#1 Trusted Cybersecurity News Platform
Followed by 5.20+ million
The Hacker News Logo
Subscribe – Get Latest News
DevSecOps

data privacy | Breaking Cybersecurity News | The Hacker News

Category — data privacy
DeepSeek App Transmits Sensitive User and Device Data Without Encryption

DeepSeek App Transmits Sensitive User and Device Data Without Encryption

Feb 07, 2025 Mobile Security / Artificial Intelligence
A new audit of DeepSeek's mobile app for the Apple iOS operating system has found glaring security issues, the foremost being that it sends sensitive data over the internet sans any encryption, exposing it to interception and manipulation attacks. The assessment comes from NowSecure, which also found that the app fails to adhere to best security practices and that it collects extensive user and device data. "The DeepSeek iOS app sends some mobile app registration and device data over the Internet without encryption," the company said . "This exposes any data in the internet traffic to both passive and active attacks." The teardown also revealed several implementation weaknesses when it comes to applying encryption on user data. This includes the use of an insecure symmetric encryption algorithm ( 3DES ), a hard-coded encryption key, and the reuse of initialization vectors . What's more, the data is sent to servers that are managed by a cloud compute a...
Taiwan Bans DeepSeek AI Over National Security Concerns, Citing Data Leakage Risks

Taiwan Bans DeepSeek AI Over National Security Concerns, Citing Data Leakage Risks

Feb 04, 2025 Artificial Intelligence / Data Privacy
Taiwan has become the latest country to ban government agencies from using Chinese startup DeepSeek's Artificial Intelligence (AI) platform, citing security risks. "Government agencies and critical infrastructure should not use DeepSeek, because it endangers national information security," according to a statement released by Taiwan's Ministry of Digital Affairs, per Radio Free Asia . "DeepSeek AI service is a Chinese product. Its operation involves cross-border transmission, and information leakage and other information security concerns." DeepSeek's Chinese origins have prompted authorities from various countries to look into the service's use of personal data. Last week, it was blocked in Italy, citing a lack of information regarding its data handling practices. Several companies have also prohibited access to the chatbot over similar risks. The chatbot has captured much of the mainstream attention over the past few weeks for the fact tha...
Protecting Your Software Supply Chain: Assessing the Risks Before Deployment

Protecting Your Software Supply Chain: Assessing the Risks Before Deployment

Feb 11, 2025Software Security / Threat Intelligence
Imagine you're considering a new car for your family. Before making a purchase, you evaluate its safety ratings, fuel efficiency, and reliability. You might even take it for a test drive to ensure it meets your needs. The same approach should be applied to software and hardware products before integrating them into an organization's environment. Just as you wouldn't buy a car without knowing its safety features, you shouldn't deploy software without understanding the risks it introduces. The Rising Threat of Supply Chain Attacks Cybercriminals have recognized that instead of attacking an organization head-on, they can infiltrate through the software supply chain—like slipping counterfeit parts into an assembly line. According to the 2024 Sonatype State of the Software Supply Chain report , attackers are infiltrating open-source ecosystems at an alarming rate, with over 512,847 malicious packages detected last year alone—a 156% increase from the previous year. Traditional sec...
Italy Bans Chinese DeepSeek AI Over Data Privacy and Ethical Concerns

Italy Bans Chinese DeepSeek AI Over Data Privacy and Ethical Concerns

Jan 31, 2025 AI Ethics / Machine Learning
Italy's data protection watchdog has blocked Chinese artificial intelligence (AI) firm DeepSeek's service within the country, citing a lack of information on its use of users' personal data. The development comes days after the authority, the Garante, sent a series of questions to DeepSeek, asking about its data handling practices and where it obtained its training data. In particular, it wanted to know what personal data is collected by its web platform and mobile app, from which sources, for what purposes, on what legal basis, and whether it is stored in China. In a statement issued January 30, 2025, the Garante said it arrived at the decision after DeepSeek provided information that it said was "completely insufficient." The entities behind the service, Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, have "declared that they do not operate in Italy and that European legislation does not apply to them," it...
cyber security

Level Up Your Cyber Skills at SANS 2025

websiteSANS InstituteCyber Security / Training
Master in-demand techniques at our largest training event in 2025. Explore 50+ courses. Train in person to claim your $769 savings!
DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked

DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked

Jan 30, 2025 Artificial Intelligence / Data Privacy
Buzzy Chinese artificial intelligence (AI) startup DeepSeek , which has had a meteoric rise in popularity in recent days, left one of its databases exposed on the internet, which could have allowed malicious actors to gain access to sensitive data. The ClickHouse database "allows full control over database operations, including the ability to access internal data," Wiz security researcher Gal Nagli said . The exposure also includes more than a million lines of log streams containing chat history, secret keys, backend details, and other highly sensitive information, such as API Secrets and operational metadata. DeepSeek has since plugged the security hole following attempts by the cloud security firm to contact them. The database, hosted at oauth2callback.deepseek[.]com:9000 and dev.deepseek[.]com:9000, is said to have enabled unauthorized access to a wide range of information. The exposure, Wiz noted, allowed for complete database control and potential privilege escalati...
New SLAP & FLOP Attacks Expose Apple M-Series Chips to Speculative Execution Exploits

New SLAP & FLOP Attacks Expose Apple M-Series Chips to Speculative Execution Exploits

Jan 29, 2025 Vulnerability / Threat Intelligence
A team of security researchers from Georgia Institute of Technology and Ruhr University Bochum has demonstrated two new side-channel attacks targeting Apple silicon that could be exploited to leak sensitive information from web browsers like Safari and Google Chrome. The attacks have been codenamed Data Speculation Attacks via Load Address Prediction on Apple Silicon ( SLAP ) and Breaking the Apple M3 CPU via False Load Output Predictions ( FLOP ). Apple was notified of the issues in May and September 2024, respectively. The vulnerabilities, like the previously disclosed iLeakage attack, build on Spectre , arising when speculative execution "backfires," leaving traces of mispredictions in the CPU's microarchitectural state and the cache. Speculative execution refers to a performance optimization mechanism in modern processors that are aimed at predicting the control flow the CPU should take and execute instructions along the branch beforehand. In the event of a mi...
OAuth Redirect Flaw in Airline Travel Integration Exposes Millions to Account Hijacking

OAuth Redirect Flaw in Airline Travel Integration Exposes Millions to Account Hijacking

Jan 28, 2025
Cybersecurity researchers have disclosed details of a now-patched account takeover vulnerability affecting a popular online travel service for hotel and car rentals. "By exploiting this flaw, attackers can gain unauthorized access to any user's account within the system, effectively allowing them to impersonate the victim and perform an array of actions on their behalf – including booking hotels and car rentals using the victim's airline loyalty points, canceling or editing booking information, and more," API security firm Salt Labs said in a report shared with The Hacker News. Successful exploitation of the vulnerability could have put millions of online airline users at risk, it added. The name of the company was not disclosed, but it said the service is integrated into "dozens of commercial airline online services" and enables users to add hotel bookings to their airline itinerary. The shortcoming, in a nutshell, can be weaponized trivially by sending a...
New Research: The State of Web Exposure 2025

New Research: The State of Web Exposure 2025

Jan 23, 2025 Website Security / Data Privacy
Are your websites leaking sensitive data? New research reveals that 45% of third-party apps access user info without proper authorization, and 53% of risk exposures in Retail are due to the excessive use of tracking tools. Learn how to uncover and mitigate these hidden threats and risks—download the full report here . New research by web exposure management specialist Reflectiz reveals several alarming findings about the high number of website vulnerabilities organizations across many industries are needlessly exposing themselves to. For instance, one standout statistic from the report is that 45% of third-party applications access sensitive user information without good reason . Although third-party apps may be essential for marketing and functionality purposes, not all of them need access to the kind of personal and financial user information that cybercriminals are hunting for. It's safer to limit apps' access to it on a need-to-know basis. For the report, Reflectiz gathere...
TikTok Goes Dark in the U.S. as Federal Ban Takes Effect January 19, 2025

TikTok Goes Dark in the U.S. as Federal Ban Takes Effect January 19, 2025

Jan 19, 2025 Social Media / Data Privacy
Popular video-sharing social network TikTok has officially gone dark in the United States, as a federal ban on the app comes into effect on January 19, 2025. "We regret that a U.S. law banning TikTok will take effect on January 19 and force us to make our services temporarily unavailable," the company said in a pop-up message. "We're working to restore our service in the U.S. as soon as possible, and we appreciate your support. Please stay tuned." An immediate outcome of the ban means that existing users will no longer be able to access TikTok content, and new users won't be able to download the app from the official app stores for Android and iOS. Other apps from its parent company ByteDance, including CapCut, Lemon8, and Gauth, have become unavailable as well. The development comes days after the U.S. Supreme Court ruled unanimously to uphold a law requiring that its ByteDance sell TikTok or see it be effectively blocked in the country due to nation...
Google OAuth Vulnerability Exposes Millions via Failed Startup Domains

Google OAuth Vulnerability Exposes Millions via Failed Startup Domains

Jan 14, 2025 Vulnerability / Data Privacy
New research has pulled back the curtain on a "deficiency" in Google's "Sign in with Google" authentication flow that exploits a quirk in domain ownership to gain access to sensitive data. "Google's OAuth login doesn't protect against someone purchasing a failed startup's domain and using it to re-create email accounts for former employees," Truffle Security co-founder and CEO Dylan Ayrey said in a Monday report.  "And while you can't access old email data, you can use those accounts to log into all the different SaaS products that the organization used." The San Francisco-based company said the issue has the potential to put millions of American users' data at risk simply by purchasing a defunct domain associated with a failed startup and gaining unauthorized access to old employee accounts related to various applications like OpenAI ChatGPT, Slack, Notion, Zoom, and even HR systems. "The most sensitive accou...
E.U. Commission Fined for Transferring User Data to Meta in Violation of Privacy Laws

E.U. Commission Fined for Transferring User Data to Meta in Violation of Privacy Laws

Jan 09, 2025 Data Privacy / GDPR
The European General Court on Wednesday fined the European Commission, the primary executive arm of the European Union responsible for proposing and enforcing laws for member states, for violating the bloc's own data privacy regulations. The development marks the first time the Commission has been held liable for infringing stringent data protection laws in the region. The court determined that a "sufficiently serious breach" was committed by transferring a German citizen's personal data, including their IP address and web browser metadata, to Meta's servers in the United States when visiting the now-inactive futureu.europa[.]eu website in March 2022. The individual registered for one of the events on the site by using the Commission's login service, which included an option to sign in using a Facebook account. "By means of the 'Sign in with Facebook' hyperlink displayed on the E.U. Login webpage, the Commission created the conditions for t...
Apple to Pay Siri Users $20 Per Device in Settlement Over Accidental Siri Privacy Violations

Apple to Pay Siri Users $20 Per Device in Settlement Over Accidental Siri Privacy Violations

Jan 03, 2025 Technology / Data Privacy
Apple has agreed to pay $95 million to settle a proposed class action lawsuit that accused the iPhone maker of invading users' privacy using its voice-activated Siri assistant. The development was first reported by Reuters. The settlement applies to U.S.-based individuals current or former owners or purchasers of a Siri-enabled device who had their confidential voice communications with the assistant "obtained by Apple and/or were shared with third-parties as a result of an unintended Siri activation" between September 17, 2014, and December 31, 2024. Eligible individuals can submit claims for up to five Siri devices – iPhone, iPad, Apple Watch, MacBook, iMac, HomePod, iPod touch, or Apple TV – on which they claim to have experienced an accidental Siri activation during a conversation intended to be confidential or private. Class members who submit valid claims can receive $20 per device. The lawsuit was brought against Apple following a 2019 report from The Guar...
Top 10 Cybersecurity Trends to Expect in 2025

Top 10 Cybersecurity Trends to Expect in 2025

Dec 23, 2024 Cybersecurity / Threat Intelligence
The 2025 cybersecurity landscape is increasingly complex, driven by sophisticated cyber threats, increased regulation, and rapidly evolving technology. In 2025, organizations will be challenged with protecting sensitive information for their customers while continuing to provide seamless and easy user experiences. Here's a closer look at ten emerging challenges and threats set to shape the coming year. 1. AI as a weapon for attackers The dual-use nature of AI has created a great deal of risk to organizations as cybercriminals increasingly harness the power of AI to perpetrate highly sophisticated attacks. AI-powered malware can change its behavior in real-time. This means it can evade traditional methods of detection and find and exploit vulnerabilities with uncanny precision. Automated reconnaissance tools let attackers compile granular intelligence about systems, employees, and defenses of a target at unprecedented scale and speed. AI use also reduces the planning time for a...
Expert Insights / Articles Videos
Cybersecurity Resources