News

Security policy and user awareness

• May 19, 2025 19 May'25

  Chinese cyber spooks lure laid-off US government workers

  A Washington DC-based think tank has published evidence that Chinese intelligence services have been running a network of digital ‘front’ companies targeting laid-off government workers as recruits

• May 15, 2025 15 May'25

  NHS asks suppliers to sign up to cyber covenant

  NHS digital and security leaders call on their suppliers to commit to a cyber security charter as the health service works to improve its resilience in the face of growing threat levels

• May 14, 2025 14 May'25

  Scattered Spider retail attacks spreading to US, says Google

  Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK

• May 14, 2025 14 May'25

  New security paradigm needed for IT/OT convergence

  Industry leaders and policymakers highlight growing cyber threats from the integration of IT and operational technology systems, calling for collaboration and regulatory frameworks to protect critical systems, among other measures

• May 13, 2025 13 May'25

  May Patch Tuesday brings five exploited zero-days to fix

  Microsoft fixes five exploited, and two publicly disclosed, zero-days in the fifth Patch Tuesday update of 2025

• May 13, 2025 13 May'25

  Australian data breaches hit record high in 2024

  More than 1,100 data breaches were reported in Australia last year, a 25% jump from 2023, prompting calls for stronger security measures across businesses and government agencies

• May 08, 2025 08 May'25

  Government will miss cyber resiliency targets, MPs warn

  A Public Accounts Committee report on government cyber resilience finds that the Cabinet Office has been working hard to improve, but is likely to miss targets and needs a fundamentally different approach

• May 08, 2025 08 May'25

  Preparing for post-quantum computing will be more difficult than the millennium bug

  The job of getting the UK ready for post-quantum computing will be at least as difficult as the Y2K problem, says National Cyber Security Centre CTO Ollie Whitehouse

• May 08, 2025 08 May'25

  US tells CNI orgs to stop connecting OT kit to the web

  US authorities have released guidance for owners of critical national infrastructure in the face of an undisclosed number of cyber incidents

• May 08, 2025 08 May'25

  UK government websites to replace passwords with secure passkeys

  Government websites are to replace difficult-to-remember passwords with highly secure passkeys that will protect against phishing and cyber attackers

• May 07, 2025 07 May'25

  Europe leads shift from cyber security ‘headcount gap’ to skills-based hiring

  Research from Sans Institute reveals European organisations are leading a global shift in hiring priorities, driven by regional regulatory frameworks

• May 07, 2025 07 May'25

  Oxford Uni adds cyber resilience module to MBA programme

  Oxford University’s Saïd Business School is working with cyber response specialist Sygnia to help future business leaders get on top of security

• April 30, 2025 30 Apr'25

  Co-op shuts off IT systems to contain cyber attack

  A developing cyber incident at Co-op has forced the retailer to pull the plug on some of its IT systems as it works to contain the attack

• April 24, 2025 24 Apr'25

  M&S systems remain offline days after cyber incident

  M&S is still unable to provide contactless payment or click-and-collect services amid a cyber attack that it says has forced it to move a number of processes offline to safeguard its customers, staff and business

• April 23, 2025 23 Apr'25

  Financially motivated cyber crime remains biggest threat source

  Mandiant’s latest annual threat report reveals data on how financially motivated cyber criminals, such as ransomware gangs, dominate the cyber security landscape

• April 23, 2025 23 Apr'25

  Amid uncertainty, Armis becomes newest CVE numbering authority

  Amid an uncertain future for vulnerability research, exposure management company Armis has been given the authority to assign CVE IDs to newly discovered vulnerabilities

• April 22, 2025 22 Apr'25

  Cyber ‘agony aunts’ launch guidebook for women in security

  Cyber ‘agony aunts’ Amelia Hewitt and Rebecca Taylor are launching a book aimed at empowering women in their cyber security careers

• April 22, 2025 22 Apr'25

  Secure Future Initiative reveals Microsoft staff focus

  IT security is now a metric in the Microsoft employee appraisal process

• April 17, 2025 17 Apr'25

  Tariff turmoil is making supply chain security riskier

  Many businesses around the world are taking the decision to alter their supplier mix in the face of tariff uncertainty, but in doing so are creating more cyber risks for themselves, according to a report

• April 16, 2025 16 Apr'25

  CISA extends Mitre CVE contract at last moment

  The US Cybersecurity and Infrastructure Security Agency has ridden to the rescue of the under-threat Mitre CVE Programme, approving a last-minute, 11-month contract extension to preserve the project’s vital security vulnerability work

• April 16, 2025 16 Apr'25

  CVE Foundation pledges continuity after Mitre funding cut

  With news that Mitre’s contract to run the world-renowned CVE Programme is abruptly terminating, a breakaway group is setting up a non-profit foundation to try to ensure the project’s continuity

• April 16, 2025 16 Apr'25

  Security leaders grapple with AI-driven threats

  Experts warn of AI’s dual role in both empowering and challenging cyber defences, and called for intelligence sharing and the need to strike a balance between AI-driven innovation and existing security practices

• April 15, 2025 15 Apr'25

  Mitre warns over lapse in CVE coverage

  Mitre, the operator of the world-renowned CVE repository, has warned of significant impacts to global cyber security standards, and increased risk from threat actors, as it emerges its US government contract will lapse imminently

• April 08, 2025 08 Apr'25

  NCSC issues warning over Chinese Moonshine and BadBazaar spyware

  Two spyware variants are being used to target the mobile devices of persons of interest to Chinese intelligence, including individuals in the Taiwanese, Tibetan and Uyghur communities

• April 07, 2025 07 Apr'25

  UK SMEs losing over £3bn a year to cyber incidents

  A lack of access to technology, little to no staff training, and competing priorities are losing UK SMEs up to £3.4bn to cyber incidents every year

• April 07, 2025 07 Apr'25

  NIST calls time on older vulnerabilities amid surging disclosures

  The National Institute of Standards and Technology is deferring future updates to thousands of cyber vulnerabilities discovered prior to 2018 amid surging volumes of new submissions

• April 04, 2025 04 Apr'25

  Norway and Nordic financial sector ramps up cyber security

  Finans Norge sets up cyber security unit CTSU to support the finance sector in Norway amid increasing threats

• April 01, 2025 01 Apr'25

  Apple devices are at ‘most risk’ in UK following government ‘backdoor’ order

  Home Office refuses to answer questions from Lords over technical capability notice issued against Apple’s iCloud Advanced Data Protection encryption services

• March 25, 2025 25 Mar'25

  ETSI launches first post-quantum encryption standard

  European telco standards body launches its first post-quantum cryptography cyber standard, covering the security of critical data and communications

• March 21, 2025 21 Mar'25

  NCSC, DSIT enlist IBM to spearhead cyber diversity agenda

  IBM signs on to a partnership deal in support of the popular NCSC CyberFirst Girls scheme designed to foster gender diversity in the cyber security profession

• March 19, 2025 19 Mar'25

  Clop resurgence drives ransomware attacks in February

  The exploitation of two new vulnerabilities in a popular file transfer service saw the Clop ransomware gang soar in February, according to NCC

• March 18, 2025 18 Mar'25

  Seaco charts course for unified security strategy

  Shipping container leasing giant consolidates security tools onto a single platform, leveraging AI and extended detection and response to improve security operations

• March 13, 2025 13 Mar'25

  SuperBlack ransomware may have ties to LockBit

  Forescout researchers report on a new ransomware gang that appears to be keeping the legacy of the notorious LockBit crew alive

• March 12, 2025 12 Mar'25

  iPhone, iPad update fixes critical WebKit flaw

  iPhone and iPad users are advised to update their devices as Apple addresses an out-of-bounds write issue in the WebKit browser engine that appears to have been exploited in targeted cyber attacks

• March 11, 2025 11 Mar'25

  March Patch Tuesday brings 57 fixes, multiple zero-days

  The third Patch Tuesday of 2025 brings fixes for 57 flaws and a hefty number of zero-days

• March 11, 2025 11 Mar'25

  Perimeter security appliances source of most ransomware hits

  Perimeter security appliances and devices, particularly VPNs, prove to be the most popular entry points into victim networks for financially motivated ransomware gangs, according to reports

• March 11, 2025 11 Mar'25

  Dutch police disrupt half of ransomware operations, finds embedded PHD student

  Dutch PhD study reveals the impact of centralised intelligence and strategic interventions in the fight against ransomware

• March 11, 2025 11 Mar'25

  Post Office scandal data leak interim compensation offers made

  Some subpostmasters affected by Post Office data breach offered interim compensation payments

• March 11, 2025 11 Mar'25

  Singapore IT leaders boost AI security defences

  Study reveals a surge in perceived importance of artificial intelligence for cyber security in Singapore, but declining investment in traditional measures raises concerns as sophisticated cyber attacks intensify

• March 10, 2025 10 Mar'25

  How CISOs are tackling cyber security challenges

  Security chiefs at the recent Gartner Security and Risk Management Summit in Sydney share insights on navigating board communication, organisational resilience and the importance of understanding business needs

• March 07, 2025 07 Mar'25

  Managing security in the AI age

  Gartner experts offer guidance on harnessing AI’s power while mitigating its risks, from managing shadow AI to implementing security controls and policies

• March 06, 2025 06 Mar'25

  UK cyber security damaged by ‘clumsy Home Office political censorship’

  Britain’s National Cyber Security Centre secretly censors computer security guidance and drops references to encryption

• March 05, 2025 05 Mar'25

  NHS investigating how API flaw exposed patient data

  NHS patient data was left vulnerable by a flaw in an application programming interface used at online healthcare provider Medefer

• March 04, 2025 04 Mar'25

  Aussie businesses ramp up security spending

  Australian organisations are set to spend A$6.2bn on security and risk management in 2025, a 14.4% jump from the previous year, driven by the rise of AI and a growing threat landscape

• March 03, 2025 03 Mar'25

  Singapore’s HomeTeamNS hit by ransomware attack

  The non-profit organisation suffered a ransomware attack that affected some servers containing employee and member data, prompting an investigation and enhanced security measures

• March 01, 2025 01 Mar'25

  Ransomware: from REvil to Black Basta, what do we know about Tramp?

  This key member of the Black Basta ransomware gang is wanted by the US justice system. He narrowly escaped extradition at the end of June 2024 - with the help of highly-placed contacts in Moscow, according to him

• February 28, 2025 28 Feb'25

  NHS staff lack confidence in health service cyber measures

  NHS staff understand their role in protecting the health service from cyber threats and the public backs them in this aim, but legacy tech and a lack of training are hindering efforts, according to BT

• February 27, 2025 27 Feb'25

  CVE volumes head towards 50,000 in 2025, analysts claim

  Many trends, notably a big shift to open source tools, are behind an expected boom in the number of disclosed vulnerabilities

• February 26, 2025 26 Feb'25

  CISOs spending more on insider risk

  Insider risk management budgets have more than doubled in the past 12 months and look set to grow further still in 2025, according to a report

• February 25, 2025 25 Feb'25

  Ransomware: on the murky trail of one of the leaders of Black Basta

  The internal exchanges within the Black Basta group revealed last week offer a new opportunity to investigate one of its leaders: Tramp. He may have been arrested in Armenia in June 2024, before being released