This is the story of the world’s worst scam and how it is being used to fuel entire underground economies that have the power to rival nation-states across the globe. This is the story of “pig butchering.”
“Pig butchering” is a violent term that is used to describe a growing type of online investment scam that has ruined the lives of countless victims all across the world. No age group is spared, nearly no country is untouched, and, if the numbers are true, with more than $6.5 billion stolen in 2024 alone, no scam might be more serious today, than this.
Despite this severity, like many types of online fraud today, most pig-butchering scams start with a simple “hello.”
Sent through text or as a direct message on social media platforms like X, Facebook, Instagram, or elsewhere, these initial communications are often framed as simple mistakes—a kind stranger was given your number by accident, and if you reply, you’re given a kind apology and a simple lure: “You seem like such a kind person… where are you from?”
Here, the scam has already begun. Pig butchers, like romance scammers, build emotional connections with their victims. For months, their messages focus on everyday life, from family to children to marriage to work.
But, with time, once the scammer believes they’ve gained the trust of their victim, they launch their attack: An investment “opportunity.”
Pig butchers tell their victims that they’ve personally struck it rich by investing in cryptocurrency, and they want to share the wealth. Here, the scammers will lead their victims through opening an entirely bogus investment account, which is made to look real through sham websites that are littered with convincing tickers, snazzy analytics, and eye-popping financial returns.
When the victims “invest” in these accounts, they’re actually giving money directly to their scammers. But when the victims log into their online “accounts,” they see their money growing and growing, which convinces many of them to invest even more, perhaps even until their life savings are drained.
This charade goes on as long as possible until the victims learn the truth and the scammers disappear. The continued theft from these victims is where “pig-butchering” gets its name—with scammers fattening up their victims before slaughter.
Today, on the Lock and Code podcast with host David Ruiz, we speak with Erin West, founder of Operation Shamrock and former Deputy District Attorney of Santa Clara County, about pig butchering scams, the failures of major platforms like Meta to stop them, and why this global crisis represents far more than just a few lost dollars.
“It’s really the most compelling, horrific, humanitarian global crisis that is happening in the world today.”
Since the Online Safety Act took effect in late July, UK internet users have made it very clear to their politicians that they do not want anything to do with this censorship regime. Just days after age checks came into effect, VPN apps became the most downloaded on Apple's App Store in the UK, and a petition calling for the repeal of the Online Safety Act (OSA) hit over 400,000 signatures.
In the months since, more than 550,000 people have petitioned Parliament to repeal or reform the Online Safety Act, making it one of the largest public expressions of concern about a UK digital law in recent history. The OSA has galvanized swathes of the UK population, and it’s high time for politicians to take that seriously.
Last week, EFF joined Open Rights Group, Big Brother Watch, and Index on Censorship in sending a briefing to UK politicians urging them to listen to their constituents and repeal the Online Safety Act ahead of this week’s Parliamentary petition debate on 15 December.
The legislation is a threat to user privacy, restricts free expression by arbitrating speech online, exposes users to algorithmic discrimination through face checks, and effectively blocks millions of people without a personal device or form of ID from accessing the internet. The briefing highlights how, in the months since the OSA came into effect, we have seen the legislation:
Make it harder for not-for-profits and community groups to run their own websites.
Result in the wrong types of content being taken down.
Lead to age-assurance being applied widely to all sorts of content.
“Those raising concerns about the Online Safety Act are not opposing child safety. They are asking for a law that does both: protects children and respects fundamental rights, including children’s own freedom of expression rights.”
The petition shows that hundreds of thousands of people feel the current Act tilts too far, creating unnecessary risks for free expression and ordinary online life. With sensible adjustments, Parliament can restore confidence that online safety and freedom of expression rights can coexist.
If the UK really wants to achieve its goal of being the safest place in the world to go online, it must lead the way in introducing policies that actually protect all users—including children—rather than pushing the enforcement of legislation that harms the very people it was meant to protect.
Cast your mind back to May of this year: Congress was in the throes of debate over the massive budget bill. Amidst the many seismic provisions, Senator Ted Cruz dropped a ticking time bomb of tech policy: a ten-year moratorium on the ability of states to regulate artificial intelligence. To many, this was catastrophic. The few massive AI companies seem to be swallowing our economy whole: their energy demands are overriding household needs, their data demands are overriding creators’ copyright, and their products are triggering mass unemployment as well as new types of clinical psychoses. In a moment where Congress is seemingly unable to act to pass any meaningful consumer protections or market regulations, why would we hamstring the one entity evidently capable of doing so—the states? States that have already enacted consumer protections and other AI regulations, like California, and those actively debating them, like Massachusetts, were alarmed. Seventeen Republican governors wrote a letter decrying the idea, and it was ultimately killed in a rare vote of bipartisan near-unanimity.
The idea is back. Before Thanksgiving, a House Republican leader suggested they might slip it into the annual defense spending bill. Then, a draft document leaked outlining the Trump administration’s intent to enforce the state regulatory ban through executive powers. An outpouring of opposition (including from some Republican state leaders) beat back that notion for a few weeks, but on Monday, Trump posted on social media that the promised Executive Order is indeed coming soon. That would put a growing cohort of states, including California and New York, as well as Republican strongholds like Utah and Texas, in jeopardy.
The constellation of motivations behind this proposal is clear: conservative ideology, cash, and China.
The intellectual argument in favor of the moratorium is that “freedom“-killing state regulation on AI would create a patchwork that would be difficult for AI companies to comply with, which would slow the pace of innovation needed to win an AI arms race with China. AI companies and their investors have been aggressively peddling this narrative for years now, and are increasingly backing it with exorbitant lobbying dollars. It’s a handy argument, useful not only to kill regulatory constraints, but also—companies hope—to win federal bailouts and energy subsidies.
Citizens should parse that argument from their own point of view, not Big Tech’s. Preventing states from regulating AI means that those companies get to tell Washington what they want, but your state representatives are powerless to represent your own interests. Which freedom is more important to you: the freedom for a few near-monopolies to profit from AI, or the freedom for you and your neighbors to demand protections from its abuses?
There is an element of this that is more partisan than ideological. Vice President J.D. Vance argued that federal preemption is needed to prevent “progressive” states from controlling AI’s future. This is an indicator of creeping polarization, where Democrats decry the monopolism, bias, and harms attendant to corporate AI and Republicans reflexively take the opposite side. It doesn’t help that some in the parties also have direct financial interests in the AI supply chain.
But this does not need to be a partisan wedge issue: both Democrats and Republicans have strong reasons to support state-level AI legislation. Everyone shares an interest in protecting consumers from harm created by Big Tech companies. In leading the charge to kill Cruz’s initial AI moratorium proposal, Republican Senator Masha Blackburn explained that “This provision could allow Big Tech to continue to exploit kids, creators, and conservatives? we can’t block states from making laws that protect their citizens.” More recently, Florida Governor Ron DeSantis wants to regulate AI in his state.
The often-heard complaint that it is hard to comply with a patchwork of state regulations rings hollow. Pretty much every other consumer-facing industry has managed to deal with local regulation—automobiles, children’s toys, food, and drugs—and those regulations have been effective consumer protections. The AI industry includes some of the most valuable companies globally and has demonstrated the ability to comply with differing regulations around the world, including the EU’s AI and data privacy regulations, substantially more onerous than those so far adopted by US states. If we can’t leverage state regulatory power to shape the AI industry, to what industry could it possibly apply?
The regulatory superpower that states have here is not size and force, but rather speed and locality. We need the “laboratories of democracy” to experiment with different types of regulation that fit the specific needs and interests of their constituents and evolve responsively to the concerns they raise, especially in such a consequential and rapidly changing area such as AI.
We should embrace the ability of regulation to be a driver—not a limiter—of innovation. Regulations don’t restrict companies from building better products or making more profit; they help channel that innovation in specific ways that protect the public interest. Drug safety regulations don’t prevent pharma companies from inventing drugs; they force them to invent drugs that are safe and efficacious. States can direct private innovation to serve the public.
But, most importantly, regulations are needed to prevent the most dangerous impact of AI today: the concentration of power associated with trillion-dollar AI companies and the power-amplifying technologies they are producing. We outline the specific ways that the use of AI in governance can disrupt existing balances of power, and how to steer those applications towards more equitable balances, in our new book, Rewiring Democracy. In the nearly complete absence of Congressional action on AI over the years, it has swept the world’s attention; it has become clear that states are the only effective policy levers we have against that concentration of power.
Instead of impeding states from regulating AI, the federal government should support them to drive AI innovation. If proponents of a moratorium worry that the private sector won’t deliver what they think is needed to compete in the new global economy, then we should engage government to help generate AI innovations that serve the public and solve the problems most important to people. Following the lead of countries like Switzerland, France, and Singapore, the US could invest in developing and deploying AI models designed as public goods: transparent, open, and useful for tasks in public administration and governance.
Maybe you don’t trust the federal government to build or operate an AI tool that acts in the public interest? We don’t either. States are a much better place for this innovation to happen because they are closer to the people, they are charged with delivering most government services, they are better aligned with local political sentiments, and they have achieved greater trust. They’re where we can test, iterate, compare, and contrast regulatory approaches that could inform eventual and better federal policy. And, while the costs of training and operating performance AI tools like large language models have declined precipitously, the federal government can play a valuable role here in funding cash-strapped states to lead this kind of innovation.
This essay was written with Nathan E. Sanders, and originally appeared in Gizmodo.
Multiple security vulnerabilities have been disclosed in the open-source private branch exchange (PBX) platform FreePBX, including a critical flaw that could result in an authentication bypass under certain configurations.
The shortcomings, discovered by Horizon3.ai and reported to the project maintainers on September 15, 2025, are listed below -
CVE-2025-61675 (CVSS score: 8.6) - Numerous
If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready.
Below, we list the urgent updates you need to install right now to stop these active threats.
⚡ Threat of the Week
Apple and
In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale.
A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them run clean for years to build trust and gain millions of installs, then suddenly flipping them into
After an investigation by BleepingComputer, PayPal closed a loophole that allowed scammers to send emails from the legitimate service@paypal.com email address.
Following reports from people who received emails claiming an automatic payment had been cancelled, BleepingComputer found that cybercriminals were abusing a PayPal feature that allows merchants to pause a customer’s subscription.
The scammers created a PayPal subscription and then paused it, which triggers PayPal’s genuine “Your automatic payment is no longer active” notification to the subscriber. They also set up a fake subscriber account, likely a Google Workspace mailing list, which automatically forwards any email it receives to all other group members.
This allowed the criminals to use a similar method to one we’ve described before, but this time with the legitimate service@paypal.com address as the sender, bypassing email filters and a first casual check by the recipient.
Image courtesy of BleepingComputer
“Your automatic payment is no longer active
You’ll need to contact Sony U.S.A. for more details or to reactivate your automatic payments. Here are the details:”
BleepingComputer says there are slight variations in formating and phone numbers to call, but in essence they are all based on this method.
To create urgency, the scammers made the emails look as though the target had been charged for some high-end, expensive device. They also added a fake “PayPal Support” phone number, encouraging targets to call in case if they wanted to cancel the payment of had questions
In this type of tech support scam, the target calls the listed number, and the “support agent” on the other end asks to remotely log in to their computer to check for supposed viruses. They might run a short program to open command prompts and folders, just to scare and distract the victim. Then they’ll ask to install another tool to “fix” things, which will search the computer for anything they can turn into money. Others will sell you fake protection software and bill you for their services. Either way, the result is the same: the victim loses money.
PayPal contacted BleepingComputer to let them know they were closing the loophole:
“We are actively mitigating this matter, and encourage people to always be vigilant online and mindful of unexpected messages. If customers suspect they are a target of a scam, we recommend they contact Customer Support directly through the PayPal app or our Contact page for assistance.”
How to stay safe
The best way to stay safe is to stay informed about the tricks scammers use. Learn to spot the red flags that almost always give away scams and phishing emails, and remember:
Use verified, official ways to contact companies. Don’t call numbers listed in suspicious emails or attachments.
Beware of someone wanting to connect to your computer remotely. One of the tech support scammer’s biggest weapons is their ability to connect remotely to their victims. If they do this, they essentially have total access to all of your files and folders.
If you’ve already fallen victim to a tech support scam:
Paid the scammer? Contact your credit card company or bank and let them know what’s happened. You may also want to file a complaint with the FTC or contact your local law enforcement, depending on your region.
Shared a password? If you shared your password with a scammer, change it everywhere it’s used. Consider using a password manager and enable 2FA for important accounts.
Scan your system: If scammers had access to your system, they may have planted a backdoor so they can revisit whenever they feel like it. Malwarebytes can remove these and other software left behind by scammers.
Watch your accounts: Keep an eye out for unexpected payments or suspicious charges on your credit cards and bank accounts.
Be wary of suspicious emails. If you’ve fallen for one scam, they may target you again.
Pro tip: Malwarebytes Scam Guard recognized this email as a scam. Upload any suspicious text, emails, attachments and other files to ask for its opinion. It’s really very good at recognizing scams. Here’s what it reported back for this particular scam:
“Suspicious Email Assessment
This email appears to be a phishing attempt designed to trick you into contacting scammers via a fake customer service number, a suspicious website, or email address. Here’s a breakdown of key warning signs:
Red Flags Detected
Fake or Spoofed Sender Address
While it says “service@paypal.com”, sender addresses can be easily spoofed. The real test is the content and behavior of the message, not just the visible address.
Suspicious URLs
Links like http://sonyusa.store and [sonyusa.store] (both non-official and unrelated to PayPal or Sony).
Official PayPal links always use paypal.com domain.
Non-Official Customer Service Email
Email provided is sony12service@gmail.com instead of an official Sony or PayPal domain.
Urgency and Threat of Unauthorized Charges
Creates panic by telling you a large payment was processed and prompts you to act quickly by contacting their “support” number or email.
Phone Number Trap
The number provided (805-500-6377) is likely operated by scammers. Real PayPal will never ask you to contact them via generic phone numbers outside of their secure website.
Unusual Formatting and Grammar
Awkward phrasing and formatting errors are common in scams.”
We don’t just report on scams—we help detect them
Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we’ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!
Exploits for React2Shell (CVE-2025-55182) remain active. However, at this point, I would think that any servers vulnerable to the "plain" exploit attempts have already been exploited several times. Here is today's most popular exploit payload:
And then the script is marked as executable. It is unclear whether the script is explicitly executed. The Virustotal summary is somewhat ambiguous regarding the binary, identifying it as either adware or a miner [1]. Currently, this is the most common exploit variant we see for react2shell.
Other versions of the exploit use /dev/lrt and /tmp/lrt instead of /dev/shm/lrt to store the malware.
/dev/shm and /dev/tmp are typically world writable and should always work. /dev requires root privileges, and these days it is unlikely for a web application to run as root. One recommendation to harden Linux systems is to create/tmp as its own partition and mark it as "noexec" to prevent it from being used as a scratch space to run exploit code. But this is sometimes tough to implement with "normal" processes running code in /tmp (not pretty, but done ever so often)
Cast your mind back to May of this year: Congress was in the throes of debate over the massive budget bill. Amidst the many seismic provisions, Senator Ted Cruz dropped a ticking time bomb of tech policy: a ten-year moratorium on the ability of states to regulate artificial intelligence. To many, this was catastrophic. The few massive AI companies seem to be swallowing our economy whole: their energy demands are overriding household needs, their data demands are overriding creators’ copyright, and their products are triggering mass unemployment as well as new types of clinical ...
This is the third installment in our four-part 2025 Year-End Roundtable. In Part One, we explored how accountability got personal. In Part Two, we examined how regulatory mandates clashed with operational complexity.
Navigating the Most Complex Regulatory Landscapes in Cybersecurity Financial services and healthcare organizations operate under the most stringent regulatory frameworks in existence. From HIPAA and PCI-DSS to GLBA, SOX, and emerging regulations like DORA, these industries face a constant barrage of compliance requirements that demand not just checkboxes, but comprehensive, continuously monitored security programs. The
The cybersecurity battlefield has changed. Attackers are faster, more automated, and more persistent than ever. As businesses shift to cloud, remote work, SaaS, and distributed infrastructure, their security needs have outgrown traditional IT support. This is the turning point:Managed Service Providers (MSPs) are evolving into full-scale Managed Security Service Providers (MSSPs) – and the ones
Launching an AI initiative without a robust data strategy and governance framework is a risk many organizations underestimate. Most AI projects often stall, deliver poor...Read More
Most enterprise breaches no longer begin with a firewall failure or a missed patch. They begin with an exposed identity. Credentials harvested from infostealers. Employee logins are sold on criminal forums. Executive personas impersonated to trigger wire fraud. Customer identities stitched together from scattered exposures. The modern breach path is identity-first — and that shift …
Join us in the midst of the holiday shopping season as we discuss a growing privacy problem: tracking pixels embedded in marketing emails. According to Proton’s latest Spam Watch 2025 report, nearly 80% of promotional emails now contain trackers that report back your email activity. We discuss how these trackers work, why they become more […]
The FBI Anchorage Field Office has issued a public warning after seeing a sharp increase in fraud cases targeting residents across Alaska. According to federal authorities, scammers are posing as law enforcement officers and government officials in an effort to extort money or steal sensitive personal information from unsuspecting victims.
The warning comes as reports continue to rise involving unsolicited phone calls where criminals falsely claim to represent agencies such as the FBI or other local, state, and federal law enforcement bodies operating in Alaska. These scams fall under a broader category of law enforcement impersonation scams, which rely heavily on fear, urgency, and deception.
How the Phone Scam Works
Scammers typically contact victims using spoofed phone numbers that appear legitimate. In many cases, callers accuse individuals of failing to report for jury duty or missing a court appearance. Victims are then told that an arrest warrant has been issued in their name.
To avoid immediate arrest or legal consequences, the caller demands payment of a supposed fine. Victims are pressured to act quickly, often being told they must resolve the issue immediately. According to the FBI, these criminals may also provide fake court documents or reference personal details about the victim to make the scam appear more convincing.
In more advanced cases, scammers may use artificial intelligence tools to enhance their impersonation tactics. This includes generating realistic voices or presenting professionally formatted documents that appear to come from official government sources. These methods have contributed to the growing sophistication of government impersonation scams nationwide.
Common Tactics Used by Scammers
Authorities note that these scams most often occur through phone calls and emails. Criminals commonly use aggressive language and insist on speaking only with the targeted individual. Victims are often told not to discuss the call with family members, friends, banks, or law enforcement agencies.
Payment requests are another key red flag. Scammers typically demand money through methods that are difficult to trace or reverse. These include cash deposits at cryptocurrency ATMs, prepaid gift cards, wire transfers, or direct cryptocurrency payments. The FBI has emphasized that legitimate government agencies never request payment through these channels.
FBI Clarifies What Law Enforcement Will Not Do
The FBI has reiterated that it does not call members of the public to demand payment or threaten arrest over the phone. Any call claiming otherwise should be treated as fraudulent. This clarification is a central part of the FBI’s broader FBI scam warning Alaska residents are being urged to take seriously.
Impact of Government Impersonation Scams
Data from the FBI’s Internet Crime Complaint Center (IC3) highlights the scale of the problem. In 2024 alone, IC3 received more than 17,000 complaints related to government impersonation scams across the United States. Reported losses from these incidents exceeded $405 million nationwide.
Alaska has not been immune. Reported victim losses in the state surpassed $1.3 million, underscoring the financial and emotional impact these scams can have on individuals and families.
How Alaskans Can Protect Themselves
To reduce the risk of falling victim, the FBI urges residents to “take a beat” before responding to any unsolicited communication. Individuals should resist pressure tactics and take time to verify claims independently.
The FBI strongly advises against sharing or confirming personally identifiable information with anyone contacted unexpectedly. Alaskans are also cautioned never to send money, gift cards, cryptocurrency, or other assets in response to unsolicited demands.
What to Do If You Are Targeted
Anyone who believes they may have been targeted or victimized should immediately stop communicating with the scammer. Victims should notify their financial institutions, secure their accounts, contact local law enforcement, and file a complaint with the FBI’s Internet Crime Complaint Center at www.ic3.gov. Prompt reporting can help limit losses and prevent others from being targeted.
The Pierce County Library System cyberattack has exposed the personal information of more than 340,000 individuals following a cybersecurity incident discovered in April 2025. The public library system, which operates 19 locations and serves nearly one million residents outside Seattle, confirmed that unauthorized access to its network resulted in sensitive data being copied and taken.
According to breach notification letters published this week on the Pierce County Library System (PCLS) website and filed with regulators in multiple states, the incident occurred between April 15 and April 21, 2025.
PCLS detected the breach on April 21 and immediately shut down its systems to contain the attack and begin an investigation.
Unauthorized Network Access and Data Exposure
The investigation revealed that attackers gained access to PCLS systems for nearly a week and exfiltrated files containing personal information. By May 12, the organization confirmed that hackers had stolen data belonging to both library patrons and current or former employees.
For library patrons, the exposed data included names and dates of birth. For employees and their family members, the compromised information was significantly more sensitive. Impacted data may include Social Security numbers, financial account details, driver’s license numbers, credit card information, passport numbers, health insurance records, medical information, and dates of birth.
PCLS stated that it is not currently aware of any misuse of the stolen data. However, the organization acknowledged the seriousness of the breach and emphasized that it takes the confidentiality and privacy of personal information in its care very seriously.
Ransomware Gang Claims Responsibility of Pierce County Library System cyberattack
The Pierce County Library System cyberattack was claimed in May by the INC ransomware gang, a cybercriminal group that has carried out multiple high-profile attacks against government and public-sector organizations in 2025. The group has previously targeted systems such as the Pennsylvania Office of the Attorney General and an emergency warning service used by municipalities across the United States.
While PCLS has not publicly confirmed whether a ransom demand was made or paid, public library systems have increasingly become targets for ransomware attacks on public libraries. Cybercriminal groups often assume that governments will pay to quickly restore access to essential public services.
History of Cyber Incidents in Pierce County
This is not the first cybersecurity incident to impact Pierce County. In 2023, a ransomware attack disrupted the county’s public bus service, affecting systems used by approximately 18,000 riders daily. The recurring nature of such incidents highlights ongoing challenges faced by local governments in defending critical public infrastructure.
Globally, library systems have experienced a rise in cyberattacks in recent years. High-profile incidents, including the British Library cyberattack, along with multiple attacks across Canada and the United States, have caused prolonged outages and service disruptions.
Steps for Impacted Individuals
PCLS is urging affected individuals to remain vigilant against identity theft and fraud. The organization recommends regularly reviewing bank and credit card statements and monitoring credit reports for suspicious activity.
Under U.S. law, consumers are entitled to one free credit report annually from each of the three major credit bureaus, Equifax, Experian, and TransUnion. Individuals may also place fraud alerts or credit freezes on their credit files at no cost to help prevent unauthorized accounts from being opened in their name.
PCLS has provided a dedicated call center for questions related to the incident.
As cyberattack on the Pierce County Library System continue to expand digital offerings, cybersecurity remains a critical challenge requiring sustained investment and vigilance.
Japan is set to hold its first public-private sector tabletop exercise to prepare for large-scale cyberattacks, particularly targeting critical infrastructure. The drill, scheduled for December 18th, will involve the central government, the Tokyo metropolitan government, and major infrastructure operators across the capital region.The exercise comes during multiple cyberattacks in Japan, which have increasingly targeted sectors essential to daily life and economic activity. By simulating infrastructure disruptions, officials aim to identify vulnerabilities and establish a coordinated public-private response framework.The exercise is designed around a scenario in which a sudden, large-scale power outage of unknown origin hits the Tokyo metropolitan area. Participants will simulate cascading disruptions affecting water supply, telecommunications, internet services, traffic networks, and railway operations. The goal is to replicate the chain reactions that could occur if Japan's cyberattacks multiple systems simultaneously.If power outages are prolonged, healthcare facilities could face urgent challenges, including the care of patients dependent on ventilators or dialysis machines. Similarly, persistent traffic congestion could delay fuel deliveries, including gasoline and diesel, with serious repercussions for everyday life and commercial activity.
Collaboration Between Public and Private Sectors
The cybersecurity drill will involve key infrastructure sectors in Tokyo, including electricity, gas, telecommunications, healthcare, and finance. The National Security Secretariat and the Tokyo metropolitan government are leading the exercise, with participation from major private-sector operators. Officials hope the exercise will clarify existing coordination challenges and strengthen preparedness for real-world incidents.By conducting its first public-private cyber drill, Japan seeks not only to test operational readiness but also to reinforce collaboration between government agencies and private infrastructure operators. The simulation emphasizes the need for real-time communication, rapid decision-making, and coordinated measures to mitigate the impact of cyber incidents.
Strengthening Japan’s Cyber Resilience
This marks an important step in Japan’s response to cyberattacks, particularly as the country has faced a series of incidents targeting critical infrastructure in recent years. Experts note that Japan, with its highly interconnected urban infrastructure, is particularly vulnerable to cyberattacks that can trigger cascading failures. Disruptions in one sector, such as electricity, can quickly affect water distribution, transportation networks, healthcare facilities, and financial services. The Tokyo metropolitan area, as the nation’s economic and political center, is especially critical in this context.As Japan faces new cyber threats from highly skilled cyber actors, exercises such as this one in Tokyo are expected to become a regular component of national cybersecurity strategy. Officials believe that repeated drills will help identify gaps, improve response protocols, and enhance resilience against future cyberattacks on Japan’s essential infrastructure.
Shashank Bajpai, CISO & CTSO at Yotta
2026 is the execution year for India’s Digital Personal Data Protection (DPDP) regime , the Rules were notified in November 2025 and the government has signalled a phased enforcement timeline. The law is consent-centric, imposes heavy penalties (up to ₹250 crore for the most serious security failures), creates a new institutional stack (Data Protection Board, Consent Managers), and elevates privacy to boardroom priority.
Organizations that treat compliance as a strategic investment, not a cost centre, will gain trust, operational resilience, and competitive advantage.
Key themes for 2026: consent at scale, data minimization, hardened security, vendor accountability, and new dependency risks arising from Consent Manager infrastructure.
Why 2026 Matters
The DPDP Act (2023) becomes operational through Rules notified in November 2025; the result is a staggered compliance timetable that places 2026 squarely in the execution phase.
That makes 2026 the inflection year when planning becomes measurable operational work and when regulators will expect visible progress.
The practical effect is immediate: companies must move from policy documents to implemented consent systems, security controls, breach workflows, and vendor governance.
The High-Impact Obligations
Explicit consent architecture: Consent must be free, specific, informed and obtained by clear affirmative action. Systems must record, revoke and propagate consent signals reliably.
Data minimization & purpose limitation: Collect only what’s necessary and purge data when the purpose is fulfilled.
Reasonable security safeguards: Highest penalty bracket (up to ₹250 crore) for failures to implement required security measures. Encryption, tokenization, RBAC, monitoring and secure third-party contracts are expected.
Breach notification: Obligatory notification to the Data Protection Board and affected principals, with tight timelines (public guidance references 72-hour reporting windows for board notification).
Data subject rights: Access, correction, erasure, withdrawal of consent and grievance mechanisms must be operational and auditable.
Children’s data: Verifiable parental consent and prohibitions on behavioural profiling/targeted advertising toward minors; failures risk very high penalties.
Consent Managers: New regulated intermediaries where individuals may centrally manage consent; only India-incorporated entities meeting financial/operational thresholds (minimum net worth indicated in Rules) can register. This constructs a new privacy infrastructure and a new dependency vector for data fiduciaries.
Data minimization, encryption, and segmentation reduce storage costs and limit breach blast radius.
Privacy investments double as technical debt reduction with measurable ROI and lower incident recovery costs.
Global Market Access
Alignment with global privacy principles simplifies cross-border expansion and compliance-sensitive partnerships.
Faster deal closures, reduced due diligence friction, and improved access to regulated international markets.
Domestic Privacy & RegTech Ecosystem Growth
Demand for Consent Managers, RegTech, and privacy engineering solutions creates a new domestic market.
Strategic opportunity for Indian vendors to lead in privacy infrastructure and export DPDP-aligned solutions globally.
DPDP Readiness Roadmap for 2026
Time Horizon
Key Actions
Primary Owners
Strategic Outcome
Immediate (0–3 Months)
• Establish Board-level Privacy Steering Committee
•Appoint or contract a Data Protection Officer (DPO)
• Conduct rapid enterprise data mapping (repositories, processors, high-risk data flows)
• Triage high-risk systems for encryption, access controls, and logging
• Update breach response runbooks to meet Board and individual notification timelines
Board, CEO, CISO, Legal, Compliance
Executive accountability for privacy; clear visibility of data risk exposure; regulatory-ready breach response posture
Short Term (3–9 Months)
• Deploy consent management platform interoperable with upcoming Consent Managers
• Standardize DPDP-compliant vendor contracts and initiate bulk vendor renegotiation/audits
• Automate data principal request handling (identity verification, APIs, evidence trails)
• Implement data minimization and archival policies focused on high-sensitivity datasets
• Embed Privacy Impact Assessments (PIAs) into product development (“privacy by design”)
• Stress-test reliance on Consent Managers and negotiate resilience SLAs and contingency plans
Product, Engineering, CISO, Risk, Procurement
Sustainable compliance architecture; reduced long-term data liability; privacy-integrated product innovation
Ongoing (Board Dashboard Metrics)
• Consent fulfillment latency & revocation success rate
• Mean time to detect and notify data breaches (aligned to regulatory windows)
• % of sensitive data encrypted at rest and in transit
• Vendor compliance score and DPA coverage
Board, CISO, Risk & Compliance
Continuous assurance, measurable compliance maturity, and defensible regulatory posture
Board-Level Takeaway
DPDP compliance in 2026 is not a one-time legal exercise, it is an operating model change.
Organizations that treat privacy as a board-governed, product-integrated, and metrics-driven discipline will outperform peers on regulatory trust, customer confidence, and incident resilience.
The Macro View: Data Sovereignty & Trust Infrastructure
The Rules reinforce India’s intention to control flows of citizen data while creating domestic privacy infrastructure (DPB + Consent Managers + data auditors).
This is not just regulation; it is an economic strategy to build domestic capability in cloud, identity, security and RegTech, and to position India as a credible participant in global data governance conversations.
Act Strategically, Not Reactively
DPDP is a structural shift: it will change products, engineering practices, contracts, and customer expectations. 2026 will reveal winners and laggards.
Those that embrace privacy as a governance discipline and a product differentiator will realize measurable advantages in trust, operational resilience, and market value.
The alternative, waiting until enforcement escalates, risks fines, reputational harm and erosion of customer trust.
(This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)
Asahi Group Holdings Ltd. is weighing the creation of a dedicated cybersecurity unit as it continues to deal with the prolonged impact of a ransomware incident that struck the company in late September. The Asahi cyberattack disrupted core operations, delayed financial reporting, and exposed vulnerabilities in both the company’s internal systems and Japan’s broader corporate cyber defenses.The cyberattack on Asahi occurred on September 29, when a system disruption was detected at approximately 7:00 a.m. Japan Standard Time. Subsequent investigations confirmed that files within the company’s network had been encrypted by ransomware. By around 11:00 a.m. the same day, Asahi disconnected its network and isolated its data center in an effort to contain the damage.According to Asahi Group Holdings, the attacker gained unauthorized access through network equipment located at a Group facility. Ransomware was deployed simultaneously across multiple active servers, and some employee PC devices connected to the network. While the impact has been limited to systems managed in Japan, the disruption has been extensive.
Shift Toward Zero-Trust Security Model
Chief Executive Officer Atsushi Katsuki said the incident has prompted a fundamental reassessment of how information security is handled at the management level. As part of its recovery, Asahi Group Holdings has scrapped the use of virtual private networks and is adopting a stricter “zero-trust” model, which assumes no user or device inside the network can be automatically trusted.“Information security is a management issue that should be given the highest priority,” Katsuki said. “We thought we had taken sufficient measures, which were easily broken. It made me realize there’s no limit to the precautions that can be taken.”The Asahi cyberattack froze key business systems in Japan, forcing the company to shift order processing and shipments offline. The disruption hit at a critical time, delaying deliveries of year-end gift sets, a seasonal mainstay for the Japanese beverage market. As a result, November sales of beer and other alcoholic beverages fell by more than 20% compared with the same period a year earlier.
Operational and Financial Fallout Continues
Operational disruptions have gradually eased, but the effects on financial reporting remain significant. Asahi Group Holdings now expects its annual earnings disclosure to be delayed by more than 50 days. While partial third-quarter figures were released in November, Katsuki declined to set a new date for the full earnings announcement.Before the cyberattack on Asahi, the company had forecast that operating profit for the year ending in December would decline 5.2% to ¥255 billion ($1.6 billion), on sales of ¥2.95 trillion. Once reporting resumes, Asahi plans to outline its growth strategy, with a particular focus on non-alcoholic and low-alcohol beverages, along with its investment plans.Despite the setback, Katsuki said the breach does not threaten Asahi’s long-term foundation and expressed confidence that lost market share can be recovered. He expects most systems to be restored by February, with shelf space recovery and full competitive positioning returning from March.
Data Exposure, Recovery Efforts, and Broader Implications
In parallel with restoring operations, Asahi Group Holdings has been conducting a detailed forensic investigation in collaboration with external cybersecurity experts. In a statement released on November 27, 2025, the company disclosed that some data from company-issued PCs had been exposed and that personal information stored on servers may also have been affected. As of that date, there was no confirmation that server-based personal data had been published on the internet.The investigation identified the following categories of personal information that have been or may have been exposed: data belonging to approximately 1.525 million individuals who contacted customer service centers of Asahi Breweries, Asahi Soft Drinks, and Asahi Group Foods; information related to 114,000 external contacts who received congratulatory or condolence telegrams; personal details of 107,000 employees and retirees; and information concerning 168,000 family members of employees and retirees. Asahi confirmed that no credit card information was included.On November 26, Asahi submitted a final report to Japan’s Personal Information Protection Commission and stated that affected individuals will be notified in due course. A dedicated inquiry hotline was established to respond to questions related to personal data exposure.System restoration efforts have taken roughly two months and have included containment of ransomware, integrity checks, and enhanced security measures. Asahi said systems and devices confirmed to be secure will be restored in phases, with ongoing monitoring to prevent recurrence. Preventive measures include redesigned network controls, stricter connection restrictions, enhanced threat detection, updated backup strategies, revised business continuity plans, and expanded employee training and external audits.
Cybersecurity researchers have disclosed details of an active phishing campaign that's targeting a wide range of sectors in Russia with phishing emails that deliver Phantom Stealer via malicious ISO optical disc images.
The activity, codenamed Operation MoneyMount-ISO by Seqrite Labs, has primarily singled out finance and accounting entities, with those in the procurement, legal, payroll
The pro-Russian hacktivist group known as CyberVolk (aka GLORIAMIST) has resurfaced with a new ransomware-as-a-service (RaaS) offering called VolkLocker that suffers from implementation lapses in test artifacts, allowing users to decrypt files without paying an extortion fee.
According to SentinelOne, VolkLocker (aka CyberVolk 2.x) emerged in August 2025 and is capable of targeting both Windows
Bugcrowd unveils AI Triage Assistant and AI Analytics to help security teams proactively defend against AI-driven cyberattacks by accelerating vulnerability analysis, reducing MTTR, and enabling preemptive security decisions.
Learn how fine-grained access control protects sensitive Model Context Protocol (MCP) data. Discover granular policies, context-aware permissions, and quantum-resistant security for AI infrastructure.
Understand the key differences between CIAM and IAM. Learn which identity management solution is right for your business for customer and employee access.
United States of America’s NASA Astronaut Jessica Meir’s Hanukkah Wishes from the International Space Station: Happy Hanukkah to all those who celebrate it on Earth! (Originally Published in 2019)
United States of America’s NASA Astronaut Jessica Meir
Are You Overlooking the Security of Non-Human Identities in Your Cybersecurity Framework? Where bustling with technological advancements, the security focus often zooms in on human authentication and protection, leaving the non-human counterparts—Non-Human Identities (NHIs)—in the shadows. The integration of NHIs in data security strategies is not just an added layer of protection but a necessity. […]
Why Are Non-Human Identities Essential for Secure Cloud Environments? Organizations face a unique but critical challenge: securing non-human identities (NHIs) and their secrets within cloud environments. But why are NHIs increasingly pivotal for cloud security strategies? Understanding Non-Human Identities and Their Role in Cloud Security To comprehend the significance of NHIs, we must first explore […]
What Challenges Do Organizations Face When Managing NHIs? Organizations often face unique challenges when managing Non-Human Identities (NHIs). A critical aspect that enterprises must navigate is the delicate balance between security and innovation. NHIs, essentially machine identities, require meticulous attention when they bridge the gap between security teams and research and development (R&D) units. For […]
What Role Do Non-Human Identities Play in Securing Our Digital Ecosystems? Where more organizations migrate to the cloud, the concept of securing Non-Human Identities (NHIs) is becoming increasingly crucial. NHIs, essentially machine identities, are pivotal in maintaining robust cybersecurity frameworks. They are a unique combination of encrypted passwords, tokens, or keys, which are akin to […]
Authors, Creators & Presenters: Jonas Juffinger (Graz University of Technology), Fabian Rauscher (Graz University of Technology), Giuseppe La Manna (Amazon), Daniel Gruss (Graz University of Technology)
PAPER
Secret Spilling Drive: Leaking User Behavior through SSD Contention
Covert channels and side channels bypass architectural security boundaries. Numerous works have studied covert channels and side channels in software and hardware. Thus, research on covert-channel and side-channel mitigations relies on the discovery of leaky hardware and software components. In this paper, we perform the first study of timing channels inside modern commodity off-the-shelf SSDs. We systematically analyze the behavior of NVMe PCIe SSDs with concurrent workloads. We observe that exceeding the maximum I/O operations of the SSD leads to significant latency spikes. We narrow down the number of I/O operations required to still induce latency spikes on 12 different SSDs. Our results show that a victim process needs to read at least 8 to 128 blocks to be still detectable by an attacker. Based on these experiments, we show that an attacker can build a covert channel, where the sender encodes secret bits into read accesses to unrelated blocks, inaccessible to the receiver. We demonstrate that this covert channel works across different systems and different SSDs, even from processes running inside a virtual machine. Our unprivileged SSD covert channel achieves a true capacity of up to 1503 bit/s while it works across virtual machines (cross-VM) and is agnostic to operating system versions, as well as other hardware characteristics such as CPU or DRAM. Given the coarse granularity of the SSD timing channel, we evaluate it as a side channel in an open-world website fingerprinting attack over the top 100 websites. We achieve an F1 score of up to 97.0. This shows that the leakage goes beyond covert communication and can leak highly sensitive information from victim users. Finally, we discuss the root cause of the SSD timing channel and how it can be mitigated.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
How can we describe the past year in cybersecurity? No doubt, AI was front and center in so many conversations, and now there’s no going back. Here’s why.
What is the LGPD (Brazil)? The Lei Geral de Proteção de Dados Pessoais (LGPD), or General Data Protection Law (Law No. 13.709/2018), is Brazil’s comprehensive data protection framework, inspired by the European Union’s GDPR. It regulates the collection, use, storage, and sharing of personal data, applying to both public and private entities, regardless of industry, […]
Will the perception of security completely overturn with the exponential growth of AI in today’s technology-driven world? As we approach 2026, attackers upgrading to AI cyberattacks is no longer a possibility but a known fact. Let us examine the emerging trends in AI-driven cyberattacks and see how businesses of all sizes can strengthen their defenses […]
What Makes AI-Driven Security Solutions Crucial in Modern Cloud Environments? How can organizations navigate the complexities of cybersecurity to ensure robust protection, particularly when dealing with Non-Human Identities (NHIs) in cloud environments? The answer lies in leveraging AI-driven security solutions, offering remarkable freedom of choice and adaptability for cybersecurity professionals. Understanding Non-Human Identities: The Backbone […]
How Are Non-Human Identities Transforming Cybersecurity Practices? Are you aware of the increasing importance of Non-Human Identities (NHIs)? Where organizations transition towards more automated and cloud-based environments, managing NHIs and secrets security becomes vital. These machine identities serve as the backbone for securing sensitive operations across industries like financial services, healthcare, and DevOps environments. Understanding […]
How Can Organizations Enhance Their Cloud Security Through Non-Human Identities? Have you ever wondered about the unseen challenges within your cybersecurity framework? Managing Non-Human Identities (NHIs) and their associated secrets has emerged as a vital component in establishing a robust security posture. For organizations operating in the cloud, neglecting to secure machine identities can result […]
What Are Non-Human Identities and Why Are They Essential for Cybersecurity? Have you ever pondered the complexity of cybersecurity beyond human interactions? Non-Human Identities (NHIs) are becoming a cornerstone in securing digital environments. With the guardians of machine identities, NHIs are pivotal in addressing the security gaps prevalent between research and development teams and security […]
One thing is certain: every year, the cybersecurity threat environment will evolve. AI tools, advances in computing, the growth of high-powered data centers that can be weaponized, compromised IoT networks, and all of the traditional vectors grow and change. As such, the tools and frameworks we use to resist these attacks will also need to […]
Login
