One Healthcare Archive Was Breached. 9.5 Million Patients Paid the Price.
A breach at Aesto Health reached 9.5 million people across at least two dozen providers, exposing medical, financial and identity data stored in AWS.
AMER Series
BlackTree articles covering cybersecurity, privacy and digital legislation across North America.
Who Had Access to America’s Sealed Court Records?
A breach of Thomson Reuters’ C-Track cloud may have exposed sealed and confidential court records across at least 12 US jurisdictions and Ontario.
ATF Isolated the Breached System. It Still Contained Investigation Targets.
ATF says a standalone system breach did not reach its enterprise network or eForms, but the isolated environment contained information about investigation targets.
Alabama Is Testing Whether an AI Sandbox Failure Was Also a Consumer-Protection Failure.
Alabama has subpoenaed OpenAI over the Hugging Face agent intrusion, testing whether weak AI evaluation controls can also violate consumer-protection law.
The Tracker Can Disappear. Targeting and Metrics Still Leak the Audience.
Research finds that privacy-protected ad targeting and campaign metrics can compose into an inference channel. The result is a systems limit, not evidence of misuse by one named platform.
Alabama Subpoenaed OpenAI. An AI Sandbox Escape Is Now a Consumer-Protection Case.
Alabama has subpoenaed OpenAI over the Hugging Face agent incident, testing whether an AI containment failure can become a consumer-protection case.
The Attack Was Stopped at the Edge. The University Still Had to Delay the Semester.
UT San Antonio says an intrusion attempt was stopped before core systems, yet precautionary shutdowns disrupted services and delayed fall classes.
US Charges Say Iran’s Academic Espionage Contractors Also Sold the Data They Stole.
US prosecutors allege Mabna Institute hackers served Iranian state clients while selling stolen research and university access through commercial sites.
North Korean IT Workers Reached US Government Environments. The Failure Was Identity, Not Malware.
Most security teams are trained to look for attackers entering an organisation. Malware arrives. Credentials are stolen. A vulnerability is exploited. A suspicious login appears. The North Korean remote IT worker programme takes a different route. The attacker applies for…
America Is Hiring Private Cyber Firms to Hack Back! (Under Government Control)
A new White House programme will let vetted U.S. security companies conduct surveillance and disruptive operations against foreign cybercrime groups under federal direction. It is a significant expansion of private-sector offensive capability, but the memorandum’s legal guardrails leave difficult questions about attribution, accountability and escalation.