.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The Target: Comcast is an American mass media, telecommunications, and entertainment multinational company, and the fourth-largest telecom firm in the world by revenue, after AT&T, Verizon, and China Mobile.
The Take: The threat actors stole personal and financial information between February 14 and February 26, including the names, addresses, Social Security numbers, dates of birth, and Comcast account numbers of affected current and former customers.
The Vector: The breach occurred in February 2024, when attackers hacked into the systems of Financial Business and Consumer Solutions (FBCS), a debt collector Comcast had stopped using two years earlier.
This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.
Yahoo News/Reuters: EU member states and the European Parliament have agreed on new rules to force banks and other payment service providers to better protect their customers against online fraud, hidden fees and data leaks, the Parliament said.
SecurityWeek: The threat actors were seen impersonating financial institutions to steal money or information from individuals, businesses, and organizations of different sizes, as over 5,100 complaints received by the agency show.
Forbes: For too long, the cybersecurity industry has relied on hope and hype when it should be focused on demonstrable effectiveness. Massive investments in cybersecurity haven’t translated into confidence for executives, boards or insurers—and CISOs are stuck in the middle.
CSO Online: A seasonal surge in malicious activity combined with alliances between ransomware groups led to a 41% increase in attacks between September and October. Cybercriminal group Qilin continues to be the most active ransomware paddlers, responsible for 170 of 594 attacks (29%) in October, NCC Group reports.
SecurityWeek: Founded in 2023 by veteran cybersecurity experts, Opti has built an AI-native identity and access management (IAM) platform. The company’s solution is powered by a context-aware engine that continuously monitors access and risks across identities and applications, enabling security teams to define, govern, and protect identities.
Investment News: The Securities and Exchange Commission has levied a $325,000 penalty against M Holdings Securities for failing to maintain adequate cybersecurity safeguards across its nationwide network of member firms, marking the latest enforcement action targeting inadequate information security practices in the wealth management industry.
TechCrunch: Several U.S. banking giants and mortgage lenders are reportedly scrambling to assess how much of their customers’ data was stolen during a cyberattack on a New York financial technology company earlier this month.
The Target: Checkout operates checkout.com and is a global payment processing firm that provides a unified payments API, hosted payment portals, mobile SDK, and plugins to use on existing platforms.
The Take: Checkout says the threat actor, known as ShinyHunters, gained access to a third-party legacy system that had not been properly decommissioned, which held merchant data from 2020 and earlier, including internal operational documents and onboarding materials
The Vector: Upon investigation, Checkout determined that this data was obtained by the threat actor gaining unauthorized access to a legacy third-party cloud file storage system, used in 2020 and prior years.
This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.
Yahoo Finance: The Securities and Exchange Commission said it was dropping a landmark civil fraud case against SolarWinds and Tim Brown, the company’s chief information security officer.
Forbes: You’ve heard it before: Security is no longer a luxury or nice-to-have—it’s an operational imperative. But has your organization really taken the necessary steps needed to protect itself?
SecurityWeek: Chronosphere explains that its platform enables teams to “zero in on the data that’s most useful” and provides insights into every layer of their stack — from the infrastructure to the applications to the business.
PR Newswire: Nudge Security, the leading innovator in SaaS and AI security governance, announced Series A funding of $22.5 million led by Cerberus Ventures with participation from existing investors Ballistic Ventures, Forgepoint Capital, and Squadra Ventures.
CFO Dive: Financial industry CFOs have faced an “an unprecedented tightening of cybersecurity oversight” in recent years, with new rules from entities such as the Federal Trade Commission and the New York State Department of Financial Services, according to the report.
Help Net Security: Logitech, the Swiss multinational electronics and technology company best known for marketing computer peripherals and hardware, has suffered a data breach.
Banking Dive: As artificial intelligence rapidly evolves and democratizes cyber crime, it’s also elevated the human element of cybersecurity. That’s according to Sarah Gosler, Wells Fargo’s head of cyber human defense.
The Target: GlobalLogic, a provider of digital engineering services part of the Hitachi group.
The Take: The data stolen in the breach includes personal information collected by GlobalLogic's human resources and, depending on the affected individual, it includes name, address, phone number, and emergency contact (name and phone number). The attackers also exfiltrated the email addresses, dates of birth, nationalities, countries of birth, passport information, national identifiers or tax identifiers (e.g., Social Security Numbers), salary information, and bank account details of impacted employees.
The Vector: In a breach notification letter filed with the office of Maine's Attorney General, the company states that the attackers exploited an Oracle EBS zero-day vulnerability to steal personal information belonging to 10,471 employees.
This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.
Forbes: Zero trust (ZT) models transformed cybersecurity by upending how organizations think about and guard against threats. But can this strategy for safeguarding data, people and systems translate into successful techniques for building high-performance cultures?
TechCrunch: Deepwatch, a cybersecurity firm that makes an AI-powered detection and response platform, laid off dozens of employees, citing AI as one of the reasons.
CSO Online: Google is asking to a US court for help in dismantling the infrastructure behind the Lighthouse phishing-as-a-service operation, the latest effort by a technology company to use the legal system to put a dent in cybercrime.
The Record: After more than four years of development and multiple delays, the British government introduced its landmark Cyber Security and Resilience Bill to Parliament, threatening large fines for companies that fail to protect themselves from cyberattacks.
Tech in Asia: Tenzai, an Israeli cybersecurity startup founded in May 2025 by former Guardicore executives, has raised US$75 million in a seed round led by Battery Ventures, Greylock Partners, and Lux Capital.
CSO Online: Two cybersecurity laws that lapsed during the government shutdown moved closer to restoration after the Senate voted 60-40 to advance legislation extending them through January 2026.
Banking Exchange: Bank of America has pledged to accelerate its investment in AI, automation, and digital banking as part of its strategy to fuel growth across all business lines.
The Target: Capita is a major UK-based outsourcing and professional services company that provides consulting, digital, and software services to local councils, the NHS, the Ministry of Defense, and organizations in the banking, utilities, and telecommunications sectors.
The Take: Hackers had accessed 4% of Capita’s internal IT infrastructure, and exfiltrated private files hosted on the breached systems.
The Vector: The company announced that it had been targeted by hackers who attempted access to its internal Microsoft 365 environment, forcing some systems offline as part of its response.
This breach highlights the extreme importance of timely software updates for known software vulnerabilities, not only in systems directly under a firm’s control, but in third-party systems the firm relies upon as well. The longer a firm, or its vendors, hold out on deploying the most up-to-date software for their systems, the greater the chance an attacker will exploit the issue.
Business Wire: Armis, the cyber exposure management and security company, announced a pre-IPO funding round of $435 million, bringing the company’s valuation to $6.1 billion.
SecurityWeek: The investment round was led by Shasta Ventures, with additional support from Fusion Fund and an unnamed venture. Founded in 2019, California-based Portal26 has built a platform that provides organizations with comprehensive visibility into their gen-AI consumption.
Yahoo Finance/Reuters: Cybersecurity company Wiz has cleared a U.S. Justice Department (DOJ) antitrust review of its acquisition by Google-parent Alphabet, Wiz CEO said in a Wall Street Journal event.
Dark Reading: As ransomware groups continue to operate faster than ever, European organizations are facing an increasingly large portion of attacks, accounting for nearly 22% of global ransomware and extortion victims.
Bleeping Computer: Japanese publishing giant Nikkei announced that its Slack messaging platform had been compromised, exposing the personal information of over 17,000 employees and business partners.
CSO Online: An October decision of the 4th US Circuit Court of Appeals in Virginia has — yet again — altered the risk calculus of data breaches by easing litigants’ ability to successfully sue breached companies in limited situations.
Yahoo Finance/Reuters: Prosecutors said three American cybersecurity professionals secretly ran a ransomware operation aimed at shaking down companies across the United States.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
168 Hobsons Lake Drive Suite 301
Beechville, NS
Canada, B3S 0G4
Tel: +1 902 429 8880
Manila
10th Floor, Two Ecom Center
Mall of Asia Complex
Harbor Dr, Pasay, 1300 Metro Manila
Philippines
Sydney
Level 15 Grosvenor Place
225 George Street, Sydney NSW 2000
Australia
Tel: +61 (2) 8823 3370
Abu Dhabi
Floor No. 15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy