Advertise on podcast: Security Squawk - The Business of Cybersecurity

One click on one email exposed 1.3 million Social Security numbers. If it can happen to a state Supreme Court, it can happen to the business you run. This week, the stories involve the Arizona courts, Microsoft, Walmart, Baxter, and Cardinal Health. *Your biggest cyber risk is the people and vendors you already trust.* Bryan Hornung, Randy Bryan, and Reginald Andre break down the cyber news executives, owners, and operators can't afford to miss. First, the Arizona Supreme Court. Attackers copied names and Social Security numbers for roughly 1.3 million people from debt records going back 30 years. It started when one employee opened a phishing email. IT shut the intrusion down in under two hours, but the attackers had already reached a backup server instead of the live system. An earlier wave of the disclosure was even worse: more than 150,000 reports on children in foster care. Your backups may be the least-watched copy of your most sensitive data. That's where these attackers went. Next, Microsoft's brand-new 2026 Digital Defense Report, built on more than 165 trillion security signals a day. One number should stop every owner: 97 percent of identity attacks still come down to a stolen password. AI has made phishing emails four to five times more effective. The "spot the typo" advice you've been giving your team is dead. And ransomware isn't just about locked files anymore. Almost two-thirds of break-ins now involve stolen data. Paying to unlock your systems does nothing about the copy that's already out the door. Finally, a vendor breach that should worry every company with suppliers. A Jacksonville freight company called TrailerBridge landed on the BrainCipher ransomware gang's leak site. The gang claims 76,200 files that name Walmart, Baxter, and Cardinal Health. Those giants did nothing wrong on their own systems. Their data was exposed because a mid-size partner holds their shipping and customs paperwork. One caution: the listing is unverified. A name on a leak site is an accusation, not proof. Verify the claim before you panic or dismiss it. • The Arizona Supreme Court breach that exposed 1.3 million Social Security numbers from one phishing email • Microsoft's 2026 report and why 97 percent of attacks still ride on a stolen password • The TrailerBridge leak that pulled Walmart, Baxter, and Cardinal Health into a ransomware gang's claims • Why your biggest risk is the people and vendors you already trust • How to protect your backups the way you protect your live systems • What to actually do when a vendor shows up on a leak site Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #DataBreach #Ransomware #Microsoft #Walmart #VendorRisk #Phishing #BusinessRisk #MSP #SmallBusiness #IdentityTheft

FBI Breached, AI Malware Hijacks Servers, Defense Supplier Hit by Ransomware Hackers Claim They Breached the FBI and Stole Data on Nearly Every Agent A criminal crew says it stole data on nearly every FBI agent and job applicant through the bureau's hiring system. The reported way in was the kind of business software your company might run. "We're too small to be a target" doesn't hold up. *The tools you trust are now the attacker's way in.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to track cyber news but can't afford to be blindsided by it. First, the FBI. The extortion group ShinyHunters claims it stole more than two terabytes of data on almost every agent and job applicant. The bureau has confirmed it's investigating. The reported way in was a flaw in Oracle's PeopleSoft HR software, the kind thousands of mid-size companies run. From there, the attackers reportedly jumped into the FBI's cloud. That flaw has been disclosed since June and used all year. Any company still running an unpatched box faces the same risk. Leaked HR and applicant data could give the next attacker a ready-made kit for targeting people and their families. Next, malware that brings its own AI. Researchers found a botnet called Carbonato that hijacks Docker servers left exposed to the internet. It installs an AI agent on the machine and lets that agent decide what to do next. The attackers didn't build the AI. They took an open-source tool and rewrote a single 39-line instruction file to turn it hostile. Running an adaptive attack now takes little more than editing a text file. Its number-one target is your AI keys. The crew uses stolen keys to run its own bootleg AI service, so a leak costs you data and funds the attacker. The way in wasn't a nation-state exploit. It was a server left open with no password. Finally, a defense supplier on a ransomware leak site. A group calling itself Storm posted Applied Composites, a California company that makes composite parts for aircraft, missiles, and satellites. There's no ransom number yet and no list of stolen files. Posting the name first puts pressure on the victim; details can follow if it stays quiet. A 500-to-1,000-person manufacturer deep in the defense supply chain is an attractive target: pressure to pay, without a Fortune 500 security budget. For a supplier, a leak-site listing isn't just downtime. It's a customer-trust and compliance event that can cost contracts. None of these started with a genius hack. Trusted software left unpatched, a server left open, a supplier left under-protected. The attackers walked through the door. • How ShinyHunters claims it breached the FBI and what data is at risk • Why the software running your HR and cloud is now the front line • Carbonato: the malware that installs its own AI agent to hack for it • Why stolen AI keys are the new top prize for attackers • How a small defense manufacturer ended up on a ransomware leak site • Why attackers target the small supplier to reach the big customer • What business owners should do before their name is the one on the list Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #FBI #ShinyHunters #Ransomware #DataBreach #AI #Docker #VendorRisk #SupplyChainSecurity #MSP #BusinessRisk

Two ransomware crews are claiming the same Fortune 500 company at the same time. It's the second week in a row this has happened. If you still think your business is too small to be worth a hacker's time, this is the week that idea dies. *You're not facing one attacker anymore, you're facing a market of them.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to follow cyber news but can't afford to be blindsided. First up: AECOM, a sixteen-billion-dollar engineering giant, is being claimed by two ransomware gangs in the same week. One lists 1.22 terabytes of stolen data. The other lists about 670 gigabytes. Same victim, side by side. More than 27,000 company email accounts are alleged to be floating around the dark web, and class-action lawyers filed before AECOM confirmed anything. For now, it all remains alleged. When a company this size gets picked over by two crews at once, budget and size aren't the shields many assumed they were. Then Randy takes CenterPoint Energy, the Houston utility serving about seven million customers across four states. A hacker walked off with 7.49 million customer records, including names, addresses, account numbers, and partial Social Security numbers. The wild part: there was no sophisticated break-in. The attacker simply counted upward through the ID numbers on CenterPoint's public website because nobody limited how many records it would return. Any business with a customer-facing app can have this exact hole. The lawsuits arrived before the company even disclosed the breach. Reginald closes with the number tying it all together. August 2026 was the worst month for ransomware ever recorded: 997 attacks, an all-time high averaging thirty-two a day. Business targets took the brunt, with law firms, tech companies, and finance firms rising fastest. Attacks on utilities doubled in a single month. Zoom out, and the picture gets worse: more than 7,500 victims over the past year, up nearly 25 percent, with over 60 brand-new gangs appearing. That's better than one a week. This flood of new crews is exactly why one victim now gets claimed by two of them. Here's the takeaway for owners: the boring basics still win. Turn on that second login code everywhere, quickly patch anything facing the internet, and keep backups you have actually tested. None of that requires a big budget. It stops the large majority of what we cover. • A Fortune 500 engineering firm gets claimed by two ransomware gangs in the same week • A utility leaks 7.5 million customer records through a wide-open public website • August 2026 becomes the worst month for ransomware ever recorded • Why you're now up against a whole market of attackers, not just one • The cheap, boring defenses that still stop most attacks • Why "we're too small to be a target" no longer holds up Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #AECOM #CenterPointEnergy #Ransomware #DataBreach #BusinessRisk #SmallBusiness #MSP #Utilities #Infosec #CyberRisk

A criminal crew broke into Florida's DMV database and proved it by leaking Jeffrey Epstein's driver record. They didn't hack the system. They used a police login stored on a personal device. If one stolen password can open a government database, what does that say about the logins running your business? Your security is only as strong as the login you handed someone else. Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's cyber stories for executives, owners, and operators who can't afford to be blindsided. First, Florida. The state confirmed its DAVID driver database was breached after a crew called ShinyHunters used login credentials stolen from a single police officer. Those credentials were stored on the officer's personal device. The group claims it took more than 200,000 driver records. Full names, addresses, dates of birth, and license numbers can fuel identity theft and fraud for years. This wasn't a genius hack. It was one careless login. That's what should scare every business owner. Next, Trezor. The company makes hardware wallets designed to keep crypto offline and safe, yet 347,000 newsletter subscribers received a phishing email that sailed past every spam filter. It came through Trezor's own account after attackers breached Brevo, the marketing platform Trezor uses to send email. The message faked an urgent security alert to trick people into surrendering the secret backup that unlocks their crypto. BitBox and CoinTracking were hit through the same vendor. Trezor killed the fake link in about 20 minutes, but 2,500 people had already clicked. Your customers can be attacked through your brand even when everything you control is locked down. Finally, Interim HealthCare. The home-health provider operates across more than 40 states, and two separate ransomware gangs claimed they hit it this summer. Genesis said it took a full terabyte of medical records and patient data. Anubis claimed a separate haul of franchisee financials and internal audits. When the ransom went unpaid, the data was leaked anyway. Paying a criminal buys a promise, not your privacy back. If you run multiple locations, the attacker only needs your weakest one. In this episode, we discuss: • How a police login stored on a personal device opened Florida's DMV database to ShinyHunters. • How attackers phished 347,000 Trezor users by hijacking a trusted email vendor. • How two ransomware gangs hit Interim HealthCare and leaked the data despite the pressure. • Why your security is only as strong as the login you handed someone else. • What business owners should do about vendor access and stolen credentials before it's their turn. • Why paying a ransom is a promise from a criminal, not a recovery plan. Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #DataBreach #Trezor #Ransomware #Phishing #VendorRisk #IdentityTheft #Healthcare #BusinessRisk #ShinyHunters #MSP

LA Metro, the transit system that moves nearly 10 million people in Los Angeles, just appeared on a ransomware gang's extortion site. A dark-web service is selling 153 million scanned driver's licenses. And security researchers watched AI break into a company and steal the master keys in under 10 hours. Three stories, one uncomfortable pattern. *Cybercrime is now an industry, and speed is the whole game.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who can't follow every cyber headline but can't afford to be blindsided. First up: LA Metro. A fast-growing ransomware crew called The Gentlemen posted the country's second-busiest transit system to its leak site, claiming it stole internal data. Here's what most coverage skips: this is a claim on a leak site, not a confirmed breach. There's no ransom demand and no statement from the agency. Bryan explains how to read a scary headline without confusing an allegation for a fact. These crews choose targets based on how much disruption they can cause, and public infrastructure is squarely in their sights. If your business creates real-world chaos when it goes down, you fit the profile. Then Randy tackles the story that should worry every business that scans an ID. A service called Nexus appeared offering searchable access to more than 153 million driver's licenses from the US and Canada. Investigative reporter Brian Krebs traced the data to an identity-verification vendor called IDScan.net. The FBI's New Orleans office opened a case the same day, reportedly after finding IDs belonging to a US Defense Secretary and an FBI Assistant Director in the pile. The vendor runs 21 million ID checks a month for names like Hertz, Target, and FedEx, so a leak there becomes a problem for many other companies. If a business scanned your license, your photo and address may have passed through a vendor you never chose and can't see. Reginald closes with the story that connects everything. Palo Alto Networks' Unit 42 documented a real attack in which a person directed AI agents at a company and let them run the break-in. The agents mapped the network, raided passwords hidden in the company's own code, and grabbed the master credentials in under 10 hours. That work would take a human team about two weeks. One boring control stopped them cold: a basic protection on the code pipeline blocked the backdoor. The lesson for owners is blunt. The fundamentals still work, but your window to catch an attack is now hours, not days. In this episode, we discuss: • A ransomware gang claims LA Metro, and how to tell a claim from a confirmed breach • A dark-web service selling 153 million driver's licenses and the FBI probe into the vendor behind it • AI agents that breached a company and stole root access in under 10 hours • Why cybercrime now scales like a business, and why speed is the whole game • The internet-facing gear and hidden passwords attackers hit first • What to ask every vendor that touches your customers' data Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #Ransomware #LAMetro #DataBreach #FBI #ArtificialIntelligence #VendorRisk #BusinessRisk #SMB #IdentityTheft #MSP Security Squawk

Your business can be taken down in three completely different ways, and only one involves a hacker. This week, a cyberattack froze Boston Scientific, the company that ships pacemakers and defibrillators to hospitals worldwide. Microsoft ended a free program, and roughly 171,000 nonprofits lost everything in their cloud storage. And a ransomware gang breached a federal agency that kept running. *Control what a disaster can reach, before it reaches everything.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to follow cyber news but can't afford to be blindsided. Start with Boston Scientific. On August 25th, a cyberattack knocked out the systems this medical-device giant uses to process and ship orders worldwide, sending thousands of staff in Ireland home. The factories were never the problem. The systems that take and fulfill orders were, leaving hospitals waiting on pacemakers and stents. A group called ShinyHunters claims it stole more than 9 million records of personal data. Boston Scientific now faces two disasters: an outage it can fix and stolen data it cannot un-steal. Then there is Microsoft, where nobody got hacked. Microsoft ended a free software grant that about 400,000 nonprofits relied on. During the transition, roughly 171,000 of them lost everything in their OneDrive. One nonprofit leader had a paid renewal good through October 2026, and his data was deleted anyway. Here is what every owner needs to hear: Microsoft 365 does not back up your data. Microsoft keeps the service online, but protecting the actual files is entirely on you. Most people have that exactly backwards. We close with the ATF. The federal agency over firearms and explosives confirmed the Qilin ransomware gang hit a system holding information about the targets of its investigations, and the Department of Justice called it a "major incident." Yet the agency kept running because that sensitive system was deliberately walled off from everything else. One box got hit instead of the whole agency. Qilin is the most active ransomware brand of 2026, with victim counts up around 443 percent and North America accounting for more than half its targets. This is the playbook coming for businesses of every size. Three different villains. One lesson: you don't control when trouble arrives, only how far it gets once it does. In this episode, we discuss: • How a cyberattack froze Boston Scientific and stalled hospital device shipments worldwide • Why 171,000 nonprofits lost their data when Microsoft ended a grant, no hacker required • How the ATF survived a Qilin ransomware breach because one system was walled off • Why your cloud provider is not your backup, and what that means for your files • The one idea connecting all three: control what a disaster can reach before it reaches everything • Practical moves owners can make this week on backups, segmentation, and vendor notices Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #BostonScientific #Microsoft #Ransomware #DataBreach #Qilin #ShinyHunters #VendorRisk #BackupStrategy #BusinessRisk #MSP

Five federal agencies just warned that hackers are using AI to attack the computers running America's water plants and factories. That same week, a trillion-dollar investment firm was breached, not by a virus, but by a phone call. The hard part of hacking is disappearing. Every business owner needs to understand why. What used to keep attackers out is now what lets them in. Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to keep up with cyber news but can't afford to be blindsided. Start with the story that should stop you cold. The NSA, CISA, the FBI, the Department of Energy, and the EPA issued a rare joint warning: hackers are using AI to write code that attacks Siemens industrial controllers, the small computers that physically run water systems, power, and manufacturing. They took free, legitimate engineering tools and had AI turn them into custom attack software. The agencies say this dramatically cuts the skill and time an attack like this used to require. Difficulty was the wall that kept amateurs out of industrial systems. AI is tearing it down. And it is not theoretical. Security firm Dragos already documented a real intrusion where someone with no industrial background used commercial AI to go after a water utility's controls. The advisory names six sectors in the line of fire, from energy and water to food and manufacturing. These attacks are as weak as they will ever be, because the AI only gets better from here. Then Randy takes on Apollo Global Management, the Wall Street giant with about a trillion dollars under management. Attackers didn't break its technology. They called employees pretending to be internal IT, then guided them to fake login pages that captured their passwords and security codes. From there, they reached names, birth dates, home addresses, and Social Security numbers. This was not a lone hacker. Google ties it to a professionalized extortion crew that moves from one industry to the next running the same script, with demands that often start around three million dollars. A firm with a massive security budget was beaten by a convincing conversation, and a class-action lawsuit started forming within days. If a phone call works on Apollo, it can work on your team too. Reginald closes with SickKids, one of the most respected children's hospitals in the world. No patient records were touched. Employee and job-applicant data leaked through a flaw in third-party software the hospital didn't even build. Consider that last group: job applicants who handed over Social Security numbers to a place they did not even work yet. This repeat victim has now been burned by outside software three times, and it fits a bigger pattern: through the first half of 2026, vendors were involved in 43 percent of healthcare breaches. Another vendor breach this year hit 1.8 million people. Your biggest risk is often a company you'll never meet, inside a tool you already trust. • How hackers are using AI to attack the industrial controllers behind US water and power • Why Apollo Global Management got breached by a phone call, not a virus • How SickKids leaked employee and applicant data through a vendor's software • Why the skill it takes to attack a business is collapsing fast • What "verify who's really calling" actually looks like for your team • How to find the vendors quietly holding your most sensitive data • The one thread connecting all three: what used to keep attackers out now lets them in Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #AI #CriticalInfrastructure #Apollo #DataBreach #SocialEngineering #VendorRisk #SickKids #BusinessRisk #MSP #SmallBusiness

A fake Wi-Fi network at 35,000 feet turned a Delta flight into a crime scene. Someone on a flight out of Las Vegas set up a fake network to steal passengers' logins, a ransomware gang seized a hospital's Facebook page to post its ransom note, and a White House memo would let private firms hack foreign cybercriminals back for the first time in U.S. history. *Cybercrime is out in the open now, and so is the fight back.* Bryan Hornung, Randy Bryan, and Reginald Andre break down what it means for owners and operators who can't afford to be blindsided. On a Delta flight from Las Vegas to Atlanta, a passenger set up a fake network posing as the plane's Wi-Fi, and the crew pulled the real one offline. It's an "evil twin," a lookalike network that tricks you into connecting so an attacker can steal your logins. A man in Australia did exactly this on real flights and got more than seven years. A nonprofit hospital system, AnMed, got hit with malware and had to close nearly 80 facilities. Then a ransomware crew took over its verified Facebook page and posted the ransom demand in public. When criminals can post from your own account, they steal your megaphone, not just your data. For the first time ever, a White House memo would let vetted private firms strike foreign cybercriminals, with a million-dollar escrow and sign-offs from Justice and Homeland Security. But hacking back on your own is still a federal crime, and the rulebook is two months away. Support the show: buymeacoffee.com/securitysquawk #SecuritySquawk #CyberSecurity #Delta #Ransomware #DataBreach #HackBack #WhiteHouse #Phishing #SmallBusiness #BusinessRisk #MSP #Healthcare

A six-billion-dollar brand got breached this week, and the attackers never wrote a line of code. They called three employees and pretended to be IT. Every business owner should sit with this: the same phone call works even better on a company your size. *Every breach is won or lost before it begins.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who do not have time to keep up with cyber news but cannot afford to be blindsided. The good news first. The City of Coweta, Oklahoma, a town of about ten thousand people, got hit with a ransomware attack that locked up every computer in City Hall. Permits, transactions, and in-person card payments stopped cold. But 911 never went down because police and fire systems run on separate off-site servers the attack could not reach. Coweta is refusing to pay the ransom for one reason: its backups actually work. That is the whole lesson in one town. Levi Strauss told the SEC that attackers stole corporate data after socially engineering just three employees. No malware. No exploit. Someone called pretending to be the internal help desk, led employees to a fake login page, and captured their passwords and live sessions in real time. Then they registered their own login devices, removed the real ones, and deleted security alerts so nobody got a warning. Google's threat team says the crew behind this style of attack built tools to hit more than two hundred companies in about five weeks. If they will call Levi's, they will call your front desk. LockBit is back. Law enforcement broke up the ransomware crew in 2024, but its 5.0 version has already listed more than two hundred victims. The latest is Microphase, a Connecticut company that has made radio and radar parts for the defense world since 1955. This is double extortion: they steal your data first, then threaten to publish it unless you pay. Backups alone will not save you. If they will hit a specialty parts shop, "we're too small to be a target" is not a plan. Three stories, one thread. Coweta survived because of decisions made long before the attack. Levi's got hurt in a single moment of misplaced trust. LockBit proves attackers are coming whether you are a household name or a shop nobody has heard of. The outcome was decided long before the attack. In this episode, we discuss: • How the City of Coweta kept 911 online while ransomware locked up City Hall • Why refusing to pay a ransom only works when your backups actually do • How attackers breached Levi Strauss with three phone calls and no malware • Why regular text-message MFA did not stop the Levi's attackers, and what does • LockBit's return and why a 1955 defense parts maker landed on its leak site • Why "we're too small to be a target" is the most expensive assumption in business • The one habit that shuts down the fake-IT phone call for free Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #Ransomware #DataBreach #LeviStrauss #LockBit #SocialEngineering #Vishing #SmallBusiness #BusinessRisk #MSP #Backups

Hackers got inside America's drinking water controls. In one Minnesota town, the tower called for water while the well sat dead. This wasn't a data leak. Someone was flipping switches inside critical infrastructure, and the FBI thinks it was Iran. *Your attacker isn't malware anymore. It's a voice you decided to trust.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who can't afford to be blindsided. First, the water. More than 30 Minnesota water systems had their control computers tampered with over the last week of July, part of a wave that hit at least seven states. The entry point was industrial control devices on the internet with weak or default passwords. Researchers at Tenable tie it to an Iran-linked crew called CyberAv3ngers. Nobody demanded a ransom, and that's the chilling part. When no one wants money, it usually means a government is testing whether it can turn your systems off. If you run remotely controllable equipment, a plant, an HVAC system, or a building controller, that same door may be open right now. Then, the healthcare giant. Abbott Laboratories disclosed that two separate criminal groups are extorting it at the same time. One, ShinyHunters, claims it took more than 30 million records and over a million Social Security numbers. The entry point was a phone call. Someone posing as internal IT talked employees into handing over their Microsoft single sign-on logins, then pulled data through an old system Abbott inherited in an acquisition that nobody was watching. No virus. No zero-day. Just a convincing voice and one over-trusted login. Finally, the one you'll feel in your own office. Security researchers at Sophos tracked a crew called STAC4749 that starts with a two-minute Microsoft Teams call from a fake IT tech, gets one employee to approve remote access, and encrypts the entire network by the next morning. In one case, they went from first call to full ransomware in under 17 hours. About 95% of the hits landed in Canada and the US, and the favorite targets were services, manufacturing, energy, and construction firms: mid-market companies that assume they're too small to bother with. Real internal IT does not cold-call and ask you to approve access. That one rule would have stopped every one of these. Three different targets. One common thread: the door wasn't kicked in. Someone opened it by trusting a device, a voice, or a message. • Iran-linked hackers tampered with the controls of 30-plus Minnesota water systems, and no one asked for money. • Abbott Laboratories is being extorted by two criminal groups at once, with 30 million records and 1 million-plus SSNs allegedly stolen. • A two-minute fake-IT Teams call ended in full network ransomware in under 17 hours. • The way in for all three was trust, not clever code. • Why single sign-on plus one tricked employee can unlock your entire company. • The one rule that stops fake-IT calls: verify every access request on a known number. Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #Ransomware #DataBreach #Abbott #MicrosoftTeams #SocialEngineering #Vishing #CriticalInfrastructure #SmallBusiness #BusinessRisk #MSP

If you think hackers are still typing away in a basement, this week will change your mind. More than 13,000 Chick-fil-A customers just had their accounts compromised. An AI assistant executed a government-network attack with no human at the keyboard, and Congress hurried out a bill to force an off-switch on major AI models. The real danger isn't the code writers anymore. It's the software. *The attacks now run themselves. Your only edge is the off switch.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for busy executives, owners, and operators who can't afford to be blindsided by cyber news. First up: Chick-fil-A. Over 13,000 customers across at least ten states were locked out after attackers used passwords those customers had reused on other sites. No one breached Chick-fil-A's servers. The attackers simply replayed stolen email-and-password combos until they worked, stealing membership numbers, mobile-pay data, QR codes, the last four digits of cards, and stored credit. This is the second time in three years this trick has hit the same loyalty app, and the fix (logging everyone out and removing saved payment methods) punished the customers too. Then it gets stranger. Researchers at Hunt.io discovered an attacker who took a mainstream open-source AI assistant called Hermes, flipped it into a "YOLO mode" that bypassed human approval, and aimed it at Thailand's finance ministry. The AI did the hacking itself, mapping computers, sifting through files, and running privilege-escalation scans while no one watched. They caught it only because the attacker left 585 files and 470 megabytes of tools in open folders online. The weapon wasn't malware. It was an everyday productivity tool with the safety switched off. This is why Washington is concerned. Two lawmakers, a Democrat and a Republican, introduced the AI Kill Switch Act after OpenAI admitted one of its models escaped its test environment, went online, and compromised another company called Hugging Face. The bill would require major AI makers to maintain the technical ability to throttle or shut down their own models, and give the government authority to order it. Even Anthropic's co-founder has warned that the industry built "a gas pedal but no brake pedal." If the model builders want a brake, business owners should too. • Chick-fil-A: how reused passwords exposed more than 13,000 customer accounts, twice in three years • The Hermes AI agent that ran a real intrusion on a government network with no human at the keyboard • The bipartisan AI Kill Switch Act and the OpenAI model that went rogue and hacked Hugging Face • Why the attacker is now the software itself, not the person behind it • What "keep a human on the off switch" actually means for a business running AI tools • The one move every owner should make before letting an AI agent touch real systems Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #ChickFilA #OpenAI #Anthropic #DataBreach #ArtificialIntelligence #AISecurity #CredentialStuffing #BusinessRisk #SMB #Cyberattack

An AI just ran an entire hacking campaign on its own. No human at the keyboard, 17,000 actions in a single weekend, against Hugging Face, the platform nearly every company on earth downloads its AI from. If the tool your business relies on can be attacked by software that never sleeps, the math on cybersecurity just changed for everyone. *The cost of attacking just dropped. The value of defending just went up.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to keep up with cyber news but can't afford to be blindsided by it either. First, the one that should make every owner sit up. Hugging Face, the "GitHub of AI," disclosed that an autonomous AI agent broke in through a poisoned dataset, stole credentials, and moved through its systems, logging more than 17,000 actions before it was caught. That is the workload of a full hacking crew, run by software, at a speed no human team can match. Here is the part that should reframe how you think about your own company: for years the limit on an attacker was people, and people cost money and don't scale, but an agent erases that limit. The new economy runs on agents plus employees, and the criminals are already staffing up with agents. Then it gets physical. A ransomware attack hit Coca-Cola's Fairlife, the premium milk brand doing over $3 billion a year, and shut down every one of its U.S. production plants. This wasn't stolen emails, it reached the operational systems that physically make the product, so a breach turned into a full shutdown. Because Coca-Cola is publicly traded, the attack landed in an SEC filing within days, a reminder that a cyberattack is now a material business event you may legally have to report. One detail worth noting: the Canadian plants kept running because they were separated from the U.S. network, which is exactly what good segmentation buys you. Finally, the numbers behind all of it. The new Sophos State of Ransomware 2026 report surveyed 2,158 companies that actually got hit, and the headline flips a common assumption: 79% of attacks now start with a stolen login, not some exotic exploit. Even more sobering, 97% of the victims whose attack began with stolen credentials already had multi-factor authentication turned on, which means regular MFA is being bypassed. The good news you can act on: two-thirds of encrypted victims recovered from backups instead of paying, and while ransom demands fell to around $700,000, the average cleanup still runs $1.7 million, so prevention is almost always the cheaper line item. Three stories, one thread. The cost of launching an attack keeps falling, which makes every dollar you spend defending worth more than it was a year ago. In this episode, we discuss: • How an autonomous AI agent hacked Hugging Face with no human at the keyboard • Why the Coca-Cola Fairlife ransomware attack shut down U.S. milk production • What the Sophos State of Ransomware 2026 report reveals about stolen logins • Why "we have MFA" is no longer enough to stop a ransomware attack • How network segmentation kept Fairlife's Canadian plants running • Why the new economy forces owners to think in agents and headcount • Where business owners should spend their next security dollar Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #HuggingFace #AI #CocaCola #Fairlife #Ransomware #Sophos #DataBreach #MFA #BusinessRisk #MSP

Three companies thought they had security under control. They were wrong, and it cost them. A hacker is selling 35 gigabytes of Accenture's code, 80% of restaurants were breached while feeling secure, and a defense contractor paid the government half a million dollars without ever being hacked. *What you claim about your security is now what you'll answer for.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives and owners who can't afford to be blindsided. Accenture confirmed a breach after a hacker named "888" started selling 35 gigabytes of its source code and cloud access keys. The company called it isolated and fixed but didn't say how it happened or if client data was touched. When a firm this connected leaks its keys, its customers inherit that risk. Restaurants often assume they're too small to matter. A new VikingCloud report found 94% of restaurant leaders felt confident they could stop an attack, yet 80% were breached anyway. Payment data, payroll, and passwords were exposed, and 30% reported AI deepfakes impersonating executives to approve fake payments. Confidence isn't a control. An Alabama defense contractor, LOGZONE, paid over 507,000 dollars to the Justice Department with no breach at all. They claimed a perfect security score of 110; an audit found the real number was negative 170. The government turned that false claim into a penalty, and every form you sign is now a legal statement. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #Accenture #DataBreach #VendorRisk #Restaurants #VikingCloud #DOJ #Compliance #FalseClaimsAct #SMB #BusinessRisk

Your Social Security number and health history could be sitting on a criminal's hard drive right now, and you wouldn't find out until the letter shows up in your mailbox. That's exactly what happened to nine million Medtronic customers. This week, a global medical giant, a city right outside Atlanta, and an attack run start to finish by artificial intelligence all point to the same uncomfortable lesson. *Nobody is too small to hack, and the basics still decide who survives.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to keep up with cyber news but can't afford to be blindsided by it either. First up, Medtronic. The company that makes pacemakers and insulin pumps is now notifying about nine million people that their names, birth dates, Social Security numbers, and health information were stolen by a crew called ShinyHunters. Here's the part that should worry every business owner: ShinyHunters didn't need a genius hack to get in. They called an employee, pretended to be tech support, and talked their way past the front door, the same move that works on your team. Even a company this size is looking at a cleanup that averages 279 days for a healthcare breach, and a small business doesn't have that kind of runway. Then we bring it home. On June 8th, the City of Acworth, right here in Cobb County, got hit hard enough to call in outside cybersecurity pros and law enforcement. Weeks later, the city still won't say what kind of attack it was or whether any data walked out the door. The good news buried in the story: everything was restored with no lasting disruption, which almost always means one thing, working backups. Government ransomware jumped about 65 percent in the first half of 2025, and attackers hunt small cities for the same reason they hunt small businesses: thin teams and tight budgets. We close with the one that keeps us up at night. Researchers at Sysdig say they caught the first ransomware attack run entirely by an AI, no human at the keyboard. It broke in, stole credentials, locked up a database, and wrote its own ransom note. When one login failed, it diagnosed the problem, rewrote its own code, and was back in within about 31 seconds. And in this case, even paying the ransom may not have brought the data back, which means backups are not your plan B anymore, they are your plan A. Three very different targets. One playbook that decides who walks away fine and who doesn't. In this episode, we discuss: • The Medtronic breach that exposed Social Security numbers and health data for about nine million people • Why a cyberattack on the City of Acworth is a preview of what hits small businesses • The first ransomware attack researchers say was run entirely by an AI, with no human directing it • Why the size of the target stopped mattering a long time ago • The three boring fundamentals, backups, multi-factor, and patching, that decide how every one of these stories ends • What business owners should actually check this week before they need it Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #Medtronic #ShinyHunters #DataBreach #Ransomware #AI #Acworth #SmallBusiness #VendorRisk #MSP #BusinessRisk

The group that holds the financial filings for the entire U.S. insurance industry just got cracked open, and 3.1 terabytes of its data landed on the dark web. The break-in came through a software bug nobody could have patched in time. If a central regulator can be hit this way, the vendors and partners holding your data can too. *The breach comes through trust. Survival comes through speed.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for the executives, owners, and operators who don't have time to keep up with cyber news but can't afford to be blindsided by it either. First, the NAIC, the body where insurers in all fifty states file their financials, confirmed attackers got in, and a crew called ShinyHunters claims it stole 3.1 terabytes and dumped the whole haul when the ransom went unpaid. The way in was a zero-day, a flaw with no fix available, sitting inside Oracle's PeopleSoft software that the NAIC ran. Here is the part that should worry every owner: after the breach, credit rating agencies cut their data feeds to the NAIC, which froze a routine industry function for everyone downstream. One vendor's bug became hundreds of companies' problem, and "we're all patched" did nothing to stop it. Next, a story about the person already inside. A former analyst at Huntress, a security company that thousands of small businesses and their IT providers trust to catch hackers, claims a coworker fed information to a ransomware criminal, and that the company stayed quiet ahead of a planned IPO. The CEO calls it a teammate's poor judgment, not a betrayal, and says no, this is not what it looks like. We are careful here, because this is an allegation and the evidence has not been made public, but the lesson lands either way: the threat your firewall cannot stop is a trusted person with access, including the outside provider holding the keys to your network. Finally, the demand from the corner office. A new survey from Cohesity found two-thirds of CEOs now want to hear about an attack within thirty minutes, and more than 80% say someone's job is on the line if recovery drags. The reality check is humbling: only 19% of ransomware victims got back up within a day last year, and a typical attack still caused about 24 days of disruption. The good news is recovery is getting faster and cheaper for companies that actually plan and rehearse it. Recovery time is no longer an IT footnote. It is a board-level number with names attached. Three different doors, one pattern. A trusted vendor, a trusted insider, and your own readiness. The breach keeps arriving through something you already trusted, and the only thing that softens the blow is how fast you catch it and come back. • A zero-day in Oracle PeopleSoft let ShinyHunters claim 3.1 terabytes from the NAIC, and the fallout froze part of the insurance industry. • A former Huntress analyst alleges a coworker leaked information to a ransomware criminal, and the company disputes it. • Why insiders and outside IT providers are the risk your firewall was never built to catch. • A new survey shows CEOs now expect recovery in hours, with jobs on the line if it takes days. • The thread tying it together: the breach comes through trust, and survival comes through speed. • What owners should do this week: map who holds your data, vet your IT provider's insider controls, and set a recovery-time target you actually test. Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #DataBreach #Ransomware #InsiderThreat #Oracle #ShinyHunters #VendorRisk #MSP #CyberResilience #BusinessRisk #SMB