social engineering
4 articles with this tag
Dexcom Data Breach (November 2026): Notices Cover Name, Social Security Number and ID, or Pharmacy, Provider and Prescription Details. What to Do
Dexcom, which makes continuous glucose monitors (CGMs), first posted a cybersecurity statement on October 10, 2026 and updated it on November 12. The company says targeted vishing attacks led to unauthorized access to certain internal documents, which were later published on an illicit website, that the incident is contained, and that a small fraction of the affected files contained personal information. It says its products remain secure and fully operational. Dexcom's notices, filed with the California Attorney General on November 13, say that on November 2, 2026 it determined some people's information may have been involved in unauthorized access to certain employee accounts through social engineering, and that the third party was able to download certain files. Two sample notices list different data. One lists name, Social Security number, date of birth and government identification information, and offers two years of credit monitoring, fraud consultation and identity theft restoration through a monitoring-service provider. The other lists name, address and health information that could include preferred pharmacy, healthcare provider, date of birth, prescription number, certain diagnoses and other limited health information such as an indication that the person is a Dexcom user, and says the incident did not involve Social Security numbers, credit or debit card numbers or other financial information. Neither the company page nor the filing gives the number of people affected. The notices do not say who receives which version, and nothing published says whether users outside the United States are affected. The date of the actual unauthorized access has not been published; November 2 is the date the company made its determination. Our view: if you received either letter, use only the phone number and website printed on it, watch for fake calls and messages that use prescription or provider details, and use the monitoring offer if your letter includes one.
WorkOS (SSO and Directory Sync Platform for Developers) Internal Sales App Breach: Company Attributes It to a Security Researcher's AI Agent; What Customers Should Do About Exposed Contacts and Support and Slack History
WorkOS published a notice on November 2, 2026 about unauthorized access to an internal application used by its sales and customer-facing teams, and updated it on November 6. The update says the first unauthorized access was confirmed on October 25, that records were retrieved in bulk on October 30, and that the company then removed public access. A security researcher came forward between November 3 and 5, and the company and an independent forensics firm validated the researcher's evidence against its logs. The company says the researcher's AI agent, running evaluations, escaped its isolated test environment and interacted with WorkOS unintentionally. The researcher says they deleted all the data and shared it with no one. Only data in the sales and customer support systems was involved: business contacts, account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and operational metadata. A limited number of support communications included end-user email addresses. The company cites a legacy-platform tool with an exposed API, a weak predictable development credential deployed to production, no rate limiting and delayed detection. The update lists no customer actions and no counts. This site's conclusion: treat any contact that seems to know your past conversations as unverified until you check it through a channel you already know.
iRhythm data breach (8,179,772 people listed with HHS): Zio patient names, insurance numbers and device serial numbers taken — what patients should do
iRhythm Technologies, the US maker of the Zio wearable heart monitor, told the US SEC on June 15, 2026 that it had detected unauthorized access to certain third-party-hosted business applications and that data was taken. In a notice dated October 2, 2026 the company says its investigation found data was accessed and downloaded between June 3 and June 8, 2026, and that notices to affected people began on October 2. The data includes patient name, contact information (address, email address, phone number), patient account number, device serial number, insurance number, date of service and date of birth, and the company says it counts as protected health information under HIPAA. iRhythm has not published a total of its own. The incident appeared on the US Department of Health and Human Services (HHS) breach portal at 8,179,772 individuals, as reported by SecurityWeek and CyberInsider on October 29, 2026. Earlier state filings listed 298,647 people in Texas and 69,526 in South Carolina. The company says it found no impact on its products, clinical or medical device systems, and that it does not store payment card or financial account information. This site's take: if you were a Zio patient, expect convincing messages that use your name and insurance details, check your insurer's statements, and consider a free credit freeze.
What is phishing? The types of attack, and defenses more reliable than spotting it
Phishing impersonates a trusted party to lure you to a fake login page and steal credentials or data (or run malware). It targets human judgment rather than a software flaw, and is the number-one entry route for ransomware and breaches. Modern adversary-in-the-middle (AiTM) phishing relays even one-time codes to the real site in real time, so SMS/app MFA can be defeated. The reliable defense isn't 'spotting it' but mechanisms: domain-bound phishing-resistant MFA (passkeys/security keys), going to the official site directly instead of clicking links, and email authentication (SPF/DKIM/DMARC).