, the Cyberspace Administration of China (CAC) will enforce its new National Cybersecurity Incident Reporting Management Measures, a sweeping set of rules that tighten…
Category: Of Note
Going Dark: ShinyHunters/ScatteredSpider/LAPSUS$ Say Goodbye (2)
On September 8, the “scattered LAPSUS$ hunters 4.0” Telegram channel posted: FBI and French LE, great job for the third time arresting the wrong person in France once again. DOJ please stop wasting your budget by flying your agents to France every time to make the WRONG arrest, as it’s almost the end of the…
Kivimäki walks free during appeal over Vastaamo data breach
The Helsinki Times reports: Aleksanteri Kivimäki, convicted of thousands of cybercrimes linked to the Vastaamo data breach, has been released from custody by the Helsinki Court of Appeal. The decision followed two days of testimony from Kivimäki, who denied all charges. The court cited his prolonged pretrial detention as the reason for release. He has…
English Court of Appeal Rules on Compensation for Data Breaches
There’s an update to Farley v Equiniti. Ann Bevitt and Morgan McCormack of Cooley write: The English Court of Appeal has handed down an important judgment in Farley v. Paymaster (Equiniti) [1] on when compensation may be claimed for nonmaterial damage (such as distress or anxiety) arising out of breaches of the General Data Protection Regulation (GDPR) and the…
CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure
Ashden Fein, Micaela McMurrough, Caleb Skeath, and John Webster Leslie of Covington and Burling write: The U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) plans to delay the publication of its much-anticipated cybersecurity incident reporting rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”). According to an entry on the Spring 2025 Unified Agenda…
CISA orders federal agencies to patch Sitecore zero-day following hacking reports
Jonathan Greig reports: Federal civilian agencies have until September 25 to patch a vulnerability in popular content management system Sitecore after incident responders said they disrupted a recent attack involving the bug. Sitecore published a bulletin on Wednesday about CVE-2025-53690, which affects several of the company’s products. A key issue with the bug is the use of…