Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In a stark reminder of the increasing risk to software supply chains, freelance talent platform Toptal is the latest high-profile organization impacted by a compromise of a GitHub account that led to the deployment of malicious npm packages with the capability to wipe developer machines and steal passwords. The breach, first disclosed last week, has shocked the developer community and exposed serious flaws in repository security, disclosure practices, and package ecosystem hygiene.

Founded by Dr. Daniel Talley in 1905, the Radiology Associates of Richmond is one of America's oldest private radiology practices. RAR has since been at the forefront of advanced diagnostic, interventional services, and medical imaging. The institution spans seven hospitals and four outpatient centers in central Virginia. RAR has 62 board-certified radiologists, and the practice specializes in breast imaging, neuroradiology, and vascular interventions.

In 2023, a critical vulnerability in MOVEit Transfer software (CVE-2023-34362) was weaponized by the Cl0p ransomware group, leading to a substantial leak of sensitive employee data from major global corporations. The flaw in MOVEit allowed attackers to bypass authentication and access secure files, resulting in a far-reaching data breach that impacted various sectors including finance, healthcare, government, and retail.

What does it take to stay calm in the face of constant cyber pressure—and why does that mindset matter more than ever? In this episode of Security Matters, host David Puner speaks with Den Jones, founder and CEO of 909Cyber, about his transition from enterprise chief security officer (CSO) to cybersecurity consultant.

‍ ‍ ‍Both the Marks & Spencer ransomware attack and the Qantas breach dominated headlines for weeks, each exposing serious lapses in how data and risk were managed at the organizational level. But within the cybersecurity community, the response took a different turn. Unlike with other commentary post-cyber incidents, the focus quickly moved away from compromised systems and toward something more structural. These weren’t framed as technical breakdowns.

In June 2025, a disturbing security failure surfaced involving McDonald’s AI-powered hiring assistant, Olivia, operated by Paradox.ai. The platform, designed to screen job applicants via chatbot, exposed the personal information of over 64 million people. That included names, contact info, shift preferences, and even chat transcripts. The root cause? A combination of missteps that highlight the growing risk of insecure APIs in modern, AI-driven systems.

Established in 1996, Esse Health was the product of a merger of two physician-led institutions. It soon emerged as a leading independent physician group in the larger St. Louis area, operating in more than 50 locations. Esse Health has 100 doctors specializing in primary and specialty care. Unlike other corporate healthcare systems, Esse Health maintains a physician-owned and managed system. It prioritizes a collaborative approach where patients and doctors partner to make care-based decisions.

On July 3, 2025, Qantas confirmed in an update statement that a cyber incident had compromised data from one of its contact centers, following the detection of suspicious activity on June 30. The breach didn’t strike at the heart of Qantas’ systems; it snuck in through a third-party provider. The attack allegedly exposed the data of 6 million Qantas customers. Figure 1. Qantas’ latest statement posted on July 3, 2025.

Inheritance scams are deceptive tactics used by fraudsters to lure unsuspecting victims with promises of substantial wealth. These scams typically involve false claims of inheritance from unknown individuals or distant relatives, accompanied by requests for fees or personal data for funds to be released. Many victims succumbed to these schemes due to the emotional appeal of unexpected fortune, urgency created by scammers, and the presentation of seemingly legitimate documents of stories.

Episource is a California-based healthcare services and technology company that provides risk adjustment and medical coding services to healthcare plans, doctors, and several other types of healthcare organizations. The company offers point-of-care solutions and software services that enable healthcare providers to meet patients wherever they are. This helps close gaps in healthcare and ameliorate health outcomes.

Look at any collection of top 10 organizational security concerns from recent years, and “third-party breaches” are consistently high on the list. These attacks have caused financial and reputational damage to every sector, from banks to healthcare systems to retail to governments. And the problem is growing. Recent statistics highlight just how severe the issue has become.