IoT and Stolen Cars: Thieves May Use Tech to Grab Your Ride

The 10 Most Stolen Vehicles in America in 2025

Vehicle theft declined in the United States in 2025, but several models remained frequent targets because of their popularity, availability, and persistent appeal to thieves (National Insurance Crime Bureau [NICB], 2025; Car and Driver, 2026). According to NICB data, the most stolen vehicle in America in 2025 was the Hyundai Elantra, followed by the Honda Accord and the Hyundai Sonata (NICB, 2025; Car and Driver, 2026).
Ranked Vehicles 

 

The 10 most stolen vehicles in America in 2025 were the following:

• Hyundai Elantra (21,732)
• Honda Accord (17,797)
• Hyundai Sonata (17,687)
• Chevrolet Silverado 1500 (16,764)Honda Civic (12,725)
• Kia Optima (11,521)
• Ford F-150 (10,102)
• Toyota Camry (9,833)
• Honda CR-V (9,809)
• Nissan Altima (8,445)

 

Theft Trends

NICB reported that U.S. vehicle thefts experienced a decline in 2025, yet the same report still identified specific models that were stolen far more often than others. NICB specifically stated that the Hyundai Elantra remained the most stolen vehicle model in 2025 with 21,732 thefts, followed by the Honda Accord with 17,797 thefts and the Hyundai Sonata with 17,687 thefts (NICB, 2025).

Car and Driver’s report on the NICB figures confirms the same ranking and shows that the list included a mix of sedans, pickups, and one SUV, suggesting that theft risk in 2025 was not limited to one body style or market segment (Car and Driver, 2026). The presence of the Chevrolet Silverado 1500 and Ford F-150 on the same list as the Honda Civic, Toyota Camry, and Nissan Altima shows that both high-volume passenger cars and high-demand trucks remained attractive targets (Car and Driver, 2026). 

Internet of Things

Modern connected vehicles increasingly function like Internet of Things systems because they rely on wireless connectivity, cloud services, software-driven features, and communication between in-vehicle components and outside networks (Trend Micro, 2021). Trend Micro explains that connected cars use technologies such as 5G, cloud-connected applications, over-the-air updates, and vehicle-to-network communication, all of which expand what vehicles can do while also increasing cybersecurity exposure (Trend Micro, 2021).

Trend Micro also notes that the modern connected car is becoming similar to a “smartphone-on-wheels,” with applications communicating through middleware, gateway electronic control units, and cloud services. These systems can introduce risks such as denial-of-service attacks, man-in-the-middle attacks, hijacking of services, data privacy issues, authentication and management issues, incorrect data, and misconfiguration problems (Trend Micro, 2021). As the costs and resale values for car computers, collision avoidance systems, and other tech devices increase, thieves now also disassemble vehicles to steal those items.

Radio frequency interception and transmission devices are sometimes used to capture the codes transmitted by key fobs on some vehicles. The codes are then used to reprogram devices that the thieves emply to unlock, start, and steal a vehicle. 

This means connected technology can create additional pathways that thieves or cybercriminals may try to exploit. If remote services, app connections, or cloud-linked vehicle functions are not properly secured, the same connectivity designed for convenience may also increase opportunities for unauthorized access or interference (Trend Micro, 2021). 

Prevention Methods

NICB advises vehicle owners to use layered theft-prevention practices rather than relying on a single measure. Its prevention guidance recommends removing keys or fobs from the vehicle, locking doors and windows, parking in well-lit areas, and using anti-theft technology such as steering wheel locks, audible alarms, and aftermarket tracking devices (NICB, n.d.).

These recommendations support the use of steering wheel locking devices, alarm systems, and location-tracking tools as practical deterrents. They also fit well with additional protective measures such as ignition kill switches or fuel-system shutoff devices, which are commonly used to make a stolen vehicle harder to start or move, although the verified NICB source specifically highlights locks, alarms, and tracking devices rather than detailing those other devices individually (NICB, n.d.).

For connected vehicles, owners must  recognize that digital security matters alongside physical security. Because connected cars increasingly depend on cloud services, APIs, and networked vehicle systems, keeping manufacturer software current and treating app-based vehicle access cautiously are sensible precautions consistent with the risks described by Trend Micro (Trend Micro, 2021). 

References

Car and Driver. (2026, March 23). What cars were stolen most last year? The top 10 may surprise you. https://www.caranddriver.com/news/a70833130/top-10-most-stolen-cars-2025/

National Insurance Crime Bureau. (2025). U.S. vehicle thefts experience historic decline. https://www.nicb.org/news/news-releases/us-vehicle-thefts-experience-historic-decline

National Insurance Crime Bureau. (n.d.). Prevent vehicle theft. https://www.nicb.org/prevent-vehicle-theft

Trend Micro. (2021, February 15). Connected cars, 5G, the cloud: Opportunities and risks. https://www.trendmicro.com/en_us/research/21/b/connected-cars-5g-the-cloud-opportunities-and-risks.html

Technology in Public Administration and Justice Studies

OECD: ‘institutional incoherence’ undermining digital ambitions

The Organisation for Economic Co-operation and Development (OECD) Digital Government Outlook report finds that governments have made progress in building digital capabilities, but a gap remains between ambition and actual performance. The core issue is “institutional incoherence,” meaning digital initiatives exist but are not well connected, coordinated, or reinforced across government systems.

The Five Key Challenges

The report highlights five challenges that explain why progress stalls:

• Data systems that cannot be shared: Weak data foundations and poor interoperability prevent effective data reuse across agencies.
• Infrastructure that is built but not adopted: Governments invest in digital platforms that are underused due to fragmentation or lack of integration.
• Investments that are approved but not evaluated: Funding decisions are made, but follow-through, performance tracking, and adaptability are weak.
• AI that is deployed but not governed: AI adoption is widespread, but governance (risk assessment, audits, oversight) is inconsistent and underdeveloped.
• Services that are designed but not connected: Digital services exist but are not integrated into seamless, user-centered systems.

A common thread across all five is lack of coordination—individual components exist, but they do not work together effectively.

Other Important Findings

• Data strategy gaps: While 94% of countries have data strategies, many function as policy statements rather than operational tools. Data quality and long-term, cross-border planning remain weak.
• AI governance imbalance: Governments often have “guardrails” (rules) but lack “enablers” (tools and infrastructure), which slows innovation and adoption in high-impact areas like policymaking.
• Digital identity unevenness: Most countries have governance structures, but adoption and integration vary widely. Trust, usability, and inclusion remain barriers.
• Skills shortage: Only 17% of countries have a dedicated digital skills strategy for public servants, limiting the ability to execute digital transformation.
• Investment rigidity: Governments struggle with inflexible funding, weak evaluation mechanisms, and procurement systems not suited to modern digital development.

Bottom Line

The OECD’s central message is that digital transformation is no longer about building new tools—it is about making systems work together coherently. Without this alignment, even well-funded and well-designed initiatives will underperform.

Implications

For justice systems and public administration, these findings carry particular weight. Fragmented data, disconnected services, and weak interoperability can directly affect access to justice, case management, law enforcement, and public trust. Digital transformation in these sectors must prioritize integration, accountability, and user-centered design—not just technology deployment.

Reference

Aldane, Jack. (6, June 2026). OECD: ‘institutional incoherence’ undermining digital ambitions https://www.globalgovernmentforum.com/oecd-warns-institutional-incoherence-undermining-members-digital-ambitions/

Infographic by Perplexity AI
 

IoT: Cyberthreats to Automatic Tank Gauge (ATG) Systems

Automatic tank gauge (ATG) systems are a cybersecurity concern because they are often internet-connected industrial control systems that monitor fuel storage, leak detection, and tank inventory at gas stations and other critical facilities (BitSight, 2024; Dutch Institute for Vulnerability Disclosure [DIVD], 2025). Reporting in 2026 indicates that attackers have actively targeted exposed ATG systems in the United States, reinforcing long-standing warnings from researchers that these devices can be manipulated when they are placed online without adequate access controls (Energy Marketers of America, 2026; In Food & Fuel, 2026).

What is an Automatic Tank Gauge (ATG)?

An automatic tank gauge is an electronic monitoring system used to measure fuel levels, detect leaks, and support inventory management in underground or aboveground fuel storage systems (U.S. Environmental Protection Agency [EPA], n.d.; DIVD, 2025). In practice, ATGs help operators track tank conditions and support release detection obligations that are part of underground storage tank compliance and environmental protection programs (EPA, n.d.).

Who Controls ATGs?

ATGs are generally controlled by the owners and operators of fuel storage systems, such as gas stations, convenience stores, fuel distributors, and operators of facilities that store petroleum or hazardous substances (EPA, n.d.). State, territorial, tribal, and federal regulators do not typically operate the devices directly, but they regulate the broader underground storage tank environment and compliance expectations surrounding release detection and environmental protection (EPA, n.d.). Vendors, service contractors, and remote monitoring providers may also play a role when they install, configure, maintain, or remotely access the systems (DIVD, 2025; Veeder-Root, 2024).

How Many ATGs Are There in the United States?

A precise national count of ATG devices in the United States is uncertain. The EPA states that approximately 542,000 underground storage tanks nationwide store petroleum or hazardous substances, but that figure refers to tanks rather than ATG units, and one facility may have multiple tanks while not every tank count translates directly into a one-to-one ATG count (EPA, n.d.). The closest verifiable contextual figure is the EPA’s estimate of approximately 542,000 underground storage tanks in the United States (EPA, n.d.).

What Are the Vulnerabilities of ATGs?

The clearest recurring vulnerability is direct exposure of ATG interfaces to the public internet without proper authentication or network isolation (DIVD, 2025; BitSight, 2024). DIVD reported that exposed systems from multiple manufacturers, especially certain Veeder-Root models, could be accessed through serial interfaces commonly reachable on TCP port 10001, allowing unauthorized parties to view fuel levels, change tank labels, alter alarm thresholds, and modify monitoring parameters (DIVD, 2025). BitSight reported multiple critical vulnerabilities across six ATG systems from five vendors and warned that internet-exposed ATGs remain attractive targets for sabotage and cyberwarfare scenarios (BitSight, 2024).

Other weaknesses include poor password practices, insecure remote connectivity, weak segmentation between operational technology and business networks, and overreliance on remote polling designs that require open network paths into the ATG environment (DIVD, 2025; PAS, 2025). Veeder-Root’s guidance also emphasizes controls such as firewalls, access restrictions, and secure remote connectivity, which indirectly confirms that misconfiguration and unnecessary exposure are central risk factors (Veeder-Root, 2024).

What Are the Threats to ATGs?

The threat landscape includes unauthorized access, reconnaissance, tampering, denial-of-service activity, and operational disruption (DIVD, 2025). Researchers and industry alerts have described attackers changing passwords, modifying system information, deleting data, and interfering with remote access and fuel operations when gauges are exposed online (In Food & Fuel, 2026; DIVD, 2025). In addition to opportunistic criminal exploitation, researchers have warned that ATGs could be targeted in sabotage or cyberwarfare contexts because they are part of the fuel distribution ecosystem and are present at critical facilities beyond retail gas stations (BitSight, 2024; DIVD, 2025).

What Harm Could Come from a Cyberattack on an ATG?

Potential harm from an ATG cyberattack includes environmental damage, operational shutdowns, business interruption, false inventory readings, disabled alarms, and impaired leak detection (BitSight, 2024; DIVD, 2025). BitSight reported that attackers may be able to change critical parameters such as tank geometry and capacity, disable alarms, and interfere with automatic or manual responses, creating the possibility of fuel leaks, safety incidents, and economic losses (BitSight, 2024). Industry reporting in 2026 also described incidents in which stations could not pump gas until affected devices were reset or restored, showing that even attacks short of physical damage can disrupt daily commerce and fuel availability (In Food & Fuel, 2026).

Who Would Want to Threaten an ATG and Why?

Several categories of adversaries could have an interest in ATG systems. Cybercriminals may target them for disruption, extortion, vandalism, or opportunistic exploitation of poorly secured systems (DIVD, 2025; In Food & Fuel, 2026). Nation-state or state-aligned actors may view ATGs as a soft target within critical infrastructure, particularly because fuel distribution has economic and public safety significance and ATGs are often locally managed rather than defended through a uniform national architecture (BitSight, 2024; CNN, 2026). Hacktivists or malicious insiders could also target ATGs to cause embarrassment, interrupt fuel sales, or manipulate records and alarms for ideological, retaliatory, or personal reasons, although specific motive patterns vary by incident and are not always publicly confirmed (DIVD, 2025).

What Are the Recent Reports of Attacks on ATGs?

Industry and media reporting from 2026 indicates that attacks against ATGs were not merely theoretical. Energy Marketers of America circulated a cybersecurity advisory in April 2026 stating that known cyberattacks were targeting ATGs in Tennessee and that cybercriminals were targeting systems nationwide, including at least 15 affected tanks at one convenience store chain (Energy Marketers of America, 2026). In Food & Fuel reported that the Utah Department of Public Safety had identified 76 vulnerable ATGs in Utah and more than 4,000 across the United States, while also describing confirmed incidents involving unauthorized access to tank and sensor data, false alarms, and deletion of system information (In Food & Fuel, 2026).

Mainstream reporting also linked the 2026 campaign to suspected Iranian actors. CNN reported that U.S. officials believed Iranian hackers had breached fuel tank monitoring systems at gas stations across multiple states by accessing internet-connected ATGs that lacked password protection (Bertrand et al., 2026). Because attribution in fast-moving cyber incidents can evolve, that point should be treated as a reported government assessment rather than a final judicial finding (Bertrand et al., 2026).

What Measures Should Be in Place to Protect ATGs?

The strongest protective measure is to avoid exposing ATGs directly to the public internet (DIVD, 2025; Veeder-Root, 2024). Recommendations include placing ATGs behind properly configured firewalls, using VPN gateways or dedicated hardware interfaces for remote connectivity, applying source IP filtering, and setting passwords on serial ports where the feature is supported (DIVD, 2025; Veeder-Root, 2024). Operators should also audit their network configurations regularly to identify exposed systems, restrict third-party remote access to only what is necessary, and separate ATG environments from broader corporate or payment networks (DIVD, 2025; PAS, 2025).

Additional protective measures include maintaining documented incident response procedures, validating alarm and leak-detection settings, coordinating with qualified service vendors, and promptly applying vendor guidance or security updates when available (DIVD, 2025; Veeder-Root, 2024). Because some ATG risk stems from insecure deployment rather than a single patchable flaw, sound architecture, restricted connectivity, and administrative discipline remain as important as software maintenance (DIVD, 2025).

References

Bertrand, N., Lillis, K. B., & Marquardt, A. (2026, May 15). Iranian hackers have breached fuel tank readers at gas stations across multiple U.S. states, sources say. CNN. https://www.cnn.com/2026/05/15/politics/iran-hackers-tank-readers-gas-stations

BitSight. (2024, September 23). Critical vulnerabilities discovered in automated tank gauge systems. https://www.bitsight.com/blog/critical-vulnerabilities-discovered-automated-tank-gauge-systems

Dutch Institute for Vulnerability Disclosure. (2025, August 25). DIVD-2025-00005 - Exposed automated tank gauge systems. https://csirt.divd.nl/cases/DIVD-2025-00005/

Energy Marketers of America. (2026, April 13). Urgent cybersecurity advisory: Nationwide cyberattacks targeting automatic tank gauges (ATGs). https://www.fueliowa.com/latest-news.cfm/Article/INDUSTRY-NEWS/Urgent-Cybersecurity-Advisory-Nationwide-Cyberattacks-Targeting-Automatic-Tank-Gauges-ATGs/2026-4-14

In Food & Fuel. (2026, April 23). Cybersecurity alert: Automatic tank gauge systems targeted. https://www.infoodandfuel.org/news/cybersecurity-alert-automatic-tank-gauge-systems-targeted

PAS. (2025, April 24). Securing your Veeder-Root ATG: Protecting against vulnerabilities in remote connectivity. https://passtesting.com/news/securing-your-veeder-root-atg-protecting-against-vulnerabilities-in-remote-connectivity

Perplexity AI. (2026). Perplexity AI [Large language model]. https://www.perplexity.ai/

U.S. Environmental Protection Agency. (n.d.). Underground storage tanks (USTs). https://www.epa.gov/ust

Veeder-Root. (2024, August 14). Ensuring automatic tank gauge security compliance. https://www.veeder.com/us/ensuring-automatic-tank-gauge-security-compliance

AI Use Statement

Perplexity AI was employed in the research and development of this information. 

=-=-=-=-=-=

Video: https://youtu.be/HbBIadarg60

AI: Anthropic’s Mythos Release: Apocalypse Delayed...for now

April, 2026

Anthropic announced that it will delay widespread release of its newest AI system, Claude Mythos Preview, and instead provide restricted access to a small group of large technology and cybersecurity firms. This model has reportedly identified thousands of high‑severity software vulnerabilities, including flaws across nearly every major operating system and web browser, most of which remain unpatched (Anthropic).

Anthropic argues that making such a system widely available could enable cybercriminals or nation‑state actors to rapidly discover and weaponize zero‑day vulnerabilities at unprecedented scale. In response, the company is granting access primarily to major corporations that “build or maintain critical software infrastructure,” including partners like Microsoft, Google, Amazon Web Services, Apple, and leading cybersecurity vendors through an initiative called Project Glasswing (Underwood).

From an ethical and policy perspective, this move highlights tensions between open access, security, and market power. Concentrating such capabilities in the hands of large corporations may help coordinate patching efforts and reduce immediate exploitation risk, but it also reinforces existing power imbalances in who can benefit from frontier AI systems. At the same time, Anthropic frames its decision as an application of “defensive acceleration,” delaying a general‑purpose release until critical systems can be hardened against attacks enabled by models like Mythos. For practitioners in cybersecurity and digital forensics, this situation underscores the need to treat AI as both a vital defensive tool and a significant emerging threat (Politico).

Concrete Steps for Individual Users

For a typical end user, the biggest risk is being caught on outdated, poorly secured systems as automated exploitation ramps up. Focus on resilience:

1. Keep systems up to date

• Turn on automatic updates for your OS, browsers, and major applications; Mythos‑class tools have already found vulnerabilities in ALL major platforms, and patches will roll out continuously.
• Replace abandoned or end‑of‑life software and plugins, because “long‑forgotten” code is exactly where these models are finding exploitable flaws.

2. Harden your accounts

• Enable phishing‑resistant MFA (security keys or app‑based codes) on email, password managers, banking, and social media; automated exploitation makes credential theft more valuable.
• Use a reputable password manager and unique passwords, as Mythos‑class models reduce the cost of credential‑stuffing and brute‑force attacks.

3. Reduce your attack surface

• Uninstall software you don’t use, disable browser extensions you don’t recognize, and turn off remote‑access features you don’t actively need.
• Be more conservative about side‑loading apps, running untrusted macros, or using pirated software, since automated exploit discovery makes obscure attack chains more viable.

4. Improve detection and recovery readiness

• Make regular offline or cloud backups of critical data so you can recover from ransomware or destructive attacks, which AI‑assisted adversaries are expected to scale up.
• Turn on built‑in security features (SmartScreen, Gatekeeper, reputable AV/EDR) and review security alerts instead of ignoring them.

5. Be skeptical of AI‑mediated content

• Expect more convincing spear‑phishing, deepfakes, and social‑engineering that leverage advanced models; treat unexpected “urgent” messages, even if well‑written and personalized, as suspect.
• Verify high‑stakes requests (wire transfers, password resets, disclosures of sensitive info) through an independent channel such as a phone call.

Small Organizations

Even small organizations are implicated by the shift Anthropic and others are describing.

• Inventory and patch: Maintain a living asset list (servers, endpoints, SaaS) and tighten patch SLAs, because Mythos‑class tools can find and exploit issues in hours, not months.
• Third‑party risk: Re‑scope vendor questionnaires and contracts so “reasonable” patch timelines reflect AI‑accelerated discovery, not legacy cadence.
• AI governance: Document how you’ll handle adversaries using AI against your own AI deployments (chatbots, internal copilots, etc.), which commentators note is now a realistic threat model.

---

AI Use Statement

Perplexity AI was employed in the research and development of this work.

---

References

Anthropic. (2026, April 7). Claude Mythos Preview (red‑team report). https://red.anthropic.com/2026/mythos-preview/ red.anthropic

Perplexity AI. (2026). *Perplexity AI (GPT‑5.1) Large language model]*. https://www.perplexity.ai 

Politico. (2026, April 9). Anthropic’s AI sparks concerns over a new national security risk. https://www.politico.com/newsletters/digital-future-daily/2026/04/09/anthropics-ai-sparks-concerns-over-a-new-national-security-risk-00865901

The Peak. (2026, April 8). Anthropic is afraid to release its new model. https://www.readthepeak.com/p/anthropic-is-afraid-to-release-its-new-model readthepeak 

Tom’s Hardware. (2026, April 6). Anthropic’s latest AI model identifies ‘thousands of zero-day vulnerabilities’ in ‘every major operating system and every major web browser’. https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropics-latest-ai-model-identifies-thousands-of-zero-day-vulnerabilities-in-every-major-operating-system-and-every-major-web-browser-claude-mythos-preview-sparks-race-to-fix-critical-bugs-some-unpatched-for-decades

Underwood, T. (2026, April 7). Why Anthropic believes its latest model is too dangerous to release. Understanding AI. https://www.understandingai.org/p/why-anthropic-believes-its-latest understandingai

Cyber Threats: Warnings and Prevention

Recent announcements issued from the the Internet Crime Complaint Center (IC3) highlight several cyber‑threat vectors: Phishing‑driven compromise of commercial messaging app (CMA) accounts and the use of residential proxies to turn ordinary consumer devices into tools for criminal activity. For users, these advisories underscore that cyber hygiene and vigilance remain the most effective defenses. Below is a summary of the major warnings and recommended preventative measures.

Russian‑linked phishing against messaging apps

Federal agencies warn that actors associated with Russian intelligence services are exploiting commercial messaging applications—particularly Signal and similar end‑to‑end encrypted platforms—to gain access to private communications. These campaigns do not break encryption itself; instead, they rely on phishing and social engineering to trick users into granting unauthorized access to their accounts.

Key warnings:

• Phishing messages masquerading as official CMA support accounts can compromise an account if users provide verification codes, PINs, or click malicious links.
• Once an account is taken, attackers can read messages, contact lists, and send deceptive messages to the victim’s contacts, amplifying the attack across trusted networks.
• Even “legitimate‑looking” support messages sent inside the app may be fraudulent; genuine CMA support will not demand codes or PINs via chat.

Preventative measures:

• If it feels off, hit pause. Do not share PINs, two‑factor authentication (2FA) codes, or passwords for any action you did not initiate, and terminate interaction with suspicious messages.
• Treat unknown or odd messages as potential phishing. If a contact—known or unknown—asks for codes, clicks a link, or behaves unusually, block and report the message, and verify the request through a separate communication channel.
• Scrutinize links and files. Never click on suspicious links or open unexpected attachments; doing so can install malware or enable device‑level account takeover.
• Verify group‑chat participants. Periodically check group‑chat member lists for duplicates or suspicious accounts and confirm authenticity with contacts by a different secure method.
• Use built‑in security features. Enable features such as message expiration and device‑verification controls, and follow organizational records‑retention and legal requirements when doing so.
• Interact with official support carefully. Always contact CMA support through verified email or official websites, not through in‑app links or unsolicited chat messages.
• Report incidents promptly. Notify your organization’s security/IT team, and file a complaint with IC3 or your local FBI Field Office if you suspect you have been targeted.

Law Enforcement "Operation Lightning": Disruption of ‘SocksEscort’

A multinational law enforcement action known as Operation Lightning, coordinated by Europol, marks a major step in the global fight against cybercrime. 

Conducted in March 2026, the operation targeted the criminal proxy service ‘SocksEscort’, which exploited vulnerabilities in over 369,000 routers and Internet of Things (IoT) devices across 163 countries. These compromised devices were turned into a vast botnet used for ransomware attacks, distributed denial-of-service (DDoS) campaigns, and even the dissemination of child sexual abuse material—activities made possible by masking perpetrators’ true IP addresses.

During the operation, authorities seized 34 domains and 23 servers, located across seven countries, and froze approximately USD 3.5 million in cryptocurrency linked to the operation. Europol, working with agencies from Austria, France, the Netherlands, the United States, and Eurojust, coordinated data analysis, crypto tracing, and network forensics through its Virtual Command Post in The Hague.

The takedown of SocksEscort demonstrates how international cooperation and information sharing are important in combating cyber threats that exploit global digital infrastructure.

As Europol’s executive director emphasized, cybercrime networks thrive on anonymity—dismantling the systems that enable this anonymity significantly disrupts malicious activity worldwide. Moreover, the operation underscores the need for proactive cybersecurity measures, such as regular firmware updates and vendor accountability, to prevent devices from being co-opted into criminal networks.

This case serves as an example of how aligned strategic operations, backed by Europol’s intelligence capabilities and EMPACT’s collaborative framework, can effectively dismantle complex, borderless cybercriminal infrastructures.

Cybersecurity: What is the Budapest Convention?

Bringing Nations together on Cybercrime issues.

___________________________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo 

___________________________________________

Cybersecurity: US Department of Treasury Data Breached

Security Incident Overview

The US Department of Treasury experienced a major cybersecurity incident involving unauthorized access through a third-party service provider, BeyondTrust, on December 8, 2024[1]. A China state-sponsored Advanced Persistent Threat (APT) actor gained access to a security key used for cloud-based technical support services[1].

Incident Impact and Response

Breach Details
The threat actor successfully:

• Obtained access to a security key for BeyondTrust's cloud service
• Overrode service security measures
• Accessed Treasury Departmental Offices (DO) user workstations
• Retrieved certain unclassified documents[1]

Response Measures
The Treasury engaged multiple agencies and resources in response:

• Cybersecurity and Infrastructure Security Agency (CISA)
• Federal Bureau of Investigation (FBI)
• Intelligence Community
• Third-party forensic investigators[1]

BeyondTrust Service

BeyondTrust operated as a third-party software service provider offering cloud-based technical support for Treasury DO end users. Following the incident, the compromised service was taken offline[1]. The Treasury confirmed no evidence of continued unauthorized access to Treasury information[1].

APT Incidents and Treasury Policy

Classification
The Treasury classifies any intrusion attributable to an APT as a major cybersecurity incident, requiring specific reporting and response protocols[1].

Preventive Measures
The Treasury has implemented several protective measures:

• Investments through the Cybersecurity Enhancement Account (CEA)
• Enhanced incident response processes
• Comprehensive logging systems
• Immediate engagement with security agencies[1]

Regulatory Compliance

The incident triggered reporting requirements under:

• Federal Information Security Modernization Act of 2014 (FISMA).
• • The Treasury Department was required to notify the Committee on Banking, Housing and Urban Affairs of the situation.
• OMB Memorandum 24-04
• Treasury policy guidelines[1]

A future supplemental 30-day report will provide additional details about the incident as required by FISMA and OMB guidance[1].

Citations:
[1] https://pplx-res.cloudinary.com/image/upload/v1735767931/user_uploads/urLJfwaVDptrnxW/Screenshot-2025-01-01-at-11.31.11.jpg

 

Cybersecurity: Fake Reviews & the FTC Response - Hope for the Consumer

Dr. Frank Kardasz (Ed.D.) Editor Ava Gozo

The prevalence of fake reviews in online marketplaces is a significant issue, affecting consumers and businesses. Fabricated reviews distort consumer perceptions, leading to poor purchasing decisions and undermining trust in online platforms. Research indicates that around 30% of online reviews are fake, with platforms like Amazon experiencing even higher rates, where about 43% of reviews on top products are fabricated. The financial impact is substantial, with fake reviews estimated to cost U.S. businesses nearly $152 billion annually. Fake reviews are a form of fraud. In response, the Federal Trade Commission (FTC) introduced rules to combat fake reviews and deceptive marketing practices, aiming to protect consumers and ensure fair competition.

The Problem of Fake Reviews

Fake reviews are not isolated incidents but rather a sophisticated attempt to manipulate consumer behavior and market competition. They can lead consumers to choose lower-quality products, as demonstrated in studies where fake positive reviews influenced consumer choices towards inferior products. The trust in online reviews is crucial for consumer decision-making, with 93% of consumers stating that online reviews impact their purchasing decisions. The manipulation of reviews, whether through creating fake positive reviews or suppressing negative ones, undermines the credibility of online review systems and can damage the reputation of honest businesses.

FTC's Response to Fake Reviews

In light of the problem, the FTC introduced a rule aimed at eliminating these deceptive practices. The rule focuses on several key areas:

• Prohibition of Fake Reviews and Testimonials: The rule bans the creation, sale, and purchase of fake consumer reviews and testimonials, including those generated by AI or other deceptive means.
• Incentivized Reviews: Businesses are forbidden from offering compensation or incentives for reviews that express a specific sentiment, whether positive or negative. This includes both explicit and implicit offers of incentives.
• Insider Reviews: The rule prohibits company insiders, such as employees or managers, from writing reviews without clear disclosure of their connection to the business. It also restricts businesses from disseminating such reviews if they knew or should have known about the insider connection.
• Misleading Review Websites: Companies are barred from misrepresenting that a website they control provides independent reviews, ensuring transparency and honesty in how reviews are presented to consumers.
• Review Suppression: The rule outlaws the use of legal threats or intimidation to suppress negative reviews. Businesses cannot misrepresent the completeness of reviews displayed on their platforms.
• Social Media Influence Manipulation: The FTC prohibits the sale or purchase of fake social media indicators, such as followers or likes, when these are used to misrepresent influence for commercial purposes.

Penalties for Non-Compliance

The FTC has established penalties for businesses that fail to comply with the new rule:

• Monetary Fines: The FTC can seek civil penalties of up to $52,000 per violation for businesses found in violation of the rule. This penalty applies to each instance of a prohibited action, such as creating, selling, or buying fake reviews and testimonials.
• Scope of Violations: The penalties apply to various deceptive practices, including the use of AI-generated fake reviews, insider reviews without proper disclosure, and the buying or selling of fake social media indicators like followers or likes.
• Court Discretion: While the maximum penalty is set at $52,000 per violation, courts have the discretion to impose lower penalties depending on the circumstances of each case.

Conclusion

The FTC's rule against fake reviews represents an effort to clean up the digital marketplace. The rule aims to foster an improved environment for businesses and an attempt to protect consumers. This regulation is set to take effect 60 days after its publication in the Federal Register, marking an enhancement in the FTC's enforcement capabilities. As fake reviews continue to be a significant problem across various platforms, the need for continued vigilance and stricter enforcement measures remains critical. It remains to be seen whether or not the new rules can be effectively enforced to slow the proliferation of fake reviews.

References

Akesson, J. (November, 2023). National Bureau of Economic Research. (n.d.). https://www.nber.org/papers/w31836

Entrepreneur. (July, 2023). FTC proposes rule to protect consumers from fake reviews. Retrieved from https://www.entrepreneur.com/business-news/ftc-proposes-rule-to-protect-consumers-from-fake-reviews/455215

Exploding Topics. (December, 2023). Online review stats. https://explodingtopics.com/blog/online-review-stats

Federal Trade Commission. (2024, August). Federal Trade Commission announces final rule banning fake reviews and testimonials. FTC. https://www.ftc.gov/news-events/news/press-releases/2024/08/federal-trade-commission-announces-final-rule-banning-fake-reviews-testimonials 

InvespCRO. (May, 2023). Fake reviews statistics. https://www.invespcro.com/blog/fake-reviews-statistics/

Sahut, J. (March, 2024). ScienceDirect. https://www.sciencedirect.com/science/article/abs/pii/S0148296324000766

Song, Y. (September, 2023). ScienceDirect. https://www.sciencedirect.com/science/article/abs/pii/S0148296323003296

WiserNotify. (n.d). Fake review stats. https://wisernotify.com/blog/fake-review-stats/

___________________________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo 

Cybersecurity: Privacy Nightmare - National Public Data Hacked

 

Editor: Ava Gozo. August 15, 2024.

A massive data breach allegedly occurred at National Public Data, a company that provides background checks and public records data. Here are the key details:

The Breach

National Public Data reportedly suffered a data breach that exposed the personal information of approximately 2.9 billion people[1][2]. The breach is believed to have occurred in late December 2023, with potential data leaks in April 2024 and summer 2024[2].

Stolen Information

The compromised data allegedly includes:

• Full names
• Email addresses
• Phone numbers
• Social Security numbers
• Mailing addresses[2]

Hacking Group Involvement

A hacking group known as USDoD claimed responsibility for the breach. They allegedly offered the stolen database, which is about 4 terabytes in size, for sale on the dark web for $3.5 million[3][4].

Timeline & Discovery

• April 2024: The hackers reportedly posted the database on a dark web forum for sale[4].
• July 2024: Some individuals learned their data was compromised through identity theft protection services[3].
• August 2024: The breach gained widespread media attention, and a class-action lawsuit was filed in Florida[3][4].

National Public Data's Response

National Public Data acknowledged the incident on its website, stating they are cooperating with law enforcement and governmental investigators. They have implemented additional security measures to prevent future breaches[2].

Uncertainty Surrounding the Breach

As of mid-August 2024, there was still some uncertainty about the full extent and details of the breach. Some experts expressed caution about the reported scale of the incident, citing technical difficulties in exfiltrating such a massive amount of data undetected[4].

Recommended Actions

If you believe your data may have been compromised:

1. Monitor your financial accounts closely.
2. Contact the three major U.S. credit reporting agencies for free credit reports.
3. Consider freezing your credit.
4. Stay vigilant for potential phishing attempts.
5. Change passwords for sensitive accounts.
6. Consider signing up for identity theft protection services[2][3].

As the situation continues to develop, it's advisable to stay informed about any updates or official communications from National Public Data regarding the breach.

References

USA Today. (2024, August 15). 2.9 billion records stolen in Social Security data hack, USDoD claims. https://www.usatoday.com/story/tech/2024/08/15/social-security-hack-national-public-data-breach/74807903007/ Pocono Record. (2024, August 14). What to do if your data was leaked in the 

National Public Data leak. https://www.poconorecord.com/story/news/2024/08/14/what-to-do-if-your-data-was-leaked-in-the-national-public-data-leak/74796229007/  

News4Jax. (2024, August 15). Billions of people possibly compromised after National Public Data breach. https://www.news4jax.com/news/local/2024/08/15/billions-of-people-possibly-compromised-after-national-public-data-breach/  

SecurityWeek. (n.d.). Unconfirmed hack of 2.9 billion records at National Public Data sparks media frenzy amid lawsuits. https://www.securityweek.com/unconfirmed-hack-of-2-9-billion-records-at-national-public-data-sparks-media-frenzy-amid-lawsuits/  

YouTube. (n.d.). [Video]. https://www.youtube.com/watch?v=C6-qEt3KOFs 

Citations 

[1] https://www.usatoday.com/story/tech/2024/08/15/social-security-hack-national-public-data-breach/74807903007/
[2] https://www.poconorecord.com/story/news/2024/08/14/what-to-do-if-your-data-was-leaked-in-the-national-public-data-leak/74796229007/
[3] https://www.news4jax.com/news/local/2024/08/15/billions-of-people-possibly-compromised-after-national-public-data-breach/
[4] https://www.securityweek.com/unconfirmed-hack-of-2-9-billion-records-at-national-public-data-sparks-media-frenzy-amid-lawsuits/
[5] https://www.youtube.com/watch?v=C6-qEt3KOFs

___________________________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo 

Cybersecurity: "Evil Twin" Wi-Fi on Australian Airplane

Evil Twin on an Aircraft

Dr. Frank Kardasz, July 1, 2024 

Editor: Ava Gozo. 

The link leads to a report of a cybersecurity incident on an Australian flight, highlighting the growing threat of "evil twin" Wi-Fi attacks, emphasizing the need for heightened vigilance when connecting to public networks.

In this case, a man allegedly created a fake Wi-Fi hotspot on a commercial flight mimicking legitimate the airline network to harvest passengers' credentials for email and social media services.

The suspect was apprehended with a portable wireless access device, laptop, and mobile phone in his hand luggage. Further investigation led to the discovery of similar activities at locations linked to his previous employment.

This incident serves as a  reminder of the vulnerabilities associated with public Wi-Fi networks and the sophisticated methods cybercriminals employ to exploit unsuspecting users.

Prevention

To protect yourself against fake internet access points and similar threats, consider the following tips:

1. Be wary of free Wi-Fi: Legitimate free Wi-Fi services typically don't require login through email or social media accounts. If prompted for such credentials, exercise caution.

2. Use a VPN: Install a reputable virtual private network (VPN) on your devices to encrypt and secure your data when using public networks[1].

3. Disable file sharing: Turn off file sharing features on your device when connected to public networks to prevent unauthorized access to your files.

4. Avoid sensitive activities: Refrain from accessing sensitive applications, such as banking or financial services, while using public Wi-Fi networks.

5. Forget network connections: Manually forget network connections after use to prevent your device from automatically reconnecting to potentially malicious networks.

6. Verify network names: Double-check the exact name of the official Wi-Fi network with the service provider to avoid connecting to similarly named, but fake, access points.

7. Enable two-factor authentication: Implement this additional security measure on your accounts to provide an extra layer of protection even if your credentials are compromised.

8. Keep software updated: Regularly update your device's operating system and applications to ensure you have the latest security patches.

9. Use HTTPS: When browsing, ensure websites use HTTPS encryption, especially when entering sensitive information.

10. Consider using cellular data: If available, use your mobile data connection instead of public Wi-Fi for sensitive tasks.

Remember, your digital security is ultimately in your hands, and a proactive approach is the best defense against evolving cyber threats.

Reference

Sharwood, S. (2024, July 1). The Register. (2024, July 1). Police allege 'evil twin' of in-flight Wi-Fi used to steal passenger's credentials. https://www.theregister.com/2024/07/01/australia_evil_twin_wifi_airline_attack/

 ___________________________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo 

Cybersecurity: The Ascension Hospitals Ransomware Attacks

Editor: Ava Gozo. 

 In May 2024, Ascension, one of the largest non-profit health systems in the United States, faced a crippling ransomware attack that disrupted operations across its 142 hospitals and 2,600 care sites. 

The attack, attributed to the Russia-linked Black Basta ransomware group, forced Ascension to take critical systems offline, including electronic health records, patient portals, and communication tools, leading to significant challenges in patient care delivery. 

The incident highlighted the severe impact on healthcare workers, patient safety, and operational efficiency, while also underscoring the importance of robust cybersecurity measures and coordinated response efforts involving federal agencies and industry organizations.

Learn more about the attack at this link:  https://www.perplexity.ai/page/The-Ascension-Hospitals-v5ZSPWQDTQSLPpvrImOJQA

Cybersecurity: Wichita, Kansas Cyberattack of May 2024

Editor: Ava Gozo. 

The Wichita, Kansas Cyberattack of 2024 was a significant ransomware attack that had widespread impacts on the city's operations and services. Here are the key details:

Incident Overview

Date of Attack: The cyberattack occurred between May 3 and 4, 2024, and was publicly announced on May 5, 2024[1][2].
 

Type of Attack: The attack involved ransomware, specifically attributed to the LockBit ransomware gang[2][6].
 

Immediate Response: The city shut down its computer network to prevent the spread of the malware, which led to the temporary unavailability of several city services[1].

Impact on City Services

Service Disruptions: Many city services were disrupted, including payment portals for water and sewer bills, the clerk's office, and the municipal court system[1]. The attack also affected the WiFi and departure screens at the local airport, and forced city-run organizations to revert to cash payments for various services[6].
Law Enforcement and Emergency Services: Wichita's police and fire departments had to switch to backup procedures and use paper for creating reports[1][6].
Communication Issues: Many city departments could not be contacted by phone, although some divisions like the city manager's office and IT still had working phones[1].

Data Compromise

Personal Information: The attack compromised personal information, including names, Social Security numbers, driver’s licenses, state IDs, and payment card information[2][5]. Law enforcement data, including incident and traffic information, was also affected[5][15].
Extent of Data Breach: The city confirmed that files were copied from its network without permission, but did not disclose the full extent of the data breach or how far back the files dated[5].

Response and Investigation

Law Enforcement Involvement: Federal and local law enforcement agencies were notified and are investigating the incident[1][2].
Mitigation Efforts: The city's IT department is working with third-party specialists to restore the compromised network and put mitigation measures in place[1][5].
Public Communication: The city has been providing updates through FAQs and news releases, although some information is being withheld for operational security purposes[1][18].

Broader Context

Healthcare Impact: The attack on Wichita was part of a broader trend of ransomware attacks affecting various sectors, including healthcare. For instance, Ascension hospitals in Wichita also experienced a cyberattack around the same time, disrupting clinical operations and patient care[4].
Cybersecurity Measures: The incident underscores the importance of robust cybersecurity measures and the need for continuous improvement in incident response and resilience strategies, as highlighted in events like the Kansas Public Sector Cybersecurity Summit[3][9].

In summary, the Wichita cyberbreach of 2024 was a ransomware attack that caused significant disruptions to city services, compromised personal and law enforcement data, and required extensive response efforts from local and federal authorities.

Citations:
[1] https://www.govtech.com/security/ransomware-attack-on-wichita-gov-causes-city-network-outage
[2] https://www.scmagazine.com/brief/ransomware-attack-impacts-law-enforcement-data-in-wichita
[3] https://events.govtech.com/Kansas-Public-Sector-Cybersecurity-Summit
[4] https://www.kake.com/story/50762870/cyberattack-disrupts-operations-at-major-us-healthcare-network
[5] https://www.ksn.com/news/local/wichita-cyberattack-got-personal-financial-information/
[6] https://therecord.media/wichita-kansas-ransomware-attack-claimed-by-lockbit
[7] https://statescoop.com/cyberattack-macon-bibb-county-georgia-2024/
[8] https://thebeaconnews.org/stories/2024/01/25/how-ransomware-attacks-at-kansas-city-hospitals-threaten-your-privacy/
[9] https://www.ebit.ks.gov/divisions/information-security-office-kiso/cyber-summit
[10] https://www.ksn.com/news/state-regional/kansas-courts-cyber-attack-impacts-150000-people/
[11] https://www.ksn.com/news/local/wichita-cyberattack-update-what-residents-need-to-know/
[12] https://www.kwch.com/2024/05/11/cyber-attacks-leave-significant-financial-impact-hacked-organizations/
[13] https://www.kwch.com/2024/05/14/city-wichita-says-social-security-numbers-other-ids-compromised-security-breach/
[14] https://www.kwch.com/video/2024/05/07/city-wichita-feels-impact-cyber-security-attack/
[15] https://www.kansas.com/news/politics-government/article288491333.html
[16] https://seculore.com/state/kansas/05-06-2024-ks-city-of-wichita/
[17] https://www.kansas.com/news/politics-government/article288397380.html
[18] https://www.kansas.com/news/politics-government/article288549047.html
[19] https://www.kwch.com/2024/01/23/delays-background-checks-continue-kansas-court-system-recovers-cyberattack/
[20] https://www.kwch.com/2024/05/14/city-wichita-says-cyberattack-did-not-hurt-water-systems-other-faqs/

Cybersecurity: Noteworthy Dark Web Criminal Cases

Editor: Ava Gozo. 

Below are just a few examples of the criminal cases and investigations involving offenders who used the Dark Web to facilitate their acts.

Banmeet Singh's $100M+ Dark Web Drug Empire

Banmeet Singh of Haldwani, Northern India was sentenced to eight years in prison in 2024 for creating and leading a multi-million dollar dark web drug enterprise. His crime network completed over 18,000 drug sales on the dark web, hiding the drugs in a shed made to look like a legitimate mail-order business[1].

Operation Dark hunTor Arrests 150 in Nine Countries

In 2021, Operation Dark hunTor resulted in 150 arrests across nine countries for dark web drug trafficking and money laundering offenses[1].

Former Navy Seal Found Guilty in Dark Web CSAM Case

In 2023, former Navy Seal Robert Quido Stella was found guilty of producing, possessing, and accessing unlawful images of minor on the dark web. He paid for a membership to a dark web CSAM site using Bitcoin[1].

Attempt to Hire Dark Web Hitman Backfires

In 2024, a woman from Canberra, Australia pleaded guilty to inciting another to murder after attempting to hire a dark web hitman to murder her wealthy ex-husband. She paid $6,000 in Bitcoin as a down payment for the $20,000 murder-for-hire plot[1].

Cyber Criminal Forum Spanning 20 Countries Taken Down

Operation Shrouded Horizon dismantled an online criminal forum spanning 20 countries[2].

Man Pleads Guilty to Selling Stolen Financial Info on Dark Web

In 2023, Michael D. Mihalo plead guilty to leading a conspiracy to sell stolen financial information of tens of thousands of U.S. victims on dark web markets like Skynet, AlphaBay, Wall Street and Hansa. He earned over $1 million worth of cryptocurrency at the time of the sales[3].

These cases demonstrate the range of criminal activities occurring on the Dark Web, from drug trafficking and money laundering to child exploitation and financial fraud. Law enforcement has had some success in infiltrating dark web markets and forums and tracing suspects despite the supposed anonymity provided by Tor and cryptocurrency[4][5].

Citations:

[1] https://vpnoverview.com/privacy/anonymous-browsing/notorious-dark-web-cases/

[2] https://www.fbi.gov/investigate/cyber/major-cases

[3] https://www.justice.gov/opa/pr/man-pleads-guilty-conspiracy-sell-stolen-financial-information-dark-web

[4] https://blog.tmb.co.uk/cyber-criminals

[5] https://www.technologyreview.com/2020/02/08/349016/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught/

___________________________________________

Please buy a coffee at the link below for our excellent editor Ava Gozo