Why Security Leaders Struggle to Secure Funding

Kaspr Faces $250K Fine for LinkedIn Data Scraping

December 24, 2024December 24, 2024

Kaspr Fined for Data Scraping Violations: A Wake-Up Call for GDPR Compliance

In a significant ruling, Paris-based software firm Kaspr has been fined €249,600 (approximately $249,600) by France’s National Commission on Informatics and Liberty (CNIL) for violations related to data scraping under the General Data Protection Regulation (GDPR). The company, known for its paid Chrome browser extension that collects professional contact information from LinkedIn users, has come under fire for its questionable data collection practices. This case serves as a critical reminder for businesses to prioritize GDPR compliance and transparency in their operations.

What Led to the Fine?

Kaspr faced scrutiny for several reasons, including:

Unauthorized Data Collection: The extension gathered information from LinkedIn users beyond the allowed second-degree connections, raising serious privacy concerns.
Prolonged Data Retention: The Cognism-owned company retained user data for an excessively long period without proper justification.
Lack of Transparency: Kaspr’s notification to individuals about their data being collected was vague and came four years after the extension’s launch in 2018.

According to CNIL, when users inquired about how their contact details were sourced, Kaspr simply stated that the information was obtained from publicly accessible sources. This response underscores the lack of clarity surrounding their data collection practices.

The Importance of GDPR Compliance

The Kaspr case highlights the critical need for organizations to adhere to GDPR regulations, which are designed to protect user privacy and ensure transparent data practices. Non-compliance can lead to significant financial penalties and tarnished reputations. Here are some key aspects of GDPR that businesses should consider:

User Consent: Obtain explicit consent from individuals before collecting their data.
Data Minimization: Only collect data that is necessary for your intended purpose.
Transparency: Clearly inform users about how their data will be used and retained.
Regular Audits: Conduct regular reviews of data practices to ensure compliance with GDPR.

For more information on GDPR regulations, visit the European Commission’s official website.

Conclusion: A Call for Improved Practices

As the digital landscape continues to evolve, the Kaspr case serves as a cautionary tale for companies engaged in data collection. Organizations must prioritize ethical data practices and comply with GDPR to avoid hefty fines and preserve consumer trust. What are your thoughts on data privacy and the importance of compliance? Share your opinions in the comments below or explore related articles on data protection and privacy rights.

For more insights on GDPR compliance and data management, check out our related articles on data privacy best practices and the impact of GDPR on businesses.

Chinese Cyberattack Hits More US Telecom Companies

January 6, 2025January 6, 2025

U.S. telecommunications companies, including Windstream, Consolidated Communications, and Charter Communications, have been targeted by the Chinese state-sponsored hacker group Salt Typhoon. This group has exploited vulnerabilities in Fortinet network devices and Cisco routers, affecting nine telecom firms, including AT&T and T-Mobile. National Security Advisor Jake Sullivan has briefed industry executives about the threats, highlighting potential risks to critical infrastructure like power grids and ports. In response, AT&T, Lumen, and Verizon reported removing unauthorized access, while T-Mobile successfully thwarted multiple attacks. The situation underscores the urgent need for enhanced cybersecurity measures across the sector.

New Advanced Zloader Malware Variant Discovered

New RedDelta Attacks Unleash Updated PlugX Malware

January 13, 2025January 13, 2025

RedDelta, an advanced persistent threat group, has begun targeting Southeast Asia with a new variant of PlugX malware, affecting countries such as Taiwan, Mongolia, Cambodia, Myanmar, and Vietnam from July 2023 to December 2024. Their attacks involve spear-phishing emails that exploit current events, containing malicious attachments to deploy the malware. Investigations reveal RedDelta’s command-and-control infrastructure and highlight their focus on geopolitical threats to the Chinese Communist Party. The resurgence of these operations raises cybersecurity concerns throughout the region, emphasizing the need for enhanced protective measures against such sophisticated cyber threats.

Microsoft Calls for Urgent Update to .NET Installer Links

4 Tips to Strengthen Microsoft Entra ID Security

January 10, 2025January 10, 2025

As organizations adopt cloud services, effective cloud identity management is crucial for IT security, with Microsoft Entra ID connecting over 610 million users. Despite its growth, managing identities in hybrid environments poses challenges. Entra ID has seen 37 billion objects backed up in the past year, with 99.74% of organizations automating their backups to reduce errors. While 75% prefer full restores, many are shifting to differential recovery to minimize downtime. However, gaps in Entra ID’s native tools, such as limited recovery options for deleted items, highlight the need for robust disaster planning. Organizations must enhance their backup strategies to combat increasing threats.

Exabeam Boosts Security Platform with Open API and Automation

January 14, 2025January 14, 2025

Exabeam has announced significant updates to its New-Scale Security Operations Platform, enhancing threat detection and response capabilities for security operation centers. Key features include Open-API compatibility for seamless integration with existing tools, and New-Scale Analytics for improved risk scoring and threat detection by incorporating late-arriving event logs. The upgraded Threat Center, featuring Exabeam Copilot, automates tasks using generative AI, boosting productivity for security teams. Additionally, expanded integrations with partners like Wiz and Cloudflare enhance visibility into cloud environments. The new NetMon tool provides real-time insights into network traffic, marking a pivotal launch for Exabeam post-merger with LogRhythm.

2025 Cybersecurity Regulations: Insights from Industry Experts

January 3, 2025January 3, 2025

As 2025 approaches, significant changes in cybersecurity regulations are anticipated, particularly affecting cloud technology, AI, and identity management due to increased geopolitical tensions and stricter data protection mandates. Key developments include the EU’s Digital Operational Resilience Act (DORA) and updates to U.S. compliance standards like PCI DSS 4.0. Organizations must prioritize cyber supply chain security and enhance their cybersecurity frameworks. To navigate these shifts, experts recommend investing in compliance tools, adopting a global perspective on regulations, and improving security practices. Embracing these changes will be crucial for organizations to maintain compliance and protect against cyber threats.

Brazilian Hacker Charged for $3.2M Bitcoin Extortion Scheme

December 26, 2024December 26, 2024

Junior Barros De Oliveira, a Brazilian national, has been charged in the U.S. for attempting to extort a company by threatening to release stolen data from a 2020 breach affecting around 300,000 customers. The U.S. Department of Justice indicted the 29-year-old, detailing four counts of extortionate threats and four counts of threatening communications. De Oliveira allegedly demanded 300 bitcoin (about $3.2 million) from the company’s CEO to prevent data sale and later offered to assist with the breach for 75 bitcoin. Each extortion count could lead to five years in prison, emphasizing the rise of cyber extortion threats.