Andrew Hoog

If you're interested in leveraging AI and open source tools (radare2) to reverse engineering (mobile) apps, check out this excellent article by @pancake@infosec.exchange from @NowSecure@infosec.exchange . Abstract and repo/blog links ⬇️

➡️ Abstract: This post covers a novel approach for recovering application source code, leveraging AI language models to transform pseudo-disassembly into high-level source code. This method is able to handle complex abstractions introduced in high-level languages SwiftUI or Dart and generates output in popular programming languages like Swift, C#, Kotlin, Java, Python or even Bash.

➡️ Repo: https://github.com/radareorg/r2ai/blob/master/README.md

➡️ Blog: https://www.nowsecure.com/blog/2025/01/29/decompiling-apps-with-ai-language-models/

#radare2

data in State AG breach notification has some issues. No, this 2021 breach wasn't first reports in the year 9999!

I'm a few weeks away from releasing the new Board Cybersecurity website that's ingesting far more incident data. You can sign up for free alerts on the current side and you'll get notified when the new system with 1000's of breaches is available. https://www.board-cybersecurity.com/

in the meantime, here's the Maine AG filing for this 2021 breach: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/598f0dd5-2f8f-4610-9c63-5f2b7e96cf60.shtml

Boyd Gaming reported a cybersecurity breach involving unauthorized access to IT systems and theft of employee and some individual data; operations were not impacted.

1️⃣ Data exfiltration confirmed; records volume unspecified
2️⃣ No impact to casino or hotel operations
3️⃣ Working with external experts and law enforcement; notifications underway
4️⃣ Cyber insurance expected to cover response and related costs

Boyd Gaming Corporation is a U.S. gaming and hospitality company that owns and operates casinos, hotels, and entertainment properties across several states.
https://www.board-cybersecurity.com/incidents/tracker/20250923-boyd-gaming-corp-cybersecurity-incident/

when security nerds with dev backgrounds use AI coding assistants:
❯ great. question: what happens after 10 iterations? I want to make sure we fail with an error, not let's a persistent
attacker in if they nest 11 times. just wanted to make sure

⏺ Excellent security question! Let me check what actually happens.

⏺ Bash(node -e "
const { sanitizeInput } = require('./lib/utils/sanitize');…)
⎿ 11-level encoded result: "alert(1)"

⏺ You're absolutely right - that's a vulnerability! After 10 iterations, it returns the partially-decoded string, which then
gets decoded by the final decode() after sanitization, bypassing the XSS protection.

Let me fix this to reject input that doesn't stabilize.

Logitech disclosed a cybersecurity incident involving data exfiltration through a zero-day vulnerability in a third-party platform. The company reports no operational impact and no sensitive personal data exposure.

1️⃣ Unauthorized third party accessed internal IT systems
2️⃣ Zero-day vulnerability exploited in third-party software
3️⃣ Limited employee, consumer, customer, and supplier data likely copied
4️⃣ No impact to products, operations, or manufacturing reported

Logitech International S.A. designs and markets software-enabled hardware solutions for work, creation, and gaming.
https://www.board-cybersecurity.com/incidents/tracker/20251114-logitech-international-sa-cybersecurity-incident/

RTX Corporation reported a ransomware incident detected September 19, 2025, that disrupted business processes and systems but was not deemed material.

1️⃣ Data was encrypted by the attackers
2️⃣ Response included IR plan, experts, and law enforcement
3️⃣ Incident disclosed in SEC filing on September 24
4️⃣ No material impact or costs identified

RTX Corporation is a U.S. aerospace and defense conglomerate providing advanced systems and services for commercial, military, and government customers.
https://www.board-cybersecurity.com/incidents/tracker/20250924-rtx-corp-cybersecurity-incident/

Prosper Funding LLC disclosed a breach where attackers accessed confidential and personal information, including Social Security numbers, but customer accounts and funds were not impacted.

1️⃣ Incident detected September 1, disclosed September 17, 2025
2️⃣ Breach involved unauthorized queries of customer/applicant databases
3️⃣ Social Security numbers confirmed among exposed data
4️⃣ Company anticipates higher cybersecurity insurance costs

Prosper Funding LLC operates a peer-to-peer online lending marketplace platform that connects consumer borrowers seeking unsecured personal loans with individual and institutional investors.

https://www.board-cybersecurity.com/incidents/tracker/20250917-prosper-funding-llc-cybersecurity-incident/

An unauthorized third party gained access to Itron's systems, prompting a SEC disclosure. Notable is they reference "significant costs". https://www.board-cybersecurity.com/incidents/tracker/itron-cybersecurity-incident-7dac5afb?utm_source=mastodon&utm_medium=social&utm_campaign=itron-incident-20260424

Here's a summary of the disclosure:

1️⃣ Incident detected on April 13, 2026
2️⃣ Investigation launched with external advisors
3️⃣ No subsequent unauthorized activity observed
4️⃣ Significant costs expected to be covered by insurance

You can see the full details at the link above and if you sign up for a free account, you can not only see the full details of all incidents, governance, and regulatory action events tracked in the system but also receive email alerts on new events. https://www.board-cybersecurity.com/alerts

CareCloud, Inc. disclosed a material cybersecurity incident involving one of their electronic health record environments.

1️⃣ Incident occurred on March 16, 2026
2️⃣ Affected one of six electronic health record environments
3️⃣ Systems fully restored within ~8 hours; incident contained same day
4️⃣ Patient data may have been involved; assessment of access or exfiltration is ongoing

additional details here: https://www.board-cybersecurity.com/incidents/tracker/carecloud-cybersecurity-incident-b2e7eba5?utm_source=infosec.exchange&utm_medium=social&utm_campaign=incident_alerts&utm_content=carecloud-2026-03-16

you can sign up for a free account and incident alerts here: https://www.board-cybersecurity.com/alerts/upgrade?utm_source=infosec.exchange&utm_medium=social&utm_campaign=incident_alerts&utm_content=carecloud-2026-03-16

UFP Technologies disclosed a cybersecurity incident after detecting suspicious activity in its IT systems earlier this month. The company is investigating potential data access while reporting no material operational impact so far.

1️⃣ Suspicious activity detected on February 14, 2026
2️⃣ External cybersecurity advisors engaged for investigation
3️⃣ Possible unauthorized access and data exfiltration under review
4️⃣ Company reports no material financial or operational impact at this time

UFP Technologies, Inc. designs and manufactures custom-engineered components and packaging for medical devices and other highly regulated industries.
https://www.board-cybersecurity.com/incidents/tracker/20260224-ufp-technologies-inc-cybersecurity-incident/

Coupang provided a significant update, including a $1.2B in customer compensation program, on its previously disclosed cybersecurity incident.

1️⃣ The perpetrator has been identified, is cooperating with investigators, and surrendered all devices used in the incident
2️⃣ About 33 million accounts were accessed, but data from only ~3,000 accounts was saved and later deleted
3️⃣ No customer data was shared with third parties, based on the investigation to date
4️⃣ Coupang announced a customer compensation program worth approximately $1.2B in vouchers

Coupang, Inc. is a technology and commerce company operating retail e-commerce, restaurant delivery, video streaming, and fintech services.
https://www.board-cybersecurity.com/incidents/tracker/20251216-coupang-inc-cybersecurity-incident/#8-k-filed-on-2025-12-29

Coupang disclosed a cybersecurity incident involving unauthorized access to customer data, impacting up to 33 million accounts.

1️⃣ Incident disclosed in an SEC 8-K filed on December 16, 2025
2️⃣ Former employee allegedly accessed customer names, emails, phone numbers, and addresses
3️⃣ No payment, banking, or login credentials were compromised
4️⃣ Regulatory investigations are ongoing, with potential financial penalties

Coupang, Inc. is a technology and commerce company operating e-commerce, delivery, streaming, and fintech services, including Coupang, Coupang Eats, Coupang Play, and Farfetch.

https://www.board-cybersecurity.com/incidents/tracker/20251216-coupang-inc-cybersecurity-incident/

**Data Breach Alert** University of Phoenix just disclosed a data breach impacting SSN, DOB, bank account numbers, and contact info. Attackers exploited an Oracle EBS vulnerability. The company reports no operational impact and no evidence of public dissemination.

1️⃣ Data exfiltration occurred via an Oracle EBS vulnerability
2️⃣ Impacted data includes SSN, DOB, bank account numbers, and contact info
3️⃣ Incident was detected on 2025-11-21 and disclosed on 2025-12-02
4️⃣ Company reports no material impact on operations and ongoing review of affected data

The University of Phoenix is a private for-profit university offering open-enrollment accredited degree programs.

https://www.board-cybersecurity.com/incidents/tracker/20251202-phoenix-education-partners-inc-cybersecurity-incident/

Oncology Institute, Inc. reported a cybersecurity incident affecting a third-party software provider, causing a temporary disruption in billing operations. No evidence of patient data exposure has been identified.

1️⃣ Disclosed via SEC 8-K on Nov 6, 2025
2️⃣ Incident detected on Nov 3, 2025
3️⃣ Impact limited to delayed fee-for-service collections
4️⃣ No confirmed breach or data compromise

The Oncology Institute provides oncology care and clinical trial services for adult and senior cancer patients across the U.S.
https://www.board-cybersecurity.com/incidents/tracker/20251106-oncology-institute-inc-cybersecurity-incident/

BayFirst Financial Corp. disclosed a cybersecurity incident involving a third-party marketing vendor that exposed personal information of some customers. No misuse has been detected, and the incident is not expected to be material.

1️⃣ Incident tied to a third-party marketing provider
2️⃣ Data exposed: name, DOB, and SSN/tax ID
3️⃣ Law enforcement and cybersecurity experts engaged
4️⃣ No evidence of misuse or material impact so far

BayFirst Financial Corp. operates as the bank holding company for BayFirst National Bank, providing community banking, lending, and treasury services to small and medium-sized businesses and individuals in Florida.
https://www.board-cybersecurity.com/incidents/tracker/20251030-bayfirst-financial-corp-cybersecurity-incident/

Jewett-Cameron Trading Co. Ltd. reported a cyberattack involving unauthorized access and data exfiltration that disrupted parts of its operations. The company contained the incident and continues to investigate.

1️⃣ Attackers deployed encryption and monitoring software on corporate systems
2️⃣ Certain IT and financial data, including video screen captures, were stolen
3️⃣ Threat actors demanded payment to avoid public release of the data
4️⃣ No personal data exposure has been confirmed; recovery is ongoing

Jewett-Cameron Trading Co. Ltd. manufactures and distributes pet, fencing, and industrial wood products from its headquarters in North Plains, Oregon.

https://www.board-cybersecurity.com/incidents/tracker/20251021-jewett-cameron-trading-co-ltd-cybersecurity-incident/

F5 confirmed a sophisticated cyber intrusion by a nation-state actor, which accessed its BIG-IP product development systems and exfiltrated portions of source code and vulnerability data. The company says there’s no evidence of software supply chain tampering or critical vulnerability exploitation.

1️⃣ Nation-state actor maintained long-term access to F5 systems
2️⃣ Exfiltrated BIG-IP source code and internal vulnerability data
3️⃣ No evidence of supply chain or customer data compromise
4️⃣ Engaged CrowdStrike, Mandiant, NCC Group, and IOActive for response

F5, Inc. is a multi-cloud application services and security company specializing in application security, performance, and delivery.
https://www.board-cybersecurity.com/incidents/tracker/20251015-f5-inc-cybersecurity-incident/

One thing that has surprised me living on a high floor in downtown Chicago is the spiders! I think spiders are awesome, keeping those pesky insects at bay. They're also fascinating to watch. And ever since reading @aptshadow@mastodon.social "Children of Time" I've looked at spiders in a very different way. Go Portia!! 🕷️🕸️

Data I/O confirmed its ransomware incident and I noticed there were discrepancies in the costs disclosed: $388k in the official Item 1.05 but only $180k in Exhibit 99.0 which was a press release with a quote from the CEO. I inquired withe PR contact if this was just a typo and will share if I head back.

Overall, though, here's the summary:

1️⃣ Incident not targeted — traced to third-party firewall flaw
2️⃣ All systems restored, with no lost revenue reported
3️⃣ Q3 costs estimated at $388K (8-K) vs $180K (press release)
4️⃣ Company says IT and processes are now stronger

Data I/O Corporation designs and manufactures programming and automated device handling systems for flash, microcontroller, and logic devices.

https://www.board-cybersecurity.com/incidents/tracker/20250821-data-io-corp-cybersecurity-incident/#8-k-filed-on-2025-09-10

EVERTEC reported that its Brazilian subsidiary Sinqia discovered unauthorized access to systems connected to Brazil’s financial infrastructure, which handled R$710M (~$145M USD).
• 1️⃣ Incident detected on August 29 by Sinqia S.A., a Brazilian subsidiary
• 2️⃣ Systems tied to the Brazilian Central Bank were involved
• 3️⃣ Affected systems processed R$710M ($145M USD) in transactions
• 4️⃣ Authorities have been notified; breach limited to Brazilian operations

EVERTEC, Inc. provides transaction processing and financial technology services in Latin America, Puerto Rico, and the Caribbean.
https://www.board-cybersecurity.com/incidents/tracker/20250902-evertec-inc-cybersecurity-incident/