New SEC Regulations, Rising Data Breach Costs & More

by Robbie Araiza on Friday July 28, 2023

The cost of the average data breach is on the rise, the SEC recently approved new data breach regulations, and four AI powerhouses have come to an agreement on a new joint initiative. Catch up on these stories and more in this week’s Friday Five!

SEC’S BREACH DISCLOSURE RULE RAISES CONCERNS ABOUT TIPPING OFF HACKERS TO FLAWED SYSTEMS BY ELIAS GROLL

The Securities and Exchange Commission (SEC) has approved new rules requiring publicly traded companies to disclose cybersecurity breaches that pose a significant risk to their financial well-being. The aim is to bring transparency and consistency to information available to investors. Companies must report breaches within four days if they are considered material. However, experts warn that determining material breaches and rushing to report them may be challenging and expose companies to additional risk. The disclosure will be public in the 8-K forms filed with the SEC and made available to investors. The rules also mandate an annual report on the company's cybersecurity risk management strategy. Some experts believe businesses may struggle to assess and comply with the new guidelines.

ORGS FACE RECORD $4.5M PER DATA BREACH INCIDENT BY BECKY BRACKEN

According to IBM's most recent Cost of a Data Breach Report, the average cost per data breach for businesses in 2023 increased by 15% to $4.45 million over three years. Despite this, 57% of breached organizations intend to pass the costs onto consumers instead of investing in cybersecurity. To reduce breach costs, organizations are being advised to focus on three areas: utilizing artificial intelligence and automation, involving law enforcement, and investing in security teams for early breach detection. Early detection and fast response can significantly lessen the impact of a breach, according to IBM's data breach cost report. Currently, consumers are bearing the brunt of rising cybercrime costs in over half of the cases.

MASSIVE MACOS CAMPAIGN TARGETS CRYPTO WALLETS, DATA BY JAI VIJAYAN

Threat actors are targeting macOS users with fake blockchain games that steal cryptocurrency wallets and sensitive data. Security vendor SentinelOne discovered the Realst infostealer campaign, linked to another infostealer called PureLand. Victims who downloaded the games had their cryptocurrency wallets drained, and sensitive information like passwords and browser data stolen. The threat actor has made a considerable effort, having created multiple variants of the malware that even targets the still unreleased macOS 14 Sonoma. The threat actors have created fake websites, Discord, and X accounts to lure victims into thinking the games are authentic, and because malicious components of Realst are not currently blocked by Apple's XProtect service, users are made vulnerable.

MAJOR AI COMPANIES FORM GROUP TO RESEARCH, KEEP CONTROL OF AI BY GEORGE HAMMOND

Four leading artificial intelligence companies, Anthropic, Google, Microsoft, and OpenAI, have created the Frontier Model Forum to research and establish best practices for handling increasingly powerful AI. The initiative aims to ensure the safe and responsible development of frontier AI models amid growing public anxiety and regulatory scrutiny, including concerns raised about copyright infringement, privacy breaches, and AI's potential to replace human jobs. The group plans to promote safety research and foster communication between the AI industry and policymakers, with their focus being on potential risks arising from more powerful AI rather than current issues like copyright and data protection.

NORTH KOREAN CYBERSPIES TARGET GITHUB DEVELOPERS BY ELIZABETH MONTALBANO

The North Korean state-sponsored Lazarus advanced persistent threat (APT) group is using impersonation scams to target tech employees on GitHub. The APT poses as developers or recruiters with legitimate GitHub or social media accounts, inviting victims to join GitHub development projects that spread malware via malicious node package manager (npm) dependencies. Lazarus aims to execute a two-stage malware attack on victims' machines, with the ultimate goal being to clone and execute a GitHub repository containing the malware. GitHub has suspended associated accounts and published indicators of compromise to help mitigate the cyberattack. Developers are urged to be cautious of social media solicitations and examine dependencies closely.

Tags: Data Breaches , Compliance , Cryptocurrency , Artificial Intelligence

Robbie Araiza

Robbie is a Content Creator for the Data Protection team at Fortra. Prior to joining the organization, he studied psychology and social work at Texas State University in San Marcos, TX.