200M X (Twitter) user records leaked in a 34GB free-for-all—again.

Data enthusiast “ThinkingOne” released the files after allegedly failing to get a response from X. The breach combines:
・Data from a 2022 vulnerability X previously downplayed
・January 2025 breach data
・A total of 2.8 billion records spanning X user IDs, emails, bios, locations & more

X continues to deny its systems were the direct source of the leak. But researchers confirm much of the data is real—and the scale is unmatched.

The kicker? ThinkingOne believes this might’ve required internal access, or an attack of unprecedented sophistication.

Even without passwords, this treasure trove fuels phishing, impersonation, and targeted disinformation.

https://www.forbes.com/sites/daveywinder/2025/04/01/hacker-claims-to-have-leaked-200-million-x-user-data-records-for-free/

Intelligente Cyberabwehr fängt bei den Mitarbeitern an

Schutz vor Cyberbedrohungen: Best Practices und Lösungen | heise https://business-services.heise.de/security/bedrohungen-schwachstellen/beitrag/intelligente-cyberabwehr-faengt-bei-den-mitarbeitern-an-4873 #CredentialStuffing #Phishing #Deepfake #ArtifificialIntelligence #SocialEngineering #CyberSecurity #HumanFactor #SecurityAwareness #HumanRiskManagement

Alright folks, just a quick heads-up from your friendly neighborhood pentester: Office docs? Yeah, they're *still* a massive playground for attackers.

Sure, keeping things updated is vital, *but* let's be real: social engineering still wears the crown. Honestly, the least suspecting user often ends up being the biggest security gap in the network.

Just saw this play out at a client's site recently. An employee clicked open a seemingly innocent Word doc... hiding a nasty phishing link. And *poof*, their credentials were gone. Can happen just like that.

Now, AI *can* lend a hand here, but tread carefully. The tech's evolving way faster than most people can adapt. That makes disinformation and manipulation seriously huge threats we need to watch out for.

So, what's the game plan? Awareness training – it's absolutely worth its weight in gold! Plus, fostering a healthy dose of skepticism is key, even when it feels like a drag sometimes. You gotta stay sharp.

How are *you* shielding your users from these kinds of attacks? Let me know!

Phishing-Kampagne zielt auf hochrangige X-Accounts ab

#Cybersecurity @KnowBe4 #Phishing #SecurityAwareness #Sicherheitsbewusstsein #SocialEngineering #ZweiFaktorAuthentifizierung

https://netzpalaver.de/2025/02/25/phishing-kampagne-zielt-auf-hochrangige-x-accounts-ab/

IT-Entscheider sollten sich in 2025 auf KI-gesteuerte Phishing-Kampagnen vorbereiten

#Cybersecurity #Deepfake #HumanRiskManagement @KnowBe4 #künstlicheIntelligenz #Malware #Phishing #SecurityAwareness #SocialEngineering

https://netzpalaver.de/2025/02/21/it-entscheider-sollten-sich-in-2025-auf-ki-gesteuerte-phishing-kampagnen-vorbereiten/

E-Mail-Sicherheit bleibt Dreh- und Angelpunkt der Cybersicherheit

#Cybersicherheit #EMail #EMailSicherheit #künstlicheIntelligenz #NIS2 #OpenPGP #Phishing #SMIME #SecurityAwareness #Seppmail #Sicherheitsstrategie #Verschlüsselung

https://netzpalaver.de/2025/01/21/e-mail-sicherheit-bleibt-dreh-und-angelpunkt-der-cybersicherheit/

Esther Ouwehand nog op SwastikiX

Het is een Hindu-symbool!

Do NOT Click: https://x.com/estherouwehand/status/1815285059886461119

Over 200 #SecurityAwareness experts from across Europe attended the inaugural #ENISA Cybersecurity Awareness Raising Conference last week in Ljubljana, hosted by the Slovenian National CERT.

Our Communications Manager Rosanna Norman @RosannaCrama attended the conference and shared her notes and key takeaways: https://connect.geant.org/2024/12/03/building-together-the-human-firewall

The Call for Proposals for GÉANT #Security Days 2025 in Prague is now officially open! Send your ideas for single presentations, panels, lightning talks by 17 January and help us make the second edition even more memorable!

https://security.geant.org/geant-security-days-2025

The event is a must-attend event for CISOs, security strategists, CSIRT coordinators, security service devs, security management professionals, incident responders, and leaders in #Cybersecurity.

Since 2017, our CLAW workshop has supported the international #research and #education community with #CrisisManagement planning and preparedness.

We spoke with Vladislav Bidikov (FINKI / UKIM, Skopje), to learn how the experience of CLAW inspired him to design and develop a course for university students: https://connect.geant.org/2024/11/12/from-crisis-to-classroom-teaching-crisis-management-interview-with-vladislav-bidikov

#CONNECT47: https://connect.geant.org/connect47

@evacide wrote (in https://infosec.exchange/@evacide@hachyderm.io/113451271787551269):
❞
if you are trying to tighten up your digital security, please start with threat modeling: https://ssd.eff.org/module/your-security-plan
❝

Although her intentions are undoubtly good, this is not going to work for most people.

In fact, it may make them more vulnerable. For example, having a list with your most valuable assets adds a new risk: if that list falls into the wrong hands, attackers will know exactly what to look for (and where, if that's in the list).

The EFF page sounds like ISO 27001. In most cases such systems did and do not prevent companies from getting pwned.

Such systems are too generic; for example, every system admin knows that "turn off all unnecessary services" is pure theory, because nobody tells you which ones are unneccessary (why were they running in the first place). And you don't know which update will turn them on again, or not but make them necessary.

Even the title is misleading: "Surveillance Self-Defense" and a bit down the page: "Does my neighborhood have a history of burglaries? How trustworthy are my roommates/guests?"

What do burglars have to do with surveillance? How HUGE is your problem if your roommates/guests are NOT trustworthy? (Does an alternative of "get rid of them or move yourself" even exist?)

There are way too many question marks in said EFF page. For most people it is extremely hard and time consuming to think of ALL potential vulnerable "access points" that may exist, estimate the chance of an attack taking place plus the damage that may result, figuring out the best affordable mitigating measures, implementing them and keeping everything up to date.

IMO we must make things a lot simpler; said EFF page just scares people away.

As our #CyberSecMonth campaign ‘Your brain is the first line of defence’ comes to a close, Urpo Kaila, Head of Security Policies at CSC, shares his reflections on #InformationSecurity and on what he believes to be also the ‘last line of defence’:

“The last line of defence is not about listing requirements, regulations and standards, or the latest hype in #cybersecurity tools. It is you!"

https://connect.geant.org/2024/10/29/the-first-and-the-last-line-of-defence

We often hear that the #HumanFactor is the weakest link in the #security chain, but as cyber attacks continue to evolve, so too do our protective measures and #SecurityAwareness

According to Enrico Venuto, CISO at Politecnico di Torino, humans are beginning to serve as the most acute and sensitive sentinels against cyber attacks: https://connect.geant.org/2024/10/28/the-weakest-link

"The human brain is the most resilient link in the chain and the first line of defence in #cybersecurity"

#CrisisManagement is everyone's business.

For #CyberSecMonth, Maria Edblom Tauson (@sunet) explains why it's fundamental for all of us to be prepared for a crisis and to know exactly what to do when a crisis strikes.

Crisis management is a collective responsibility, and during a crisis, collaboration is the key. Being prepared is always better than being caught off guard.

https://connect.geant.org/csm24

@nordunet #CSM24 #Cybersecurity #SecurityAwareness #ECSM #IncidentResponse #CyberCrisis

What does secure and ethical use of #AI look like in practice in #HigherEducation and #research?

Marlon Domingus, DPO and AI lead at Erasmus University Rotterdam, shared with us some practical steps to protect data, systems, and core ethical principles for educators and researchers looking to integrate AI into their work: https://connect.geant.org/2024/10/24/practical-steps-for-secure-and-ethical-ai-use-by-educators-and-researchers

#CSM24 #SecurityAwareness #GenAI @SURF