Pacemaker manufacturer Medtronic warns patients cybercrooks may have swiped health data

LastPass confirms data breach in Klue supply chain attack

LastPass xác nhận dữ liệu khách hàng trong môi trường Salesforce bị truy cập sau cuộc tấn công chuỗi cung ứng nhằm vào Klue hôm 12/6. Nhóm tống tiền Icarus đã xâm nhập hạ tầng Klue bằng thông tin đăng nhập cũ, đánh cắp token OAuth kết nối Klue với Salesforce của khách hàng. Dữ liệu bị lộ bao gồm tên, số điện thoại, email, địa chỉ, thông tin hỗ trợ và dữ liệu CRM. LastPass cho biết sản phẩm cốt lõi, dịch vụ và kho dữ liệu khách hàng không bị ảnh hưởng.

Lập trình viên nên đọc bài này để hiểu rõ về cách tấn công supply chain attack hoạt động như thế nào, từ đó nâng cao kiến thức bảo mật cho các ứng dụng và hệ thống của mình, đặc biệt là khi sử dụng các dịch vụ cloud như Salesforce.

US government says it got hacked — again

The Department of Homeland Security is investigating a breach of its Homeland Security Information Network (HSIN), a platform used by federal, state, and local governments to share intelligence and coordinate emergency responses. Hackers reportedly broke into HSIN servers in late May and early June 2026. While the data accessed is unclassified, Senator Mark Warner warned it is highly sensitive and its exposure risks national security. The breach adds to a growing list of cybersecurity failures under the Trump administration, including DOGE's access to federal databases, a CISA contractor leaking credentials, and the FBI declaring a major cyber incident after exposing surveillance targets' phone numbers.

iPhone 18 Pro supplier list and parts exposed in Tata data leak

A ransomware group called World Leaks has published files stolen from Tata Electronics, Apple's manufacturing partner in India, exposing iPhone 18 Pro component lists, supplier names, and photographs from drop tests. The leaked bill of materials reveals Apple's supplier architecture — including where it sources from multiple vendors for bargaining leverage and where single-source dependencies create supply chain vulnerabilities. The breach is the second ransomware incident involving Tata, following an earlier claim of stolen Apple and Tesla trade secrets. Apple is investigating alongside Tata, but the supplier maps are already public, posing competitive and strategic risks beyond a typical privacy incident.

Aflac Japan Data Breach Impacts 4.38 Million Customers and Agents

Aflac Life Insurance Japan disclosed a data breach affecting approximately 4.38 million customers and agents. Hackers accessed the policyholder portal multiple times between June 15 and June 25, 2026, exfiltrating personal data including names, addresses, phone numbers, dates of birth, gender, security information, and insurance account details. Around 230,000 people also had premium transfer account information stolen. At least five services were disrupted. The post offers CISO-focused analysis, highlighting the risks of customer portal breaches in the insurance sector and recommending three practical actions: strengthening portal monitoring, preparing breach response plans for insurance data exposure, and balancing containment with service continuity.

iPhone 18 secrets spill onto the dark web

A ransomware group has leaked sensitive Apple iPhone 18 Pro files on the dark web after stealing data from Tata Electronics, Apple's Indian manufacturing partner. The leaked files include component lists, supplier mappings, and drop-test photos of unreleased iPhone 18 Pro models marked 'confidential.' The breach exposes Apple's supplier relationships and bargaining vulnerabilities, coming at a sensitive time as India now accounts for 26% of global iPhone production and Apple is expected to raise iPhone prices. Tata has restricted internal system access and hired a forensic auditor in response.

The DPO’s Role in Responsible AI

As AI becomes embedded in business operations, Data Protection Officers (DPOs) are taking on expanded roles beyond GDPR compliance. The EU AI Act introduces new obligations around risk classification, transparency, human oversight, and lifecycle management that complement existing data protection duties. DPOs bring expertise in privacy risk assessments, data mapping, and accountability documentation that directly supports AI governance. Key elements of an effective AI governance framework include maintaining an AI inventory, classifying systems by risk level, establishing governance policies, and fostering cross-functional collaboration. GDPR principles like lawfulness, data minimization, transparency, and accountability align closely with responsible AI practices. Privacy by Design should be embedded from the start of AI development rather than added retroactively. Compliance alone is insufficient — trustworthy AI also requires fairness, explainability, and ethical consideration of impacts on individuals.

Waited So Long – Two Tickets to Data Breach Litigation

Data breach litigation is evolving beyond negligent security practices to include negligent incident response — specifically, delayed notification to affected individuals. Using the Bluepeak lawsuit as a case study, this piece examines how state and federal breach notification laws (Colorado, Florida, California, HIPAA, FTC Safeguards Rule, SEC) impose strict timelines, and how delayed disclosure has factored into major cases like Target, Yahoo, and Sony. While causation remains a legal hurdle for plaintiffs (proving delayed notice caused concrete harm), companies that delay notification face regulatory, reputational, and litigation risks regardless of courtroom outcomes. A mature incident response program should treat breach notification as a parallel workstream from day one, documenting every decision and timeline as if it will become a court exhibit.