Aphinia - Your Weekly CISO Wire
Here’s your weekly update on comings and goings, jobs, networking opportunities and actionable insights:
These are the most recent appointments and promotions of your cybersecurity peers. Say “CONGRATS!”🥂 to:
Renana Friedlich - one of our own! - was appointed as VP, CISO at LPL Financial. Congrats!
Joey Rachid was appointed as CISO at Xerox.
Ryan Weeks was appointed as CISO at Vimeo.
Esther Pinto was appointed as CISO at Guardz.
Pauli Haikonen was appointed as CISO at SSH.
Ninad Varadkar was appointed as SVP, CISO at Edelweiss.
Noam Vander was appointed as CISO at Atera.
Barry Dawson was appointed as Group CISO at M Group Services.
Hannah Cusack was appointed as Global Deputy CISO at Darktrace.
Peter Blackett was appointed as Virtual CISO at Buckinghamshire Healthcare.
Appointed? Promoted? Let us know!
Aphinia is growing! Say hello, reach and connect with our new members:
Remington Winter, VP, Head of information Security, Ghostgroup Management
John Remo, SVP, Global Infrastructure & Cybersecurity, Warner Music Group
Kristen Beneduce, Deputy CISO, Nextdoor
Ronald Johnson, Head of Information Security, Karat
Anne Coulombe, CISO, Investics Analytics
Rohit Shirwadkar, Head of Security Strategy, Equinix
Kevin Chang, Director of Technology Governance, Oscar Health
Erik Bataller, Director, Cybersecurity, M&T Bank
Welcome on board!
Who in your network can benefit from Aphinia? Please send them here »
Not yet a member? Apply here »
Do you want to share your story with fellow CISOs? Book your time now: https://calendly.com/aphinia/30min
Do you want to impart your wisdom and share actionable insights? And, importantly, to further enhance your personal brand so that you would get:
a new Advisory role
a consulting gig
a promotion or appointment
a book deal
a speaking engagement at industry conference
Our dance card is filling up fast, here’s the link to grab your time slot now: https://calendly.com/aphinia/30min
Meanwhile, check out this conversation with our returning recent guest Michael Piacente (Managing Partner, Hitch Partners) about common mistakes while searching for CISO job.
Full interview here»
Several important events happened that merit your attention:
New York fines Geico and Travelers for data breach: New York has fined Geico $9.75 million for a 2020 breach that exposed the personal data of millions, including 120,000 New Yorkers, which was later used in fraudulent unemployment claims; Travelers was also fined $1.55 million for a similar breach.
India blocks 670,000 SIM cards and 130,000 IMEI codes: In a major move against cybercrime, India’s government has blocked over 670,000 SIM cards and 130,000 IMEI codes linked to recent scams, including fraudulent FedEx deliveries and impersonations of government officials. Authorities suspect the scams originated from outside India’s borders.
UK to offer cyberattack response support to allies: At a NATO cyber conference, the UK government announced plans to assist allied nations with cyberattacks targeting critical infrastructure, amid rising fears of Russian cyberattacks linked to the ongoing conflict in Ukraine.
FTC wants to investigate Microsoft’s operations: The U.S. Federal Trade Commission has initiated an antitrust investigation into Microsoft's software licensing, cloud computing, cybersecurity, and AI divisions, following complaints of the company allegedly locking in customers and hindering competition.
Canadian government battled LifeLabs for breach report: The Canadian government has won a legal battle to release a report on LifeLabs' 2019 data breach, revealing the company failed to protect over 900,000 Canadians' personal and health data. The company is now facing a massive class-action lawsuit.
AI-driven tools used to boost ransomware attacks: Cybercriminals are leveraging AI-driven tools to amplify ransomware attacks, with Trellix reporting that geopolitical conflicts, including Russia’s invasion of Ukraine and the Israel-Hamas war, have spurred cyberattacks and hacktivist activity. The group RansomHub accounts for 13% of Trellix’s ransomware detections.
NIST reviews password guidelines: The National Institute of Standards and Technology has revised its password recommendations, emphasizing longer, 15-character passwords over complex requirements, and advising against frequent mandatory changes.
Hackers can access laptop Webcams without the LED: Researchers have uncovered methods allowing hackers to remotely activate laptop webcams without illuminating the indicator LED, a vulnerability first highlighted by Johns Hopkins in 2013. Affected devices include MacBooks and Windows laptops, with experts advising users to cover webcams, keep software up-to-date, and adopt strong security practices to prevent unauthorized access.
The crypto industry keeps losing millions in deepfake frauds: The cryptocurrency sector is being increasingly targeted by deepfake fraud, with over half of companies reporting incidents involving audio and video fakes, surpassing traditional document fraud. These scams have resulted in average losses of $440,000 per incident, prompting crypto firms to adopt enhanced security measures.
Google unveils new feature for Android: Google's new Restore Credentials feature for Android enables seamless app logins by syncing encrypted credentials to the cloud, ensuring users can easily transfer accounts when switching devices.
Industry news: Cipher, a Saudi Arabia-based cybersecurity startup, has raised $13.3 million. Netbird, the Berlin-based networked security platform, has raised $4.2 million. Upwind, a cloud security company that helps run cloud environments securely and efficiently, has raised $100 million. AI SPERA, a South Korean AI-powered cybersecurity company, has raised $9 million. Qodea acquired tmc3. Canary acquired Layer 8 Security.
These senior cybersecurity executive roles you may want to forward to your friends and colleagues:
GeoComply is looking for a Chief Information Security Officer in New York, NY.
CalSTRS is looking for a Chief Information Security Officer in West Sacramento, CA.
The City of Phoenix is looking for a Chief Information Security Officer in Phoenix, AZ.
US DHS Cybersecurity Service is looking for a Deputy Chief Information Security Officer in Arlington, VA.
Golden 1 Credit Union is looking for a VP, Chief Information Security Officer in Sacramento, CA.
Gemological Institute of America is looking for a Chief Information Security Officer in Carlsbad, CA.
Looking for a job? Hiring? Let us know.
These are virtual and live events for the cyber community you may find interesting:
Aphinia Events:
FS-ISAC CISO Mastermind is taking place on March 9, 2025 in New Orleans, LA. Interested in attending? Sponsoring? Reach out!
=> Want to host or sponsor a CISO Mastermind around a conference you are going to? Reach out!
=> Want to host or sponsor a CISO Mastermind in your city? Reach out!
Industry Events:
Gartner: Identity & Access Management Summit is taking place on Dec 9-11, 2024 in Grapevine, TX.
BlackHat Europe is taking place on December 9-12, 2024 in London, UK.
RSAC is taking place on April 28-May 1, 2025 in San Francisco, CA.
Black Hat is taking place on Aug 2-7, 2025 in Las Vegas, NV.
Attending or hosting an event? Let us know!
Bad actors have been busy recently 📈:
Bologna FC confirmed a breach by RansomHub, leading to the leak of sensitive data including player and staff medical records and financial details.
Hackers, identified as the "Waste" group, stole nearly $17 million from Uganda's central bank this month, with authorities tracking part of the stolen funds to Japanese bank accounts.
A cyberattack on Arizona-based IT firm Blue Yonder, which serves over 3,000 companies, has caused disruptions to operations at major retailers like Sainsbury's, Morrisons, and Starbucks.
Clipper crypto platform fell victim to a cyberattack exploiting a flaw in its withdrawal function, resulting in a $450,000 loss.
A breach in the Veterans Health Administration exposed the personal information, including names, medical records, and social security numbers, of 2,302 veterans.
Hackers have stolen millions of dollars from EBT accounts nationwide gaining access to sensitive data such as social security numbers and PINs.
Good Smile Company's U.S. store experienced a data breach, with hackers compromising its payment system, and fraudulently using customer credit card information.
A cyberattack at SL Data Services, operating as Propertyrec, exposed over 644,000 files containing sensitive personal information, including names, criminal records, and property details.
Smart IT partner has reportedly experienced a data breach, leading to the leak of its database online, now freely accessible.
A breach in Arizona's state database has exposed sensitive personal data, including names, addresses, and contact details.
Alder Hey Children’s Hospital along with Heart and Chest Hospital NHS Foundation Trust in Liverpool were breached by the INC ransomware group.
A ransomware attack has led to the closure of Hoboken's city hall, courthouses, and public sanitation services.
But a handful of them were nabbed 👮♀️:
FBI arrested notorious Russian cybercriminal Wazawaka: Matveev, also known as Wazawaka, was arrested in Kaliningrad, Russia, after being accused of orchestrating ransomware attacks under several notorious groups including LockBit, Conti, and BABUK. The FBI had placed a $10 million bounty on him, as he now faces both Russian and U.S. charges for cybercrimes targeting critical data and bypassing security measures.
Nine suspects accused of $20 million fraud: The US government has unsealed an indictment against nine individuals accused of laundering over $20 million from internet fraud and business email compromise schemes.
Kansas City man charged for unethical hacking: Nicholas Michael Kloster has been charged by US authorities for hacking into a nonprofit and a health club, only to offer recovery assistance after the attack.
11 suspects arrested for sports piracy operation: European law enforcement has dismantled a major sports piracy platform, arresting 11 suspects and seizing 100+ domains, with the service allegedly generating €250 million monthly from 22 million users and 2,500 illegal channels.
Stay safe.
Misha Sobolev
Aphinia
***
P.S.: Are you a senior GTM executive at a cybersecurity company wanting to get your story in front of 2,000+ of cybersecurity executives? Sponsor a thought leadership section in the next issue of CISO Wire.