An extortion group says it walked out with personal data on FBI employees — and the bureau can't yet say whether the breach started in its own systems or a vendor's. Three minutes. Let's go.
🚨 THE BIG STORY
FBI confirms it's investigating a breach of its jobs portal
The extortion group ShinyHunters claims it compromised FBIJobs.gov and stole personal information on FBI employees. The bureau has confirmed it's investigating but says the point of breach is still undetermined — its own enterprise, or a third-party provider supporting the portal.
🧠 Why It Matters
For agents, exposed home addresses aren't an identity-theft problem — they're a physical safety one, since agents' names appear on court documents criminals can read. For everyone else, the lesson is the portal itself: careers sites collect rich personal data, usually run on third-party software, and rarely appear on anyone's list of sensitive systems.
⚡ CYBER IN 60 SECONDS
A Lenovo flaw let attackers into about 5,000 Dropbox accounts with no Dropbox password. The bug was in how Lenovo verified email ownership; Dropbox trusted it. Some affected users never had a Lenovo account at all. Both companies have now closed the integration. [Lenovo Flaw Opened 5,000 Dropbox Accounts, No Password]
Researchers disclosed a Windows technique that dodges the signals many security tools watch for. No patch applies — it abuses features working as designed. The buyer's question it raises: does your endpoint tool detect behavior, or just one known indicator? [New Windows Injection Method Can Slip Past EDR Tools]
💼 THE BUSINESS OF SECURITY
HUB Cyber Security received a Nasdaq delisting warning after its market value fell below the $35 million minimum. It has until March 22, 2027 to recover, and is mid-restructuring while its board explores strategic alternatives. A fair prompt for customers to ask any struggling vendor about roadmap and support. [HUB Cyber Security Gets Nasdaq Delisting Warning]
🛡️ TODAY'S SECURE MINDSET
Spend ten minutes auditing your connected logins. On your main cloud accounts — Dropbox, Google, Microsoft, anything holding your files — open settings and find connected accounts or sign-in methods. Remove any company you don't recognize or no longer use. As the Dropbox case shows, a login path you never set up can still be a way in, and nobody audits what they haven't written down. [Lenovo Flaw Opened 5,000 Dropbox Accounts, No Password]
See you tomorrow. — SecureMindset