Blog

Breach Fatigue is real, but cybercrime groups like ShinyHunters are using stolen data in a new way: pulling email lists from past corporate breaches to target you with personalized sextortion threats for cryptocurrency payments. These scams can feel convincing, but it's almost always a scare tactic using recycled public leak data. If this hits your inbox: Don't panic or pay – it’s an empty threat Report the email to law enforcement (IC3) Reach out to Sarah Anderson and our te

Five NEW cyber crime groups have popped up: ExfilSquad The Booba Project (also referred to as "Booba Group") Crpxo Global Secret Group Section 9 It's important to be aware of this because it shows that cyber crime is multiplying at a frequency that is hard to keep up with. Watch for more and let us know if we can help!

Apple boasts repetitively that it vets all apps in their Apple App Store. Well, citizens from Massachusetts and Louisiana recently filed suit because of a fake cryptocurrency app called "Sparrow." Interestingly enough - this particular app didn't have an IOS platform - an easy indicator of an unverified app for Apple to spot. Watch as Sarah shares the ins and outs of this case and think twice next time you visit the App Store.

Update on the multi-state lawsuit against 23andMe. After having no intrusion protective systems in place, 23andMe suffered a massive data breach in October 2023. Cybercriminals compromised the genetic data of 6.9 million consumers worldwide. 42 states reacted in this joint lawsuit. WATCH as Sarah Anderson shares the details of this case including settlement amount - $18 million across 42 states.

The Take it Down Act is now enforceable, and the fines for violating this Act are over $53,000! This new law bans the nonconsensual online publication of intimate images of individuals - including AI-generated deepfakes. This is a MAJOR victory for anyone who has been a victim of the publishing of images and/or videos without their consent.

Recently, a client of ours reached out to SWA Law after their breach counsel, recommended by their insurance company, did not submit reimbursements to the insurance company. SWA stepped in and recovered more than $600,000 for incident response expenses. Six hundred thousand dollars! Their previous breach counsel didn't even ask for it. The lesson: you have a choice when it comes to which breach counsel you want to use. Looking for one? We'd love to be considered!

Louisiana enacts its first Louisiana Data Privacy Act. It looks a whole lot like the other 21 states' privacy acts. This new act applies to entities with more than $20M in gross revenue collecting more than 75,000 different people's personal identity information. WATCH to learn more about this new law as Sarah Anderson explains.

CAUTION when buying World Cup tickets! Threat actors are creating legitimate websites (think fiffa[.]com) to trick users into believing they're interacting with an official brand - fifa.com. WATCH as Sarah Anderson explains what's happening and how you can stay aware and alert!

Here's what nobody told you when HR bought that AI hiring tool: when it discriminates, the vendor doesn't get sued. You do. Businesses - before you choose to engage AI vendors in your hiring process, check with legal counsel. We'd love to help!

Fraudsters aren't hacking credit unions anymore. They're applying for loans - like everyone else. The only difference is, the identity isn't theirs. It's yours. And they got it off your social media. And they're getting approved. WATCH as Sarah explains how this is happening and what you should be cautious of.

Can you imagine it taking 56 minutes to wipe 96 federal databases? After serving their sentence, the Akhter brothers were rehired as government contractors. No background check required. WATCH to hear Sarah explain what that skipped 15 minute background check cost this government contractor.

Canvas - a widely used Learning Management System - was hacked twice in four days. The lesson here: when you undergo incident response, the cheap and easy route is usually not the best.

Washington State's Governor just signed a new law regarding Artificial Intelligence. Starting January 1, 2027, all entities using an AI companion Chatbot must disclose to users that they are interacting with a machine and not an actual person. WATCH as Sarah dives into the details and if you have any follow-up questions, we'd love to hear from you!

3 New Laws about cyber security you should know about: 1. Alabama introduces a new consumer data privacy law regarding minors 2. Oklahoma introduces a consumer data privacy law with a $7,500 penalty 3. South Dakota introduces a genetic privacy law with a $5,000 fine Watch as Sarah gives you a brief overview, then check out our blog for links to all three of these new laws today!

Never engage in ransomware demands. That's it. That's the message. Watch as Sarah dives into a recent incident where DigitalMint - a cyber security firm - found several of its staff cooperating with BlackCat. If you have any questions about what to do when you see a demand for ransom, reach out to Sarah!

Recently, as Sarah was monitoring Coinbase Cartel's website, she saw an ad for "insiders." In short, this company will pay your disgruntled employees to help them access your data. Just another reason to tighten security procedures today (not when you have more time). WATCH as Sarah dives into the details. If you have any questions? Connect Sarah with your IT Department today!

Be very cautious before you spend thousands of dollars on an expert witness for your technology case. REMEMBER: Not everyone is created equal. WATCH to learn more!

There are now fake enterprise Virtual Private Networks (VPNs) convincing employees who work remotely to enter their credentials. Pro tip: only allow downloads directly from the manufacturers website or through your MSP to ensure your employees do not fall prey to any of these very convincing deep fakes.

Stryker Medical Group was hit with a cyber attack in early March where an Iranian group remotely wiped nearly 200,000 devices. Stryker Medical Group manufactures implants, hospital beds, surgical instruments and more and maintains that none of their product was impacted. This is a healthy reminder that in the currently political climate, expect cyber attacks to increase.

In the discovery phase of a technology dispute, we're looking for THREE main things: 1. What is the opposition's information security policy? 2. Who is in charge? 3. Who performed the forensics? Want to know more about each of these three top priorities for us? Watch more and reach out to us today! sarah@legallycyber.com