Zack Whittaker

Security editor, TechCrunch
Email: zack.whittaker@techcrunch.com
Signal: zackwhittaker.1337
New York, NY

Newsletter: https://this.weekinsecurity.com
TechCrunch: https://techcrunch.com/author/zack-whittaker

Public Key

npub1p5zle0pk36rncv38srupa9hayycvc48anh0t9fxg2sjuhm7fw82q2tkrfz

NIP-05 Address

zackwhittaker_at_mastodon.social@momostr.pink

Profile Code

nprofile1qqsq6p0uhsmgapeuxgncp7q7jm7jzvxv2n7emh4j5ny9gfwtalyhr4qpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsrc3etn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1p5zle0pk36rncv38srupa9hayycvc48anh0t9fxg2sjuhm7fw82q2tkrfz

Show more details

Last Notes

2026-05-04 11:04:36 UTC

Excellent reporting, alarming findings. Bloomberg's @npub1ry5…n4f0 et al found U.S. state government health websites are sharing people's personal info (sex, citizenship & race data) with tech giants via pixel-sized webpage trackers. Several states pulled the trackers after Bloomberg disclosed.
ALWAYS USE AN AD-BLOCKER. But really!
https://www.bloomberg.com/features/2026-healthcare-advertising-trackers-privacy/
https://files.mastodon.social/media_attachments/files/116/515/976/653/674/081/original/1a8d2e5a2585b1ee.png

2026-04-08 21:51:55 UTC

New, by me at TechCrunch: The developer of the widely popular Wireguard VPN says he is also unable to ship software updates to Windows users after Microsoft locked his account, marking the second high-profile app developer (VeraCrypt) in the past few weeks to face this issue.
https://techcrunch.com/2026/04/08/wireguard-vpn-developer-cant-ship-software-updates-after-microsoft-locks-account/

2026-04-07 13:05:08 UTC

For my blog ~ this week in security ~ I wrote about how hacks, cyberattacks, and data breaches are almost *never* the employee's fault — even if the companies say so.
Read online: https://this.weekinsecurity.com/that-big-company-hack-probably-was-not-an-employees-fault/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-04-02 21:28:29 UTC

New, by me: Telehealth giant Hims & Hers confirmed its customer service ticketing system was hacked. A spokesperson said it was a social engineering attack. The hacker stole mostly customer support tickets, including customer names and contact information, but also the contents of customer requests.
https://techcrunch.com/2026/04/02/telehealth-giant-hims-hers-says-its-customer-support-system-was-hacked/

2026-04-01 14:52:13 UTC

Not a joke: Hasbro was hacked. The American toymaking giant said in an SEC filing that it may take weeks for it to recover. Much of the company's website appears down.
https://techcrunch.com/2026/04/01/hasbro-hacked-may-take-several-weeks-to-recover/

2026-03-31 17:48:28 UTC

Google has now linked the hack and hijack of the popular Axios npm open-source project to North Korea (UNC1069), which is known for stealing cryptocurrency.
Axios is downloaded tens of millions of times weekly, so this hack is likely widespread.
Our updated story: https://techcrunch.com/2026/03/31/hacker-hijacks-axios-open-source-project-used-by-millions-to-push-malware?nocache=1

2026-03-31 12:15:26 UTC

Today is International Trans Day of Visibility. Sending my love, support, and solidarity to all my trans and non-binary friends. 🏳️‍⚧️❤️

2026-03-25 16:52:09 UTC

In at least six instances identified by TechCrunch, first responders have had to take control of Waymo vehicles and move them out of traffic during emergency situations.
https://techcrunch.com/2026/03/25/waymo-relies-on-firefighters-and-police-to-bail-out-stuck-robotaxis/

2026-03-25 14:23:18 UTC

Good reporting from NPR on how U.S. federal agencies are simply buying people's private information and location data to use in investigations — without getting warrants.
https://www.npr.org/2026/03/25/nx-s1-5752369/ice-surveillance-data-brokers-congress-anthropic

2026-03-25 13:03:34 UTC

Loved this blog by @npub1u2v…8zpj and Jan Strozyk reflecting 10 years on from the Panama Papers, and how nerds in the newsroom who knew (or learned!) how to script, scrape, and build tools helped to transform modern journalism. Nowadays, handling and parsing data is an indispensable skill.
https://buttondown.com/readwrite/archive/edition-12-on-the-panama-papers-ten-years-later/

2026-03-25 12:32:43 UTC

Almost exactly four months ago, I wrote about how the Trump administration was preparing to ban TP-Link routers, citing the company's alleged links to China. Now, the FCC has decided to ban *all* new models of foreign-made routers, even though many U.S.-made routers are also full of security flaws.
https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity/

2026-03-23 20:44:31 UTC

NEW: Someone has publicly leaked an exploit toolkit called DarkSword, which allows any hacker or cybercriminal to easily hack iPhones and iPads running iOS 18.
Apple said it is aware & has issued patches. Security researchers have already tested the code as working.
w/ @npub1xvw…ksg7: https://techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/

2026-03-18 16:58:02 UTC

FBI director Kash Patel confirms the FBI is buying location data and histories that can be used for tracking people. It's the first time in recent years that the FBI has said it's actively buying this information, without needing a warrant.
https://www.politico.com/news/2026/03/18/fbi-buying-data-track-people-patel-00834080

2026-03-18 12:18:35 UTC

On my flight back to the U.S. this week, I wrote some words about why age verification laws threaten the security and privacy of everyone on the internet. By requiring people to upload their IDs, governments are sleepwalking the world into an inevitable data disaster.
For my newsletter and blog ~ this week in security ~
Read online: https://this.weekinsecurity.com/papers-please-age-verification-laws-threaten-everyones-online-security-and-privacy/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-03-11 09:39:59 UTC

Breaking from vacation because this is huge/👀.
Per Burgess Everett on Bluesky: Sen. Ron Wyden says there's secret classified info in 702 surveillance program about Americans' privacy.
Americans "are going to be stunned that it took so long and that Congress has been debating this authority with insufficient information."
FAA 702 already allows warrantless surveillance of Americans' comms. Can't think how this extends. Collection of wholly domestic communications?
https://www.semafor.com/newsletter/03/10/2026/pm-semafor-washington-dc-threat-level

2026-03-07 14:32:13 UTC

In 2025, I found 3 popular apps leaking sensitive user data thanks to simple security bugs. In this *very* deep-dive for subscribers, this is how I use network analysis tools (like Burp) to understand how apps and websites work & share your data — and how you can, too!
I explain how to get started with Burp and similar browser tools, we'll explore API basics, how to understand network requests, and how to get started. I'll also include examples for you to follow along.
https://this.weekinsecurity.com/a-beginners-guide-burp-suite-analyzing-network-traffic-of-apps-and-websites/

2026-03-05 17:56:53 UTC

Meta is facing a new lawsuit over its AI smart glasses, after a news investigation found subcontractors are reviewing footage from customers' glasses, which "included sensitive content, like nudity, people having sex, and using the toilet."
https://techcrunch.com/2026/03/05/meta-sued-over-ai-smartglasses-privacy-concerns-after-workers-reviewed-nudity-sex-and-other-footage/

2026-03-04 01:28:29 UTC

Seems like the whole world is melting down so I'm gonna break my longstanding rule of not posting my feet to the internet to post this snap of my incredibly handsome loaf cat.
https://files.mastodon.social/media_attachments/files/116/168/307/095/498/011/original/40e52b6ad85895df.jpeg

2026-02-28 00:18:55 UTC

If you like my reporting, you might also like my free weekly cyber newsletter ~ this week in security ~ which packs in all the news you can use from the week, plus sections dedicated to good news and a reader-submitted cyber-cat. Goes out on Sundays by email & RSS. Newsletter archive & blog online. 🐈‍⬛
https://this.weekinsecurity.com

2026-02-27 13:26:13 UTC

Some independent/local news outlets I read and recommend. Share yours!
https://www.zetter-zeroday.com
https://citationneeded.news
https://www.lawdork.com
https://krebsonsecurity.com
https://404media.co
https://techdirt.com
https://www.metacurity.com
https://www.thehandbasket.co
https://www.garbageday.email
https://indicator.media
https://www.wheresyoured.at
https://www.courtwatch.news
https://realhackhistory.org
https://www.londoncentric.media
https://privacyguides.org
https://databreaches.net

2026-02-25 13:58:36 UTC

- reply

Despite a FOIA and an appeal, the FBI refuses to say why agents visited my home or if I was (or am) under investigation for my work. I still can't go to Mexico, or anywhere that relies on its airspace, unsure as to what view authorities there might take if I ever cross into its territory.
https://this.weekinsecurity.com/fbi-agents-visited-my-home-about-an-article-i-wrote-and-now-i-cannot-go-to-mexico/

2026-02-25 13:57:05 UTC

In 2020, the FBI came to my house to try to ask me questions about a story I'd written. I declined.
I wrote about the back-story of what happened that day and after, my outstanding questions, and why press freedoms have taken a major step back under Trump's second term.
More: https://this.weekinsecurity.com/fbi-agents-visited-my-home-about-an-article-i-wrote-and-now-i-cannot-go-to-mexico/

2026-02-24 18:45:47 UTC

Trump is "weighing a possible executive order or other action that would require banks to collect citizenship information from customers." This order could task banks, reportedly alarmed, with checking IDs of "both new and pre-existing customers who want to maintain a bank account in the U.S."
WTF. https://www.wsj.com/politics/policy/trump-administration-considers-action-requiring-banks-to-collect-citizenship-info-8e26f6d2

2026-02-21 03:13:12 UTC

Have a peaceful evening, and weekend.
https://files.mastodon.social/media_attachments/files/116/106/434/164/568/669/original/766fe06ec089e729.jpeg

2026-02-18 14:51:06 UTC

Uhh, whoops. https://techcrunch.com/2026/02/18/microsoft-says-office-bug-exposed-customers-confidential-emails-to-copilot-ai/

2026-02-17 18:19:13 UTC

Apple reportedly working on creepware, aka surveillance glasses and other AI-enabled always-on devices.
Not sure how Apple squares these products with its long-standing stance that, "Privacy is a fundamental human right."
https://www.bloomberg.com/news/articles/2026-02-17/apple-ramps-up-work-on-glasses-pendant-and-camera-airpods-for-ai-era?srnd=undefined

2026-02-14 14:16:09 UTC

I wrote some words for ~ this week in security ~ about how social media giants (aka: ad tech companies!) track you around the web, even if you don't have an account or use their apps. Follows from a brilliant column in the BBC about TikTok's use of website "pixels" to track people's browsing activity.
More: https://this.weekinsecurity.com/how-tech-giants-track-you-across-the-web-even-if-you-do-not-use-their-apps/
Sign up (or RSS) for the weekly newsletter, out Sundays. No email open or link click tracking! https://this.weekinsecurity.com

2026-02-12 23:04:45 UTC

After threatening to ban TP-Link router sales over alleged links to China (which TP-Link denies), the Trump administration has reportedly put that ban plan on hold ahead of a summit with China, suggesting it was political leverage and not about cybersecurity.
From me in November: https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity/
From Reuters today: https://reuters.com/business/media-telecom/us-china-trade-detente-fuels-mothballing-key-china-tech-curbs-2026-02-12/ (via @npub102x…wzj6)

2026-02-11 21:33:52 UTC

New, by me: Microsoft has fixed three zero-day bugs in Windows and Office that are being actively abused by hackers to break into people's computers. Microsoft said three of the exploits are now public.
Google, which helped find the bugs, said one of them is under “widespread, active exploitation."
https://techcrunch.com/2026/02/11/microsoft-says-hackers-are-exploiting-critical-zero-day-bugs-to-target-windows-and-office-users/

2026-02-11 18:49:22 UTC

Prosecutors have confirmed for the first time that Peter Williams, the former boss of L3Harris' Trenchant unit (which makes hacking and surveillance tools for the U.S. govermment and its allies), sold the company's exploits to a Russian broker that were capable of accessing "millions of computers and devices" around the world.
Williams, who pleaded guilty, is expected to be sentenced in the next two weeks.
https://techcrunch.com/2026/02/11/doj-says-trenchant-boss-sold-exploits-to-russian-broker-capable-of-accessing-millions-of-computers-and-devices/

2026-02-10 20:48:11 UTC

New, by @npub1xvw…ksg7: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge.
https://techcrunch.com/2026/02/10/google-sent-personal-and-financial-information-of-student-journalist-to-ice/

2026-02-10 13:53:40 UTC

For my newsletter and blog, I wrote about how Apple's Lockdown Mode, once billed as an "extreme" security protection for iPhones, iPads, Macs and Watches, has passed a major real-world test by blocking the feds from accessing a journalist's phone.
Free to read; with additional words, advice, and guidance for paying subscribers: https://this.weekinsecurity.com/apple-lockdown-mode-once-an-extreme-security-protection-now-a-necessity-for-americans/
Sign up/RSS for the weekly newsletter: https://this.weekinsecurity.com

2026-02-09 16:23:36 UTC

SCOOP: A hacktivist has scraped more than half a million payment records from a comapny that makes consumer-grade spyware and other phone tracking apps, exposing customers' email addresses and partial payment data. TechCrunch verified the scraped data is authentic.
By @npub1xvw…ksg7 and me:
https://techcrunch.com/2026/02/09/hacktivist-scrapes-over-500000-stalkerware-customers-payment-records/

2026-02-09 14:29:29 UTC

A Politico story out today describes how Oura wearable rings are winning over Washington, but makes no real mention of their privacy or security risks.
But... in my piece about Oura rings from last year, I explain how Oura puts user data at risk from goverment agencies (like ICE), and hackers.
• Oura data isn't end-to-end encrypted
• Sensitive health data can be accessed by Oura staff
• Oura said it has received government demands for user data.
https://this.weekinsecurity.com/oura-ring-deal-raises-valid-concerns-about-users-health-data-security/

2026-02-08 01:32:59 UTC

- reply

I had no idea that pigeons are so awesome. Sure, they can't build a nest for shit, but clearly they found a place of safety, took care of each other, loved their babies, and did a great job of raising their young. They're smart and resilient. And I'm really proud of them!
Thanks for reading! /FIN.
https://files.mastodon.social/media_attachments/files/116/032/428/605/427/178/original/f3019dee9a6b889c.png

2026-02-08 01:30:55 UTC

- reply

And within a week, they were gone! We saw them flapping on the balcony, increasingly getting lift… sometimes flying into our balcony doors (with less frequency; they learned!) On Jan. 8, the second baby pigeon took off into the world.
Me: 🥲
https://files.mastodon.social/media_attachments/files/116/032/416/775/872/151/original/e20ef87d82805204.mp4

2026-02-08 01:28:07 UTC

- reply

By the first week of January, the fledglings emerged from under our furniture and started exploring our balcony for the first time. They were pretty confident by the looks of it, and their parents were on the neighbor's balcony keeping watch. (Redacted for opsec.)
https://files.mastodon.social/media_attachments/files/116/032/404/816/055/094/original/383cb71fbd1ce5b4.png

2026-02-08 01:26:06 UTC

- reply

And a particularly funny moment when bird meets Birdcam.
https://files.mastodon.social/media_attachments/files/116/032/402/828/490/698/original/a39e30039090085e.png

2026-02-08 01:25:10 UTC

- reply

We're now at Dec. 31 and they're now fledglings, with much of their feathers grown and they will soon leave the nest and fly away. (Any time they get excited, or fed, we can hear them chirping from the other side of the glass; our regular reminder that we are pigeon landlords.)
https://files.mastodon.social/media_attachments/files/116/032/393/871/535/089/original/680eb55f308853e8.mp4

2026-02-08 01:22:40 UTC

- reply

I wasn't kidding when we called it Birdcam. Look at this little face! (Yes, this video feed was end-to-end encrypted.)
https://files.mastodon.social/media_attachments/files/116/032/386/537/283/254/original/97cc27f187398065.png

2026-02-08 01:21:29 UTC

- reply

All the while, these pigeon babies are getting bigger, their feathers are developing, and they're getting more inquisitive, gaining independence from their parents.
https://files.mastodon.social/media_attachments/files/116/032/384/212/160/792/original/280df0342bf8c7be.mp4

2026-02-08 01:19:59 UTC

- reply

By Dec. 18, the pigeon parents began leaving the babies on their own for longer, seemingly to test their boundaries. The more time on their own, the more independent they become (we think). Where are the pigeon parents going? We saw them flying to …the neighboring balcony, just patiently waiting!
https://files.mastodon.social/media_attachments/files/116/032/378/358/495/734/original/612e2fcb8b44edba.jpeg

2026-02-08 01:17:59 UTC

- reply

By Dec. 17, and these pigeon darlings are fully fledged rowdy little fuckers any time they're getting fed. As you can imagine with four of them sharing this space, there's lots of poop — but we didn't want to risk a human presence going in and inadvertently scaring them.
https://files.mastodon.social/media_attachments/files/116/032/369/277/088/746/original/4907382d3f062bde.mp4

2026-02-08 01:16:37 UTC

- reply

Two weeks in, and… yeah, turns out even pigeon parents need their peace, quiet, and a bit of space.
https://files.mastodon.social/media_attachments/files/116/032/363/498/939/259/original/0d3ed9fba8f2e459.mp4

2026-02-08 01:14:56 UTC

- reply

By Dec. 10, the beebs are starting to get bigger and you can see how much they've grown in just over a week. We're not interacting with them at all because we don't want them to get accustomed to humans (and also we really would like our balcony back at some point, lol).
https://files.mastodon.social/media_attachments/files/116/032/356/383/177/232/original/6a75477d20505018.mp4

2026-02-08 01:12:58 UTC

- reply

It was getting even colder during the day, around freezing, so we put outside a raggedy old towel in their not-very-nest. Just trying to be a good pigeon landlord here, move along.
https://files.mastodon.social/media_attachments/files/116/032/349/799/180/664/original/720835b1234a13e1.mp4

2026-02-08 01:11:07 UTC

- reply

Brief intermission: Here's one whole minute of a pigeon throwing up into the mouths of its young. This is how they are fed. Baby pigeons have one job, and that is to stay alive. They don't leave the nest until they're fully grown. That's why you never really see baby pigeons out in the world.
https://files.mastodon.social/media_attachments/files/116/032/341/887/952/864/original/eb996804e7a5778f.mp4

2026-02-08 01:07:42 UTC

- reply

They'd just sit here for hours, nesting on top of these tiny fluffballs to keep them warm as the temperatures continued to drop, presumably just thinking about how to pay for pigeon college or whatever. We put out some yarn for them in case they wanted to build up their nest. They declined, clearly.
https://files.mastodon.social/media_attachments/files/116/032/329/902/844/225/original/c6a04d55979e6f28.mp4

2026-02-08 01:05:33 UTC

- reply

Over the next few days, the pigeon parents would sit on the baby pigeons and occasionally swap every few hours, while the other would go out and get food. The baby pigeons would only be uncovered for a few seconds or so. They were tiny little things, so they would get cold very quickly.
https://files.mastodon.social/media_attachments/files/116/032/320/324/107/642/original/a29ad326fa59b416.mp4

2026-02-08 01:02:48 UTC

- reply

Almost exactly a day later…
[P...p...p… player four has entered the game.] *airhorn*
https://files.mastodon.social/media_attachments/files/116/032/299/998/143/389/original/b46274de1a15c228.mp4

2026-02-08 00:59:27 UTC

- reply

The egg hatched, and pigeon parent on duty removed it, and there it was, the tiniest little baby pigeon. I let out an almighty squee of joy.
https://files.mastodon.social/media_attachments/files/116/032/297/314/872/924/original/0b80baceb50f74a9.mp4

2026-02-08 00:56:05 UTC

- reply

Then two weeks later on Dec. 1, Birdcam sent a notification to new activity. I opened my phone and saw this new video.
Narrator voice: Player three has entered the game.
https://files.mastodon.social/media_attachments/files/116/032/279/549/913/783/original/8b15b183f5018445.mp4

2026-02-08 00:54:07 UTC

- reply

It was getting colder and colder throughout November, getting down to almost freezing temperatures, high winds, and increasingly harsher weather. I secured some cardboard to the balcony railings so that it would shelter the pigeons from the elements.
OK, so I interfered a little bit, shuddup. :).

2026-02-08 00:52:45 UTC

- reply

Meanwhile, let's take a look at their nest and… granted, not much improvement.
(Yes, this is a cybersecurity, cat, and pigeon stan account now.)
https://files.mastodon.social/media_attachments/files/116/032/269/551/888/557/original/09eff8024b5e6e82.jpeg

2026-02-08 00:51:44 UTC

- reply

We soon found that these pigeons would take turns nesting on these eggs, sometimes do a little dance and coo at each other when they would swap, maybe once or twice a day, presumably so they both could go out and eat. To see these birds take such care of their eggs was adorable.
https://files.mastodon.social/media_attachments/files/116/032/267/093/750/797/original/16d4c3db15bbffb1.mp4

2026-02-08 00:47:37 UTC

- reply

We wanted to keep watch to make sure they were doing OK, while not interfering (because nature, y'know?). We knew nothing about pigeons, but were honored that this pigeon chose our balcony to raise their young, so of course this was fine.
Soon after Birdcam went live… holy shit, it's *two* pigeons!
https://files.mastodon.social/media_attachments/files/116/032/250/296/459/339/original/10755069a78b19b2.mp4

2026-02-08 00:44:43 UTC

- reply

In mid-November, we found our cat Theo transfixed at the window. He was looking at a pigeon and two eggs, just plonked there on the astroturf. As it turns out, pigeons are quite shit at making nests (https://defector.com/why-do-pigeon-nests-look-so-shitty-an-investigation), and it was already starting to get cold out in the NY/NJ area.
https://files.mastodon.social/media_attachments/files/116/032/237/642/907/156/original/1ea87f99a0dcacb4.jpeg

2026-02-08 00:42:35 UTC

The world is on fire, but here's a nice thing. A few months ago, a pigeon laid two eggs under our outdoor furniture on our balcony. We put a camera in there to keep an eye. The eggs hatched, survived, grew up, flapped their wings, and left the nest. :) Here's what happened & what we learned.
https://files.mastodon.social/media_attachments/files/116/032/217/004/947/092/original/65fd27023a11e7a2.mp4

2026-02-07 13:41:04 UTC

My newsletter https://this.weekinsecurity.com features all of the most important cybersecurity news, analysis, and reporting that you need to know so you can stay ahead. Plus, good news that you might've missed, and a reader-submitted cyber-cat.
No email link/open tracking!
Sign up (or RSS!) for your weekly dispatch. Out Sundays.

2026-02-06 18:09:18 UTC

New, by me: I wrote some words for TechCrunch about Sen. Ron Wyden's recent unclassified letter to the CIA director, citing his "deep concerns" about the agency's activities. This isn't the first time Wyden has sounded his "siren" — and history tells us why this new letter is likely a big deal.
https://techcrunch.com/2026/02/06/senator-who-has-repeatedly-warned-about-secret-u-s-government-surveillance-sounds-new-alarm-over-cia-activities/

2026-02-04 22:09:50 UTC

🚨 This is what we call a "Wyden siren." For those who don't know, Ron Wyden (D-OR) is one of the longest serving members of the Senate Intelligence Committee. https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_d-ciapdf.pdf
https://files.mastodon.social/media_attachments/files/116/014/640/173/269/888/original/8548076e0f0a31ac.png

2026-02-03 18:45:06 UTC

I wrote a story about how Homeland Security is using administrative subpoenas, which aren't subject to judicial oversight, to seek data from tech giants about Trump critics and anonymous accounts of ICE trackers. Features some really great reporting by Bloomberg & Washington Post.
https://techcrunch.com/2026/02/03/homeland-security-is-trying-to-force-tech-companies-to-hand-over-data-about-trump-critics/

2026-02-02 18:22:40 UTC

NEW: The developer of the long-running and popular open source text editor Notepad++ has confirmed that China government-backed hackers hijacked the software's update feature for months during 2025.
The hackers could access computers of victims who were running hijacked versions of Notepad++.
https://techcrunch.com/2026/02/02/notepad-says-chinese-government-hackers-hijacked-its-software-updates-for-months

2026-02-02 12:37:40 UTC

NEW: A few weeks ago, @npub17l5…4kr3 and I ran a survey asking security researchers and journalists about the legal and criminal threats they have received for doing their jobs.
Over 100 people responded, and we now have our results.
One of our key findings is that while legal threats and criminal threats are common, most researchers & journalists stood their ground and did not give in to threats.
More: https://this.weekinsecurity.com/new-survey-reveals-how-security-researchers-and-journalists-experience-legal-and-criminal-threats/
Results: https://databreaches.net/2026/02/02/under-pressure-exploring-the-effect-of-legal-and-criminal-threats-on-security-researchers-and-journalists/
PDF: https://databreaches.net/wp-content/uploads/security-researcher-journalist-threats-survey-2026.pdf

2026-01-29 14:53:43 UTC

NEW, by me: A security and privacy feature rolled out to select models of the latest iPhones and iPads this week will make it more difficult for law enforcement, spies, and malicious hackers to obtain a person's precise location data from their phone provider.
https://techcrunch.com/2026/01/29/apples-new-iphone-and-ipad-security-feature-limits-cell-networks-from-collecting-precise-location-data/

2026-01-27 23:12:13 UTC

If you could pick one non-U.S. tech, product, or service to switch to, what would you recommend, and why? Open-source and self-hosting options welcome!
https://techcrunch.com/2026/01/27/amid-trump-attacks-and-weaponized-sanctions-europeans-look-to-rely-less-on-us-tech/

2026-01-27 14:31:55 UTC

This is an amazing read about resistance.
So many amazing lines in this piece, but one that stands out:
"We proved that you can bring a trillion-dollar security apparatus to its knees with one well-aimed rubber cock."
https://www.closertotheedge.net/p/the-dildo-distribution-delegation

2026-01-26 14:01:35 UTC

After another massive database of usernames and passwords was found unprotected and exposed to the internet (without a password of its own, ironic!), I wrote some words about the underlying problem — infostealing malware — and why it powers much of cybercrime today.
Read online: https://this.weekinsecurity.com/another-huge-leak-of-passwords-is-the-tip-of-the-infostealing-iceberg/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-01-24 14:51:18 UTC

Feels like -5°F (or -20°C) here on the east coast, and my cat just wants to sleep.
https://files.mastodon.social/media_attachments/files/115/950/623/781/614/805/original/20c0f4b1691dfeea.jpg

2026-01-20 17:58:51 UTC

Always thankful for Techdirt.
https://www.techdirt.com/2026/01/20/everyone-knows-our-mad-kings-greenland-obsession-is-insane-why-wont-congress-stop-it/

2026-01-16 17:23:33 UTC

NEW, by me: A hacking campaign targeted high-profile Gmail and WhatsApp users across the Middle East this week, sent as a phishing lure over WhatsApp.
I obtained a copy of the phishing page and analyzed it with the help of experts. The attack aimed to steal passwords, hijack WhatsApp accounts, and grab victims' location data.
But a bug in the code also *exposed* victims' data, allowing us to see dozens of people who had fallen victim.
More: https://techcrunch.com/2026/01/16/how-a-hacking-campaign-targeted-high-profile-gmail-and-whatsapp-users-across-the-middle-east/

2026-01-14 16:12:51 UTC

New, by me: Security researcher Eaton Zveare spent weeks trying to alert a little-known but critical U.S. cargo tech giant that their shipping systems and customers' data were exposed to the web.
After weeks of trying, Zveare asked TechCrunch for help. We were ignored, too. On the third time we emailed the firm's CEO, we included a partial copy of his password to show the seriousness of the flaws.
A couple of hours later, we got a response — from its law firm.
https://techcrunch.com/2026/01/14/us-cargo-tech-company-publicly-exposed-its-shipping-systems-and-customer-data-to-the-web/

2026-01-14 14:14:19 UTC

This is utterly insane, almost unheard of. This morning, the FBI *searched the home* of a Washington Post reporter, and seized her phone and smart watch, as part of an investigation into an alleged leak of classified info. by a government employee. (The federal case appears to be 1:26-mj-00045.)
https://www.washingtonpost.com/national-security/2026/01/14/washington-post-reporter-search/

2026-01-13 22:22:26 UTC

Daily Beast reports that a DHS whistleblower has leaked the personal details of around 4,500 ICE and Border Patrol employees. The data is said to include about 1,800 on-the-ground agents and 150 supervisors.
https://www.thedailybeast.com/personal-details-of-thousands-of-border-patrol-and-ice-goons-allegedly-leaked-in-huge-data-breach/

2026-01-12 18:24:30 UTC

Betterment was hacked and users' personal data compromised, but you might not know it because the company hid its data breach notice with a "noindex" tag in its web page source code. This tells search engines to ignore the page so people won't see it in search results.
More from TechCrunch: https://techcrunch.com/2026/01/12/fintech-firm-betterment-confirms-data-breach-after-hackers-send-fake-crypto-scam-notification-to-users/
https://files.mastodon.social/media_attachments/files/115/883/523/594/684/372/original/2dd608a6249b629f.png

2026-01-09 13:33:05 UTC

I very much appreciated this essay by Sarah Jeong this morning. It's a reminder that reality and truth still matters, even in the face of blatant and brazen lies.
https://www.theverge.com/policy/859055/minneapolis-renee-good-ice-shooting

2025-12-31 14:30:45 UTC

Are you a security researcher or journalist? We want to hear from you — please take this survey!
Dissent Doe at DataBreaches, and I, are running this survey to better understand the state of legal demands and criminal threats in cybersecurity. Help us by filling out this survey! (and please share!)
https://forms.gle/yAiNNq2gTqE6ctWU8

2025-12-26 14:26:37 UTC

New, by @npub1xvw…ksg7 and me: We just published TechCrunch's annual jealousy list of cybersecurity stories that we *didn’t* publish but wish we had. This is the very best cybersecurity reporting from our friends at competing publications.
https://techcrunch.com/2025/12/26/these-are-the-cybersecurity-stories-we-were-jealous-of-in-2025/

2025-12-23 15:16:25 UTC

- reply

The exposed Uzbek license plate tracking system offers a rare glimpse into how these surveillance systems work, and the security and privacy risks associated with the mass monitoring of vehicles and their owners.
Just this week, 404 Media reported finding publicly exposed Flock cameras in the United States.
https://www.404media.co/flock-exposed-its-ai-powered-cameras-to-the-internet-we-tracked-ourselves/

2025-12-23 15:07:47 UTC

NEW, by me: Uzbekistan exposed its nationwide license plate surveillance system to the web, no password needed.
The system reveals around a hundred locations around the country where banks of cameras have been placed, including big cities and rural areas. The system contains raw video footage of millions of vehicles and their occupants.
https://techcrunch.com/2025/12/23/inside-uzbekistans-nationwide-license-plate-surveillance-system/

2025-12-19 23:54:05 UTC

Absolute horror story of a long-time Apple customer who was locked out of their devices and account with no recourse after redeeming a suspected bad gift card.
Gift card scams are on the rise & increasingly difficult to spot, and can have devastating consequences.
https://this.weekinsecurity.com/apple-nuking-a-customer-account-over-a-bad-gift-card-is-a-warning-for-everyone/

2025-12-17 21:33:32 UTC

I'm thrilled to have been featured in the EFF's Breachies for uncovering security lapses in the info-sharing app TeaOnHer and stalkerware app Catwatchful, along with TechCrunch's security desk's coverage of data breaches at Blue Shield of California, PowerSchool, TransUnion, and more. Thanks, EFF!
https://www.eff.org/deeplinks/2025/12/breachies-2025-worst-weirdest-most-impactful-data-breaches-year

2025-12-17 19:17:28 UTC

This looks like a particularly spicy shituation affecting Cisco customers:
• 10/10 severity zero-day bug in popular Cisco products
• Cisco says China is exploiting bug to hack customers
• Cyberattacks discovered on Dec. 10; disclosed today
• No patches yet. Compromised devices must be wiped
https://techcrunch.com/2025/12/17/cisco-says-chinese-hackers-are-exploiting-its-customers-with-a-new-zero-day/

2025-12-17 16:28:34 UTC

- reply

These are the questions that TechCrunch asked Mixpanel CEO Jen Taylor about the company's data breach.
If anyone else wants to follow up with any of these questions, be my guest. Mixpanel is welcome to respond to my emails at any time.
https://files.mastodon.social/media_attachments/files/115/735/843/697/130/364/original/7329930fd8baa230.png

2025-12-17 16:15:29 UTC

- reply

If anyone at Mixpanel wants to respond to any of the emails (including the 19+ specific questions) we've sent to CEO Jen Taylor about the company's data breach, please get in touch.
You can reach me at zack.whittaker@techcrunch.com or email me back from any of the messages we've sent!

2025-12-16 21:33:46 UTC

With news that the data breach at web and phone analytics giant Mixpanel includes the viewing habits of Pornhub users, here's my TechCrunch story from early December about why this data breach is a big deal — and what sort of data Mixpanel tracks about millions of ordinary people every day.
https://techcrunch.com/2025/12/02/a-data-breach-at-analytics-giant-mixpanel-leaves-a-lot-of-open-questions/

2025-12-12 16:46:32 UTC

NEW, by me: Home Depot exposed access to its internal systems for a year after an employee posted a private GitHub token online, likely by mistake.
When a security researcher found it and tried to alert Home Depot, he was ignored. I alerted the company, which revoked access, but wouldn't say if it has logs to detect if anyone else found the key.
More: https://techcrunch.com/2025/12/12/home-depot-exposed-access-to-internal-systems-for-a-year-says-researcher/

2025-12-10 13:49:54 UTC

- reply

We found the bug in how Vetco generates PDF documents for its customers. Its PDF page was public and was indexed by Google, which is how we found it. Worse, an IDOR bug in the URL meant it was possible for anyone to obtain customer data by changing the customer's unique ID by a single digit. 🤦
https://techcrunch.com/2025/12/10/petco-takes-down-vetco-website-after-exposing-customers-personal-information/

2025-12-10 13:44:43 UTC

NEW: Petco has taken down parts of its Vetco website after we discovered a masive data leak exposing customers' personally identifiable information (and their pets!) to the open web.
After flagging the leak, Petco still took four days to respond. We estimate millions of customers may be affected.
More: https://techcrunch.com/2025/12/10/petco-takes-down-vetco-website-after-exposing-customers-personal-information/

2025-12-07 00:10:09 UTC

If there's one thing from my ~two decades in journalism I still think about with the hatred that burns with the heat of a thousand suns, it's "stalkerware," a kind of phone surveillance used against millions of people around the world
When a documentary crew from my native U.K. reached out to me after reading some of my work investigating these illegal operations, I jumped at the chance to chat with them.
Here's what I've learned in five years reporting on stalkerware.
https://this.weekinsecurity.com/i-have-investigated-stalkerware-for-five-years-here-is-what-i-have-learned/

2025-12-06 01:57:27 UTC

Before you log off (or not, for the extremely online), sign up (or RSS) for my newsletter https://this.weekinsecurity.com for your comprensive guide to the week in cyber — featuring all the news you need to know, and all the stuff you might've missed, and more — hand curated by me. Out Sundays. 🐈‍⬛

2025-12-04 20:53:21 UTC

I've never understood why some data breach notices say things like, "We have no reason to believe that your information was misused..." Like, why do you think a Russian ransomware gang would steal reams of your customers' Social Security numbers? For shits and giggles? No, they're using it for crime. Lots of crime.

2025-11-28 15:14:48 UTC

Business Insider reports that Oura is planning to expand its Oura wearable rings beyond health tracking to allow for payments, authentication, and more.
Well, Capitan Buzzkill (me) here wrote about Oura's security and privacy practices earlier this year, and found:
• Oura rings *don't* end-to-end encrypt users' health data;
• As such, Oura *can* access its users' data;
• Oura told me that the company *has* received U.S. government demands for users' data.
More: https://this.weekinsecurity.com/oura-ring-deal-raises-valid-concerns-about-users-health-data-security/

2025-11-26 13:26:24 UTC

New, by me: Router maker TP-Link faces a potential U.S.-wide ban over its alleged links to China. In my latest analysis, I dive into why a TP-Link ban is unlikely to make America meaningfully safer from Chinese cyberthreats (or anywhere). Please share!
Read more: https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com/

2025-11-24 14:23:10 UTC

NEW: U.S. banking giants and mortgage lenders are scrambling to figure out how much of their customers' non-public banking data was stolen during a cyberattack on a financial tech firm earlier this month.
Customers of at least JPMorgan Chase, Citigroup, and Morgan Stanley are said to be affected.
https://techcrunch.com/2025/11/24/us-banks-scramble-to-assess-data-theft-after-hackers-breach-financial-tech-firm/

2025-11-17 13:56:16 UTC

New, by me: Protei, a Russian-founded telecoms provider and supplier of surveillance and web monitoring technologies, was breached, its website defaced, and its servers raided.
"Another DPI/SORM provider bites the dust," read the company's defaced website.
https://techcrunch.com/2025/11/17/surveillance-tech-provider-protei-was-hacked-its-data-stolen-and-its-website-defaced/

2025-11-14 13:08:38 UTC

For my blog and newsletter, I wrote about why there have been so many data breaches and security lapses this year *alone* involving the mass-exposure of people's driver's licenses and passports — including new details about an exposure of 223,000 government-issued IDs as recently as this week.
Read more: https://this.weekinsecurity.com/it-is-far-too-easy-to-find-leaked-passports-and-drivers-licenses-online/
Sign up/RSS/subscribe: https://this.weekinsecurity.com

2025-11-13 12:55:02 UTC

My new hacker handle just dropped.
https://files.mastodon.social/media_attachments/files/115/542/490/455/215/406/original/0d3e95e8062dfbfc.png

2025-11-12 19:43:43 UTC

Looks like Elon Musk botched X's passkey and security key switchover, and users are reporting that they're getting stuck in endless loops and, in some cases, getting locked out of their accounts.
https://techcrunch.com/2025/11/12/elon-musks-x-botched-its-security-key-switchover-locking-users-out/

2025-11-11 13:00:36 UTC

According to Nevada's report into its recent ransomware attack, a state employee "searched Google for a system administration tool to download and was instead shown a malicious advertisement that led to a fraudulent website impersonating the legitimate project."
Yeah, that happens a lot! An ad-blocker is one of your top security and privacy defenses online. If you work in an enterprise org, consider rolling out an ad-blocker to your company network!
Here's more from me: https://this.weekinsecurity.com/why-ad-blockers-are-a-top-security-and-privacy-defense-for-everyone/