UK Telco Data breach 📡, UHC confirms 190M affected 🏥, FALCON Threat Response 🦅

TalkTalk is investigating claims of a data breach affecting customer information on a third-party platform. The company denies the scale of the breach ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ 

Sign Up |Advertise|View Online TLDR Together With TLDR Information Security 2025-01-27 SaaS breaches surged 300% in 2024, with attackers breaching core systems in as little as 9 minutes (Sponsor) A new report by Obsidian Security reveals a massive spike in YoY data breaches. In 99% of analyzed breaches, the initial target was the Identity Provider (IdP). 📚 Read the 2025 SaaS Security Threat Report to find out: What the biggest threats were in 2024—informed by the industry's largest breach data repository and direct involvement in +150 incident responses. Why traditional defenses are failing against new attack patterns and why identities have become the new frontline What to watch for in 2025 and beyond 👀 Want to see how SaaS breach data powers ML-based threat detection — and how you can achieve an 85% reduction in your SaaS attack surface? Book your demo with Obsidian 🔓 Attacks & Vulnerabilities UK telco TalkTalk confirms probe into alleged data grab underway (3 minute read) TalkTalk is investigating claims of a potential data breach affecting customer information on a third-party platform. The company denies the scale of the alleged breach, stating that no billing or financial details were compromised and the claimed customer numbers are inaccurate. UnitedHealth confirms 190 million Americans affected by Change Healthcare data breach (2 minute read) UnitedHealth confirmed the Change Healthcare ransomware attack affected approximately 190 million Americans, making it the largest medical data breach in U.S. history. The ALPHV ransomware gang stole extensive personal, medical, and financial information through a compromised account. SonicWall Flags Critical Bug Likely Exploited As a 0-Day (2 minute read) SonicWall has issued a warning to customers running SonicWall's Secure Mobile Access 1000 product of a critical (9.8) vulnerability. The vulnerability in question allows for OS command injection. SonicWall is urging customers to update or work around the issue immediately as the vulnerability may be under active exploitation. 🧠 Strategies & Tactics Ransacked (20 minute read) Researchers discovered 119 vulnerabilities across 10 LTE/5G network implementations that enable potential city-wide cellular service disruption and remote network access. Every tested implementation had flaws that affected critical communication systems and could compromise cellular infrastructure. This post goes through every one of them. Salt Typhoon: An Analysis of Vulnerabilities Exploited by this State-Sponsored Actor (7 minute read) Salt Typhoon breached multiple U.S. telecommunications providers, exploiting known vulnerabilities in external-facing systems. The sophisticated APT group targets government and technology sectors, maintaining stealthy network access through custom malware and unpatched devices. This blog analyses the attack. Safeguard Your Generative AI Workloads From Prompt Injections (7 minute read) The AWS Security team provides an overview of prompt injection techniques and an overview of defenses available in AWS. AWS suggests using Amazon Bedrock Guardrails for prompt injection defenses and input and output filtering as well as integrating a WAF and secure prompt engineering practices. It also recommends ensuring proper logging and that IAM roles associated with GenAI apps not have excessive permissions. 🧑‍💻 Launches & Tools Using Application Allowlisting to block ransomware [4 minute demo] (Sponsor) Threatlocker Allowlisting lets you set default-deny policies that prevent ransomware and zero-day exploits, and define exceptions for applications you trust. It comes with 24/7/365 support and outperforms other appsec tools when it comes to blocking ransomware. See how it works in four minutes, no signup required Horus (GitHub Repo) Horus is a Python tool for investigations that offers API support and data compilation. The tool allows for manual API configuration and has intended features at different development stages. TokenSmith (GitHub Repo) TokenSmith is a tool that generates Entra ID access and refresh tokens for offensive engagements. It supports bypassing Intune compliant device conditional access. TryHackMe's New SOC Simulator (5 minute read) TryHackMe launched a new SOC Simulator environment to provide an immersive SOC training environment. It is running a competition for businesses interested in trying out the simulator. 🎁 Miscellaneous Atomic & Stateful Detection Rules (6 minute read) Atomic detection rules focus on a single anomalous event. Stateful detection rules focus on identifying a pattern of suspicious activity such as repeated failed logins from a single IP. This post introduces both topics and provides sample Sigma rules for each. World's First MIDI Shellcode (21 minute read) This blog post discusses how researchers gained control of a Yamaha PSR-E433 synth by sending MIDI messages to make it play a song on the LCD screen. The researchers discovered a powerful chip inside the synth and found ways to manipulate its memory through MIDI commands. By using clever tricks and assembly snippets, they were able to create the world's first MIDI shellcode without needing special interfaces like JTAG or UART. Inside FunkSec: An Exclusive Interview with a Ransomware Architect (6 minute read) This is an interview conducted by Foreseit with an architect of FunkSec ransomware group. Mitigation for FunkSec strategies involve strong cybersecurity measures, employee training, and staying informed on threats. Businesses should focus on prevention, backup processes, and proactive security to defend against ransomware threats. ⚡ Quick Links 2024 Hybrid Security Trends Report - Healthcare Sector (5 minute read) Report on the threats and attacks of the healthcare sector - 84% of organizations in the sector spotted a cyberattack on their infrastructure last year. Costa Rica refinery cyberattack was first deployment for new US response program, ambassador says (5 minute read) The U.S. used a new rapid response program called FALCON to help Costa Rica after a ransomware attack on its oil refinery - it provided swift support within 36 hours, costing $500,000. Google H1 2025 Threat Horizons Report (PDF Document) Threat actors are increasingly exploiting overprivileged service accounts and identity vulnerabilities for lateral movement while adapting tactics to evade detection and maximize profits through data theft, ransomware, and cloud resource hijacking. Love TLDR? Tell your friends and get rewards! Share your referral link below with friends to get free TLDR swag! https://refer.tldr.tech/dc263000/8 Track your referrals here. Want to advertise in TLDR? 📰 If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us. Want to work at TLDR? 💼 Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them! If you have any comments or feedback, just respond to this email! Thanks for reading, Prasanna Gautam, Eric Fernandez & Sammy Tbeile Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please unsubscribe.