Welcome to my weekly cybersecurity roundup! Here, I share updates on the projects I’m currently working on, along with the most insightful cybersecurity videos I watched, articles I found valuable, and podcasts I tuned into this week.
Featured Analysis
Featured article analysis: Broadcom employee data stolen by ransomware crooks following hit on payroll provider
This serves as a reminder of the risks inherent in supply chains, particularly concerning sensitive data like payroll information. The fact that a ransomware attack on Business Systems House (BSH), a Middle Eastern partner of ADP, led to the theft of Broadcom employee data highlights the vulnerabilities that can exist even when an organization outsources critical functions. The timeline is particularly noteworthy: the initial ransomware attack occurred in September 2024, BSH/ADP became aware of data exfiltration in December 2024, yet Broadcom wasn’t informed until May 2025. This significant delay underscores the challenges in incident detection, investigation, and notification across multiple entities, leaving affected individuals in the dark for an extended period and hindering their ability to take timely protective measures. The article also subtly emphasizes the importance of vendor security assessments and the need for robust contractual agreements outlining breach notification timelines and responsibilities.
The attribution of the attack to the El Dorado ransomware group, with potential links to the BlackLock group, adds another layer of complexity and intrigue for threat intelligence followers. The rapid emergence and rebranding (or suspected rebranding) of ransomware groups are common tactics to evade law enforcement and maintain operational continuity. The report of infostealer data compromising employee accounts and potentially leading to wider third-party breaches through stolen credentials further illustrates the multi-faceted nature of modern ransomware attacks. The mention of Hudson Rock’s findings regarding compromised accounts and the potential impact on 35 additional companies underscores the lateral movement capabilities that attackers often exploit after initial access. This emphasizes the need for organizations to not only secure their own perimeters but also to implement strong internal segmentation and monitoring to limit the blast radius of any potential compromise originating from a third-party incident.
Finally, the types of data potentially stolen – including national IDs, financial account numbers, salary details, and home addresses – represent a high-value target for cybercriminals and pose significant risks to the affected Broadcom employees. The advice given by Broadcom to enable multi-factor authentication and monitor financial records is standard but crucial in the aftermath of such a breach. ADP’s attempt to distance itself by emphasizing that their own systems were not compromised and that only a “small subset” of clients were affected highlights the reputational damage and legal liabilities that can arise from third-party breaches. The case also underscores the complexities of the double extortion model, where data is both encrypted and exfiltrated, leaving victims with little incentive to pay a ransom if the attackers have already demonstrated a willingness to publish stolen information. For cybersecurity professionals, this incident serves as a valuable case study in understanding supply chain risks, incident response challenges, and the evolving tactics of ransomware actors.
Projects
- TryHackMe – Cryptography Basics – In Progress
Articles
- Google will pay a $1.375 billion settlement to Texas over privacy violations – Texas had filed two lawsuits against Google for how it handled users’ geolocation, incognito search, and biometric data.
- FBI warns that end of life devices are being actively targeted by threat actors – Cybercriminals install malware on compromised devices, set up a botnet, and sell proxy services or launch coordinated attacks.
- Education giant Pearson hit by cyberattack exposing customer data – Education giant Pearson suffered a cyberattack, allowing threat actors to steal corporate data and customer information, BleepingComputer has learned.
- Ukraine arrests two over alleged Hungarian spy plot – Ukraine says it has uncovered a spy network being run by the Hungarian state to obtain intelligence about its defences near their shared border.
- Russian spy ring leader jailed in UK for nearly 11 years – One of their operations was a plan to intercept mobile phone signals at Patch barracks, a U.S. base near Stuttgart where Ukrainian troops were believed to be training to use surface-to-air Patriot missiles
- Government webmail hacked via XSS bugs in global spy campaign – Hackers are running a worldwide cyberespionage campaign dubbed ‘RoundPress,’ leveraging zero-day and n-day flaws in webmail servers to steal email from high-value government organizations.
- FBI: US officials targeted in voice deepfake attacks since April – The FBI warned that cybercriminals using AI-generated audio deepfakes to target U.S. officials in voice phishing attacks that started in April.
- Cybersecurity firm Proofpoint to buy European rival for over $1 billion as it eyes IPO – Cybersecurity firm Proofpoint is acquiring European rival Hornetsecurity for north of $1 billion to strengthen its European presence as it explores a return to public markets.
- Coinbase Rejects $20M Ransom After Rogue Contractors Bribed to Leak Customer Data – Coinbase said a group of rogue contractors were bribed to pull customer data from internal systems, leading to a $20 million ransom demand.
- Details on 89M Steam Accounts Leaked, Valve Says Systems Not Breached – Valve says the leak features phone numbers that previously received a one-time passcode, but they’re not associated with a Steam account, password, or other personal data.
- Broadcom employee data stolen by ransomware crooks following hit on payroll provider – Tech giant was in process of dropping payroll biz as it learned of breach
